test-container: EPERM from unshare is UNSUPPORTED

For example, the security policy on the Fedora build daemons results in
this EPERM error.

diff --git a/ChangeLog b/ChangeLog
index 3995e4b536a01711c3ab763f09ff53197d6d92cf..61b12adb9e4ae31583770f19fffa2f60dbb0e59c 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2018-08-28  Florian Weimer  <fweimer@redhat.com>
+
+       * support/test-container.c (main): Treat unshare failure with
+       EPERM as an unsupported test.
+
 2018-08-28  Florian Weimer  <fweimer@redhat.com>
 
        [BZ #23520]

diff --git a/support/test-container.c b/support/test-container.c
index ce16e061e7d7208dafa937ac68341ae246c3b88b..2e91bdf9ecb866fabb7620411e29f1f171133a36 100644 (file)
--- a/support/test-container.c
+++ b/support/test-container.c
@@ -871,8 +871,9 @@ main (int argc, char **argv)
   /* The unshare here gives us our own spaces and capabilities.  */
   if (unshare (CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWNS) < 0)
     {
-      /* Older kernels may not support all the options.  */
-      if (errno == EINVAL)
+      /* Older kernels may not support all the options, or security
+        policy may block this call.  */
+      if (errno == EINVAL || errno == EPERM)
        FAIL_UNSUPPORTED ("unable to unshare user/fs: %s", strerror (errno));
       else
        FAIL_EXIT1 ("unable to unshare user/fs: %s", strerror (errno));