[LTP] [PATCH] syscalls/cma: Require root for process_vm tests

[LTP] [PATCH] syscalls/cma: Require root for process_vm tests

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

When security modules like Yama LSM are active (e.g. ptrace_scope >= 1),
process_vm_readv() and process_vm_writev() fail with EPERM for
unprivileged sibling processes due to missing CAP_SYS_PTRACE capability.

Require root so tests can reliably execute across different security
configurations.

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
The cma testing suite started to fail on modern systems enabling YAMA.
Unfortunately, using CAP_PTRACE capability for users is not enough to
avoid an EPERM. For this reason, it's better to require root and fix the
whole suite in one shot.
---
 testcases/kernel/syscalls/cma/process_vm_readv02.c  | 5 +++++
 testcases/kernel/syscalls/cma/process_vm_readv03.c  | 5 +++++
 testcases/kernel/syscalls/cma/process_vm_writev02.c | 5 +++++
 3 files changed, 15 insertions(+)

diff --git a/testcases/kernel/syscalls/cma/process_vm_readv02.c b/testcases/kernel/syscalls/cma/process_vm_readv02.c
index 1e2ac38fa..d985bdad9 100644
--- a/testcases/kernel/syscalls/cma/process_vm_readv02.c
+++ b/testcases/kernel/syscalls/cma/process_vm_readv02.c
@@ -10,6 +10,10 @@
  * then the other one calls process_vm_readv and reads from the same
  * memory location, it then verifies if process_vm_readv returns
  * correct data.
+ *
+ * Requires root for ``CAP_SYS_PTRACE`` to access the address space of
+ * another process when security policies such as Yama LSM (ptrace_scope)
+ * are enabled.
  */
 
 #include <stdio.h>
@@ -116,6 +120,7 @@ static struct tst_test test = {
 	.test_all = run,
 	.setup = setup,
 	.cleanup = cleanup,
+	.needs_root = 1,
 	.forks_child = 1,
 	.needs_checkpoints = 1,
 };
diff --git a/testcases/kernel/syscalls/cma/process_vm_readv03.c b/testcases/kernel/syscalls/cma/process_vm_readv03.c
index 95d35c422..2b533ca56 100644
--- a/testcases/kernel/syscalls/cma/process_vm_readv03.c
+++ b/testcases/kernel/syscalls/cma/process_vm_readv03.c
@@ -12,6 +12,10 @@
  * locations and the local iovecs initialized to randomly sized and
  * allocated local memory locations. The second child then verifies
  * that the data is copied correctly.
+ *
+ * Requires root for ``CAP_SYS_PTRACE`` to access the address space of
+ * another process when security policies such as Yama LSM (ptrace_scope)
+ * are enabled.
  */
 
 #include <stdio.h>
@@ -189,6 +193,7 @@ static struct tst_test test = {
 	.test = run,
 	.setup = setup,
 	.cleanup = cleanup,
+	.needs_root = 1,
 	.forks_child = 1,
 	.needs_checkpoints = 1,
 	.tcnt = ARRAY_SIZE(testcases),
diff --git a/testcases/kernel/syscalls/cma/process_vm_writev02.c b/testcases/kernel/syscalls/cma/process_vm_writev02.c
index 15bd66a44..e9edc4a6f 100644
--- a/testcases/kernel/syscalls/cma/process_vm_writev02.c
+++ b/testcases/kernel/syscalls/cma/process_vm_writev02.c
@@ -9,6 +9,10 @@
  * Fork two children, the first one allocates a chunk of memory and the
  * other one call process_vm_writev to write known data into the first
  * child. Then first child verifies that the data is as expected.
+ *
+ * Requires root for ``CAP_SYS_PTRACE`` to access the address space of
+ * another process when security policies such as Yama LSM (ptrace_scope)
+ * are enabled.
  */
 
 #include <stdlib.h>
@@ -122,6 +126,7 @@ static struct tst_test test = {
 	.test_all = run,
 	.setup = setup,
 	.cleanup = cleanup,
+	.needs_root = 1,
 	.forks_child = 1,
 	.needs_checkpoints = 1,
 	.options =

---
base-commit: c082253808608e57a4fba3e7f3787a9f5c377638
change-id: 20261014-fix_process_vm_writev_permissions-6fca6598d9fb

Best regards,
--  
Andrea Cervesato <andrea.cervesato@suse.com>


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] syscalls/cma: Require root for process_vm tests

[linuxtestproject.agent]

Hi Andrea,

On 14 October 2026, Andrea Cervesato wrote:
> syscalls/cma: Require root for process_vm tests

> diff --git a/testcases/kernel/syscalls/cma/process_vm_readv02.c b/testcases/kernel/syscalls/cma/process_vm_readv02.c
> @@ -116,6 +120,7 @@ static struct tst_test test = {
>  	.test_all = run,
>  	.setup = setup,
>  	.cleanup = cleanup,
> +	.needs_root = 1,
>  	.forks_child = 1,
>  	.needs_checkpoints = 1,

Across all three tests, this skips valid non-root runs when Yama is
disabled or ptrace_scope=0, yet UID 0 without CAP_SYS_PTRACE still passes
the framework's geteuid() check and gets EPERM under modes 1/2.
For mode 1, have the target call prctl(PR_SET_PTRACER, getppid(), ...)
before signalling readiness to authorize the parent and its descendants,
including the sibling.
Preserve unprivileged execution where allowed and use tst_cap_action()
with TST_CAP_REQ when CAP_SYS_PTRACE is actually needed, so missing
capabilities produce TCONF.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp