[PATCH] selftests/capabilities: test_execve: drop supplementary groups

[PATCH] selftests/capabilities: test_execve: drop supplementary groups

[Kurt Lin]

When run as root, test_execve keeps the caller's supplementary groups,
which usually include group 0.

Since commit 337490f0007f ("exec: Correct the permission check for
unsafe exec"), a setgid exec is not an id change if the new egid is
already one of the caller's groups. As group 0 is one of them, the
ambient capabilities survive exec of the sgidroot helper, and two
cases fail:

  # [RUN]	Root, gid != 0, +ia, sgidroot => eip
  # Wrong ambient state (AT_SECURE is set)
  # [RUN]	Non-root +ia, sgidroot => i
  # Wrong effective state (AT_SECURE is set)

Clear the supplementary groups before switching UIDs.

An AI coding assistant (Claude) was used to analyze the failure and to
draft the fix and this changelog. Tested on v7.4-rc2: as root, all 21
cases now pass (2 failed before); the unprivileged user namespace path
is unchanged.

Fixes: 337490f0007f ("exec: Correct the permission check for unsafe exec")
Signed-off-by: Kurt Lin <lylin1023@gmail.com>
---
 tools/testing/selftests/capabilities/test_execve.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/testing/selftests/capabilities/test_execve.c b/tools/testing/selftests/capabilities/test_execve.c
index 46fc8d46b6e6..9428b787437f 100644
--- a/tools/testing/selftests/capabilities/test_execve.c
+++ b/tools/testing/selftests/capabilities/test_execve.c
@@ -8,6 +8,7 @@
 #include <stdio.h>
 #include <fcntl.h>
 #include <errno.h>
+#include <grp.h>
 #include <stdarg.h>
 #include <sched.h>
 #include <sys/mount.h>
@@ -90,6 +91,9 @@ static bool create_and_enter_ns(uid_t inner_uid)
 
 	if (outer_uid == 0 && unshare(CLONE_NEWNS) == 0) {
 		ksft_print_msg("[NOTE]\tUsing global UIDs for tests\n");
+		/* Group 0 must not stay a supplementary group (sgidroot tests) */
+		if (setgroups(0, NULL) != 0)
+			ksft_exit_fail_msg("setgroups - %s\n", strerror(errno));
 		if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) != 0)
 			ksft_exit_fail_msg("PR_SET_KEEPCAPS - %s\n",
 						strerror(errno));
-- 
2.56.0

Re: [PATCH] selftests/capabilities: test_execve: drop supplementary groups

[sashiko-bot]

> When run as root, test_execve keeps the caller's supplementary groups,
> which usually include group 0.
> 
> Since commit 337490f0007f ("exec: Correct the permission check for
> unsafe exec"), a setgid exec is not an id change if the new egid is
> already one of the caller's groups. As group 0 is one of them, the
> ambient capabilities survive exec of the sgidroot helper, and two
> cases fail:
> 
>   # [RUN]	Root, gid != 0, +ia, sgidroot => eip
>   # Wrong ambient state (AT_SECURE is set)
>   # [RUN]	Non-root +ia, sgidroot => i
>   # Wrong effective state (AT_SECURE is set)
> 
> Clear the supplementary groups before switching UIDs.
> 
> An AI coding assistant (Claude) was used to analyze the failure and to
> draft the fix and this changelog. Tested on v7.4-rc2: as root, all 21
> cases now pass (2 failed before); the unprivileged user namespace path
> is unchanged.
> 
> Fixes: 337490f0007f ("exec: Correct the permission check for unsafe exec")
> Signed-off-by: Kurt Lin <lylin1023@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111164645.260593-1-lylin1023@gmail.com?part=1