Fix sandbox chroot

Sandbox was setting chroot, but was not chaging the working
dir. Added test to ensure this doesn't happen in the future.

PiperOrigin-RevId: 215676270
Change-Id: I14352d3de64a4dcb90e50948119dc8328c9c15e1

2 files changed, 16 insertions, 1 deletions

diff --git a/runsc/test/testutil/docker.go b/runsc/test/testutil/docker.go
index 55ca353b8..cf61f2c10 100644
--- a/runsc/test/testutil/docker.go
+++ b/runsc/test/testutil/docker.go
@@ -267,6 +267,19 @@ func (d *Docker) FindPort(sandboxPort int) (int, error) {
 	return port, nil
 }
 
+// SandboxPid returns the PID to the sandbox process.
+func (d *Docker) SandboxPid() (int, error) {
+	out, err := do("inspect", "-f={{.State.Pid}}", d.Name)
+	if err != nil {
+		return -1, fmt.Errorf("error retrieving pid: %v", err)
+	}
+	pid, err := strconv.Atoi(strings.TrimSuffix(string(out), "\n"))
+	if err != nil {
+		return -1, fmt.Errorf("error parsing pid %q: %v", out, err)
+	}
+	return pid, nil
+}
+
 // WaitForOutput calls 'docker logs' to retrieve containers output and searches
 // for the given pattern.
 func (d *Docker) WaitForOutput(pattern string, timeout time.Duration) (string, error) {
diff --git a/runsc/test/testutil/testutil.go b/runsc/test/testutil/testutil.go
index cdc7f78c3..b4664995c 100644
--- a/runsc/test/testutil/testutil.go
+++ b/runsc/test/testutil/testutil.go
@@ -238,7 +238,7 @@ func WaitForHTTP(port int, timeout time.Duration) error {
 }
 
 // RunAsRoot ensures the test runs with CAP_SYS_ADMIN and CAP_SYS_CHROOT. If
-// need it will create a new user namespace and reexecute the test as root
+// needed it will create a new user namespace and re-execute the test as root
 // inside of the namespace. This functionr returns when it's running as root. If
 // it needs to create another process, it will exit from there and not return.
 func RunAsRoot() {
@@ -246,6 +246,8 @@ func RunAsRoot() {
 		return
 	}
 
+	fmt.Println("*** Re-running test as root in new user namespace ***")
+
 	// Current process doesn't have CAP_SYS_ADMIN, create user namespace and run
 	// as root inside that namespace to get it.
 	runtime.LockOSThread()