Function traversePath

integration/pod_userns_linux_test.go:98–127

traversePath gives 755 permissions for all elements in tPath below os.TempDir() and errors out if elements above it don't have read+exec permissions for others. tPath MUST be a descendant of os.TempDir(). The path returned by testing.TempDir() usually is.

(tPath string)

// permissions for others.  tPath MUST be a descendant of os.TempDir(). The path
// returned by testing.TempDir() usually is.
func traversePath(tPath string) error {
	// Check the assumption that the argument is under os.TempDir().
	tempBase := os.TempDir()
	if !strings.HasPrefix(tPath, tempBase) {
		return fmt.Errorf("traversePath: %q is not a descendant of %q", tPath, tempBase)
	}

	var path string
	for _, p := range strings.SplitAfter(tPath, "/") {
		path = path + p
		stats, err := os.Stat(path)
		if err != nil {
			return err
		}

		perm := stats.Mode().Perm()
		if perm&0o5 == 0o5 {
			continue
		}
		if strings.HasPrefix(tempBase, path) {
			return fmt.Errorf("traversePath: directory %q MUST have read+exec permissions for others", path)
		}

		if err := os.Chmod(path, perm|0o755); err != nil {
			return err
		}
	}

	return nil
}

func TestPodUserNS(t *testing.T) {
	containerID := uint32(0)