Function setupChildExec

internal/testutils/token_linux.go:252–311

setupChildExec does the child-side setup for a token-scoped test and re-execs the test binary. The function never returns.

()

// setupChildExec does the child-side setup for a token-scoped test and re-execs
// the test binary. The function never returns.
func setupChildExec() {
	// Create a new bpffs file system context.
	bpffsCtx, err := unix.Fsopen("bpf", unix.FSOPEN_CLOEXEC)
	if err != nil {
		panicf("create bpffs context: %v", err)
	}

	// Send the bpffs fd to the parent process so it can delegate permissions to
	// it.
	if err := sendFD(toParentFd, bpffsCtx); err != nil {
		panicf("send bpffs fd to parent: %v", err)
	}

	// Wait for the parent's ready signal delegation is done.
	if err := waitReady(toParentFd); err != nil {
		panicf("wait for parent's reply: %v", err)
	}

	if err := unix.Close(toParentFd); err != nil {
		panicf("close child socket: %v", err)
	}

	// Turn the filesystem context into an anonymous mount.
	bpffsMnt, err := unix.Fsmount(bpffsCtx, unix.FSMOUNT_CLOEXEC, 0)
	if err != nil {
		panicf("mount bpffs: %v", err)
	}

	if err := unix.Close(bpffsCtx); err != nil {
		panicf("close bpffs context: %v", err)
	}

	// Move the detached mount to /sys/fs/bpf, the default location.
	if err := unix.MoveMount(bpffsMnt, "", unix.AT_FDCWD, "/sys/fs/bpf", unix.MOVE_MOUNT_F_EMPTY_PATH); err != nil {
		panicf("move mount: %v", err)
	}

	if err := unix.Close(bpffsMnt); err != nil {
		panicf("close bpffs mount fd: %v", err)
	}

	// Drop all but the following capabilities:
	//
	//  - CAP_BPF for making BPF() syscalls with a token
	//  - CAP_DAC_READ_SEARCH for reading files owned by the user running the test,
	//    as we'll be `nobody` in the user namespace.
	const caps = (uint64(1) << CAP_BPF) | (uint64(1) << CAP_DAC_READ_SEARCH)
	if err := capset(capUserData{caps, caps, caps}); err != nil {
		panicf("drop capabilities in child: %v", err)
	}

	// Setup done, re-exec and signal the child to run the function under test.
	if err := os.Setenv(testUserNS, "true"); err != nil {
		panicf("set test environment variable: %v", err)
	}

	if err := syscall.Exec(os.Args[0], os.Args, os.Environ()); err != nil {
		panicf("re-exec child process: %v", err)