From: Bobby Eshleman <bobbyeshleman@gmail.com>
To: sashiko-reviews@lists.linux.dev
Cc: kvm@vger.kernel.org
Subject: Re: [PATCH net-next 6/6] selftests/vsock: test the assign ioctl privilege checks
Date: Fri, 4 Sep 2026 10:33:39 -0700 [thread overview]
Message-ID: <apsA808VUA8CrbCd@devvm29614.prn0.facebook.com> (raw)
In-Reply-To: <20260903230147.63ACA1F00A3D@smtp.kernel.org>
On Thu, Sep 03, 2026 at 11:01:47PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] The unprivileged user namespace test spuriously fails because the unprivileged user lacks DAC permissions to open `/dev/vsock`.
> --
>
> commit 4c5b8557bb5663f827061639a80256407bfe6c8c
> Author: Bobby Eshleman <bobbyeshleman@meta.com>
>
> selftests/vsock: test the assign ioctl privilege checks
>
> This commit adds two tests to verify that CAP_NET_ADMIN is required to use
> the IOCTL_VM_SOCKETS_ASSIGN_G2H_NETNS ioctl, and that an unprivileged user
> namespace alone is insufficient.
>
> > diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh
> > index 53591fa07f1a8..efb94d17d9976 100755
> > --- a/tools/testing/selftests/vsock/vmtest.sh
> > +++ b/tools/testing/selftests/vsock/vmtest.sh
> [ ... ]
> > @@ -1805,6 +1817,51 @@ test_ns_guest_assign_g2h_netns_reset_on_ns_delete_ok() {
> [ ... ]
> > +test_ns_guest_assign_g2h_netns_unpriv_user_ns_fails() {
> > + local helper=/tmp/vsock_assign_g2h_netns
> > + local unpriv_uid=65534
> > + local unpriv
> > + local rc
> > +
> > + unpriv="setpriv --reuid=${unpriv_uid} --regid=${unpriv_uid}"
> > + unpriv="${unpriv} --clear-groups"
> > +
> > + if ! vm_ssh "init_ns" -- "${unpriv} unshare -U true"; then
> > + log_host "unprivileged user namespaces unavailable, skipping"
> > + return "${KSFT_SKIP}"
> > + fi
> > +
> > + # The home shared with the guest is root-only, so place the helper where
> > + # an unprivileged user can execute it.
> > + vm_ssh "init_ns" -- \
> > + "cp ./vsock_assign_g2h_netns ${helper} && chmod 755 ${helper}"
> > +
> > + vm_ssh "init_ns" -- "${unpriv} unshare -Urn ${helper}" &>/dev/null
> > + rc=$?
> > +
> > + if [[ "${rc}" -ne "${EPERM}" ]]; then
>
> [Severity: Medium]
> Will this test spuriously fail in minimal environments like virtme-ng?
>
> The test helper vsock_assign_g2h_netns is executed as an unprivileged user
> (UID 65534). In minimal environments without systemd-udevd to modify default
> device node permissions, devtmpfs creates /dev/vsock with default 0600
> (root:root) permissions since vsock_device in the kernel does not explicitly
> specify a mode.
>
> When the unprivileged user tries to open /dev/vsock:
>
> tools/testing/selftests/vsock/vsock_assign_g2h_netns.c:main() {
> ...
> fd = open("/dev/vsock", O_RDONLY);
> if (fd < 0) {
> fprintf(stderr, "open /dev/vsock: %s\n", strerror(errno));
> return -1;
> }
> ...
> }
>
> It gets EACCES, causing the C helper to return -1 (exit code 255).
>
> Since the script expects EPERM (exit code 1) from the ioctl failure, does it
> misinterpret the 255 exit code as a test failure?
>
I don't know about systemd-udevd, but seems like we can generalize this
to non-zero exits just to be cautious.
next prev parent reply other threads:[~2026-09-04 17:33 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-02 23:00 [PATCH net-next 0/6] vsock: assign the guest vsock device to a network namespace Bobby Eshleman
2026-09-02 23:00 ` [PATCH net-next 1/6] vsock: constify the transport in vsock_for_each_connected_socket() Bobby Eshleman
2026-09-02 23:00 ` [PATCH net-next 2/6] vsock: add IOCTL_VM_SOCKETS_ASSIGN_G2H_NETNS Bobby Eshleman
2026-09-02 23:35 ` Randy Dunlap
2026-09-02 23:58 ` Bobby Eshleman
2026-09-03 23:01 ` sashiko-bot
2026-09-04 23:49 ` Bobby Eshleman
2026-09-02 23:00 ` [PATCH net-next 3/6] vsock/virtio: support guest device network namespace Bobby Eshleman
2026-09-02 23:00 ` [PATCH net-next 4/6] selftests/vsock: add a helper to assign the g2h device to a netns Bobby Eshleman
2026-09-02 23:00 ` [PATCH net-next 5/6] selftests/vsock: test the guest vsock device network namespace Bobby Eshleman
2026-09-02 23:00 ` [PATCH net-next 6/6] selftests/vsock: test the assign ioctl privilege checks Bobby Eshleman
2026-09-03 23:01 ` sashiko-bot
2026-09-04 17:33 ` Bobby Eshleman [this message]
2026-09-04 8:55 ` [PATCH net-next 0/6] vsock: assign the guest vsock device to a network namespace Stefano Garzarella
2026-09-04 17:30 ` Bobby Eshleman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=apsA808VUA8CrbCd@devvm29614.prn0.facebook.com \
--to=bobbyeshleman@gmail.com \
--cc=kvm@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox