exec_userns.go

package main

import (
	"log"
	"os"
	"syscall"
)

func main() {
	syscall.ForkLock.Lock()
	pid, r2, err1 := syscall.RawSyscall6(syscall.SYS_CLONE, uintptr(syscall.SIGCHLD|syscall.CLONE_NEWUSER), 0, 0, 0, 0, 0)
	syscall.ForkLock.Unlock()

	if pid != 0 {
		log.Printf("pid: %v, r2: %v, err1: %v", pid, r2, err1)
		log.Println("In parent", os.Getpid(), os.Getuid())
		log.Println("Wait for child to exit")
		var wstat syscall.WaitStatus
		_, err := syscall.Wait4(int(pid), &wstat, 0, nil)
		if err != nil {
			log.Println("Failed to wait for child", err)
			os.Exit(1)
		}

		log.Printf("Status: %v", wstat.ExitStatus())

		log.Println("Ready to exit.")
		os.Exit(wstat.ExitStatus())
	} else {
		log.Printf("pid: %v, r2: %v, err1: %v", pid, r2, err1)
		args := []string{""}
		log.Println("In child", os.Getpid(), os.Getuid())
		syscall.Exec("/bin/ls", args, nil)

		// If we reach here, then exec failed.
		os.Exit(2)
	}
}