Change namespace creation for root and non-root user differently in create_and_enter_ns() function
Test result with root user: $sudo make TARGETS="capabilities" kselftest ... TAP version 13 1..1 timeout set to 45 selftests: capabilities: test_execve TAP version 13 1..12 [RUN] +++ Tests with uid == 0 +++ [NOTE] Using global UIDs for tests [RUN] Root => ep ... ok 12 Passed Totals: pass:12 fail:0 xfail:0 xpass:0 skip:0 error:0 ================================================== TAP version 13 1..9 [RUN] +++ Tests with uid != 0 +++ [NOTE] Using global UIDs for tests [RUN] Non-root => no caps ... ok 9 Passed Totals: pass:9 fail:0 xfail:0 xpass:0 skip:0 error:0
Test result without root or normal user: $make TARGETS="capabilities" kselftest ... timeout set to 45 selftests: capabilities: test_execve TAP version 13 1..12 [RUN] +++ Tests with uid == 0 +++ [NOTE] Using a user namespace for tests [RUN] Root => ep validate_cap:: Capabilities after execve were correct ok 1 Passed Check cap_ambient manipulation rules ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap ok 4 PR_CAP_AMBIENT_RAISE worked ok 5 Basic manipulation appears to work [RUN] Root +i => eip validate_cap:: Capabilities after execve were correct ok 6 Passed [RUN] UID 0 +ia => eipa validate_cap:: Capabilities after execve were correct ok 7 Passed ok 8 # SKIP SUID/SGID tests (needs privilege) Planned tests != run tests (12 != 8) Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0 ================================================== TAP version 13 1..9 [RUN] +++ Tests with uid != 0 +++ [NOTE] Using a user namespace for tests [RUN] Non-root => no caps validate_cap:: Capabilities after execve were correct ok 1 Passed Check cap_ambient manipulation rules ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap ok 4 PR_CAP_AMBIENT_RAISE worked ok 5 Basic manipulation appears to work [RUN] Non-root +i => i validate_cap:: Capabilities after execve were correct ok 6 Passed [RUN] UID 1 +ia => eipa validate_cap:: Capabilities after execve were correct ok 7 Passed ok 8 # SKIP SUID/SGID tests (needs privilege) Planned tests != run tests (9 != 8) Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0
Signed-off-by: Swarup Laxman Kotiaklapudi swarupkotikalapudi@gmail.com --- tools/testing/selftests/capabilities/test_execve.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/tools/testing/selftests/capabilities/test_execve.c b/tools/testing/selftests/capabilities/test_execve.c index df0ef02b4036..8236150d377e 100644 --- a/tools/testing/selftests/capabilities/test_execve.c +++ b/tools/testing/selftests/capabilities/test_execve.c @@ -96,11 +96,7 @@ static bool create_and_enter_ns(uid_t inner_uid) outer_uid = getuid(); outer_gid = getgid();
- /* - * TODO: If we're already root, we could skip creating the userns. - */ - - if (unshare(CLONE_NEWNS) == 0) { + if (outer_uid == 0 && unshare(CLONE_NEWNS) == 0) { ksft_print_msg("[NOTE]\tUsing global UIDs for tests\n"); if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) != 0) ksft_exit_fail_msg("PR_SET_KEEPCAPS - %s\n",
esOn Fri, Sep 29, 2023 at 06:23:48PM +0530, Swarup Laxman Kotiaklapudi wrote:
Change namespace creation for root and non-root user differently in create_and_enter_ns() function
Test result with root user: $sudo make TARGETS="capabilities" kselftest ... TAP version 13 1..1 timeout set to 45 selftests: capabilities: test_execve TAP version 13 1..12 [RUN] +++ Tests with uid == 0 +++ [NOTE] Using global UIDs for tests [RUN] Root => ep ... ok 12 Passed Totals: pass:12 fail:0 xfail:0 xpass:0 skip:0 error:0 ================================================== TAP version 13 1..9 [RUN] +++ Tests with uid != 0 +++ [NOTE] Using global UIDs for tests [RUN] Non-root => no caps ... ok 9 Passed Totals: pass:9 fail:0 xfail:0 xpass:0 skip:0 error:0
Test result without root or normal user: $make TARGETS="capabilities" kselftest ... timeout set to 45 selftests: capabilities: test_execve TAP version 13 1..12 [RUN] +++ Tests with uid == 0 +++ [NOTE] Using a user namespace for tests [RUN] Root => ep validate_cap:: Capabilities after execve were correct ok 1 Passed Check cap_ambient manipulation rules ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap ok 4 PR_CAP_AMBIENT_RAISE worked ok 5 Basic manipulation appears to work [RUN] Root +i => eip validate_cap:: Capabilities after execve were correct ok 6 Passed [RUN] UID 0 +ia => eipa validate_cap:: Capabilities after execve were correct ok 7 Passed ok 8 # SKIP SUID/SGID tests (needs privilege) Planned tests != run tests (12 != 8) Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0 ================================================== TAP version 13 1..9 [RUN] +++ Tests with uid != 0 +++ [NOTE] Using a user namespace for tests [RUN] Non-root => no caps validate_cap:: Capabilities after execve were correct ok 1 Passed Check cap_ambient manipulation rules ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap ok 4 PR_CAP_AMBIENT_RAISE worked ok 5 Basic manipulation appears to work [RUN] Non-root +i => i validate_cap:: Capabilities after execve were correct ok 6 Passed [RUN] UID 1 +ia => eipa validate_cap:: Capabilities after execve were correct ok 7 Passed ok 8 # SKIP SUID/SGID tests (needs privilege) Planned tests != run tests (9 != 8) Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0
Signed-off-by: Swarup Laxman Kotiaklapudi swarupkotikalapudi@gmail.com
tools/testing/selftests/capabilities/test_execve.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/tools/testing/selftests/capabilities/test_execve.c b/tools/testing/selftests/capabilities/test_execve.c index df0ef02b4036..8236150d377e 100644 --- a/tools/testing/selftests/capabilities/test_execve.c +++ b/tools/testing/selftests/capabilities/test_execve.c @@ -96,11 +96,7 @@ static bool create_and_enter_ns(uid_t inner_uid) outer_uid = getuid(); outer_gid = getgid();
- /*
* TODO: If we're already root, we could skip creating the userns.*/- if (unshare(CLONE_NEWNS) == 0) {
- if (outer_uid == 0 && unshare(CLONE_NEWNS) == 0) { ksft_print_msg("[NOTE]\tUsing global UIDs for tests\n"); if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) != 0) ksft_exit_fail_msg("PR_SET_KEEPCAPS - %s\n",
-- 2.34.1
Hi Shuah, Please review this patchset. Thanks, Swarup
On 9/29/23 06:53, Swarup Laxman Kotiaklapudi wrote:
Change namespace creation for root and non-root user differently in create_and_enter_ns() function
Sorry for the delay on reviewing this.
Can you tell me more about why this change is needed and include it in the change log.
thanks, -- Shuah
On Tue, Nov 07, 2023 at 02:23:34PM -0700, Shuah Khan wrote:
On 9/29/23 06:53, Swarup Laxman Kotiaklapudi wrote:
Change namespace creation for root and non-root user differently in create_and_enter_ns() function
Sorry for the delay on reviewing this.
Can you tell me more about why this change is needed and include it in the change log.
thanks, -- Shuah
Hi Shuah,
This patchset was raised to fix below TODO:
"If we're already root, we could skip creating the userns."
Without this patchset, function create_and_enter_ns(), at this path --> tools/testing/selftests/capabilities/test_execve.c was as mentioned below:
static bool create_and_enter_ns(uid_t inner_uid) { .... if (unshare(CLONE_NEWNS) == 0) { .... } else if (unshare(CLONE_NEWUSER | CLONE_NEWNS) == 0) { .... } else { ksft_exit_skip("must be root or be able to create a userns\n"); }
... }
To fix the TODO, above mentioned if block is executed if root user, for normal user it enters inside 'else if' block.
Thanks, Swarup
This patchset fixes TODO: "If we're already root, we could skip creating the userns."
Change namespace creation for root and non-root user differently in create_and_enter_ns() function in this file: tools/testing/selftests/capabilities/test_execve.c
Test result with root user: $sudo make TARGETS="capabilities" kselftest ... TAP version 13 1..1 timeout set to 45 selftests: capabilities: test_execve TAP version 13 1..12 [RUN] +++ Tests with uid == 0 +++ [NOTE] Using global UIDs for tests [RUN] Root => ep ... ok 12 Passed Totals: pass:12 fail:0 xfail:0 xpass:0 skip:0 error:0 ================================================== TAP version 13 1..9 [RUN] +++ Tests with uid != 0 +++ [NOTE] Using global UIDs for tests [RUN] Non-root => no caps ... ok 9 Passed Totals: pass:9 fail:0 xfail:0 xpass:0 skip:0 error:0
Test result without root or normal user: $make TARGETS="capabilities" kselftest ... timeout set to 45 selftests: capabilities: test_execve TAP version 13 1..12 [RUN] +++ Tests with uid == 0 +++ [NOTE] Using a user namespace for tests [RUN] Root => ep validate_cap:: Capabilities after execve were correct ok 1 Passed Check cap_ambient manipulation rules ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap ok 4 PR_CAP_AMBIENT_RAISE worked ok 5 Basic manipulation appears to work [RUN] Root +i => eip validate_cap:: Capabilities after execve were correct ok 6 Passed [RUN] UID 0 +ia => eipa validate_cap:: Capabilities after execve were correct ok 7 Passed ok 8 # SKIP SUID/SGID tests (needs privilege) Planned tests != run tests (12 != 8) Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0 ================================================== TAP version 13 1..9 [RUN] +++ Tests with uid != 0 +++ [NOTE] Using a user namespace for tests [RUN] Non-root => no caps validate_cap:: Capabilities after execve were correct ok 1 Passed Check cap_ambient manipulation rules ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap ok 4 PR_CAP_AMBIENT_RAISE worked ok 5 Basic manipulation appears to work [RUN] Non-root +i => i validate_cap:: Capabilities after execve were correct ok 6 Passed [RUN] UID 1 +ia => eipa validate_cap:: Capabilities after execve were correct ok 7 Passed ok 8 # SKIP SUID/SGID tests (needs privilege) Planned tests != run tests (9 != 8) Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0
Signed-off-by: Swarup Laxman Kotiaklapudi swarupkotikalapudi@gmail.com ---
Changes in V2: - Change the commit message explaining why this patchset is needed.
tools/testing/selftests/capabilities/test_execve.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/tools/testing/selftests/capabilities/test_execve.c b/tools/testing/selftests/capabilities/test_execve.c index df0ef02b4036..8236150d377e 100644 --- a/tools/testing/selftests/capabilities/test_execve.c +++ b/tools/testing/selftests/capabilities/test_execve.c @@ -96,11 +96,7 @@ static bool create_and_enter_ns(uid_t inner_uid) outer_uid = getuid(); outer_gid = getgid();
- /* - * TODO: If we're already root, we could skip creating the userns. - */ - - if (unshare(CLONE_NEWNS) == 0) { + if (outer_uid == 0 && unshare(CLONE_NEWNS) == 0) { ksft_print_msg("[NOTE]\tUsing global UIDs for tests\n"); if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) != 0) ksft_exit_fail_msg("PR_SET_KEEPCAPS - %s\n",
On 11/11/23 10:38, Swarup Laxman Kotiaklapudi wrote:
This patchset fixes TODO: "If we're already root, we could skip creating the userns."
Change namespace creation for root and non-root user differently in create_and_enter_ns() function in this file: tools/testing/selftests/capabilities/test_execve.c
Test result with root user: $sudo make TARGETS="capabilities" kselftest ... TAP version 13 1..1 timeout set to 45 selftests: capabilities: test_execve TAP version 13 1..12 [RUN] +++ Tests with uid == 0 +++ [NOTE] Using global UIDs for tests [RUN] Root => ep ... ok 12 Passed Totals: pass:12 fail:0 xfail:0 xpass:0 skip:0 error:0 ================================================== TAP version 13 1..9 [RUN] +++ Tests with uid != 0 +++ [NOTE] Using global UIDs for tests [RUN] Non-root => no caps ... ok 9 Passed Totals: pass:9 fail:0 xfail:0 xpass:0 skip:0 error:0
Test result without root or normal user: $make TARGETS="capabilities" kselftest ... timeout set to 45 selftests: capabilities: test_execve TAP version 13 1..12 [RUN] +++ Tests with uid == 0 +++ [NOTE] Using a user namespace for tests [RUN] Root => ep validate_cap:: Capabilities after execve were correct ok 1 Passed Check cap_ambient manipulation rules ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap ok 4 PR_CAP_AMBIENT_RAISE worked ok 5 Basic manipulation appears to work [RUN] Root +i => eip validate_cap:: Capabilities after execve were correct ok 6 Passed [RUN] UID 0 +ia => eipa validate_cap:: Capabilities after execve were correct ok 7 Passed ok 8 # SKIP SUID/SGID tests (needs privilege) Planned tests != run tests (12 != 8) Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0 ================================================== TAP version 13 1..9 [RUN] +++ Tests with uid != 0 +++ [NOTE] Using a user namespace for tests [RUN] Non-root => no caps validate_cap:: Capabilities after execve were correct ok 1 Passed Check cap_ambient manipulation rules ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap ok 4 PR_CAP_AMBIENT_RAISE worked ok 5 Basic manipulation appears to work [RUN] Non-root +i => i validate_cap:: Capabilities after execve were correct ok 6 Passed [RUN] UID 1 +ia => eipa validate_cap:: Capabilities after execve were correct ok 7 Passed ok 8 # SKIP SUID/SGID tests (needs privilege) Planned tests != run tests (9 != 8) Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0
Signed-off-by: Swarup Laxman Kotiaklapudi swarupkotikalapudi@gmail.com
Changes in V2:
- Change the commit message explaining why this patchset is needed.
Applied to linux-kselftest next for Linux 6.8-rc1
thanks, -- Shuah
linux-kselftest-mirror@lists.linaro.org
-
Shuah Khan -
swarup -
Swarup Laxman Kotiaklapudi