From: Peter Senna Tschudin <peter.senna@linux.intel.com>
To: igt-dev@lists.freedesktop.org
Cc: Peter Senna Tschudin <peter.senna@linux.intel.com>,
Rodrigo Vivi <rodrigo.vivi@intel.com>,
Michal Winiarski <michal.winiarski@intel.com>,
Kamil Konieczny <kamil.konieczny@linux.intel.com>
Subject: [PATCH i-g-t 0/2] tests/intel/xe_compute: check root-only write permission for ccs_mode
Date: Tue, 9 Sep 2025 15:08:06 +0200 [thread overview]
Message-ID: <20250909130808.54117-1-peter.senna@linux.intel.com> (raw)
I've recently sent a patch that created a dedicated security check to
verify that 13 files are only accessible by the root user. The problem
with the first submission was that it was not very maintainable because
it duplicated code that is required to find the files in sysfs.
This series takes a different and more maintainable approach: instead of
adding new tests, it extends existing ones. Specifically, this series:
- Adds the helper function
`bool igt_fs_check_root_perm(int dirfd, const char *pathname)` to
lib/igt_fs.c.
- Uses `igt_fs_check_root_perm()` in the `test_ccs_mode()` function
in tests/intel/xe_compute.c to verify that the "ccs_mode" sysfs
attribute is writable only by root.
Intentionally ignoring checkpatch warnings:
- WARNING:SYMBOLIC_PERMS: Symbolic permissions 'S_IWGRP' are not preferred.
Consider using octal permissions '0020'.
#53: FILE: lib/igt_fs.c:164:
+ if (st.st_mode & S_IWGRP)
- WARNING:SYMBOLIC_PERMS: Symbolic permissions 'S_IWOTH' are not preferred.
Consider using octal permissions '0002'.
#56: FILE: lib/igt_fs.c:167:
+ if (st.st_mode & S_IWOTH)
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Michal Winiarski <michal.winiarski@intel.com>
Cc: Kamil Konieczny <kamil.konieczny@linux.intel.com>
Peter Senna Tschudin (2):
lib/igt_fs: add igt_fs_check_root_perm() helper
tests/intel/xe_compute: check root-only write permission for ccs_mode
lib/igt_fs.c | 28 ++++++++++++++++++++++++++++
lib/igt_fs.h | 1 +
tests/intel/xe_compute.c | 7 +++++++
3 files changed, 36 insertions(+)
--
2.43.0
next reply other threads:[~2025-09-09 13:09 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-09 13:08 Peter Senna Tschudin [this message]
2025-09-09 13:08 ` [PATCH i-g-t 1/2] lib/igt_fs: add igt_fs_check_root_perm() helper Peter Senna Tschudin
2025-09-12 15:57 ` Kamil Konieczny
2025-09-09 13:08 ` [PATCH i-g-t 2/2] tests/intel/xe_compute: check root-only write permission for ccs_mode Peter Senna Tschudin
2025-09-15 12:28 ` Kamil Konieczny
2025-09-10 0:20 ` ✓ Xe.CI.BAT: success for " Patchwork
2025-09-10 0:26 ` ✓ i915.CI.BAT: " Patchwork
2025-09-10 7:16 ` ✓ Xe.CI.Full: " Patchwork
2025-09-10 13:04 ` ✗ i915.CI.Full: failure " Patchwork
2026-01-18 20:00 ` [PATCH v2 i-g-t 1/2] lib/igt_fs: add igt_fs_check_root_perm() helper Peter Senna Tschudin
2026-01-18 20:00 ` [PATCH v2 i-g-t 2/2] tests/intel/xe_compute: check root-only write permission for ccs_mode Peter Senna Tschudin
2026-01-19 12:29 ` Kamil Konieczny
2026-01-18 20:33 ` ✓ Xe.CI.BAT: success for tests/intel/xe_compute: check root-only write permission for ccs_mode (rev2) Patchwork
2026-01-18 20:51 ` ✓ i915.CI.BAT: " Patchwork
2026-01-18 21:40 ` ✗ Xe.CI.Full: failure " Patchwork
2026-01-18 22:55 ` ✗ i915.CI.Full: " Patchwork
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250909130808.54117-1-peter.senna@linux.intel.com \
--to=peter.senna@linux.intel.com \
--cc=igt-dev@lists.freedesktop.org \
--cc=kamil.konieczny@linux.intel.com \
--cc=michal.winiarski@intel.com \
--cc=rodrigo.vivi@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox