[LTP] [PATCH] containers: override kernel.unprivileged_userns_clone sysctl where needed

[Petr Vorel]

Hi Seth,

> Some distros have a kernel.unprivileged_userns_clone which when disabled
> forbids users without CAP_SYS_ADMIN in the initial user namespace from
> creating new user namespaces. When disabled the containers user07 and
> user08 tests fail.

> Update these tests to ensure that when this sysctl is present it is set
> to allow unprivileged user namespace creation while the test is running.

Good catch, it's indeed a problem on Debian.

Reviewed-by: Petr Vorel Petr Vorel <pvorel@suse.cz>
Tested-by: Petr Vorel Petr Vorel <pvorel@suse.cz>

BTW it took me a while to find out /proc/sys/kernel/unprivileged_userns_clone is
Debian out of tree patch [1] (The funny note from 2013 "This is a short-term patch")
probably refused by upstream kernel (I've only found 3 years later one of Debian
kernel maintainers Ben Hutchings talking about it [2]).

Kind regards,
Petr

[1] https://salsa.debian.org/kernel-team/linux/-/blob/master/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch
[2] https://lore.kernel.org/lkml/1453510799.3734.153.camel@decadent.org.uk/