* [LTP] [PATCH v2] Confirming EPERM is returned when CAP_SYS_ADMIN is removed from clone3. Signed-off-by: Stephen Bertram <sbertram@redhat.com>
@ 2025-11-11 15:34 Stephen Bertram via ltp
2025-11-12 10:00 ` Cyril Hrubis
2025-11-12 10:34 ` Li Wang via ltp
0 siblings, 2 replies; 4+ messages in thread
From: Stephen Bertram via ltp @ 2025-11-11 15:34 UTC (permalink / raw)
To: ltp; +Cc: Stephen Bertram
---
runtest/syscalls | 1 +
testcases/kernel/syscalls/clone3/.gitignore | 1 +
testcases/kernel/syscalls/clone3/clone304.c | 63 +++++++++++++++++++++
3 files changed, 65 insertions(+)
create mode 100644 testcases/kernel/syscalls/clone3/clone304.c
diff --git a/runtest/syscalls b/runtest/syscalls
index 54d94c0ca..b2c4f338e 100644
--- a/runtest/syscalls
+++ b/runtest/syscalls
@@ -128,6 +128,7 @@ clone10 clone10
clone301 clone301
clone302 clone302
clone303 clone303
++clone304 clone304
close01 close01
close02 close02
diff --git a/testcases/kernel/syscalls/clone3/.gitignore b/testcases/kernel/syscalls/clone3/.gitignore
index 10369954b..e9b5312f4 100644
--- a/testcases/kernel/syscalls/clone3/.gitignore
+++ b/testcases/kernel/syscalls/clone3/.gitignore
@@ -1,3 +1,4 @@
clone301
clone302
clone303
+clone304
diff --git a/testcases/kernel/syscalls/clone3/clone304.c b/testcases/kernel/syscalls/clone3/clone304.c
new file mode 100644
index 000000000..8d0d85bd4
--- /dev/null
+++ b/testcases/kernel/syscalls/clone3/clone304.c
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2025 Stephen Bertram <sbertram@redhat.com>
+ */
+
+/*\
+ * This test verifies that clone3() fals with EPERM when CAP_SYS_ADMIN
+ * has been dropped and ``clone_args.set_tid_size`` is greater than zero.
+ */
+
+#define _GNU_SOURCE
+#include "tst_test.h"
+#include "lapi/sched.h"
+
+struct clone_args args = {0};
+
+static struct tcase {
+ uint64_t flags;
+ char *sflags;
+} tcases[] = {
+ {CLONE_NEWPID, "CLONE_NEWPID"},
+ {CLONE_NEWCGROUP, "CLONE_NEWCGROUP"},
+ {CLONE_NEWIPC, "CLONE_NEWIPC"},
+ {CLONE_NEWNET, "CLONE_NEWNET"},
+ {CLONE_NEWNS, "CLONE_NEWNS"},
+ {CLONE_NEWUTS, "CLONE_NEWUTS"},
+};
+
+static void run(unsigned int n)
+{
+ struct tcase *tc = &tcases[n];
+ pid_t tid_array[4] = {0, 0, 0, 0};
+
+ args.flags = tc->flags;
+ args.set_tid = (uint64_t)(uintptr_t)tid_array;
+
+ TST_EXP_FAIL(clone3(&args, sizeof(args)), EPERM, "clone3(%s) should fail with EPERM",tc->sflags);
+}
+
+static void setup(void)
+{
+ clone3_supported_by_kernel();
+
+ args.pidfd = 0;
+ args.child_tid = 0;
+ args.parent_tid = 0;
+ args.exit_signal = 0;
+ args.stack = 0;
+ args.stack_size = 0;
+ args.tls = 0;
+ args.set_tid_size = 4; // Greater than zero - requires CAP_SYS_ADMIN
+}
+
+static struct tst_test test = {
+ .tcnt = ARRAY_SIZE(tcases),
+ .setup = setup,
+ .test = run,
+ .needs_root = 1,
+ .caps = (struct tst_cap []) {
+ TST_CAP(TST_CAP_DROP, CAP_SYS_ADMIN),
+ {}
+ },
+};
--
2.49.0
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [LTP] [PATCH v2] Confirming EPERM is returned when CAP_SYS_ADMIN is removed from clone3. Signed-off-by: Stephen Bertram <sbertram@redhat.com>
2025-11-11 15:34 [LTP] [PATCH v2] Confirming EPERM is returned when CAP_SYS_ADMIN is removed from clone3. Signed-off-by: Stephen Bertram <sbertram@redhat.com> Stephen Bertram via ltp
@ 2025-11-12 10:00 ` Cyril Hrubis
2025-11-12 10:34 ` Li Wang via ltp
1 sibling, 0 replies; 4+ messages in thread
From: Cyril Hrubis @ 2025-11-12 10:00 UTC (permalink / raw)
To: Stephen Bertram; +Cc: ltp
Hi!
First of all the patch description shouldn't be on a single line since
the first line ends up in the email subject. There should be newlines
between the subject, patch description and the signed-off-by.
> ---
> runtest/syscalls | 1 +
> testcases/kernel/syscalls/clone3/.gitignore | 1 +
> testcases/kernel/syscalls/clone3/clone304.c | 63 +++++++++++++++++++++
> 3 files changed, 65 insertions(+)
> create mode 100644 testcases/kernel/syscalls/clone3/clone304.c
>
> diff --git a/runtest/syscalls b/runtest/syscalls
> index 54d94c0ca..b2c4f338e 100644
> --- a/runtest/syscalls
> +++ b/runtest/syscalls
> @@ -128,6 +128,7 @@ clone10 clone10
> clone301 clone301
> clone302 clone302
> clone303 clone303
> ++clone304 clone304
^
This + shouldn't be there I suppose.
> close01 close01
> close02 close02
> diff --git a/testcases/kernel/syscalls/clone3/.gitignore b/testcases/kernel/syscalls/clone3/.gitignore
> index 10369954b..e9b5312f4 100644
> --- a/testcases/kernel/syscalls/clone3/.gitignore
> +++ b/testcases/kernel/syscalls/clone3/.gitignore
> @@ -1,3 +1,4 @@
> clone301
> clone302
> clone303
> +clone304
> diff --git a/testcases/kernel/syscalls/clone3/clone304.c b/testcases/kernel/syscalls/clone3/clone304.c
> new file mode 100644
> index 000000000..8d0d85bd4
> --- /dev/null
> +++ b/testcases/kernel/syscalls/clone3/clone304.c
> @@ -0,0 +1,63 @@
> +// SPDX-License-Identifier: GPL-2.0-or-later
> +/*
> + * Copyright (c) 2025 Stephen Bertram <sbertram@redhat.com>
> + */
> +
> +/*\
> + * This test verifies that clone3() fals with EPERM when CAP_SYS_ADMIN
> + * has been dropped and ``clone_args.set_tid_size`` is greater than zero.
> + */
> +
> +#define _GNU_SOURCE
> +#include "tst_test.h"
> +#include "lapi/sched.h"
> +
> +struct clone_args args = {0};
Ideally this should be allocated via the guarded buffers:
struct clone_args *args;
struct tst_test test = {
...
.bufs = (struct tst_buffers []) {
{&args, size = sizeof(*args)},
{}
}
...
}
https://linux-test-project.readthedocs.io/en/latest/developers/api_c_tests.html#guarded-buffers
> +static struct tcase {
> + uint64_t flags;
> + char *sflags;
> +} tcases[] = {
> + {CLONE_NEWPID, "CLONE_NEWPID"},
> + {CLONE_NEWCGROUP, "CLONE_NEWCGROUP"},
> + {CLONE_NEWIPC, "CLONE_NEWIPC"},
> + {CLONE_NEWNET, "CLONE_NEWNET"},
> + {CLONE_NEWNS, "CLONE_NEWNS"},
> + {CLONE_NEWUTS, "CLONE_NEWUTS"},
> +};
> +
> +static void run(unsigned int n)
> +{
> + struct tcase *tc = &tcases[n];
> + pid_t tid_array[4] = {0, 0, 0, 0};
> +
> + args.flags = tc->flags;
> + args.set_tid = (uint64_t)(uintptr_t)tid_array;
> +
> + TST_EXP_FAIL(clone3(&args, sizeof(args)), EPERM, "clone3(%s) should fail with EPERM",tc->sflags);
^
missing space
> +}
> +
> +static void setup(void)
> +{
> + clone3_supported_by_kernel();
> +
> + args.pidfd = 0;
> + args.child_tid = 0;
> + args.parent_tid = 0;
> + args.exit_signal = 0;
> + args.stack = 0;
> + args.stack_size = 0;
> + args.tls = 0;
memset(args, 0, sizeof(*args) is probably safer.
> + args.set_tid_size = 4; // Greater than zero - requires CAP_SYS_ADMIN
> +}
> +
> +static struct tst_test test = {
> + .tcnt = ARRAY_SIZE(tcases),
> + .setup = setup,
> + .test = run,
> + .needs_root = 1,
> + .caps = (struct tst_cap []) {
> + TST_CAP(TST_CAP_DROP, CAP_SYS_ADMIN),
> + {}
^
Just single tab here.
> + },
> +};
> --
> 2.49.0
>
>
> --
> Mailing list info: https://lists.linux.it/listinfo/ltp
--
Cyril Hrubis
chrubis@suse.cz
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [LTP] [PATCH v2] Confirming EPERM is returned when CAP_SYS_ADMIN is removed from clone3. Signed-off-by: Stephen Bertram <sbertram@redhat.com>
2025-11-11 15:34 [LTP] [PATCH v2] Confirming EPERM is returned when CAP_SYS_ADMIN is removed from clone3. Signed-off-by: Stephen Bertram <sbertram@redhat.com> Stephen Bertram via ltp
2025-11-12 10:00 ` Cyril Hrubis
@ 2025-11-12 10:34 ` Li Wang via ltp
2025-11-12 14:40 ` Stephen Bertram via ltp
1 sibling, 1 reply; 4+ messages in thread
From: Li Wang via ltp @ 2025-11-12 10:34 UTC (permalink / raw)
To: Stephen Bertram; +Cc: ltp
Hi Stephen,
According to the clone3() manual page:
"EPERM CLONE_NEWCGROUP, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS,
CLONE_NEWPID, or CLONE_NEWUTS was specified by an unprivileged process
(process without CAP_SYS_ADMIN).
EPERM (clone3() only)
set_tid_size was greater than zero, and the caller lacks the
CAP_SYS_ADMIN capability in one or more of the user namespaces that own the
corresponding PID namespaces."
Shouldn't we separately test both? In your test, we don't know the EPERM
comes from "set_tid_size>0" (or CLONE_NEW*) with no CAP_SYS_ADMIN.
--
Regards,
Li Wang
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [LTP] [PATCH v2] Confirming EPERM is returned when CAP_SYS_ADMIN is removed from clone3. Signed-off-by: Stephen Bertram <sbertram@redhat.com>
2025-11-12 10:34 ` Li Wang via ltp
@ 2025-11-12 14:40 ` Stephen Bertram via ltp
0 siblings, 0 replies; 4+ messages in thread
From: Stephen Bertram via ltp @ 2025-11-12 14:40 UTC (permalink / raw)
To: Li Wang; +Cc: ltp
Hi Li,
On Wed, Nov 12, 2025 at 5:34 AM Li Wang <liwang@redhat.com> wrote:
> Hi Stephen,
>
> According to the clone3() manual page:
>
> "EPERM CLONE_NEWCGROUP, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS,
> CLONE_NEWPID, or CLONE_NEWUTS was specified by an unprivileged process
> (process without CAP_SYS_ADMIN).
>
I mis-interpreted this and thought it is only for clone3, will add a test
for clone as well.
>
> EPERM (clone3() only)
> set_tid_size was greater than zero, and the caller lacks the
> CAP_SYS_ADMIN capability in one or more of the user namespaces that own the
> corresponding PID namespaces."
>
>
> Shouldn't we separately test both? In your test, we don't know the EPERM
>
See setup
args.set_tid_size = 4; // Greater than zero - requires CAP_SYS_ADMIN
> comes from "set_tid_size>0" (or CLONE_NEW*) with no CAP_SYS_ADMIN.
>
That is exactly what this test does.
See run results:
> [root@localhost clone3]# ./clone304
> tst_test.c:2025: TINFO: LTP version: 20250930
> tst_test.c:2028: TINFO: Tested kernel: 6.12.0-xxx.xxx.aarch64 #1 SMP
> PREEMPT_RT Mon Nov 10 10:56:27 EST 2025 aarch64
> tst_kconfig.c:88: TINFO: Parsing kernel config '/proc/config.gz'
> tst_test.c:1846: TINFO: Overall timeout per run is 0h 00m 30s
>
> *tst_capability.c:29: TINFO: Dropping CAP_SYS_ADMIN(21)*clone304.c:37:
> TPASS: clone3(CLONE_NEWPID) should fail with EPERM : EPERM (1)
> clone304.c:37: TPASS: clone3(CLONE_NEWCGROUP) should fail with EPERM :
> EPERM (1)
> clone304.c:37: TPASS: clone3(CLONE_NEWIPC) should fail with EPERM : EPERM
> (1)
> clone304.c:37: TPASS: clone3(CLONE_NEWNET) should fail with EPERM : EPERM
> (1)
> clone304.c:37: TPASS: clone3(CLONE_NEWNS) should fail with EPERM : EPERM
> (1)
> clone304.c:37: TPASS: clone3(CLONE_NEWUTS) should fail with EPERM : EPERM
> (1)
Summary:
> passed 6
> failed 0
> broken 0
> skipped 0
> warnings 0
Let me know if I missed anything.
Hi Cyril and Andrea,
I received your input and I will make updates accordingly.
Thank you all,
stephen
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-11-12 14:41 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-11 15:34 [LTP] [PATCH v2] Confirming EPERM is returned when CAP_SYS_ADMIN is removed from clone3. Signed-off-by: Stephen Bertram <sbertram@redhat.com> Stephen Bertram via ltp
2025-11-12 10:00 ` Cyril Hrubis
2025-11-12 10:34 ` Li Wang via ltp
2025-11-12 14:40 ` Stephen Bertram via ltp
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.