Re: [LTP] syscalls/cachestat05: Add test for permission checks

[linuxtestproject.agent@gmail.com]

Hi Xuewen,

On Thu Nov 5 18:46:17 2026 +0800, Xuewen Wang <wangxuewen@kylinos.cn> wrote:
> syscalls/cachestat05: Add test for permission checks

> +/*\
> + * Verify that cachestat() is only allowed on file descriptors with write
> + * access to the underlying file.

Use :manpage:`cachestat(2)` when referring to the syscall in the
documentation comment block.

> +static struct tcase {
> +	const char *file;
> +	int open_flags;
> +	int exp_errno;
> +	int needs_fix;
> +	const char *desc;
> +} tcases[] = {
> +	{FILE_RDWR, O_RDWR, 0, 0, "descriptor open for writing"},
> +	{FILE_OWNED, O_RDONLY, 0, 0, "file owned by the caller"},
> +	{FILE_RDWR, O_RDONLY, 0, 0, "file writable by the caller"},
> +	{FILE_RDONLY, O_RDONLY, EPERM, 1, "file read-only for the caller"},
> +};
> +
> +static void verify_cachestat(unsigned int n)
> +{
> +	struct tcase *tc = &tcases[n];
> +	int fd;
> +
> +	if (tc->needs_fix && tst_kvercmp(6, 14, 0) < 0) {
> +		tst_res(TCONF, "cachestat() permission check added in v6.14");
> +		return;
> +	}

Remove the kernel version check and tc->needs_fix. Commit 5f537664e705 is a
bug fix already recorded in .tags, so unpatched kernels should fail and print
the missing-fix hint rather than skipping with TCONF.

> +	SAFE_SETGROUPS(0, NULL);
> +	SAFE_SETGID(gid);
> +	SAFE_SETUID(uid);
> +
> +	fd = SAFE_OPEN(tc->file, tc->open_flags);

Opening FILE_RDWR (mode 0666) after dropping privileges means the caller also
has write permission on the file, so the FMODE_WRITE check in
can_do_cachestat() is not isolated from file_permission(f, MAY_WRITE). Open
tc->file before dropping privileges and use FILE_RDONLY with O_RDWR for the
first test case.

> +	fd = SAFE_OPEN(FILE_OWNED, O_CREAT | O_RDWR, 0600);
> +	SAFE_CLOSE(fd);
> +	SAFE_CHOWN(FILE_OWNED, uid, -1);

FILE_OWNED is created with mode 0600, which gives the owner write permission
and satisfies file_permission(f, MAY_WRITE) in addition to
file_owner_or_capable(). Create FILE_OWNED with mode 0400 so the ownership
check is tested without write permission.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp