From: swarup <swarupkotikalapudi@gmail.com>
To: shuah@kernel.org, linux-kselftest@vger.kernel.org,
linux-kernel@vger.kernel.org, luto@kernel.org
Cc: linux-kernel-mentees@lists.linuxfoundation.org
Subject: Re: [PATCH] selftests: capabilities: namespace create varies for root and normal user
Date: Fri, 20 Oct 2023 00:09:11 +0530 [thread overview]
Message-ID: <ZTF3z9gKJCn3bQ7w@swarup-virtual-machine> (raw)
In-Reply-To: <20230929125348.13302-1-swarupkotikalapudi@gmail.com>
esOn Fri, Sep 29, 2023 at 06:23:48PM +0530, Swarup Laxman Kotiaklapudi wrote:
> Change namespace creation for root and non-root
> user differently in create_and_enter_ns() function
>
> Test result with root user:
> $sudo make TARGETS="capabilities" kselftest
> ...
> TAP version 13
> 1..1
> timeout set to 45
> selftests: capabilities: test_execve
> TAP version 13
> 1..12
> [RUN] +++ Tests with uid == 0 +++
> [NOTE] Using global UIDs for tests
> [RUN] Root => ep
> ...
> ok 12 Passed
> Totals: pass:12 fail:0 xfail:0 xpass:0 skip:0 error:0
> ==================================================
> TAP version 13
> 1..9
> [RUN] +++ Tests with uid != 0 +++
> [NOTE] Using global UIDs for tests
> [RUN] Non-root => no caps
> ...
> ok 9 Passed
> Totals: pass:9 fail:0 xfail:0 xpass:0 skip:0 error:0
>
> Test result without root or normal user:
> $make TARGETS="capabilities" kselftest
> ...
> timeout set to 45
> selftests: capabilities: test_execve
> TAP version 13
> 1..12
> [RUN] +++ Tests with uid == 0 +++
> [NOTE] Using a user namespace for tests
> [RUN] Root => ep
> validate_cap:: Capabilities after execve were correct
> ok 1 Passed
> Check cap_ambient manipulation rules
> ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap
> ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap
> ok 4 PR_CAP_AMBIENT_RAISE worked
> ok 5 Basic manipulation appears to work
> [RUN] Root +i => eip
> validate_cap:: Capabilities after execve were correct
> ok 6 Passed
> [RUN] UID 0 +ia => eipa
> validate_cap:: Capabilities after execve were correct
> ok 7 Passed
> ok 8 # SKIP SUID/SGID tests (needs privilege)
> Planned tests != run tests (12 != 8)
> Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0
> ==================================================
> TAP version 13
> 1..9
> [RUN] +++ Tests with uid != 0 +++
> [NOTE] Using a user namespace for tests
> [RUN] Non-root => no caps
> validate_cap:: Capabilities after execve were correct
> ok 1 Passed
> Check cap_ambient manipulation rules
> ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap
> ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap
> ok 4 PR_CAP_AMBIENT_RAISE worked
> ok 5 Basic manipulation appears to work
> [RUN] Non-root +i => i
> validate_cap:: Capabilities after execve were correct
> ok 6 Passed
> [RUN] UID 1 +ia => eipa
> validate_cap:: Capabilities after execve were correct
> ok 7 Passed
> ok 8 # SKIP SUID/SGID tests (needs privilege)
> Planned tests != run tests (9 != 8)
> Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0
>
> Signed-off-by: Swarup Laxman Kotiaklapudi <swarupkotikalapudi@gmail.com>
> ---
> tools/testing/selftests/capabilities/test_execve.c | 6 +-----
> 1 file changed, 1 insertion(+), 5 deletions(-)
>
> diff --git a/tools/testing/selftests/capabilities/test_execve.c b/tools/testing/selftests/capabilities/test_execve.c
> index df0ef02b4036..8236150d377e 100644
> --- a/tools/testing/selftests/capabilities/test_execve.c
> +++ b/tools/testing/selftests/capabilities/test_execve.c
> @@ -96,11 +96,7 @@ static bool create_and_enter_ns(uid_t inner_uid)
> outer_uid = getuid();
> outer_gid = getgid();
>
> - /*
> - * TODO: If we're already root, we could skip creating the userns.
> - */
> -
> - if (unshare(CLONE_NEWNS) == 0) {
> + if (outer_uid == 0 && unshare(CLONE_NEWNS) == 0) {
> ksft_print_msg("[NOTE]\tUsing global UIDs for tests\n");
> if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) != 0)
> ksft_exit_fail_msg("PR_SET_KEEPCAPS - %s\n",
> --
> 2.34.1
>
Hi Shuah,
Please review this patchset.
Thanks,
Swarup
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
WARNING: multiple messages have this Message-ID (diff)
From: swarup <swarupkotikalapudi@gmail.com>
To: shuah@kernel.org, linux-kselftest@vger.kernel.org,
linux-kernel@vger.kernel.org, luto@kernel.org
Cc: linux-kernel-mentees@lists.linuxfoundation.org
Subject: Re: [PATCH] selftests: capabilities: namespace create varies for root and normal user
Date: Fri, 20 Oct 2023 00:09:11 +0530 [thread overview]
Message-ID: <ZTF3z9gKJCn3bQ7w@swarup-virtual-machine> (raw)
In-Reply-To: <20230929125348.13302-1-swarupkotikalapudi@gmail.com>
esOn Fri, Sep 29, 2023 at 06:23:48PM +0530, Swarup Laxman Kotiaklapudi wrote:
> Change namespace creation for root and non-root
> user differently in create_and_enter_ns() function
>
> Test result with root user:
> $sudo make TARGETS="capabilities" kselftest
> ...
> TAP version 13
> 1..1
> timeout set to 45
> selftests: capabilities: test_execve
> TAP version 13
> 1..12
> [RUN] +++ Tests with uid == 0 +++
> [NOTE] Using global UIDs for tests
> [RUN] Root => ep
> ...
> ok 12 Passed
> Totals: pass:12 fail:0 xfail:0 xpass:0 skip:0 error:0
> ==================================================
> TAP version 13
> 1..9
> [RUN] +++ Tests with uid != 0 +++
> [NOTE] Using global UIDs for tests
> [RUN] Non-root => no caps
> ...
> ok 9 Passed
> Totals: pass:9 fail:0 xfail:0 xpass:0 skip:0 error:0
>
> Test result without root or normal user:
> $make TARGETS="capabilities" kselftest
> ...
> timeout set to 45
> selftests: capabilities: test_execve
> TAP version 13
> 1..12
> [RUN] +++ Tests with uid == 0 +++
> [NOTE] Using a user namespace for tests
> [RUN] Root => ep
> validate_cap:: Capabilities after execve were correct
> ok 1 Passed
> Check cap_ambient manipulation rules
> ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap
> ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap
> ok 4 PR_CAP_AMBIENT_RAISE worked
> ok 5 Basic manipulation appears to work
> [RUN] Root +i => eip
> validate_cap:: Capabilities after execve were correct
> ok 6 Passed
> [RUN] UID 0 +ia => eipa
> validate_cap:: Capabilities after execve were correct
> ok 7 Passed
> ok 8 # SKIP SUID/SGID tests (needs privilege)
> Planned tests != run tests (12 != 8)
> Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0
> ==================================================
> TAP version 13
> 1..9
> [RUN] +++ Tests with uid != 0 +++
> [NOTE] Using a user namespace for tests
> [RUN] Non-root => no caps
> validate_cap:: Capabilities after execve were correct
> ok 1 Passed
> Check cap_ambient manipulation rules
> ok 2 PR_CAP_AMBIENT_RAISE failed on non-inheritable cap
> ok 3 PR_CAP_AMBIENT_RAISE failed on non-permitted cap
> ok 4 PR_CAP_AMBIENT_RAISE worked
> ok 5 Basic manipulation appears to work
> [RUN] Non-root +i => i
> validate_cap:: Capabilities after execve were correct
> ok 6 Passed
> [RUN] UID 1 +ia => eipa
> validate_cap:: Capabilities after execve were correct
> ok 7 Passed
> ok 8 # SKIP SUID/SGID tests (needs privilege)
> Planned tests != run tests (9 != 8)
> Totals: pass:7 fail:0 xfail:0 xpass:0 skip:1 error:0
>
> Signed-off-by: Swarup Laxman Kotiaklapudi <swarupkotikalapudi@gmail.com>
> ---
> tools/testing/selftests/capabilities/test_execve.c | 6 +-----
> 1 file changed, 1 insertion(+), 5 deletions(-)
>
> diff --git a/tools/testing/selftests/capabilities/test_execve.c b/tools/testing/selftests/capabilities/test_execve.c
> index df0ef02b4036..8236150d377e 100644
> --- a/tools/testing/selftests/capabilities/test_execve.c
> +++ b/tools/testing/selftests/capabilities/test_execve.c
> @@ -96,11 +96,7 @@ static bool create_and_enter_ns(uid_t inner_uid)
> outer_uid = getuid();
> outer_gid = getgid();
>
> - /*
> - * TODO: If we're already root, we could skip creating the userns.
> - */
> -
> - if (unshare(CLONE_NEWNS) == 0) {
> + if (outer_uid == 0 && unshare(CLONE_NEWNS) == 0) {
> ksft_print_msg("[NOTE]\tUsing global UIDs for tests\n");
> if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) != 0)
> ksft_exit_fail_msg("PR_SET_KEEPCAPS - %s\n",
> --
> 2.34.1
>
Hi Shuah,
Please review this patchset.
Thanks,
Swarup
next prev parent reply other threads:[~2023-10-19 18:39 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-29 12:53 [PATCH] selftests: capabilities: namespace create varies for root and normal user Swarup Laxman Kotiaklapudi
2023-09-29 12:53 ` Swarup Laxman Kotiaklapudi
2023-10-19 18:39 ` swarup [this message]
2023-10-19 18:39 ` swarup
2023-11-07 21:23 ` Shuah Khan
2023-11-11 16:53 ` swarup
2023-11-11 17:38 ` [PATCH v2] " Swarup Laxman Kotiaklapudi
2023-11-30 23:38 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZTF3z9gKJCn3bQ7w@swarup-virtual-machine \
--to=swarupkotikalapudi@gmail.com \
--cc=linux-kernel-mentees@lists.linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=luto@kernel.org \
--cc=shuah@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.