container: transparently degrade landlock in tests

Explicitly requiring landlock in tests will be supported in a future change.

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 9 insertions, 0 deletions

diff --git a/container/container_test.go b/container/container_test.go
index bcbcdded..693021bf 100644
--- a/container/container_test.go
+++ b/container/container_test.go
@@ -453,6 +453,15 @@ func TestContainer(t *testing.T) {
 			c.SeccompDisable = !tc.filter
 			c.RetainSession = tc.session
 			c.HostNet = tc.net
+			if !c.HostNet {
+				if _, err := container.LandlockGetABI(); err != nil {
+					if !errors.Is(err, syscall.ENOSYS) {
+						t.Fatalf("LandlockGetABI: error = %v", err)
+					}
+					c.HostAbstract = true
+					t.Log("Landlock LSM is unavailable, enabling HostAbstract")
+				}
+			}
 
 			c.
 				Readonly(check.MustAbs(pathReadonly), 0755).