Changeset 4d2d182 in mod_gnutls

Timestamp:

Jan 28, 2016, 3:03:36 PM (5 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, jessie-backports, master, proxy-ticket, upstream

Children:

c0bb823

Parents:

b21bf4f

Message:

Test suite: Switch to non-root user namespace before running Apache

Apache tries to switch permissions to a non-root user when started as
root. However, inside a namespace with pseudo root access (needed to
bring up the loopback device of the network namespace) this fails
because no such user exists inside the namespace. Changing to a
non-root user namespace beforehand avoids the issue.

File:

• test/common.bash (modified) (1 diff)

test/common.bash

@@ -27 +27 @@
 # MGS_NETNS_ACTIVE is used to track status, there's no harm in calling
 # it multiple times (e.g. in the test-* script and runtests).
+#
+# Note that once the network is up, the reexec is wrapped in another
+# user namespace to get rid of pseudo "root" access. The reason for
+# this is that Apache tries to switch permissions to a non-root user
+# when apparently started as root, and fails because no such user
+# exists inside the namespace. Changing to a non-root user beforehand
+# avoids that issue.
 function netns_reexec
 {
     if [ -n "${USE_TEST_NAMESPACE}" ] && [ -z "${MGS_NETNS_ACTIVE}" ]; then
         exec "${UNSHARE}" --net -r /bin/bash -c \
-             "export MGS_NETNS_ACTIVE=1; ip link set up lo; exec ${0} ${@}"
+             "export MGS_NETNS_ACTIVE=1; ip link set up lo; exec ${UNSHARE} --user ${0} ${@}"
     fi
     return 0