From f3ed72f30be081127aa2894625b0314b5bf60cec Mon Sep 17 00:00:00 2001 From: Alois Wohlschlager Date: Sun, 30 Nov 2025 14:20:11 +0100 Subject: [PATCH] tests/functional: include mount and PID namespaces in the sandbox check Running the sandbox (as unprivileged user) requires all of user, mount and PID namespacing. Previously, only the user namespacing support was checked. Unfortunately, newer Ubuntu kernels impose restrictions on capabilities within unprivileged user namespaces [1]; as observed by experimentation, in particular (re-)mounting filesystems or changing mount propagation is prohibited even inside a mount namespace, making it impossible to use the Lix sandbox. So any tests requiring sandboxing should check for this breakage and be skipped if detected. `unshare --mount` performs the same problematic operations, so that's what gets used for the test. PID namespaces are included as well for completeness, even though currently no instance of breakage due to them specifically is known. This fixes [2] for the functional test suite only. [1] https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces [2] https://git.lix.systems/lix-project/lix/issues/545 Change-Id: If95b527bf965ccb06371bbef7b6007666a6a6964 --- tests/functional/common/vars-and-functions.sh.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/functional/common/vars-and-functions.sh.in b/tests/functional/common/vars-and-functions.sh.in index 0739ff8e9..8202402b3 100644 --- a/tests/functional/common/vars-and-functions.sh.in +++ b/tests/functional/common/vars-and-functions.sh.in @@ -144,7 +144,7 @@ restartDaemon() { startDaemon } -if [[ $(uname) == Linux ]] && [[ -L /proc/self/ns/user ]] && unshare --user true; then +if [[ $(uname) == Linux ]] && [[ -L /proc/self/ns/user ]] && unshare --user --mount --pid true; then _canUseSandbox=1 fi