Running unit tests manually using hack/ci/ci.sh, I see fairly reproducible failures of TestGetPermissionError….
Adding debug logging shows that even after supposedly dropping the capabilities, they are =ep.
Starting getWrappedMain with runtime.LockOSThread() seems to reliably help — but that is not robust against starting other goroutines and the like. Is there something better we can do to reliably drop capabilities for the whole process? Go’s os.Exec seems not to have a flag for that.
Running unit tests manually using
hack/ci/ci.sh, I see fairly reproducible failures ofTestGetPermissionError….Adding debug logging shows that even after supposedly dropping the capabilities, they are
=ep.Starting
getWrappedMainwithruntime.LockOSThread()seems to reliably help — but that is not robust against starting other goroutines and the like. Is there something better we can do to reliably drop capabilities for the whole process? Go’sos.Execseems not to have a flag for that.