test join other container userns with selinux enabled

Signed-off-by: lifubang <[email protected]>

Author: lifubang

tests/integration/userns.bats

@@ -125,6 +125,26 @@ function teardown() {
 	fi
 }
 
+# issue: https://github.com/opencontainers/runc/issues/4466
+@test "userns join other container userns[selinux enabled]" {
+	if ! selinuxenabled; then
+		skip "requires SELinux enabled and in enforcing mode"
+	fi
+	# Create a detached container with the id-mapping we want.
+	update_config '.process.args = ["sleep", "infinity"]'
+	runc run -d --console-socket "$CONSOLE_SOCKET" target_userns
+	[ "$status" -eq 0 ]
+
+	# Configure our container to attach to the first container's userns.
+	target_pid="$(__runc state target_userns | jq .pid)"
+	update_config '.linux.namespaces |= map(if .type == "user" then (.path = "/proc/'"$target_pid"'/ns/" + .type) else . end)
+		| del(.linux.uidMappings)
+		| del(.linux.gidMappings)
+		| .linux.mountLabel="system_u:object_r:container_file_t:s0:c344,c805"'
+	runc run -d --console-socket "$CONSOLE_SOCKET" in_userns
+	[ "$status" -eq 0 ]
+}
+
 @test "userns join other container userns [bind-mounted nsfd]" {
 	requires root