* [LTP] [PATCH v15 2/3] lib: New library function tst_get_free_uid
2026-09-19 1:53 [LTP] [PATCH v15 0/3] open16: allow restricted O_CREAT of FIFOs and regular files Wei Gao via ltp
2026-09-19 1:53 ` [LTP] [PATCH v15 1/3] lib/tst_uid: Remove spurious TERRNO from tst_get_free_gid success path Wei Gao via ltp
@ 2026-09-19 1:53 ` Wei Gao via ltp
2026-09-19 1:53 ` [LTP] [PATCH v15 3/3] open16: allow restricted O_CREAT of FIFOs and regular files Wei Gao via ltp
2 siblings, 0 replies; 7+ messages in thread
From: Wei Gao via ltp @ 2026-09-19 1:53 UTC (permalink / raw)
To: ltp
Add tst_get_free_uid() to dynamically find unused UIDs for tests.
Some tests need a completely unassigned, unused UID. This is used by
open16 to verify restricted O_CREAT in sticky directories by running
as a sandboxed user with no file ownership or privileges.
Signed-off-by: Wei Gao <wegao@suse.com>
Reviewed-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
include/tst_uid.h | 14 ++++++++++++++
lib/tst_uid.c | 28 ++++++++++++++++++++++++++++
2 files changed, 42 insertions(+)
diff --git a/include/tst_uid.h b/include/tst_uid.h
index 2237ddcbf..03f9dc073 100644
--- a/include/tst_uid.h
+++ b/include/tst_uid.h
@@ -7,6 +7,20 @@
#include <sys/types.h>
+uid_t tst_get_free_uid_(const char *file, const int lineno, uid_t skip);
+
+/**
+ * tst_get_free_uid() - Find a UID not assigned to any user.
+ * @skip: UID value to skip (pass 0 to skip none).
+ *
+ * Scans the password database for the first unused UID starting
+ * from 1, skipping @skip. Calls tst_brk(TBROK) if no free UID
+ * is found or a lookup error occurs.
+ *
+ * Return: An unused uid_t value.
+ */
+#define tst_get_free_uid(skip) tst_get_free_uid_(__FILE__, __LINE__, (skip))
+
/*
* Find unassigned gid. The skip argument can be used to ignore e.g. the main
* group of a specific user in case it's not listed in the group file. If you
diff --git a/lib/tst_uid.c b/lib/tst_uid.c
index b0b087362..47c267bc4 100644
--- a/lib/tst_uid.c
+++ b/lib/tst_uid.c
@@ -5,6 +5,7 @@
#include <sys/types.h>
#include <grp.h>
+#include <pwd.h>
#include <errno.h>
#define TST_NO_DEFAULT_MAIN
@@ -12,6 +13,33 @@
#include "tst_uid.h"
#define MAX_GID 32767
+#define MAX_UID 32767
+
+uid_t tst_get_free_uid_(const char *file, const int lineno, uid_t skip)
+{
+ uid_t ret;
+
+ for (ret = 1; ret < MAX_UID; ret++) {
+ if (ret == skip)
+ continue;
+
+ errno = 0;
+ if (getpwuid(ret))
+ continue;
+
+ if (errno == 0 || errno == ENOENT || errno == ESRCH) {
+ tst_res_(file, lineno, TINFO,
+ "Found unused UID %d", (int)ret);
+ return ret;
+ }
+
+ tst_brk_(file, lineno, TBROK | TERRNO, "User ID lookup failed");
+ return (uid_t)-1;
+ }
+
+ tst_brk_(file, lineno, TBROK, "No free user ID found");
+ return (uid_t)-1;
+}
gid_t tst_get_free_gid_(const char *file, const int lineno, gid_t skip)
{
--
2.55.0
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply related [flat|nested] 7+ messages in thread* [LTP] [PATCH v15 3/3] open16: allow restricted O_CREAT of FIFOs and regular files
2026-09-19 1:53 [LTP] [PATCH v15 0/3] open16: allow restricted O_CREAT of FIFOs and regular files Wei Gao via ltp
2026-09-19 1:53 ` [LTP] [PATCH v15 1/3] lib/tst_uid: Remove spurious TERRNO from tst_get_free_gid success path Wei Gao via ltp
2026-09-19 1:53 ` [LTP] [PATCH v15 2/3] lib: New library function tst_get_free_uid Wei Gao via ltp
@ 2026-09-19 1:53 ` Wei Gao via ltp
2 siblings, 0 replies; 7+ messages in thread
From: Wei Gao via ltp @ 2026-09-19 1:53 UTC (permalink / raw)
To: ltp
Add LTP coverage for kernel commit 30aba6656f61 (Linux 4.19), which
introduced protection against spoofing attacks via O_CREAT of FIFOs
and regular files in world-writable or group-writable sticky
directories.
This commit adds test cases to verify these security restrictions
(values 1 and 2 for protected_fifos and protected_regular) for opening
FIFOs and regular files in world-writable or group-writable sticky
directories when the file is not owned by the opener.
Signed-off-by: Wei Gao <wegao@suse.com>
Reviewed-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
include/tst_path_defs.h | 2 +
runtest/syscalls | 1 +
testcases/kernel/syscalls/open/.gitignore | 1 +
testcases/kernel/syscalls/open/open16.c | 143 ++++++++++++++++++++++
4 files changed, 147 insertions(+)
create mode 100644 testcases/kernel/syscalls/open/open16.c
diff --git a/include/tst_path_defs.h b/include/tst_path_defs.h
index 1a60028d3..2995150be 100644
--- a/include/tst_path_defs.h
+++ b/include/tst_path_defs.h
@@ -47,6 +47,8 @@
#define PATH_FS_PIPE_MAX_PAGES "/proc/sys/fs/pipe-max-pages"
#define PATH_FS_MAX_USER_GROUPS "/proc/sys/fs/fanotify/max_user_groups"
#define PATH_FS_MAX_USER_MARKS "/proc/sys/fs/fanotify/max_user_marks"
+#define PATH_FS_PROTECTED_REGULAR "/proc/sys/fs/protected_regular"
+#define PATH_FS_PROTECTED_FIFOS "/proc/sys/fs/protected_fifos"
/* VM */
#define PATH_VM_DROP_CACHES "/proc/sys/vm/drop_caches"
diff --git a/runtest/syscalls b/runtest/syscalls
index a021c79da..4fd62efa8 100644
--- a/runtest/syscalls
+++ b/runtest/syscalls
@@ -1008,6 +1008,7 @@ open12 open12
open13 open13
open14 open14
open15 open15
+open16 open16
openat01 openat01
openat02 openat02
diff --git a/testcases/kernel/syscalls/open/.gitignore b/testcases/kernel/syscalls/open/.gitignore
index af5997572..d2cacc02e 100644
--- a/testcases/kernel/syscalls/open/.gitignore
+++ b/testcases/kernel/syscalls/open/.gitignore
@@ -13,3 +13,4 @@
/open13
/open14
/open15
+/open16
diff --git a/testcases/kernel/syscalls/open/open16.c b/testcases/kernel/syscalls/open/open16.c
new file mode 100644
index 000000000..a8d33870f
--- /dev/null
+++ b/testcases/kernel/syscalls/open/open16.c
@@ -0,0 +1,143 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2026 Wei Gao <wegao@suse.com>
+ */
+
+/*\
+ * Verify restricted opening (:manpage:`open(2)` and :manpage:`openat(2)`) of
+ * FIFOs and regular files in sticky directories. This protection is controlled via
+ * ``/proc/sys/fs/protected_fifos`` and ``/proc/sys/fs/protected_regular`` sysctl values:
+ *
+ * - When set to "0", writing/opening is unrestricted.
+ * - When set to "1", O_CREAT open on FIFOs/regular files we don't own in world-writable
+ * sticky directories is disallowed, unless they are owned by the owner of the directory.
+ * - When set to "2", the same restriction also applies to group-writable sticky directories.
+ *
+ * This test requires root to modify ``/proc/sys/fs/protected_*`` sysctls and
+ * to manage file ownership and permissions in sticky directories.
+ */
+
+#include <pwd.h>
+#include <stdlib.h>
+#include "tst_test.h"
+#include "tst_safe_file_at.h"
+#include "tst_uid.h"
+
+#define DIR "ltp_tmp_check1"
+#define TEST_FILE "test_file_1"
+#define TEST_FIFO "test_fifo_1"
+#define TEST_FIFO_PATH DIR "/" TEST_FIFO
+
+static int dir_fd = -1;
+static uid_t uid1, uid2;
+static gid_t gid1;
+
+static struct tcase {
+ int exp_errno;
+ uid_t owner_uid;
+ int use_nobody_gid;
+ mode_t dir_mode;
+} tcases[] = {
+ {
+ .dir_mode = 0777 | S_ISVTX,
+ },
+ {
+ .exp_errno = EACCES,
+ .dir_mode = 0777 | S_ISVTX,
+ },
+ {
+ .exp_errno = EACCES,
+ .owner_uid = -1,
+ .use_nobody_gid = 1,
+ .dir_mode = 0030 | S_ISVTX,
+ },
+};
+
+static void verify_open(unsigned int n)
+{
+ struct tcase *tc = &tcases[n];
+
+ SAFE_FILE_PRINTF(PATH_FS_PROTECTED_REGULAR, "%u", n);
+ SAFE_FILE_PRINTF(PATH_FS_PROTECTED_FIFOS, "%u", n);
+
+ if (tc->owner_uid != (uid_t)-1 || tc->use_nobody_gid) {
+ gid_t gid = tc->use_nobody_gid ? gid1 : 0;
+
+ SAFE_CHOWN(DIR, tc->owner_uid, gid);
+ }
+
+ if (tc->dir_mode)
+ SAFE_CHMOD(DIR, tc->dir_mode);
+
+ if (SAFE_FORK())
+ return;
+
+ SAFE_SETGID(gid1);
+ SAFE_SETUID(uid2);
+
+ TST_EXP_FD_OR_FAIL(openat(dir_fd, TEST_FILE, O_RDWR | O_CREAT, 0777),
+ tc->exp_errno, "openat %s (sysctl_val=%u)", TEST_FILE, n);
+ if (TST_RET != -1)
+ SAFE_CLOSE(TST_RET);
+
+ TST_EXP_FD_OR_FAIL(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777),
+ tc->exp_errno, "open %s (sysctl_val=%u)", TEST_FIFO, n);
+ if (TST_RET != -1)
+ SAFE_CLOSE(TST_RET);
+
+ exit(0);
+}
+
+static void setup(void)
+{
+ struct passwd *pw;
+
+ pw = SAFE_GETPWNAM("nobody");
+ uid1 = pw->pw_uid;
+ gid1 = pw->pw_gid;
+ uid2 = tst_get_free_uid(uid1);
+
+ umask(0);
+ SAFE_MKDIR(DIR, 0777 | S_ISVTX);
+ dir_fd = SAFE_OPEN(DIR, O_DIRECTORY);
+
+ int fd = SAFE_OPENAT(dir_fd, TEST_FILE, O_CREAT | O_RDWR, 0777);
+
+ SAFE_CLOSE(fd);
+ SAFE_MKFIFO(TEST_FIFO_PATH, 0777);
+ SAFE_CHOWN(TEST_FIFO_PATH, uid1, gid1);
+ SAFE_CHOWN(DIR "/" TEST_FILE, uid1, gid1);
+}
+
+static void cleanup(void)
+{
+ if (dir_fd != -1)
+ SAFE_CLOSE(dir_fd);
+}
+
+static struct tst_test test = {
+ .setup = setup,
+ .cleanup = cleanup,
+ .needs_root = 1,
+ .tcnt = ARRAY_SIZE(tcases),
+ .test = verify_open,
+ .needs_tmpdir = 1,
+ .forks_child = 1,
+ .save_restore = (const struct tst_path_val[]) {
+ {PATH_FS_PROTECTED_REGULAR, NULL, TST_SR_TCONF},
+ {PATH_FS_PROTECTED_FIFOS, NULL, TST_SR_TCONF},
+ {}
+ },
+ .tags = (const struct tst_tag[]) {
+ {"linux-git", "30aba6656f61"},
+ {"CVE", "2000-1134"},
+ {"CVE", "2007-3852"},
+ {"CVE", "2008-0525"},
+ {"CVE", "2009-0416"},
+ {"CVE", "2011-4834"},
+ {"CVE", "2015-1838"},
+ {"CVE", "2015-7442"},
+ {"CVE", "2016-7489"},
+ {}
+ }
+};
--
2.55.0
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply related [flat|nested] 7+ messages in thread