| Message ID | 20231111173806.16775-1-swarupkotikalapudi@gmail.com |
|---|---|
| State | New |
| Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org>
Delivered-To: ouuuleilei@gmail.com
Received: by 2002:a59:b909:0:b0:403:3b70:6f57 with SMTP id t9csp344599vqg;
Sat, 11 Nov 2023 09:38:45 -0800 (PST)
X-Google-Smtp-Source:
AGHT+IFNzRSfbJifd3+hNdr7Kxb/ulqtKKefvwmPwS2FaHE7+KTl7f5A+khByileGHljLDKTfEDY
X-Received: by 2002:a05:6a00:2e1f:b0:6c6:b762:ad8c with SMTP id
fc31-20020a056a002e1f00b006c6b762ad8cmr646627pfb.0.1699724325599;
Sat, 11 Nov 2023 09:38:45 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1699724325; cv=none;
d=google.com; s=arc-20160816;
b=fus2MHdXg9hzzflAjfsrfaoX6pwWRrHCM3aHZ5+jMcSYh8yqXUl8FMkccujbLYv8VG
UrHfex6J0HTxMj+yx6s//EVcN1ytCoH4JitXcluBUFsGSx1/VCnTpOY8N6HB5lCX01Fy
qjwxRDXFtVFKzXmaZu+z/1dlmXOmqF4HFKeCbF3k9wu40uCXEfzm8p19TF64mnI0NVrl
56ZexiX5dwvLPU8qkz5H+j/n8YdWDRmu0udmE3/1X9dp3qKUad/LVwiCA93KhWEw6oPw
QVq/lNlVIEC4om6WzEs9i3vtCF8OBtYqSpXaftwp4qVHYay26esQTzDevih3xkG/QKud
SgXw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com;
s=arc-20160816;
h=list-id:precedence:content-transfer-encoding:mime-version
:references:in-reply-to:message-id:date:subject:cc:to:from
:dkim-signature;
bh=zjn0mx0T4ELUgwN3eqbWBleZXpgBP6Grrg4uPvTk4DY=;
fh=Y+zX3Py9Nl9Dd9Ic7aHLhRBAXAEjt8FddwY8SeMioGs=;
b=d5WNwmMDTy8SyGlWwm70AyfJMqJczt9Lk3maJsPYhZ4oWdC1Ouh8MxZRaBWIQeMmZ+
t0ajxOBdXQH852uGvezrLud8VLuo+rU64S1J7vOHDnUBF9c+ynO/2+DTWIkjrnvr9Kh8
RInmvPe53mezaMHUzHKlT2L7UyAyQIjm2CYUyHbv4ASMHC7++d026KmlpO3MHgYwwTdo
F7fjrlj81vsn/r3zrV/dg8MkTkjU+42ZCrX7TbI06g5XVq5Jqmgb6hwkPzotDwSQCvOq
wu5Rt7PQ8kHjwbwY0Y5xpsIIWQvqKquSupNYUljm4mXmFaBFZsLcqx6igZk0HYJr8xTj
T5ig==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@gmail.com header.s=20230601 header.b=EX7YlFSi;
spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 23.128.96.35 as permitted sender)
smtp.mailfrom=linux-kernel-owner@vger.kernel.org;
dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Received: from groat.vger.email (groat.vger.email. [23.128.96.35])
by mx.google.com with ESMTPS id
ay40-20020a056a00302800b006c31b7dd73fsi2220939pfb.288.2023.11.11.09.38.45
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Sat, 11 Nov 2023 09:38:45 -0800 (PST)
Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 23.128.96.35 as permitted sender) client-ip=23.128.96.35;
Authentication-Results: mx.google.com;
dkim=pass header.i=@gmail.com header.s=20230601 header.b=EX7YlFSi;
spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 23.128.96.35 as permitted sender)
smtp.mailfrom=linux-kernel-owner@vger.kernel.org;
dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0])
by groat.vger.email (Postfix) with ESMTP id 4B75B809C91C;
Sat, 11 Nov 2023 09:38:43 -0800 (PST)
X-Virus-Status: Clean
X-Virus-Scanned: clamav-milter 0.103.11 at groat.vger.email
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S229437AbjKKRiV (ORCPT <rfc822;heyuhang3455@gmail.com>
+ 29 others); Sat, 11 Nov 2023 12:38:21 -0500
Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41608 "EHLO
lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S229379AbjKKRiT (ORCPT
<rfc822;linux-kernel@vger.kernel.org>);
Sat, 11 Nov 2023 12:38:19 -0500
Received: from mail-il1-x12d.google.com (mail-il1-x12d.google.com
[IPv6:2607:f8b0:4864:20::12d])
by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2E9D9F;
Sat, 11 Nov 2023 09:38:16 -0800 (PST)
Received: by mail-il1-x12d.google.com with SMTP id
e9e14a558f8ab-357ccaf982eso11242775ab.0;
Sat, 11 Nov 2023 09:38:16 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1699724296; x=1700329096;
darn=vger.kernel.org;
h=content-transfer-encoding:mime-version:references:in-reply-to
:message-id:date:subject:cc:to:from:from:to:cc:subject:date
:message-id:reply-to;
bh=zjn0mx0T4ELUgwN3eqbWBleZXpgBP6Grrg4uPvTk4DY=;
b=EX7YlFSi159vq5AXo5ZU3Qk15D2ENYI8JF4Pyg9bQiTuJ9quu5r4H7UYsISZv01wzE
cJ19zGHMlM3AnTy3ix6q+tB71l2HYLQkR+rraub3Zc9wX1QMtWBYLwMwG632vUOzf6NQ
Ws2RTBG90sm5i3Ebcj/B4k/25NQY8ru5fkpGoLksNFJDPKJaMV0OIchIt609J7Zius6Z
MDB9myASZLM6WlUQaD2FEDAPr483L90rfiscdg7YqD/aSoKCx8vsHLV06FF9MWJjPjW6
DnY3Ve5RSay9Xg1KGacHeKo+GK4urdNiSGSZSdwtKxn2s2N4h9tffJY156NWHhqkR3v/
cFjA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1699724296; x=1700329096;
h=content-transfer-encoding:mime-version:references:in-reply-to
:message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
:subject:date:message-id:reply-to;
bh=zjn0mx0T4ELUgwN3eqbWBleZXpgBP6Grrg4uPvTk4DY=;
b=biGJTs/lX6i2gEucSbdlXCPx3p31XGVaweaNUwFvE1BZ20dzcRxUaplOHw3t48+HNi
mu079W4+AuPTmC2RLskRO5HF/V4a1LfvwHIwp6XBqGjYG4qG2SH5wIMwJ9rH4LarKh03
rBOYtv5IZS1VGY6CrGHBBrYyk7eqx/hvurvhJ/7wN7cqgUdvFNsC93QGfZFGj34LJgpq
HThLdELm73HefxXVEQzonai+xeY7KeWPTta3y/NojZkBUGCA2bfeienKEQmCg3MNvEcz
HiKZ/Uum7SyKL2WtA/VwgOBzyD+naCSytlHm4SIewASeUQhCOFdoKbXGqaK1sKIg5L+W
1+KA==
X-Gm-Message-State: AOJu0YwlsRzvKQdmRyPzl6LrNlYHn/Ul2sEqlo3RugJj6ms8e+toywBp
tn6/QJttLjuFOY3TkKPfk7RYeN6gv7ohXg==
X-Received: by 2002:a05:6e02:16c6:b0:359:3150:c69d with SMTP id
6-20020a056e0216c600b003593150c69dmr4152096ilx.9.1699724295984;
Sat, 11 Nov 2023 09:38:15 -0800 (PST)
Received: from swarup-virtual-machine.localdomain ([171.76.83.22])
by smtp.gmail.com with ESMTPSA id
w12-20020aa7858c000000b006b76cb6523dsm1511226pfn.165.2023.11.11.09.38.13
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Sat, 11 Nov 2023 09:38:15 -0800 (PST)
From: Swarup Laxman Kotiaklapudi <swarupkotikalapudi@gmail.com>
To: shuah@kernel.org, linux-kselftest@vger.kernel.org,
linux-kernel@vger.kernel.org,
linux-kernel-mentees@lists.linuxfoundation.org, luto@kernel.org
Cc: Swarup Laxman Kotiaklapudi <swarupkotikalapudi@gmail.com>
Subject: [PATCH v2] selftests: capabilities: namespace create varies for root
and normal user
Date: Sat, 11 Nov 2023 23:08:06 +0530
Message-Id: <20231111173806.16775-1-swarupkotikalapudi@gmail.com>
X-Mailer: git-send-email 2.34.1
In-Reply-To: <ZU+xkpH09xjzO5IS@swarup-virtual-machine>
References: <ZU+xkpH09xjzO5IS@swarup-virtual-machine>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Spam-Status: No, score=-0.6 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,
HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,
SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no
version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test,
not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]);
Sat, 11 Nov 2023 09:38:43 -0800 (PST)
X-getmail-retrieved-from-mailbox: INBOX
X-GMAIL-THRID: 1778378671163057271
X-GMAIL-MSGID: 1782290134592148600
|
| Series |
[v2] selftests: capabilities: namespace create varies for root and normal user
|
|
Commit Message
Swarup Laxman Kotiaklapudi
Nov. 11, 2023, 5:38 p.m. UTC
This patchset fixes TODO:
"If we're already root, we could skip creating the userns."
Change namespace creation for root and non-root
user differently in create_and_enter_ns() function
in this file:
tools/testing/selftests/capabilities/test_execve.c
Test result with root user:
$sudo make TARGETS="capabilities" kselftest
...
TAP version 13
1..1
timeout set to 45
selftests: capabilities: test_execve
TAP version 13
1..12
[RUN] +++ Tests with uid == 0 +++
[NOTE] Using global UIDs for tests
[RUN] Root => ep
...
ok 12 Passed
Totals: pass:12 fail:0 xfail:0 xpass:0 skip:0 error:0
==================================================
TAP version 13
1..9
[RUN] +++ Tests with uid != 0 +++
[NOTE] Using global UIDs for tests
[RUN] Non-root => no caps
...
ok 9 Passed
Totals: pass:9 fail:0 xfail:0 xpass:0 skip:0 error:0
Test result without root or normal user:
$make TARGETS="capabilities" kselftest
...
timeout set to 45
selftests: capabilities: test_execve
TAP version 13
1..12
[RUN] +++ Tests with uid == 0 +++
[NOTE] Using a user namespace for tests
[RUN] Root => ep
validate_cap:: Capabilities after execve were correct
ok 1 Passed
Check cap_ambient manipulation rules
ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap
ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap
ok 4 PR_CAP_AMBIENT_RAISE worked
ok 5 Basic manipulation appears to work
[RUN] Root +i => eip
validate_cap:: Capabilities after execve were correct
ok 6 Passed
[RUN] UID 0 +ia => eipa
validate_cap:: Capabilities after execve were correct
ok 7 Passed
ok 8 # SKIP SUID/SGID tests (needs privilege)
Planned tests != run tests (12 != 8)
Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0
==================================================
TAP version 13
1..9
[RUN] +++ Tests with uid != 0 +++
[NOTE] Using a user namespace for tests
[RUN] Non-root => no caps
validate_cap:: Capabilities after execve were correct
ok 1 Passed
Check cap_ambient manipulation rules
ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap
ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap
ok 4 PR_CAP_AMBIENT_RAISE worked
ok 5 Basic manipulation appears to work
[RUN] Non-root +i => i
validate_cap:: Capabilities after execve were correct
ok 6 Passed
[RUN] UID 1 +ia => eipa
validate_cap:: Capabilities after execve were correct
ok 7 Passed
ok 8 # SKIP SUID/SGID tests (needs privilege)
Planned tests != run tests (9 != 8)
Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0
Signed-off-by: Swarup Laxman Kotiaklapudi <swarupkotikalapudi@gmail.com>
---
Changes in V2:
- Change the commit message explaining
why this patchset is needed.
tools/testing/selftests/capabilities/test_execve.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
Comments
On 11/11/23 10:38, Swarup Laxman Kotiaklapudi wrote: > This patchset fixes TODO: > "If we're already root, we could skip creating the userns." > > Change namespace creation for root and non-root > user differently in create_and_enter_ns() function > in this file: > tools/testing/selftests/capabilities/test_execve.c > > Test result with root user: > $sudo make TARGETS="capabilities" kselftest > ... > TAP version 13 > 1..1 > timeout set to 45 > selftests: capabilities: test_execve > TAP version 13 > 1..12 > [RUN] +++ Tests with uid == 0 +++ > [NOTE] Using global UIDs for tests > [RUN] Root => ep > ... > ok 12 Passed > Totals: pass:12 fail:0 xfail:0 xpass:0 skip:0 error:0 > ================================================== > TAP version 13 > 1..9 > [RUN] +++ Tests with uid != 0 +++ > [NOTE] Using global UIDs for tests > [RUN] Non-root => no caps > ... > ok 9 Passed > Totals: pass:9 fail:0 xfail:0 xpass:0 skip:0 error:0 > > Test result without root or normal user: > $make TARGETS="capabilities" kselftest > ... > timeout set to 45 > selftests: capabilities: test_execve > TAP version 13 > 1..12 > [RUN] +++ Tests with uid == 0 +++ > [NOTE] Using a user namespace for tests > [RUN] Root => ep > validate_cap:: Capabilities after execve were correct > ok 1 Passed > Check cap_ambient manipulation rules > ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap > ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap > ok 4 PR_CAP_AMBIENT_RAISE worked > ok 5 Basic manipulation appears to work > [RUN] Root +i => eip > validate_cap:: Capabilities after execve were correct > ok 6 Passed > [RUN] UID 0 +ia => eipa > validate_cap:: Capabilities after execve were correct > ok 7 Passed > ok 8 # SKIP SUID/SGID tests (needs privilege) > Planned tests != run tests (12 != 8) > Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0 > ================================================== > TAP version 13 > 1..9 > [RUN] +++ Tests with uid != 0 +++ > [NOTE] Using a user namespace for tests > [RUN] Non-root => no caps > validate_cap:: Capabilities after execve were correct > ok 1 Passed > Check cap_ambient manipulation rules > ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap > ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap > ok 4 PR_CAP_AMBIENT_RAISE worked > ok 5 Basic manipulation appears to work > [RUN] Non-root +i => i > validate_cap:: Capabilities after execve were correct > ok 6 Passed > [RUN] UID 1 +ia => eipa > validate_cap:: Capabilities after execve were correct > ok 7 Passed > ok 8 # SKIP SUID/SGID tests (needs privilege) > Planned tests != run tests (9 != 8) > Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0 > > Signed-off-by: Swarup Laxman Kotiaklapudi <swarupkotikalapudi@gmail.com> > --- > > Changes in V2: > - Change the commit message explaining > why this patchset is needed. > Applied to linux-kselftest next for Linux 6.8-rc1 thanks, -- Shuah
diff --git a/tools/testing/selftests/capabilities/test_execve.c b/tools/testing/selftests/capabilities/test_execve.c index df0ef02b4036..8236150d377e 100644 --- a/tools/testing/selftests/capabilities/test_execve.c +++ b/tools/testing/selftests/capabilities/test_execve.c @@ -96,11 +96,7 @@ static bool create_and_enter_ns(uid_t inner_uid) outer_uid = getuid(); outer_gid = getgid(); - /* - * TODO: If we're already root, we could skip creating the userns. - */ - - if (unshare(CLONE_NEWNS) == 0) { + if (outer_uid == 0 && unshare(CLONE_NEWNS) == 0) { ksft_print_msg("[NOTE]\tUsing global UIDs for tests\n"); if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) != 0) ksft_exit_fail_msg("PR_SET_KEEPCAPS - %s\n",