{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/rkt/issues/1927","labels_url":"https://api.github.com/repos/coreos/rkt/issues/1927/labels{/name}","comments_url":"https://api.github.com/repos/coreos/rkt/issues/1927/comments","events_url":"https://api.github.com/repos/coreos/rkt/issues/1927/events","html_url":"https://github.com/coreos/rkt/issues/1927","id":124333136,"number":1927,"title":"TestUserns fails on CentOS 7","user":{"login":"alban","id":27575,"avatar_url":"https://avatars.githubusercontent.com/u/27575?v=3","gravatar_id":"","url":"https://api.github.com/users/alban","html_url":"https://github.com/alban","followers_url":"https://api.github.com/users/alban/followers","following_url":"https://api.github.com/users/alban/following{/other_user}","gists_url":"https://api.github.com/users/alban/gists{/gist_id}","starred_url":"https://api.github.com/users/alban/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alban/subscriptions","organizations_url":"https://api.github.com/users/alban/orgs","repos_url":"https://api.github.com/users/alban/repos","events_url":"https://api.github.com/users/alban/events{/privacy}","received_events_url":"https://api.github.com/users/alban/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/coreos/rkt/labels/technology/userns","name":"technology/userns","color":"d4c5f9"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-12-30T10:55:27Z","updated_at":"2015-12-30T12:15:15Z","closed_at":null,"body":"TestUserns fails on CentOS 7:\r\n\r\n```\r\n$ make functional-check GO_TEST_FUNC_ARGS='-run TestUser'\r\n  GO TEST      github.com/coreos/rkt/tests\r\n=== RUN TestUserns\r\n--- FAIL: TestUserns (11.77s)\r\n\trkt_userns_test.go:65: Running 'run' test #0: /var/tmp/rkt/builds/build-rkt-coreos-/build-rkt-0.14.0+git/bin/rkt --dir=/tmp/datadir-750947925 --local-config=/tmp/localdir-981642672 --system-config=/tmp/systemdir-222893903 --debug --insecure-options=image run  --no-overlay --set-env=FILE=/ --mds-register=false /var/tmp/rkt/builds/build-rkt-coreos-/build-rkt-0.14.0+git/tmp/functional/test-tmp/rkt-inspect-stat.aci\r\n\trkt_userns_test.go:65: Running 'run' test #0: /var/tmp/rkt/builds/build-rkt-coreos-/build-rkt-0.14.0+git/bin/rkt --dir=/tmp/datadir-701898850 --local-config=/tmp/localdir-603407961 --system-config=/tmp/systemdir-166618084 --debug --insecure-options=image run --private-users --no-overlay --set-env=FILE=/ --mds-register=false /var/tmp/rkt/builds/build-rkt-coreos-/build-rkt-0.14.0+git/tmp/functional/test-tmp/rkt-inspect-stat.aci\r\n\trkt_userns_test.go:73: Expected \"drwxr-xr-x\" but not found: rkt: using image from file /var/tmp/rkt/builds/build-rkt-coreos-/build-rkt-0.14.0+git/bin/stage1-coreos.aci\r\n\t\trkt: using image from file /var/tmp/rkt/builds/build-rkt-coreos-/build-rkt-0.14.0+git/tmp/functional/test-tmp/rkt-inspect-stat.aci\r\n\t\t2015/12/29 21:30:48 Preparing stage1\r\n\t\t2015/12/29 21:30:51 Writing image manifest\r\n\t\t2015/12/29 21:30:51 Loading image sha512-5b92352f7806f6311e94d7cb16b80bc3b728307c86af58b2d52b2f4b59b9e75b\r\n\t\t2015/12/29 21:30:52 Writing image manifest\r\n\t\t2015/12/29 21:30:52 Writing pod manifest\r\n\t\t2015/12/29 21:30:52 Setting up stage1\r\n\t\t2015/12/29 21:30:52 Wrote filesystem to /tmp/datadir-701898850/pods/run/8797eae9-08f7-485b-b2e1-7bdbecff792c\r\n\t\t2015/12/29 21:30:52 Pivoting to filesystem /tmp/datadir-701898850/pods/run/8797eae9-08f7-485b-b2e1-7bdbecff792c\r\n\t\t2015/12/29 21:30:52 Execing /init\r\n\t\t2015/12/29 21:30:52 Loading networks from /tmp/localdir-603407961/net.d\r\n\t\t2015/12/29 21:30:52 Loading network default with type ptp\r\n\t\tSpawning container rkt-8797eae9-08f7-485b-b2e1-7bdbecff792c on /tmp/datadir-701898850/pods/run/8797eae9-08f7-485b-b2e1-7bdbecff792c/stage1/rootfs.\r\n\t\tPress ^] three times within 1s to kill container.\r\n\t\tUsing user namespaces with base 787742720 and range 65536.\r\n\t\tFailed to fork inner child: Invalid argument\r\nFAIL\r\n```\r\n\r\nLogs from strace:\r\n\r\n```\r\n[pid 23608] chroot(\".\")                 = 0\r\n[pid 23608] chdir(\"/\")                  = 0\r\n[pid 23608] clone(child_stack=0, flags=CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWUSER|CLONE_NEWPID|SIGCHLD) = -1 EINVAL (Invalid argument)\r\n[pid 23608] writev(2, [{\"Failed to fork inner child: Invalid argument\", 44}, {\"\\n\", 1}], 2) = 45\r\n```\r\n\r\nBut user namespaces are enabled in the kernel so this should work:\r\n\r\n```\r\n$ grep USER_NS /boot/config-$(uname -r)\r\nCONFIG_USER_NS=y\r\n```"},"comment":{"url":"https://api.github.com/repos/coreos/rkt/issues/comments/167988605","html_url":"https://github.com/coreos/rkt/issues/1927#issuecomment-167988605","issue_url":"https://api.github.com/repos/coreos/rkt/issues/1927","id":167988605,"user":{"login":"alban","id":27575,"avatar_url":"https://avatars.githubusercontent.com/u/27575?v=3","gravatar_id":"","url":"https://api.github.com/users/alban","html_url":"https://github.com/alban","followers_url":"https://api.github.com/users/alban/followers","following_url":"https://api.github.com/users/alban/following{/other_user}","gists_url":"https://api.github.com/users/alban/gists{/gist_id}","starred_url":"https://api.github.com/users/alban/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alban/subscriptions","organizations_url":"https://api.github.com/users/alban/orgs","repos_url":"https://api.github.com/users/alban/repos","events_url":"https://api.github.com/users/alban/events{/privacy}","received_events_url":"https://api.github.com/users/alban/received_events","type":"User","site_admin":false},"created_at":"2015-12-30T12:15:15Z","updated_at":"2015-12-30T12:15:15Z","body":"User namespaces are enabled, and `/proc/self/uid_map` is available. But it does not work nonetheless:\r\n\r\n```\r\n# strace unshare -U -f\r\nunshare(CLONE_NEWUSER)                  = -1 EINVAL (Invalid argument)\r\n```\r\n\r\nAccording to https://bugzilla.redhat.com/show_bug.cgi?id=1168776#c5, this is an issue with the CentOS 7 kernel.\r\n\r\nI don't know if we should detect this somehow and disable the test in this case?"}}