On Thu, Aug 14, 2025 at 12:08:49PM +0800, Pavel Tikhomirov wrote:
Yes, selftest is very simple and is not covering userns checks.
FWIW, see below for what I've got here at the moment for MOVE_MOUNT_SET_GROUP; no tests for cross-filesystem and not-a-subtree yet. At least it does catch that braino when run on a kernel that doesn't have it fixed ;-) No do_change_type() tests either yet...
// link with -lcap, assumes userns enabled // can run both as root and as regular user #define _GNU_SOURCE #include <sched.h> #include <sys/capability.h> #include <sys/mount.h> #include <sys/stat.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <errno.h> #include <stdbool.h>
_Bool drop_caps(void) { cap_value_t cap_value[] = { CAP_SYS_ADMIN }; cap_t cap = cap_get_proc(); if (!cap) { perror("cap_get_proc"); return false; } return true; }
void do_unshare(void) { FILE *f; uid_t uid = geteuid(); gid_t gid = getegid(); unshare(CLONE_NEWNS|CLONE_NEWUSER); f = fopen("/proc/self/uid_map", "w"); fprintf(f, "0 %d 1", uid); fclose(f); f = fopen("/proc/self/setgroups", "w"); fprintf(f, "deny"); fclose(f); f = fopen("/proc/self/gid_map", "w"); fprintf(f, "0 %d 1", gid); fclose(f); mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL); }
void bind(char *p) { mount(p, p, NULL, MS_BIND, NULL); }
void test_it(int fd1, char *p1, int fd2, char *p2, int expected) { int flags = MOVE_MOUNT_SET_GROUP; int n;
if (!p1) { p1 = ""; flags |= MOVE_MOUNT_F_EMPTY_PATH; } if (!p2) { p2 = ""; flags |= MOVE_MOUNT_T_EMPTY_PATH; } n = move_mount(fd1, p1, fd2, p2, flags); if (!n) errno = 0; if (expected != errno) printf(" failed: %d != %d\n", expected, errno); else printf(" OK\n"); }
int main() { int pipe1[2], pipe2[2]; char path[40]; pid_t child; int root_fd; char c;
if (pipe(pipe1) < 0 || pipe(pipe2) < 0) { perror("pipe"); return -1; } if (!drop_caps()) return -1; do_unshare();
root_fd = open("/", O_PATH);
errno = 0; mount("none", "/mnt", "tmpfs", 0, NULL); mkdir("/mnt/a", 0777); mkdir("/mnt/a/private", 0777); mkdir("/mnt/a/private/b", 0777); mkdir("/mnt/a/shared", 0777); mkdir("/mnt/a/slave", 0777); mkdir("/mnt/a/shared-slave", 0777); mkdir("/mnt/locked", 0777); mkdir("/mnt/no-locked", 0777); bind("/mnt/locked");
child = fork(); if (child < 0) { perror("fork"); return -1; } else if (child == 0) { do_unshare(); mount(NULL, "/mnt/", NULL, MS_SHARED, NULL); bind("/mnt/a"); write(pipe1[1], &c, 1); fchdir(root_fd); read(pipe2[0], &c, 1); printf("from should be someplace we have permissions for"); test_it(AT_FDCWD, "mnt/a", AT_FDCWD, "/mnt/a/private", EPERM); printf("to should be someplace we have permissions for"); test_it(AT_FDCWD, "/mnt/a", AT_FDCWD, "mnt/a/private", EPERM); write(pipe1[1], &c, 1); return 0; } read(pipe1[0], &c, 1); sprintf(path, "/proc/%d/root", child); chdir(path);
mount(NULL, "/mnt", NULL, MS_SHARED, NULL); bind("/mnt/a/private"); bind("/mnt/a/shared"); bind("/mnt/a/slave"); bind("/mnt/a/slave-shared"); bind("/mnt/no-locked"); mount(NULL, "/mnt/a/private", NULL, MS_PRIVATE, NULL); mount(NULL, "/mnt/a/slave", NULL, MS_SLAVE, NULL); mount(NULL, "/mnt/a/shared-slave", NULL, MS_SLAVE, NULL); mount(NULL, "/mnt/a/shared-slave", NULL, MS_SHARED, NULL); mount(NULL, "/mnt/no-locked", NULL, MS_PRIVATE, NULL);
printf("from should be mounted (pipes are not)"); test_it(pipe1[0], NULL, AT_FDCWD, "/mnt/a/private", EINVAL);
printf("to should be mounted (pipes are not)"); test_it(AT_FDCWD, "/mnt", pipe1[0], NULL, EINVAL);
printf("from should be someplace we have permissions for"); test_it(AT_FDCWD, "mnt/a", AT_FDCWD, "/mnt/a/private", 0); mount(NULL, "/mnt/a/private", NULL, MS_PRIVATE, NULL);
printf("from should be mountpoint"); test_it(AT_FDCWD, "/mnt/a", AT_FDCWD, "/mnt/a/private", EINVAL);
printf("to should be mountpoint"); test_it(AT_FDCWD, "/mnt/a", AT_FDCWD, "/mnt/a/private/b", EINVAL);
printf("from should not have anything locked in counterpart of to"); test_it(AT_FDCWD, "mnt", AT_FDCWD, "/mnt/locked", EINVAL);
printf("from should not have anything locked in counterpart of to"); test_it(AT_FDCWD, "mnt", AT_FDCWD, "/mnt/no-locked", 0); mount(NULL, "/mnt/no-locked", NULL, MS_PRIVATE, NULL);
fflush(stdout); write(pipe2[1], &c, 1); read(pipe1[0], &c, 1); return 0; }