{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/25224","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/25224/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/25224/comments","events_url":"https://api.github.com/repos/docker/docker/issues/25224/events","html_url":"https://github.com/docker/docker/pull/25224","id":168321983,"number":25224,"title":"TestRunSeccompUnconfinedCloneUserns: Check for unprivileged_userns_clone","user":{"login":"michael-holzheu","id":13906644,"avatar_url":"https://avatars.githubusercontent.com/u/13906644?v=3","gravatar_id":"","url":"https://api.github.com/users/michael-holzheu","html_url":"https://github.com/michael-holzheu","followers_url":"https://api.github.com/users/michael-holzheu/followers","following_url":"https://api.github.com/users/michael-holzheu/following{/other_user}","gists_url":"https://api.github.com/users/michael-holzheu/gists{/gist_id}","starred_url":"https://api.github.com/users/michael-holzheu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michael-holzheu/subscriptions","organizations_url":"https://api.github.com/users/michael-holzheu/orgs","repos_url":"https://api.github.com/users/michael-holzheu/repos","events_url":"https://api.github.com/users/michael-holzheu/events{/privacy}","received_events_url":"https://api.github.com/users/michael-holzheu/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/status/2-code-review","name":"status/2-code-review","color":"fad8c7"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-07-29T13:14:15Z","updated_at":"2016-07-29T16:12:02Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/25224","html_url":"https://github.com/docker/docker/pull/25224","diff_url":"https://github.com/docker/docker/pull/25224.diff","patch_url":"https://github.com/docker/docker/pull/25224.patch"},"body":"On Ubuntu and Debian there is a sysctl which allows to block\r\nclone(CLONE_NEWUSER) via \"sysctl kernel.unprivileged_userns_clone=0\"\r\nfor unprivileged users that do not have CAP_SYS_ADMIN.\r\n\r\nSee: https://lists.ubuntu.com/archives/kernel-team/2016-January/067926.html\r\n\r\nThe DockerSuite.TestRunSeccompUnconfinedCloneUserns testcase fails if\r\n\"kernel.unprivileged_userns_clone\" is set to 0:\r\n\r\n```\r\n docker_cli_run_unix_test.go:1040:\r\n    c.Fatalf(\"expected clone userns with --security-opt seccomp=unconfined\r\n              to succeed, got %s: %v\", out, err)\r\n ... Error: expected clone userns with --security-opt seccomp=unconfined\r\n              to succeed, got clone failed: Operation not permitted\r\n : exit status 1\r\n```\r\n\r\nSo add a check and skip the testcase if kernel.unprivileged_userns_clone exists and is 0.\r\n\r\nSigned-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/236223218","html_url":"https://github.com/docker/docker/pull/25224#issuecomment-236223218","issue_url":"https://api.github.com/repos/docker/docker/issues/25224","id":236223218,"user":{"login":"justincormack","id":482364,"avatar_url":"https://avatars.githubusercontent.com/u/482364?v=3","gravatar_id":"","url":"https://api.github.com/users/justincormack","html_url":"https://github.com/justincormack","followers_url":"https://api.github.com/users/justincormack/followers","following_url":"https://api.github.com/users/justincormack/following{/other_user}","gists_url":"https://api.github.com/users/justincormack/gists{/gist_id}","starred_url":"https://api.github.com/users/justincormack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justincormack/subscriptions","organizations_url":"https://api.github.com/users/justincormack/orgs","repos_url":"https://api.github.com/users/justincormack/repos","events_url":"https://api.github.com/users/justincormack/events{/privacy}","received_events_url":"https://api.github.com/users/justincormack/received_events","type":"User","site_admin":false},"created_at":"2016-07-29T16:12:02Z","updated_at":"2016-07-29T16:12:02Z","body":"The linter is complainign:\r\n```\r\n16:08:53 Errors from golint:\r\n16:08:53 integration-cli/requirements_unix.go:105:2: exported var UnprivilegedUsernsClone should have comment or be unexported\r\n16:08:53 \r\n16:08:53 Please fix the above errors. You can test via \"golint\" and commit the result.\r\n```\r\n\r\nIt should be `unprivilegedUsernsClone`- it is exported differently..."}}
{"actor":{"display_login":"justincormack"}}