[LTP] [PATCH v3 0/2] Fix cma testing suite permissions

[LTP] [PATCH v3 0/2] Fix cma testing suite permissions

[Andrea Cervesato]

The cma testing suite started to fail on modern systems enabling YAMA.
Unfortunately, using CAP_PTRACE capability for users is not enough to
avoid an EPERM. For this reason, it's better to require root and fix the
whole suite in one shot.

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
Changes in v3:
- add CAP_SYS_PTRACE fallback in lapi/capability.h
- Link to v2: https://lore.kernel.org/20261014-fix_process_vm_writev_permissions-v2-1-17710f74606c@suse.com

Changes in v2:
- consider mode 1, 2, 3 and user
- Link to v1: https://lore.kernel.org/20261014-fix_process_vm_writev_permissions-v1-1-6affee2da859@suse.com

---
Andrea Cervesato (2):
      lapi/capability.h: Add CAP_SYS_PTRACE fallback
      syscalls/cma: Handle Yama ptrace_scope in tests

 include/lapi/capability.h                          |  4 +++
 testcases/kernel/syscalls/cma/cma.h                | 38 ++++++++++++++++++++++
 testcases/kernel/syscalls/cma/process_vm_readv02.c |  5 +++
 testcases/kernel/syscalls/cma/process_vm_readv03.c |  5 +++
 .../kernel/syscalls/cma/process_vm_writev02.c      |  5 +++
 5 files changed, 57 insertions(+)
---
base-commit: 1aae0e4d9d1e2e7818fda773b372cee8fb856de7
change-id: 20261014-fix_process_vm_writev_permissions-6fca6598d9fb

Best regards,
--  
Andrea Cervesato <andrea.cervesato@suse.com>


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v3 1/2] lapi/capability.h: Add CAP_SYS_PTRACE fallback

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 include/lapi/capability.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/include/lapi/capability.h b/include/lapi/capability.h
index d3cc121fc..99cd93970 100644
--- a/include/lapi/capability.h
+++ b/include/lapi/capability.h
@@ -28,6 +28,10 @@
 # define CAP_SYS_CHROOT       18
 #endif
 
+#ifndef CAP_SYS_PTRACE
+# define CAP_SYS_PTRACE       19
+#endif
+
 #ifndef CAP_SYS_ADMIN
 # define CAP_SYS_ADMIN        21
 #endif

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] lapi/capability.h: Add CAP_SYS_PTRACE fallback

[linuxtestproject.agent]

Hi Andrea,

On Tue, 20 Oct 2026, Andrea Cervesato wrote:
> lapi/capability.h: Add CAP_SYS_PTRACE fallback
> syscalls/cma: Handle Yama ptrace_scope in tests

Verdict - Reviewed

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v3 2/2] syscalls/cma: Handle Yama ptrace_scope in tests

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

With Yama LSM enabled, process_vm_readv() and process_vm_writev() fail
with EPERM when a sibling process accesses the target's memory.

Let the target child declare its parent as ptracer, so that mode 1
works for unprivileged users too. Require CAP_SYS_PTRACE for mode 2
and skip on mode 3, where access is never allowed.

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 testcases/kernel/syscalls/cma/cma.h                | 38 ++++++++++++++++++++++
 testcases/kernel/syscalls/cma/process_vm_readv02.c |  5 +++
 testcases/kernel/syscalls/cma/process_vm_readv03.c |  5 +++
 .../kernel/syscalls/cma/process_vm_writev02.c      |  5 +++
 4 files changed, 53 insertions(+)

diff --git a/testcases/kernel/syscalls/cma/cma.h b/testcases/kernel/syscalls/cma/cma.h
new file mode 100644
index 000000000..6636cb5a3
--- /dev/null
+++ b/testcases/kernel/syscalls/cma/cma.h
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2026 SUSE LLC Andrea Cervesato <andrea.cervesato@suse.com>
+ */
+
+#ifndef CMA_H__
+#define CMA_H__
+
+#include <sys/prctl.h>
+#include "tst_test.h"
+#include "tst_capability.h"
+
+#define PTRACE_SCOPE "/proc/sys/kernel/yama/ptrace_scope"
+
+static inline void cma_check_ptrace_scope(void)
+{
+	struct tst_cap cap = TST_CAP(TST_CAP_REQ, CAP_SYS_PTRACE);
+	int scope;
+
+	if (access(PTRACE_SCOPE, F_OK))
+		return;
+
+	SAFE_FILE_SCANF(PTRACE_SCOPE, "%d", &scope);
+
+	if (scope >= 3)
+		tst_brk(TCONF, "Yama ptrace_scope=%d forbids process_vm_*()", scope);
+
+	if (scope == 2)
+		tst_cap_action(&cap);
+}
+
+static inline void cma_allow_parent_ptracer(void)
+{
+	if (prctl(PR_SET_PTRACER, getppid(), 0, 0, 0) && errno != EINVAL)
+		tst_brk(TBROK | TERRNO, "prctl(PR_SET_PTRACER)");
+}
+
+#endif /* CMA_H__ */
diff --git a/testcases/kernel/syscalls/cma/process_vm_readv02.c b/testcases/kernel/syscalls/cma/process_vm_readv02.c
index 1e2ac38fa..ceff77e29 100644
--- a/testcases/kernel/syscalls/cma/process_vm_readv02.c
+++ b/testcases/kernel/syscalls/cma/process_vm_readv02.c
@@ -17,6 +17,7 @@
 #include <sys/wait.h>
 #include "tst_test.h"
 #include "lapi/syscalls.h"
+#include "cma.h"
 
 static uintptr_t *data_ptr;
 
@@ -29,6 +30,8 @@ static void child_alloc(const char *data)
 
 	tst_res(TINFO, "child 0: memory allocated and initialized");
 
+	cma_allow_parent_ptracer();
+
 	/* wake and wait until child_invoke is done reading from our VM */
 	TST_CHECKPOINT_WAKE_AND_WAIT(0);
 }
@@ -64,6 +67,8 @@ static void setup(void)
 	/* Just a sanity check of the existence of syscall */
 	tst_syscall(__NR_process_vm_readv, getpid(), NULL, 0UL, NULL, 0UL, 0UL);
 
+	cma_check_ptrace_scope();
+
 	data_ptr = SAFE_MMAP(NULL, sizeof(uintptr_t), PROT_READ | PROT_WRITE,
 						 MAP_SHARED | MAP_ANONYMOUS, -1, 0);
 }
diff --git a/testcases/kernel/syscalls/cma/process_vm_readv03.c b/testcases/kernel/syscalls/cma/process_vm_readv03.c
index 95d35c422..831f79c89 100644
--- a/testcases/kernel/syscalls/cma/process_vm_readv03.c
+++ b/testcases/kernel/syscalls/cma/process_vm_readv03.c
@@ -20,6 +20,7 @@
 #include <sys/wait.h>
 #include "tst_test.h"
 #include "lapi/syscalls.h"
+#include "cma.h"
 
 #define MAX_IOVECS 1024
 
@@ -80,6 +81,8 @@ static void child_alloc(const int *sizes, int nr_iovecs)
 
 	tst_res(TINFO, "child_alloc: memory allocated and initialized");
 
+	cma_allow_parent_ptracer();
+
 	TST_CHECKPOINT_WAKE_AND_WAIT(0);
 }
 
@@ -139,6 +142,8 @@ static void setup(void)
 {
 	tst_syscall(__NR_process_vm_readv, getpid(), NULL, 0UL, NULL, 0UL, 0UL);
 
+	cma_check_ptrace_scope();
+
 	data_ptr = SAFE_MMAP(NULL, sizeof(void *) * MAX_IOVECS, PROT_READ | PROT_WRITE,
 			     MAP_SHARED | MAP_ANONYMOUS, -1, 0);
 }
diff --git a/testcases/kernel/syscalls/cma/process_vm_writev02.c b/testcases/kernel/syscalls/cma/process_vm_writev02.c
index 15bd66a44..78b98200f 100644
--- a/testcases/kernel/syscalls/cma/process_vm_writev02.c
+++ b/testcases/kernel/syscalls/cma/process_vm_writev02.c
@@ -16,6 +16,7 @@
 #include <sys/uio.h>
 #include "tst_test.h"
 #include "lapi/syscalls.h"
+#include "cma.h"
 
 static uintptr_t *data_ptr;
 static char *str_buffsize;
@@ -33,6 +34,8 @@ static void child_alloc_and_verify(int buffsize)
 	memset(foo, 'a', buffsize);
 	*data_ptr = (uintptr_t)foo;
 
+	cma_allow_parent_ptracer();
+
 	TST_CHECKPOINT_WAKE_AND_WAIT(0);
 
 	err = 0;
@@ -81,6 +84,8 @@ static void setup(void)
 	if (tst_parse_int(str_buffsize, &bufsize, 1, INT_MAX))
 		tst_brk(TBROK, "Invalid buffer size '%s'", str_buffsize);
 
+	cma_check_ptrace_scope();
+
 	data_ptr = SAFE_MMAP(NULL, sizeof(uintptr_t), PROT_READ | PROT_WRITE,
 			     MAP_SHARED | MAP_ANONYMOUS, -1, 0);
 }

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v3 2/2] syscalls/cma: Handle Yama ptrace_scope in tests

[Petr Vorel]

Hi Andrea,

[ Cc Yama list ]

thanks merged.

Kind regards,
Petr

> From: Andrea Cervesato <andrea.cervesato@suse.com>

> With Yama LSM enabled, process_vm_readv() and process_vm_writev() fail
> with EPERM when a sibling process accesses the target's memory.

> Let the target child declare its parent as ptracer, so that mode 1
> works for unprivileged users too. Require CAP_SYS_PTRACE for mode 2
> and skip on mode 3, where access is never allowed.

> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> ---
>  testcases/kernel/syscalls/cma/cma.h                | 38 ++++++++++++++++++++++
>  testcases/kernel/syscalls/cma/process_vm_readv02.c |  5 +++
>  testcases/kernel/syscalls/cma/process_vm_readv03.c |  5 +++
>  .../kernel/syscalls/cma/process_vm_writev02.c      |  5 +++
>  4 files changed, 53 insertions(+)

> diff --git a/testcases/kernel/syscalls/cma/cma.h b/testcases/kernel/syscalls/cma/cma.h
> new file mode 100644
> index 000000000..6636cb5a3
> --- /dev/null
> +++ b/testcases/kernel/syscalls/cma/cma.h
> @@ -0,0 +1,38 @@
> +// SPDX-License-Identifier: GPL-2.0-or-later
> +/*
> + * Copyright (C) 2026 SUSE LLC Andrea Cervesato <andrea.cervesato@suse.com>
> + */
> +
> +#ifndef CMA_H__
> +#define CMA_H__
> +
> +#include <sys/prctl.h>
> +#include "tst_test.h"
> +#include "tst_capability.h"
> +
> +#define PTRACE_SCOPE "/proc/sys/kernel/yama/ptrace_scope"
> +
> +static inline void cma_check_ptrace_scope(void)
> +{
> +	struct tst_cap cap = TST_CAP(TST_CAP_REQ, CAP_SYS_PTRACE);
> +	int scope;
> +
> +	if (access(PTRACE_SCOPE, F_OK))
> +		return;
> +
> +	SAFE_FILE_SCANF(PTRACE_SCOPE, "%d", &scope);
> +
> +	if (scope >= 3)
> +		tst_brk(TCONF, "Yama ptrace_scope=%d forbids process_vm_*()", scope);
> +
> +	if (scope == 2)
> +		tst_cap_action(&cap);
> +}
> +
> +static inline void cma_allow_parent_ptracer(void)
> +{
> +	if (prctl(PR_SET_PTRACER, getppid(), 0, 0, 0) && errno != EINVAL)
> +		tst_brk(TBROK | TERRNO, "prctl(PR_SET_PTRACER)");
> +}
> +
> +#endif /* CMA_H__ */
> diff --git a/testcases/kernel/syscalls/cma/process_vm_readv02.c b/testcases/kernel/syscalls/cma/process_vm_readv02.c
> index 1e2ac38fa..ceff77e29 100644
> --- a/testcases/kernel/syscalls/cma/process_vm_readv02.c
> +++ b/testcases/kernel/syscalls/cma/process_vm_readv02.c
> @@ -17,6 +17,7 @@
>  #include <sys/wait.h>
>  #include "tst_test.h"
>  #include "lapi/syscalls.h"
> +#include "cma.h"

>  static uintptr_t *data_ptr;

> @@ -29,6 +30,8 @@ static void child_alloc(const char *data)

>  	tst_res(TINFO, "child 0: memory allocated and initialized");

> +	cma_allow_parent_ptracer();
> +
>  	/* wake and wait until child_invoke is done reading from our VM */
>  	TST_CHECKPOINT_WAKE_AND_WAIT(0);
>  }
> @@ -64,6 +67,8 @@ static void setup(void)
>  	/* Just a sanity check of the existence of syscall */
>  	tst_syscall(__NR_process_vm_readv, getpid(), NULL, 0UL, NULL, 0UL, 0UL);

> +	cma_check_ptrace_scope();
> +
>  	data_ptr = SAFE_MMAP(NULL, sizeof(uintptr_t), PROT_READ | PROT_WRITE,
>  						 MAP_SHARED | MAP_ANONYMOUS, -1, 0);
>  }
> diff --git a/testcases/kernel/syscalls/cma/process_vm_readv03.c b/testcases/kernel/syscalls/cma/process_vm_readv03.c
> index 95d35c422..831f79c89 100644
> --- a/testcases/kernel/syscalls/cma/process_vm_readv03.c
> +++ b/testcases/kernel/syscalls/cma/process_vm_readv03.c
> @@ -20,6 +20,7 @@
>  #include <sys/wait.h>
>  #include "tst_test.h"
>  #include "lapi/syscalls.h"
> +#include "cma.h"

>  #define MAX_IOVECS 1024

> @@ -80,6 +81,8 @@ static void child_alloc(const int *sizes, int nr_iovecs)

>  	tst_res(TINFO, "child_alloc: memory allocated and initialized");

> +	cma_allow_parent_ptracer();
> +
>  	TST_CHECKPOINT_WAKE_AND_WAIT(0);
>  }

> @@ -139,6 +142,8 @@ static void setup(void)
>  {
>  	tst_syscall(__NR_process_vm_readv, getpid(), NULL, 0UL, NULL, 0UL, 0UL);

> +	cma_check_ptrace_scope();
> +
>  	data_ptr = SAFE_MMAP(NULL, sizeof(void *) * MAX_IOVECS, PROT_READ | PROT_WRITE,
>  			     MAP_SHARED | MAP_ANONYMOUS, -1, 0);
>  }
> diff --git a/testcases/kernel/syscalls/cma/process_vm_writev02.c b/testcases/kernel/syscalls/cma/process_vm_writev02.c
> index 15bd66a44..78b98200f 100644
> --- a/testcases/kernel/syscalls/cma/process_vm_writev02.c
> +++ b/testcases/kernel/syscalls/cma/process_vm_writev02.c
> @@ -16,6 +16,7 @@
>  #include <sys/uio.h>
>  #include "tst_test.h"
>  #include "lapi/syscalls.h"
> +#include "cma.h"

>  static uintptr_t *data_ptr;
>  static char *str_buffsize;
> @@ -33,6 +34,8 @@ static void child_alloc_and_verify(int buffsize)
>  	memset(foo, 'a', buffsize);
>  	*data_ptr = (uintptr_t)foo;

> +	cma_allow_parent_ptracer();
> +
>  	TST_CHECKPOINT_WAKE_AND_WAIT(0);

>  	err = 0;
> @@ -81,6 +84,8 @@ static void setup(void)
>  	if (tst_parse_int(str_buffsize, &bufsize, 1, INT_MAX))
>  		tst_brk(TBROK, "Invalid buffer size '%s'", str_buffsize);

> +	cma_check_ptrace_scope();
> +
>  	data_ptr = SAFE_MMAP(NULL, sizeof(uintptr_t), PROT_READ | PROT_WRITE,
>  			     MAP_SHARED | MAP_ANONYMOUS, -1, 0);
>  }

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp