migrate libcontainer/user to github.com/moby/sys/user

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

go.mod

@@ -11,6 +11,7 @@ require (
 	github.com/docker/go-units v0.5.0
 	github.com/godbus/dbus/v5 v5.1.0
 	github.com/moby/sys/mountinfo v0.6.2
+	github.com/moby/sys/user v0.1.0
 	github.com/mrunalp/fileutils v0.5.0
 	github.com/opencontainers/runtime-spec v1.1.1-0.20230823135140-4fec88fd00a4
 	github.com/opencontainers/selinux v1.11.0

go.sum

@@ -28,6 +28,8 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/moby/sys/mountinfo v0.6.2 h1:BzJjoreD5BMFNmD9Rus6gdd1pLuecOFPt8wC+Vygl78=
 github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
+github.com/moby/sys/user v0.1.0 h1:WmZ93f5Ux6het5iituh9x2zAG7NFY9Aqi49jjE1PaQg=
+github.com/moby/sys/user v0.1.0/go.mod h1:fKJhFOnsCN6xZ5gSfbM6zaHGgDJMrqt9/reuj4T7MmU=
 github.com/mrunalp/fileutils v0.5.0 h1:NKzVxiH7eSk+OQ4M+ZYW1K6h27RUV3MI6NUTsHhU6Z4=
 github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
 github.com/opencontainers/runtime-spec v1.1.1-0.20230823135140-4fec88fd00a4 h1:EctkgBjZ1y4q+sibyuuIgiKpa0QSd2elFtSSdNvBVow=

libcontainer/init_linux.go

@@ -13,6 +13,7 @@ import (
 	"strings"
 
 	"github.com/containerd/console"
+	"github.com/moby/sys/user"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
 	"github.com/vishvananda/netlink"
@@ -22,7 +23,6 @@ import (
 	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/opencontainers/runc/libcontainer/system"
-	"github.com/opencontainers/runc/libcontainer/user"
 	"github.com/opencontainers/runc/libcontainer/utils"
 )
 

libcontainer/user/lookup_deprecated.go

@@ -0,0 +1,81 @@
+package user
+
+import (
+	"io"
+
+	"github.com/moby/sys/user"
+)
+
+// LookupUser looks up a user by their username in /etc/passwd. If the user
+// cannot be found (or there is no /etc/passwd file on the filesystem), then
+// LookupUser returns an error.
+func LookupUser(username string) (user.User, error) {
+	return user.LookupUser(username)
+}
+
+// LookupUid looks up a user by their user id in /etc/passwd. If the user cannot
+// be found (or there is no /etc/passwd file on the filesystem), then LookupId
+// returns an error.
+func LookupUid(uid int) (user.User, error) { //nolint:revive // ignore var-naming: func LookupUid should be LookupUID
+	return user.LookupUid(uid)
+}
+
+// LookupGroup looks up a group by its name in /etc/group. If the group cannot
+// be found (or there is no /etc/group file on the filesystem), then LookupGroup
+// returns an error.
+func LookupGroup(groupname string) (user.Group, error) {
+	return user.LookupGroup(groupname)
+}
+
+// LookupGid looks up a group by its group id in /etc/group. If the group cannot
+// be found (or there is no /etc/group file on the filesystem), then LookupGid
+// returns an error.
+func LookupGid(gid int) (user.Group, error) {
+	return user.LookupGid(gid)
+}
+
+func GetPasswdPath() (string, error) {
+	return user.GetPasswdPath()
+}
+
+func GetPasswd() (io.ReadCloser, error) {
+	return user.GetPasswd()
+}
+
+func GetGroupPath() (string, error) {
+	return user.GetGroupPath()
+}
+
+func GetGroup() (io.ReadCloser, error) {
+	return user.GetGroup()
+}
+
+// CurrentUser looks up the current user by their user id in /etc/passwd. If the
+// user cannot be found (or there is no /etc/passwd file on the filesystem),
+// then CurrentUser returns an error.
+func CurrentUser() (user.User, error) {
+	return user.CurrentUser()
+}
+
+// CurrentGroup looks up the current user's group by their primary group id's
+// entry in /etc/passwd. If the group cannot be found (or there is no
+// /etc/group file on the filesystem), then CurrentGroup returns an error.
+func CurrentGroup() (user.Group, error) {
+	return user.CurrentGroup()
+}
+
+func CurrentUserSubUIDs() ([]user.SubID, error) {
+	return user.CurrentUserSubUIDs()
+}
+
+func CurrentUserSubGIDs() ([]user.SubID, error) {
+	return user.CurrentUserSubGIDs()
+}
+
+func CurrentProcessUIDMap() ([]user.IDMap, error) {
+	return user.CurrentProcessUIDMap()
+}
+
+func CurrentProcessGIDMap() ([]user.IDMap, error) {
+	return user.CurrentProcessGIDMap()
+}

libcontainer/user/user_deprecated.go

@@ -0,0 +1,143 @@
+package user
+
+import (
+	"io"
+
+	"github.com/moby/sys/user"
+)
+
+var (
+	// ErrNoPasswdEntries is returned if no matching entries were found in /etc/group.
+	ErrNoPasswdEntries = user.ErrNoPasswdEntries
+	// ErrNoGroupEntries is returned if no matching entries were found in /etc/passwd.
+	ErrNoGroupEntries = user.ErrNoGroupEntries
+	// ErrRange is returned if a UID or GID is outside of the valid range.
+	ErrRange = user.ErrRange
+)
+
+type (
+	User = user.User
+
+	Group = user.Group
+
+	// SubID represents an entry in /etc/sub{u,g}id.
+	SubID = user.SubID
+
+	// IDMap represents an entry in /proc/PID/{u,g}id_map.
+	IDMap = user.IDMap
+
+	ExecUser = user.ExecUser
+)
+
+func ParsePasswdFile(path string) ([]user.User, error) {
+	return user.ParsePasswdFile(path)
+}
+
+func ParsePasswd(passwd io.Reader) ([]user.User, error) {
+	return user.ParsePasswd(passwd)
+}
+
+func ParsePasswdFileFilter(path string, filter func(user.User) bool) ([]user.User, error) {
+	return user.ParsePasswdFileFilter(path, filter)
+}
+
+func ParsePasswdFilter(r io.Reader, filter func(user.User) bool) ([]user.User, error) {
+	return user.ParsePasswdFilter(r, filter)
+}
+
+func ParseGroupFile(path string) ([]user.Group, error) {
+	return user.ParseGroupFile(path)
+}
+
+func ParseGroup(group io.Reader) ([]user.Group, error) {
+	return user.ParseGroup(group)
+}
+
+func ParseGroupFileFilter(path string, filter func(user.Group) bool) ([]user.Group, error) {
+	return user.ParseGroupFileFilter(path, filter)
+}
+
+func ParseGroupFilter(r io.Reader, filter func(user.Group) bool) ([]user.Group, error) {
+	return user.ParseGroupFilter(r, filter)
+}
+
+// GetExecUserPath is a wrapper for GetExecUser. It reads data from each of the
+// given file paths and uses that data as the arguments to GetExecUser. If the
+// files cannot be opened for any reason, the error is ignored and a nil
+// io.Reader is passed instead.
+func GetExecUserPath(userSpec string, defaults *user.ExecUser, passwdPath, groupPath string) (*user.ExecUser, error) {
+	return user.GetExecUserPath(userSpec, defaults, passwdPath, groupPath)
+}
+
+// GetExecUser parses a user specification string (using the passwd and group
+// readers as sources for /etc/passwd and /etc/group data, respectively). In
+// the case of blank fields or missing data from the sources, the values in
+// defaults is used.
+//
+// GetExecUser will return an error if a user or group literal could not be
+// found in any entry in passwd and group respectively.
+//
+// Examples of valid user specifications are:
+//   - ""
+//   - "user"
+//   - "uid"
+//   - "user:group"
+//   - "uid:gid
+//   - "user:gid"
+//   - "uid:group"
+//
+// It should be noted that if you specify a numeric user or group id, they will
+// not be evaluated as usernames (only the metadata will be filled). So attempting
+// to parse a user with user.Name = "1337" will produce the user with a UID of
+// 1337.
+func GetExecUser(userSpec string, defaults *user.ExecUser, passwd, group io.Reader) (*user.ExecUser, error) {
+	return user.GetExecUser(userSpec, defaults, passwd, group)
+}
+
+// GetAdditionalGroups looks up a list of groups by name or group id
+// against the given /etc/group formatted data. If a group name cannot
+// be found, an error will be returned. If a group id cannot be found,
+// or the given group data is nil, the id will be returned as-is
+// provided it is in the legal range.
+func GetAdditionalGroups(additionalGroups []string, group io.Reader) ([]int, error) {
+	return user.GetAdditionalGroups(additionalGroups, group)
+}
+
+// GetAdditionalGroupsPath is a wrapper around GetAdditionalGroups
+// that opens the groupPath given and gives it as an argument to
+// GetAdditionalGroups.
+func GetAdditionalGroupsPath(additionalGroups []string, groupPath string) ([]int, error) {
+	return user.GetAdditionalGroupsPath(additionalGroups, groupPath)
+}
+
+func ParseSubIDFile(path string) ([]user.SubID, error) {
+	return user.ParseSubIDFile(path)
+}
+
+func ParseSubID(subid io.Reader) ([]user.SubID, error) {
+	return user.ParseSubID(subid)
+}
+
+func ParseSubIDFileFilter(path string, filter func(user.SubID) bool) ([]user.SubID, error) {
+	return user.ParseSubIDFileFilter(path, filter)
+}
+
+func ParseSubIDFilter(r io.Reader, filter func(user.SubID) bool) ([]user.SubID, error) {
+	return user.ParseSubIDFilter(r, filter)
+}
+
+func ParseIDMapFile(path string) ([]user.IDMap, error) {
+	return user.ParseIDMapFile(path)
+}
+
+func ParseIDMap(r io.Reader) ([]user.IDMap, error) {
+	return user.ParseIDMap(r)
+}
+
+func ParseIDMapFileFilter(path string, filter func(user.IDMap) bool) ([]user.IDMap, error) {
+	return user.ParseIDMapFileFilter(path, filter)
+}
+
+func ParseIDMapFilter(r io.Reader, filter func(user.IDMap) bool) ([]user.IDMap, error) {
+	return user.ParseIDMapFilter(r, filter)
+}

libcontainer/user/user_test.go

@@ -1,530 +0,0 @@
-package user
-
-import (
-	"fmt"
-	"io"
-	"reflect"
-	"sort"
-	"strconv"
-	"strings"
-	"testing"
-)
-
-func TestUserParseLine(t *testing.T) {
-	var (
-		a, b string
-		c    []string
-		d    int
-	)
-
-	parseLine([]byte(""), &a, &b)
-	if a != "" || b != "" {
-		t.Fatalf("a and b should be empty ('%v', '%v')", a, b)
-	}
-
-	parseLine([]byte("a"), &a, &b)
-	if a != "a" || b != "" {
-		t.Fatalf("a should be 'a' and b should be empty ('%v', '%v')", a, b)
-	}
-
-	parseLine([]byte("bad boys:corny cows"), &a, &b)
-	if a != "bad boys" || b != "corny cows" {
-		t.Fatalf("a should be 'bad boys' and b should be 'corny cows' ('%v', '%v')", a, b)
-	}
-
-	parseLine([]byte(""), &c)
-	if len(c) != 0 {
-		t.Fatalf("c should be empty (%#v)", c)
-	}
-
-	parseLine([]byte("d,e,f:g:h:i,j,k"), &c, &a, &b, &c)
-	if a != "g" || b != "h" || len(c) != 3 || c[0] != "i" || c[1] != "j" || c[2] != "k" {
-		t.Fatalf("a should be 'g', b should be 'h', and c should be ['i','j','k'] ('%v', '%v', '%#v')", a, b, c)
-	}
-
-	parseLine([]byte("::::::::::"), &a, &b, &c)
-	if a != "" || b != "" || len(c) != 0 {
-		t.Fatalf("a, b, and c should all be empty ('%v', '%v', '%#v')", a, b, c)
-	}
-
-	parseLine([]byte("not a number"), &d)
-	if d != 0 {
-		t.Fatalf("d should be 0 (%v)", d)
-	}
-
-	parseLine([]byte("b:12:c"), &a, &d, &b)
-	if a != "b" || b != "c" || d != 12 {
-		t.Fatalf("a should be 'b' and b should be 'c', and d should be 12 ('%v', '%v', %v)", a, b, d)
-	}
-}
-
-func TestUserParsePasswd(t *testing.T) {
-	users, err := ParsePasswdFilter(strings.NewReader(`
-root:x:0:0:root:/root:/bin/bash
-adm:x:3:4:adm:/var/adm:/bin/false
-this is just some garbage data
-`), nil)
-	if err != nil {
-		t.Fatalf("Unexpected error: %v", err)
-	}
-	if len(users) != 3 {
-		t.Fatalf("Expected 3 users, got %v", len(users))
-	}
-	if users[0].Uid != 0 || users[0].Name != "root" {
-		t.Fatalf("Expected users[0] to be 0 - root, got %v - %v", users[0].Uid, users[0].Name)
-	}
-	if users[1].Uid != 3 || users[1].Name != "adm" {
-		t.Fatalf("Expected users[1] to be 3 - adm, got %v - %v", users[1].Uid, users[1].Name)
-	}
-}
-
-func TestUserParseGroup(t *testing.T) {
-	groups, err := ParseGroupFilter(strings.NewReader(`
-root:x:0:root
-adm:x:4:root,adm,daemon
-this is just some garbage data
-`+largeGroup()), nil)
-	if err != nil {
-		t.Fatalf("Unexpected error: %v", err)
-	}
-	if len(groups) != 4 {
-		t.Fatalf("Expected 4 groups, got %v", len(groups))
-	}
-	if groups[0].Gid != 0 || groups[0].Name != "root" || len(groups[0].List) != 1 {
-		t.Fatalf("Expected groups[0] to be 0 - root - 1 member, got %v - %v - %v", groups[0].Gid, groups[0].Name, len(groups[0].List))
-	}
-	if groups[1].Gid != 4 || groups[1].Name != "adm" || len(groups[1].List) != 3 {
-		t.Fatalf("Expected groups[1] to be 4 - adm - 3 members, got %v - %v - %v", groups[1].Gid, groups[1].Name, len(groups[1].List))
-	}
-}
-
-func TestValidGetExecUser(t *testing.T) {
-	const passwdContent = `
-root:x:0:0:root user:/root:/bin/bash
-adm:x:42:43:adm:/var/adm:/bin/false
-111:x:222:333::/var/garbage
-odd:x:111:112::/home/odd:::::
-user7456:x:7456:100:Vasya:/home/user7456
-this is just some garbage data
-`
-	groupContent := `
-root:x:0:root
-adm:x:43:
-grp:x:1234:root,adm,user7456
-444:x:555:111
-odd:x:444:
-this is just some garbage data
-` + largeGroup()
-
-	defaultExecUser := ExecUser{
-		Uid:   8888,
-		Gid:   8888,
-		Sgids: []int{8888},
-		Home:  "/8888",
-	}
-
-	tests := []struct {
-		ref      string
-		expected ExecUser
-	}{
-		{
-			ref: "root",
-			expected: ExecUser{
-				Uid:   0,
-				Gid:   0,
-				Sgids: []int{0, 1234},
-				Home:  "/root",
-			},
-		},
-		{
-			ref: "adm",
-			expected: ExecUser{
-				Uid:   42,
-				Gid:   43,
-				Sgids: []int{1234},
-				Home:  "/var/adm",
-			},
-		},
-		{
-			ref: "root:adm",
-			expected: ExecUser{
-				Uid:   0,
-				Gid:   43,
-				Sgids: defaultExecUser.Sgids,
-				Home:  "/root",
-			},
-		},
-		{
-			ref: "adm:1234",
-			expected: ExecUser{
-				Uid:   42,
-				Gid:   1234,
-				Sgids: defaultExecUser.Sgids,
-				Home:  "/var/adm",
-			},
-		},
-		{
-			ref: "42:1234",
-			expected: ExecUser{
-				Uid:   42,
-				Gid:   1234,
-				Sgids: defaultExecUser.Sgids,
-				Home:  "/var/adm",
-			},
-		},
-		{
-			ref: "1337:1234",
-			expected: ExecUser{
-				Uid:   1337,
-				Gid:   1234,
-				Sgids: defaultExecUser.Sgids,
-				Home:  defaultExecUser.Home,
-			},
-		},
-		{
-			ref: "1337",
-			expected: ExecUser{
-				Uid:   1337,
-				Gid:   defaultExecUser.Gid,
-				Sgids: defaultExecUser.Sgids,
-				Home:  defaultExecUser.Home,
-			},
-		},
-		{
-			ref: "",
-			expected: ExecUser{
-				Uid:   defaultExecUser.Uid,
-				Gid:   defaultExecUser.Gid,
-				Sgids: defaultExecUser.Sgids,
-				Home:  defaultExecUser.Home,
-			},
-		},
-
-		// Regression tests for #695.
-		{
-			ref: "111",
-			expected: ExecUser{
-				Uid:   111,
-				Gid:   112,
-				Sgids: defaultExecUser.Sgids,
-				Home:  "/home/odd",
-			},
-		},
-		{
-			ref: "111:444",
-			expected: ExecUser{
-				Uid:   111,
-				Gid:   444,
-				Sgids: defaultExecUser.Sgids,
-				Home:  "/home/odd",
-			},
-		},
-		// Test for #3036.
-		{
-			ref: "7456",
-			expected: ExecUser{
-				Uid:   7456,
-				Gid:   100,
-				Sgids: []int{1234, 1000}, // 1000 is largegroup GID
-				Home:  "/home/user7456",
-			},
-		},
-	}
-
-	for _, test := range tests {
-		passwd := strings.NewReader(passwdContent)
-		group := strings.NewReader(groupContent)
-
-		execUser, err := GetExecUser(test.ref, &defaultExecUser, passwd, group)
-		if err != nil {
-			t.Logf("got unexpected error when parsing '%s': %s", test.ref, err.Error())
-			t.Fail()
-			continue
-		}
-
-		if !reflect.DeepEqual(test.expected, *execUser) {
-			t.Logf("ref:      %v", test.ref)
-			t.Logf("got:      %#v", execUser)
-			t.Logf("expected: %#v", test.expected)
-			t.Fail()
-			continue
-		}
-	}
-}
-
-func TestInvalidGetExecUser(t *testing.T) {
-	const passwdContent = `
-root:x:0:0:root user:/root:/bin/bash
-adm:x:42:43:adm:/var/adm:/bin/false
--42:x:12:13:broken:/very/broken
-this is just some garbage data
-`
-	const groupContent = `
-root:x:0:root
-adm:x:43:
-grp:x:1234:root,adm
-this is just some garbage data
-`
-
-	tests := []string{
-		// No such user/group.
-		"notuser",
-		"notuser:notgroup",
-		"root:notgroup",
-		"notuser:adm",
-		"8888:notgroup",
-		"notuser:8888",
-
-		// Invalid user/group values.
-		"-1:0",
-		"0:-3",
-		"-5:-2",
-		"-42",
-		"-43",
-	}
-
-	for _, test := range tests {
-		passwd := strings.NewReader(passwdContent)
-		group := strings.NewReader(groupContent)
-
-		execUser, err := GetExecUser(test, nil, passwd, group)
-		if err == nil {
-			t.Logf("got unexpected success when parsing '%s': %#v", test, execUser)
-			t.Fail()
-			continue
-		}
-	}
-}
-
-func TestGetExecUserNilSources(t *testing.T) {
-	const passwdContent = `
-root:x:0:0:root user:/root:/bin/bash
-adm:x:42:43:adm:/var/adm:/bin/false
-this is just some garbage data
-`
-	const groupContent = `
-root:x:0:root
-adm:x:43:
-grp:x:1234:root,adm
-this is just some garbage data
-`
-
-	defaultExecUser := ExecUser{
-		Uid:   8888,
-		Gid:   8888,
-		Sgids: []int{8888},
-		Home:  "/8888",
-	}
-
-	tests := []struct {
-		ref           string
-		passwd, group bool
-		expected      ExecUser
-	}{
-		{
-			ref:    "",
-			passwd: false,
-			group:  false,
-			expected: ExecUser{
-				Uid:   8888,
-				Gid:   8888,
-				Sgids: []int{8888},
-				Home:  "/8888",
-			},
-		},
-		{
-			ref:    "root",
-			passwd: true,
-			group:  false,
-			expected: ExecUser{
-				Uid:   0,
-				Gid:   0,
-				Sgids: []int{8888},
-				Home:  "/root",
-			},
-		},
-		{
-			ref:    "0",
-			passwd: false,
-			group:  false,
-			expected: ExecUser{
-				Uid:   0,
-				Gid:   8888,
-				Sgids: []int{8888},
-				Home:  "/8888",
-			},
-		},
-		{
-			ref:    "0:0",
-			passwd: false,
-			group:  false,
-			expected: ExecUser{
-				Uid:   0,
-				Gid:   0,
-				Sgids: []int{8888},
-				Home:  "/8888",
-			},
-		},
-	}
-
-	for _, test := range tests {
-		var passwd, group io.Reader
-
-		if test.passwd {
-			passwd = strings.NewReader(passwdContent)
-		}
-
-		if test.group {
-			group = strings.NewReader(groupContent)
-		}
-
-		execUser, err := GetExecUser(test.ref, &defaultExecUser, passwd, group)
-		if err != nil {
-			t.Logf("got unexpected error when parsing '%s': %s", test.ref, err.Error())
-			t.Fail()
-			continue
-		}
-
-		if !reflect.DeepEqual(test.expected, *execUser) {
-			t.Logf("got:      %#v", execUser)
-			t.Logf("expected: %#v", test.expected)
-			t.Fail()
-			continue
-		}
-	}
-}
-
-func TestGetAdditionalGroups(t *testing.T) {
-	type foo struct {
-		groups   []string
-		expected []int
-		hasError bool
-	}
-
-	groupContent := `
-root:x:0:root
-adm:x:43:
-grp:x:1234:root,adm
-adm:x:4343:root,adm-duplicate
-this is just some garbage data
-` + largeGroup()
-	tests := []foo{
-		{
-			// empty group
-			groups:   []string{},
-			expected: []int{},
-		},
-		{
-			// single group
-			groups:   []string{"adm"},
-			expected: []int{43},
-		},
-		{
-			// multiple groups
-			groups:   []string{"adm", "grp"},
-			expected: []int{43, 1234},
-		},
-		{
-			// invalid group
-			groups:   []string{"adm", "grp", "not-exist"},
-			expected: nil,
-			hasError: true,
-		},
-		{
-			// group with numeric id
-			groups:   []string{"43"},
-			expected: []int{43},
-		},
-		{
-			// group with unknown numeric id
-			groups:   []string{"adm", "10001"},
-			expected: []int{43, 10001},
-		},
-		{
-			// groups specified twice with numeric and name
-			groups:   []string{"adm", "43"},
-			expected: []int{43},
-		},
-		{
-			// groups with too small id
-			groups:   []string{"-1"},
-			expected: nil,
-			hasError: true,
-		},
-		{
-			// groups with too large id
-			groups:   []string{strconv.FormatInt(1<<31, 10)},
-			expected: nil,
-			hasError: true,
-		},
-		{
-			// group with very long list of users
-			groups:   []string{"largegroup"},
-			expected: []int{1000},
-		},
-	}
-
-	for _, test := range tests {
-		group := strings.NewReader(groupContent)
-
-		gids, err := GetAdditionalGroups(test.groups, group)
-		if test.hasError && err == nil {
-			t.Errorf("Parse(%#v) expects error but has none", test)
-			continue
-		}
-		if !test.hasError && err != nil {
-			t.Errorf("Parse(%#v) has error %v", test, err)
-			continue
-		}
-		sort.Ints(gids)
-		if !reflect.DeepEqual(gids, test.expected) {
-			t.Errorf("Gids(%v), expect %v from groups %v", gids, test.expected, test.groups)
-		}
-	}
-}
-
-func TestGetAdditionalGroupsNumeric(t *testing.T) {
-	tests := []struct {
-		groups   []string
-		expected []int
-		hasError bool
-	}{
-		{
-			// numeric groups only
-			groups:   []string{"1234", "5678"},
-			expected: []int{1234, 5678},
-		},
-		{
-			// numeric and alphabetic
-			groups:   []string{"1234", "fake"},
-			expected: nil,
-			hasError: true,
-		},
-	}
-
-	for _, test := range tests {
-		gids, err := GetAdditionalGroups(test.groups, nil)
-		if test.hasError && err == nil {
-			t.Errorf("Parse(%#v) expects error but has none", test)
-			continue
-		}
-		if !test.hasError && err != nil {
-			t.Errorf("Parse(%#v) has error %v", test, err)
-			continue
-		}
-		sort.Ints(gids)
-		if !reflect.DeepEqual(gids, test.expected) {
-			t.Errorf("Gids(%v), expect %v from groups %v", gids, test.expected, test.groups)
-		}
-	}
-}
-
-// Generate a proper "largegroup" entry for group tests.
-func largeGroup() (res string) {
-	var b strings.Builder
-	b.WriteString("largegroup:x:1000:user1")
-	for i := 2; i <= 7500; i++ {
-		fmt.Fprintf(&b, ",user%d", i)
-	}
-	return b.String()
-}

list.go

@@ -9,8 +9,8 @@ import (
 	"text/tabwriter"
 	"time"
 
+	"github.com/moby/sys/user"
 	"github.com/opencontainers/runc/libcontainer"
-	"github.com/opencontainers/runc/libcontainer/user"
 	"github.com/opencontainers/runc/libcontainer/utils"
 	"github.com/urfave/cli"
 )

vendor/github.com/moby/sys/user/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

vendor/modules.txt

@@ -35,6 +35,9 @@ github.com/godbus/dbus/v5
 # github.com/moby/sys/mountinfo v0.6.2
 ## explicit; go 1.16
 github.com/moby/sys/mountinfo
+# github.com/moby/sys/user v0.1.0
+## explicit; go 1.17
+github.com/moby/sys/user
 # github.com/mrunalp/fileutils v0.5.0
 ## explicit; go 1.13
 github.com/mrunalp/fileutils