tests/functional: include mount and PID namespaces in the sandbox check

guiwf/lix

Running the sandbox (as unprivileged user) requires all of user, mount and PID
namespacing. Previously, only the user namespacing support was checked.
Unfortunately, newer Ubuntu kernels impose restrictions on capabilities within
unprivileged user namespaces [1]; as observed by experimentation, in particular
(re-)mounting filesystems or changing mount propagation is prohibited even
inside a mount namespace, making it impossible to use the Lix sandbox. So any
tests requiring sandboxing should check for this breakage and be skipped if
detected.

`unshare --mount` performs the same problematic operations, so that's what gets
used for the test. PID namespaces are included as well for completeness, even
though currently no instance of breakage due to them specifically is known.

This fixes [2] for the functional test suite only.

[1] https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
[2] https://git.lix.systems/lix-project/lix/issues/545

Change-Id: If95b527bf965ccb06371bbef7b6007666a6a6964

This commit is contained in:

Alois Wohlschlager

2025-12-01 14:25:47 +00:00

committed by

alois31

parent 31b6c823ae

commit f3ed72f30b

1 changed files with 1 additions and 1 deletions

tests/functional/common/vars-and-functions.sh.in

+1 -1

View File

@@ -144,7 +144,7 @@ restartDaemon() {
     startDaemon
 }
 if [[ $(uname) == Linux ]] && [[ -L /proc/self/ns/user ]] && unshare --user true; then
 if [[ $(uname) == Linux ]] && [[ -L /proc/self/ns/user ]] && unshare --user --mount --pid true; then
     _canUseSandbox=1
 fi