pkg/archive: fix TestTarUntarWithXattr failure on recent kernel #38292
Conversation
Recent kernel has strict check for security.capability value. Fix moby#38289 Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
Codecov Report
@@ Coverage Diff @@
## master #38292 +/- ##
=========================================
Coverage ? 36.1%
=========================================
Files ? 610
Lines ? 45271
Branches ? 0
=========================================
Hits ? 16346
Misses ? 26687
Partials ? 2238 |
|
ping @kolyshkin @tonistiigi PTAL |
|
cc @cpuguy83 |
| @@ -232,8 +240,9 @@ func TestTarUntarWithXattr(t *testing.T) { | |||
| assert.NilError(t, err) | |||
| err = ioutil.WriteFile(filepath.Join(origin, "3"), []byte("will be ignored"), 0700) | |||
| assert.NilError(t, err) | |||
| err = system.Lsetxattr(filepath.Join(origin, "2"), "security.capability", []byte{0x00}, 0) | |||
| assert.NilError(t, err) | |||
| // there is no known Go implementation of setcap/getcap with support for v3 file capability | |||
There was a problem hiding this comment.
@AkihiroSuda should we raise an issue for this with the Go maintainers? (perhaps @tklauser knows if this is something that's being worked on, or a tracking issue exists?)
There was a problem hiding this comment.
Yes, but can be implemented as a 3rd party library perhaps. (Go standard lib doesn't seem to have library functions even for v2 cap)
Actually https://github.com/tianon/debian-golang-gocapability/blob/master/capability/capability_linux.go seems supporting v3, I can't remember why I didn't choose this library.
There was a problem hiding this comment.
@thaJeztah @AkihiroSuda AFAIK this is not being worked on currently, nor does there exist an issue for adding this to golang.org/x/sys/unix (the syscall package in the standard lib is frozen, so it is unlikely to be added there). But please feel free to file such an issue on https://github.com/golang/go/issues/new against the x/sys/unix package if you need these wrappers.
Signed-off-by: Akihiro Suda suda.akihiro@lab.ntt.co.jp
- What I did
Fix
TestTarUntarWithXattrfailure on recent kernel, which has strict check forsecurity.capabilityvalue.Fix #38289
- How I did it
Use
setcap/getcapbinary with real capability value, rather than using invalid capability.- How to verify it
Tested on Ubuntu 18.04.1, kernel
4.15.0-39-generic #42-Ubuntu- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)
🐧