Don't use root-requiring tests, add a unit test.

Signed-off-by: luke <luke.parkin@arm.com>

Author: Luke-Parkin

.github/workflows/ci.yml

@@ -78,6 +78,3 @@ jobs:
 
       - name: Run e2e tests
         run: go test -v ./e2e/...
-
-      - name: Run root namespace E2E test
-        run: sudo -E env "PATH=$PATH" go test -v -run '^TestRuntimeProxyInheritsCorrectNamespace$' ./e2e

docs/DEVELOPMENT.md

@@ -63,9 +63,6 @@ brew install lima  # macOS
 
 # Run tests
 go test -v ./e2e/...
-
-# Run root namespace-specific tests (requires sudo)
-sudo -E env "PATH=$PATH" go test -v -run '^TestRuntimeProxyInheritsCorrectNamespace$' ./e2e
 ```
 
 ### Manual testing with Remoteproc Simulator

e2e/runtime_test.go

@@ -128,49 +128,6 @@ func TestRuntimeWriteProcessPid(t *testing.T) {
 	assertFileContent(t, pidFilePath, fmt.Sprintf("%d", pid))
 }
 
-func TestRuntimeProxyInheritsCorrectNamespace(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("requires root privileges to create new namespaces")
-	}
-
-	rootDir := t.TempDir()
-	remoteprocName := "a-lovely-blue-device"
-	sim := remoteproc.NewSimulator(rootDir).WithName(remoteprocName)
-	if err := sim.Start(); err != nil {
-		t.Fatalf("failed to run simulator: %s", err)
-	}
-	defer func() { _ = sim.Stop() }()
-
-	bin, err := repo.BuildRuntimeBin(t.TempDir(), rootDir, nil)
-	require.NoError(t, err)
-
-	const containerName = "blue-container"
-	bundlePath := t.TempDir()
-
-	require.NoError(t, generateBundle(
-		bundlePath,
-		remoteprocName,
-		specs.LinuxNamespace{Type: specs.MountNamespace},
-	))
-
-	_, err = invokeRuntime(bin, "create", "--bundle", bundlePath, containerName)
-	require.NoError(t, err)
-
-	pid, err := getContainerPid(bin, containerName)
-	require.NoError(t, err)
-	require.Greater(t, pid, 0)
-
-	hostMountNS, err := os.Readlink("/proc/self/ns/mnt")
-	require.NoError(t, err)
-	proxyMountNS, err := os.Readlink(fmt.Sprintf("/proc/%d/ns/mnt", pid))
-	require.NoError(t, err)
-
-	assert.NotEqual(t, hostMountNS, proxyMountNS)
-
-	_, err = invokeRuntime(bin, "delete", containerName)
-	require.NoError(t, err)
-}
-
 func TestRuntimeProxyKeepsHostNamespaceWhenNotRoot(t *testing.T) {
 	if os.Geteuid() == 0 {
 		t.Skip("this test must be run as non-root")
@@ -229,10 +186,6 @@ func getContainerPid(bin repo.RuntimeBin, containerName string) (int, error) {
 }
 
 func getContainerState(bin repo.RuntimeBin, containerName string) (specs.State, error) {
-	return getContainerStateWithEnv(bin, containerName)
-}
-
-func getContainerStateWithEnv(bin repo.RuntimeBin, containerName string) (specs.State, error) {
 	var state specs.State
 	out, err := invokeRuntime(bin, "state", containerName)
 	if err != nil {

internal/proxy/proxy.go

@@ -21,8 +21,6 @@ var namespaceFlags = map[specs.LinuxNamespaceType]uintptr{
 	specs.UTSNamespace:     unix.CLONE_NEWUTS,
 }
 
-var getEUID = os.Geteuid
-
 func namespaceCloneFlags(spec *specs.Spec) (uintptr, error) {
 	if spec == nil {
 		return 0, nil
@@ -48,7 +46,7 @@ func effectiveNamespaceFlags(spec *specs.Spec) (uintptr, error) {
 		return 0, err
 	}
 
-	if getEUID() != 0 {
+	if os.Geteuid() != 0 {
 		if flags != 0 {
 			fmt.Fprintln(os.Stderr, "[WARN] running non-root; namespace isolation disabled")
 		}

internal/proxy/proxy_test.go

@@ -0,0 +1,51 @@
+package proxy
+
+import (
+	"testing"
+
+	"github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/sys/unix"
+)
+
+func TestNamespaceCloneFlags(t *testing.T) {
+	t.Run("returns zero when spec is nil", func(t *testing.T) {
+		got, err := namespaceCloneFlags(nil)
+
+		assert.NoError(t, err)
+		assert.Equal(t, uintptr(0), got)
+	})
+
+	t.Run("marks for creation namespaces where paths are not provided", func(t *testing.T) {
+		spec := &specs.Spec{
+			Linux: &specs.Linux{
+				Namespaces: []specs.LinuxNamespace{
+					{Type: specs.NetworkNamespace},
+					{Type: specs.PIDNamespace, Path: "/proc/self/ns/pid"},
+					{Type: specs.UTSNamespace},
+				},
+			},
+		}
+
+		got, err := namespaceCloneFlags(spec)
+
+		assert.NoError(t, err)
+		want := uintptr(unix.CLONE_NEWNET | unix.CLONE_NEWUTS)
+		assert.Equal(t, want, got)
+	})
+
+	t.Run("errors with unknown namespace types", func(t *testing.T) {
+		spec := &specs.Spec{
+			Linux: &specs.Linux{
+				Namespaces: []specs.LinuxNamespace{
+					{Type: specs.LinuxNamespaceType("unknown")},
+				},
+			},
+		}
+
+		_, err := namespaceCloneFlags(spec)
+
+		assert.Error(t, err)
+		assert.Equal(t, "unknown namespace type \"unknown\"", err.Error())
+	})
+}