[LTP] [PATCH] setsockopt08: Handle EPERM from disabled compat xtables in userns

[LTP] [PATCH] setsockopt08: Handle EPERM from disabled compat xtables in userns

[Avinesh Kumar via ltp]

From: Avinesh Kumar <avinesh.kumar@suse.com>

Since kernel commit ec1806a730a1 ("netfilter: x_tables: disable
32bit compat interface in user namespaces"), the compat xtables ABI
returns EPERM when called from inside a non-init user namespace,
regardless of privileges held there. Since the test isolates itself
with tst_setup_netns(), it always hits this path on 32-bit/compat
runs and can no longer reach the CVE-2021-22555 code path

setsockopt08.c:139: TFAIL: setsockopt(3, IPPROTO_IP, IPT_SO_SET_REPLACE, 0xf7f0c800, 1): EPERM (1)

So treat EPERM as TCONF instead of TFAIL.

Signed-off-by: Avinesh Kumar <avinesh.kumar@suse.com>
---
 testcases/kernel/syscalls/setsockopt/setsockopt08.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/testcases/kernel/syscalls/setsockopt/setsockopt08.c b/testcases/kernel/syscalls/setsockopt/setsockopt08.c
index 37051512517a..3d1838f6ed73 100644
--- a/testcases/kernel/syscalls/setsockopt/setsockopt08.c
+++ b/testcases/kernel/syscalls/setsockopt/setsockopt08.c
@@ -82,6 +82,13 @@
  *  * the kernel will insert four bytes of padding
  *    after the match and target entries each.
  *  * sizeof(struct xt_entry_target) = 32
+ *
+ * Since kernel commit ec1806a730a1 ("netfilter: x_tables: disable
+ * 32bit compat interface in user namespaces") in v7.2, the compat
+ * xtables ABI is rejected with EPERM inside a non-init user namespace.
+ * As this test runs isolated via tst_setup_netns(), it can no longer
+ * reach the vulnerable code path on such kernels and reports TCONF
+ * instead.
  */
 
 #include <netinet/in.h>
@@ -135,6 +142,11 @@ void run(void)
 	if (TST_RET == -1 && TST_ERR == ENOPROTOOPT)
 		tst_brk(TCONF | TTERRNO, res_fmt_str, fd, buffer);
 
+	if (TST_RET == -1 && TST_ERR == EPERM  && tst_is_compat_mode()) {
+		tst_res(TINFO, "32bit compat xtables interface is disabled in user namespaces since commit ec1806a730a1");
+		tst_brk(TCONF | TTERRNO, res_fmt_str, fd, buffer);
+	}
+
 	result = (TST_RET == -1 && TST_ERR == EINVAL) ? TPASS : TFAIL;
 	tst_res(result | TTERRNO, res_fmt_str, fd, buffer);
 
@@ -163,6 +175,7 @@ static struct tst_test test = {
 	},
 	.tags = (const struct tst_tag[]) {
 		{"linux-git", "b29c457a6511435960115c0f548c4360d5f4801d"},
+		{"linux-git", "ec1806a730a1c0b3d68a7f9afe81514fb0dd7991"},
 		{"CVE", "2021-22555"},
 		{}
 	}
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] setsockopt08: Handle EPERM from disabled compat xtables in userns

[Andrea Cervesato via ltp]

Merged, Thanks!

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] setsockopt08: Handle EPERM from disabled compat xtables in userns

[Andrea Cervesato via ltp]

Hi,

> Merged, Thanks!

sorry I replied to the wrong email. I only merged the make check thingy.

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] setsockopt08: Handle EPERM from disabled compat xtables in userns

[Andrea Cervesato via ltp]

Reviewed-by: Andrea Cervesato <andrea.cervesato@suse.com>

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] setsockopt08: Handle EPERM from disabled compat xtables in userns

[linuxtestproject.agent]

Hi Avinesh,

On Fri, Aug 28, 2026, Avinesh Kumar wrote:
> setsockopt08: Handle EPERM from disabled compat xtables in userns

> +	if (TST_RET == -1 && TST_ERR == EPERM  && tst_is_compat_mode()) {

Minor: Could the extra space before the second && be removed to follow
the surrounding kernel style?

> +		tst_res(TINFO, "32bit compat xtables interface is disabled in user namespaces since commit ec1806a730a1");

Minor: Could this 108-column line be wrapped to stay within the kernel
style's 100-column limit?

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] setsockopt08: Handle EPERM from disabled compat xtables in userns

[Andrea Cervesato via ltp]

Hi Avinesh,

> > +	if (TST_RET == -1 && TST_ERR == EPERM  && tst_is_compat_mode()) {
> 
> Minor: Could the extra space before the second && be removed to follow
> the surrounding kernel style?

this can be fixed before merge.

> 
> > +		tst_res(TINFO, "32bit compat xtables interface is disabled in user namespaces since commit ec1806a730a1");
> 
> Minor: Could this 108-column line be wrapped to stay within the kernel
> style's 100-column limit?

this is not needed. I will add a rule for this.

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] setsockopt08: Handle EPERM from disabled compat xtables in userns

[Andrea Cervesato via ltp]

Merged, Thanks!

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp