Add tests rootless run

The options here were either to override the EUID in the code, or require the E2E tests to be run one as sudo, and one as not sudo.
The latter was chosen as the changes to the code for tests were somewhat heavy.

Add sudo test run to the actions.

Signed-off-by: luke <luke.parkin@arm.com>

Author: Luke-Parkin

.github/workflows/ci.yml

@@ -78,3 +78,6 @@ jobs:
 
       - name: Run e2e tests
         run: go test -v ./e2e/...
+
+      - name: Run root namespace E2E test
+        run: sudo -E env "PATH=$PATH" go test -v -run '^TestRuntimeProxyInheritsCorrectNamespace$' ./e2e

docs/DEVELOPMENT.md

@@ -63,6 +63,9 @@ brew install lima  # macOS
 
 # Run tests
 go test -v ./e2e/...
+
+# Run root namespace-specific tests (requires sudo)
+sudo -E env "PATH=$PATH" go test -v -run '^TestRuntimeProxyInheritsCorrectNamespace$' ./e2e
 ```
 
 ### Manual testing with Remoteproc Simulator

e2e/runtime_test.go

@@ -129,6 +129,10 @@ func TestRuntimeWriteProcessPid(t *testing.T) {
 }
 
 func TestRuntimeProxyInheritsCorrectNamespace(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("requires root privileges to create new namespaces")
+	}
+
 	rootDir := t.TempDir()
 	remoteprocName := "a-lovely-blue-device"
 	sim := remoteproc.NewSimulator(rootDir).WithName(remoteprocName)
@@ -167,6 +171,48 @@ func TestRuntimeProxyInheritsCorrectNamespace(t *testing.T) {
 	require.NoError(t, err)
 }
 
+func TestRuntimeProxyKeepsHostNamespaceWhenNotRoot(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("this test must be run as non-root")
+	}
+	rootDir := t.TempDir()
+	remoteprocName := "a-lovely-blue-device"
+	sim := remoteproc.NewSimulator(rootDir).WithName(remoteprocName)
+	if err := sim.Start(); err != nil {
+		t.Fatalf("failed to run simulator: %s", err)
+	}
+	defer func() { _ = sim.Stop() }()
+
+	bin, err := repo.BuildRuntimeBin(t.TempDir(), rootDir, nil)
+	require.NoError(t, err)
+
+	const containerName = "good-looking-container"
+	bundlePath := t.TempDir()
+
+	require.NoError(t, generateBundle(
+		bundlePath,
+		remoteprocName,
+		specs.LinuxNamespace{Type: specs.MountNamespace},
+	))
+
+	_, err = invokeRuntime(bin, "create", "--bundle", bundlePath, containerName)
+	require.NoError(t, err)
+	defer func() {
+		_, _ = invokeRuntime(bin, "delete", containerName)
+	}()
+
+	state, err := getContainerState(bin, containerName)
+	require.NoError(t, err)
+	require.Greater(t, state.Pid, 0)
+
+	hostMountNS, err := os.Readlink("/proc/self/ns/mnt")
+	require.NoError(t, err)
+	proxyMountNS, err := os.Readlink(fmt.Sprintf("/proc/%d/ns/mnt", state.Pid))
+	require.NoError(t, err)
+
+	assert.Equal(t, hostMountNS, proxyMountNS)
+}
+
 func assertContainerStatus(t testing.TB, bin repo.RuntimeBin, containerName string, wantStatus specs.ContainerState) {
 	t.Helper()
 	state, err := getContainerState(bin, containerName)
@@ -183,6 +229,10 @@ func getContainerPid(bin repo.RuntimeBin, containerName string) (int, error) {
 }
 
 func getContainerState(bin repo.RuntimeBin, containerName string) (specs.State, error) {
+	return getContainerStateWithEnv(bin, containerName, nil)
+}
+
+func getContainerStateWithEnv(bin repo.RuntimeBin, containerName string, extraEnv []string) (specs.State, error) {
 	var state specs.State
 	out, err := invokeRuntime(bin, "state", containerName)
 	if err != nil {

internal/proxy/proxy.go

@@ -50,7 +50,7 @@ func effectiveNamespaceFlags(spec *specs.Spec) (uintptr, error) {
 
 	if getEUID() != 0 {
 		if flags != 0 {
-			fmt.Fprintln(os.Stderr, "[WARN] running without root: namespaces disabled")
+			fmt.Fprintln(os.Stderr, "[WARN] running without root; namespace isolation disabled")
 		}
 		return 0, nil
 	}