Re: [PATCH v10 3/3] selftests/namespaces: test the CAP_SETFCAP rule for user namespaces

[sashiko-bot@kernel.org]

> Add tests for whether a uid 0 task that gave up CAP_SETFCAP gets it back
> by joining a user namespace whose tasks can write file capabilities for
> its root user, or by attaching to such a task.
> 
> Each case runs as root in a private mount namespace with a tmpfs on
> /tmp.  It sets up everything but the step it tests and fails if any of
> that goes wrong, so a refusal comes from that step.
> 
> The ones that must be refused:
> 
> - setns() and PTRACE_ATTACH into namespaces that map host uid 0, at
>   uid 0 or another uid, or that have no uid_map yet and whose tasks can
>   still map it, and the same one level down among tasks of an
>   unprivileged user
> - setns() into a namespace without a uid_map under one that maps host
> [ ... ]
> create user namespaces, or there is no tmpfs or no security.capability
> on it.  The ptrace cases also skip when Yama forbids ptrace.  The
> idmapped mount cases also skip when tmpfs can't be idmapped.
> 
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112-b4-setfcap-userns-v10-0-84f6f7faa903@toxicpanda.com?part=3