Expand coverage in the pidfd image test

Makefile

@@ -402,7 +402,7 @@ docker-tests: integration-test-images $(RUNTIME_BIN)
 	@$(call install_runtime_noreload,$(RUNTIME)-dcache,--fdlimit=2000 --dcache=100) # Used by TestDentryCacheLimit.
 	@$(call install_runtime_noreload,$(RUNTIME)-host-uds,--host-uds=all) # Used by TestHostSocketConnect.
 	@$(call install_runtime_noreload,$(RUNTIME)-overlay,--overlay2=all:self) # Used by TestOverlay*.
-	@$(call install_runtime,$(RUNTIME)-cgroupv2,--mount-cgroup-v2) # Used by TestSystemd*.
+	@$(call install_runtime,$(RUNTIME)-cgroupv2,--mount-cgroup-v2) # Used by TestSystemd* and TestPIDFDSelftests.
 	@$(call test_runtime_cached,$(RUNTIME),$(INTEGRATION_TARGETS) --test_env=TEST_SAVE_RESTORE_NETSTACK=true //test/e2e:integration_runtime_test //test/e2e:runtime_in_docker_test)
 .PHONY: docker-tests
 

images/basic/pidfd-tests/Dockerfile

@@ -28,12 +28,6 @@ RUN git init && \
 
 WORKDIR /src/linux/tools/testing/selftests/pidfd
 
-# TODO(b/290826530): Remove when CLONE_INTO_CGROUP is implemented in gVisor.
-RUN sed -i '/PIDFD_NS_CGROUP,/d' pidfd_setns_test.c
-RUN sed -i '/\[PIDFD_NS_CGROUP\]/d' pidfd_setns_test.c
-RUN sed -i 's/| *CLONE_NEWCGROUP//g' pidfd_setns_test.c
-RUN sed -i 's/CLONE_NEWCGROUP *|//g' pidfd_setns_test.c
-
 # TODO(b/491161640): Remove when time namespaces are implemented in gVisor.
 RUN sed -i '/PIDFD_NS_TIME,/d' pidfd_setns_test.c && \
     sed -i '/\[PIDFD_NS_TIME\]/d' pidfd_setns_test.c && \
@@ -42,16 +36,6 @@ RUN sed -i '/PIDFD_NS_TIME,/d' pidfd_setns_test.c && \
 # Neuter switch_timens() to just "return true;"
 RUN sed -i '/static bool switch_timens(void)/,/^}/c static bool switch_timens(void) { return true; }' pidfd_setns_test.c
 
-# TODO(b/491897692): Remove when CLONE_NEWUSER is implemented in gVisor's setns(), and
-# b/491891436: when userns nsfs inodes are stable within a process.
-RUN sed -i '/\[PIDFD_NS_USER\][[:space:]]*=[[:space:]]*{[[:space:]]*"user",[[:space:]]*CLONE_NEWUSER,[[:space:]]*},/d' pidfd_setns_test.c
-RUN sed -i '/PIDFD_NS_USER,/d' pidfd_setns_test.c
-# Strip CLONE_NEWUSER from setns().
-RUN sed -i '/setns/ s/CLONE_NEWUSER[[:space:]]*|[[:space:]]*//g' pidfd_setns_test.c && \
-    sed -i '/setns/ s/|[[:space:]]*CLONE_NEWUSER//g' pidfd_setns_test.c
-# Drop the no_foul_play() test alltogether, for it needs setns() with CLONE_NEWUSER.
-RUN sed -i '/TEST_F(current_nsset, no_foul_play)/,/^}/ s/^/\/\//' pidfd_setns_test.c
-
 # Drop the test_pidfd_send_signal_recycled_pid_fail() test, for it takes long enough
 # to occassionally breach bazel's 15min timeout for "large" tests.
 # If seeking to run this test, comment the line below and uncomment the 

test/e2e/integration_runtime_test.go

@@ -309,3 +309,22 @@ func TestOverlayCheckpointRestore(t *testing.T) {
 		t.Errorf("cat /submount/file returned: output = %q, err = %v", got, err)
 	}
 }
+
+func TestPIDFDSelftests(t *testing.T) {
+	ctx := context.Background()
+	// pidfd_setns_test creates cgroup namespaces, which requires cgroup2fs to
+	// be mounted in the sandbox (--mount-cgroup-v2).
+	d := dockerutil.MakeContainerWithRuntime(ctx, t, "-cgroupv2")
+	defer d.CleanUp(ctx)
+
+	runOpts := dockerutil.RunOpts{
+		Image:      "basic/pidfd-tests",
+		Privileged: true,
+	}
+	out, err := d.Run(ctx, runOpts)
+	if err != nil {
+		t.Fatalf("docker run failed; output: %v, err: %v", out, err)
+	} else {
+		t.Logf("docker run succeeded; output: %v", out)
+	}
+}

test/image/image_test.go

@@ -835,23 +835,6 @@ func testDockerComposeRun(ctx context.Context, t *testing.T, d *dockerutil.Conta
 	}
 }
 
-func TestPIDFDSelftests(t *testing.T) {
-	ctx := context.Background()
-	d := dockerutil.MakeContainer(ctx, t)
-	defer d.CleanUp(ctx)
-
-	runOpts := dockerutil.RunOpts{
-		Image:      "basic/pidfd-tests",
-		Privileged: true,
-	}
-	out, err := d.Run(ctx, runOpts)
-	if err != nil {
-		t.Fatalf("docker run failed; output: %v, err: %v", out, err)
-	} else {
-		t.Logf("docker run succeeded; output: %v", out)
-	}
-}
-
 func TestMain(m *testing.M) {
 	dockerutil.EnsureSupportedDockerVersion()
 	flag.Parse()