[LTP] [PATCH V2] containers: new testcase userns03

[LTP] [PATCH V2] containers: new testcase userns03

[Yuan Sun]

  ID-outside-ns is interpreted according to which process is opening the file.
If the process opening the file is in the same user namespace as the process
PID, then ID-outside-ns is defined with respect to the parent user namespace.
If the process opening the file is in a different user namespace, then
ID-outside-ns is defined with respect to the user namespace of the process
opening the file.
  If kernel version >= 3.19.0, the case will ignore the git check.

Signed-off-by: Yuan Sun <sunyuan3@huawei.com>
---
 testcases/kernel/containers/userns/userns03.c | 250 ++++++++++++++++++++++++++
 1 file changed, 250 insertions(+)
 create mode 100644 testcases/kernel/containers/userns/userns03.c

diff --git a/testcases/kernel/containers/userns/userns03.c b/testcases/kernel/containers/userns/userns03.c
new file mode 100644
index 0000000..01308f6
--- /dev/null
+++ b/testcases/kernel/containers/userns/userns03.c
@@ -0,0 +1,250 @@
+/*
+* Copyright (c) Huawei Technologies Co., Ltd., 2015
+* This program is free software; you can redistribute it and/or modify it
+* under the terms of the GNU General Public License as published by the Free
+* Software Foundation; either version 2 of the License, or (at your option)
+* any later version. This program is distributed in the hope that it will be
+* useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
+* Public License for more details. You should have received a copy of the GNU
+* General Public License along with this program.
+*/
+
+/*
+* Verify that:
+* /proc/PID/uid_map and /proc/PID/gid_map contains three values separated by
+* white space:
+* ID-inside-ns   ID-outside-ns   length
+*
+*  ID-outside-ns is interpreted according to which process is opening the file.
+* If the process opening the file is in the same user namespace as the process
+* PID, then ID-outside-ns is defined with respect to the parent user namespace.
+* If the process opening the file is in a different user namespace, then
+* ID-outside-ns is defined with respect to the user namespace of the process
+* opening the file.
+*/
+
+#define _GNU_SOURCE
+#include <sys/wait.h>
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include "test.h"
+#include "libclone.h"
+#include "userns_helper.h"
+
+char *TCID = "user_namespace3";
+int TST_TOTAL = 1;
+static int cpid1, parentuid, parentgid;
+static bool setgroups;
+
+#define CHILD1UID 0
+#define CHILD1GID 0
+#define CHILD2UID 200
+#define CHILD2GID 200
+
+/*
+ * child_fn1() - Inside a new user namespace
+ */
+static int child_fn1(void)
+{
+	TST_SAFE_CHECKPOINT_WAKE_AND_WAIT(NULL, 0);
+	return 0;
+}
+
+
+/*
+ * child_fn2() - Inside a new user namespace
+ */
+static int child_fn2(void)
+{
+	int exit_val;
+	int uid, gid;
+	char cpid1uidpath[BUFSIZ];
+	char cpid1gidpath[BUFSIZ];
+	int idinsidens, idoutsidens, length;
+
+	uid = geteuid();
+	gid = getegid();
+
+	if (uid == CHILD2UID) {
+		printf("Got expected uid.\n");
+		exit_val = 0;
+	} else {
+		printf("unexpected uid=%d\n", uid);
+		exit_val = 1;
+	}
+
+	if (setgroups == 0) {
+		if (uid == CHILD2UID && gid == CHILD2GID) {
+			printf("Got expected uid and gid.\n");
+			exit_val = 0;
+		} else {
+			printf("unexpected: uid=%d gid=%d\n", uid, gid);
+			exit_val = 1;
+		}
+	}
+	/*Get the uid parameters of the child_fn2 process.*/
+	SAFE_FILE_SCANF(NULL, "/proc/self/uid_map", "%d %d %d", &idinsidens,
+		&idoutsidens, &length);
+
+	/* map file format:ID-inside-ns   ID-outside-ns   length
+	If the process opening the file is in the same user namespace as
+	the process PID, then ID-outside-ns is defined with respect to the
+	 parent user namespace.*/
+	if (idinsidens != CHILD2UID || idoutsidens != parentuid) {
+		printf("child_fn2 checks /proc/cpid2/uid_map:\n");
+		printf("unexpected: idinsidens=%d idoutsidens=%d\n",
+			idinsidens, idoutsidens);
+		exit_val = 1;
+	}
+
+	sprintf(cpid1uidpath, "/proc/%d/uid_map", cpid1);
+	SAFE_FILE_SCANF(NULL, cpid1uidpath, "%d %d %d", &idinsidens,
+		&idoutsidens, &length);
+
+	/* If the process opening the file is in a different user namespace,
+	then ID-outside-ns is defined with respect to the user namespace
+	of the process opening the file.*/
+	if (idinsidens != CHILD1UID || idoutsidens != CHILD2UID) {
+		printf("child_fn2 checks /proc/cpid1/uid_map:\n");
+		printf("unexpected: idinsidens=%d idoutsidens=%d\n",
+			idinsidens, idoutsidens);
+		exit_val = 1;
+	}
+
+	if (setgroups == 0) {
+		sprintf(cpid1gidpath, "/proc/%d/gid_map", cpid1);
+		SAFE_FILE_SCANF(NULL, "/proc/self/gid_map", "%d %d %d",
+			 &idinsidens, &idoutsidens, &length);
+
+		if (idinsidens != CHILD2GID || idoutsidens != parentgid) {
+			printf("child_fn2 checks /proc/cpid2/gid_map:\n");
+			printf("unexpected: idinsidens=%d idoutsidens=%d\n",
+				idinsidens, idoutsidens);
+			exit_val = 1;
+		}
+
+		SAFE_FILE_SCANF(NULL, cpid1gidpath, "%d %d %d", &idinsidens,
+			&idoutsidens, &length);
+
+		if (idinsidens != CHILD1GID || idoutsidens != CHILD2GID) {
+			printf("child_fn1 checks /proc/cpid1/gid_map:\n");
+			printf("unexpected: idinsidens=%d idoutsidens=%d\n",
+				idinsidens, idoutsidens);
+			exit_val = 1;
+		}
+	}
+	TST_SAFE_CHECKPOINT_WAKE_AND_WAIT(NULL, 1);
+	return exit_val;
+}
+
+
+static void setup(void)
+{
+	char read_buf[BUFSIZ];
+
+	check_newuser();
+	tst_tmpdir();
+	TST_CHECKPOINT_INIT(NULL);
+	if (tst_kvercmp(3, 19, 0) >= 0) {
+		SAFE_FILE_SCANF(NULL, "/proc/self/setgroups", "%s", read_buf);
+		if (strcmp(read_buf, "deny") == 0)
+			setgroups = 0;
+		else
+			setgroups = 1;
+	}
+}
+
+static void cleanup(void)
+{
+	tst_rmdir();
+}
+
+/*type: 0->uid; 1->git */
+static int updatemap(int cpid, bool type, int idnum, int parentmappid)
+{
+	char path[BUFSIZ];
+	char content[BUFSIZ];
+	int fd;
+
+	if (type == 0)
+		sprintf(path, "/proc/%d/uid_map", cpid);
+	else if (type == 1)
+		sprintf(path, "/proc/%d/gid_map", cpid);
+	else
+		tst_brkm(TFAIL, NULL, "invalid type parameter");
+
+	sprintf(content, "%d %d 1", idnum, parentmappid);
+	fd = SAFE_OPEN(NULL, path, O_WRONLY, 0644);
+	SAFE_WRITE(NULL, 1, fd, content, strlen(content));
+	return 0;
+}
+
+int main(int argc, char *argv[])
+{
+	pid_t cpid2;
+	int cpid1status, cpid2status;
+	int lc;
+
+	tst_parse_opts(argc, argv, NULL, NULL);
+	setup();
+
+	for (lc = 0; TEST_LOOPING(lc); lc++) {
+		tst_count = 0;
+
+		parentuid = geteuid();
+		parentgid = getegid();
+
+		cpid1 = ltp_clone_quick(CLONE_NEWUSER | SIGCHLD,
+			(void *)child_fn1, NULL);
+		if (cpid1 < 0)
+			tst_brkm(TFAIL | TERRNO, cleanup,
+				"cpid1 clone failed");
+
+		cpid2 = ltp_clone_quick(CLONE_NEWUSER | SIGCHLD,
+			(void *)child_fn2, NULL);
+		if (cpid2 < 0)
+			tst_brkm(TFAIL | TERRNO, cleanup,
+				"cpid2 clone failed");
+
+		updatemap(cpid1, 0, CHILD1UID, parentuid);
+		updatemap(cpid2, 0, CHILD2UID, parentuid);
+
+		if (setgroups == 0) {
+			updatemap(cpid1, 1, CHILD1GID, parentuid);
+			updatemap(cpid2, 1, CHILD2GID, parentuid);
+		}
+
+		TST_SAFE_CHECKPOINT_WAIT(NULL, 0);
+		TST_SAFE_CHECKPOINT_WAIT(NULL, 1);
+		TST_SAFE_CHECKPOINT_WAKE(NULL, 0);
+		TST_SAFE_CHECKPOINT_WAKE(NULL, 1);
+
+		if ((waitpid(cpid1, &cpid1status, 0) < 0) ||
+			(waitpid(cpid2, &cpid2status, 0) < 0))
+				tst_resm(TBROK, "parent: waitpid failed.");
+
+		if (WIFSIGNALED(cpid1status)) {
+			tst_resm(TBROK, "child1 was killed with signal = %d",
+				WTERMSIG(cpid1status));
+		} else if (WIFEXITED(cpid1status) &&
+			WEXITSTATUS(cpid1status) != 0) {
+			tst_resm(TBROK, "child1 exited abnormally");
+		}
+
+		if (WIFSIGNALED(cpid2status)) {
+			tst_resm(TBROK, "child2 was killed with signal = %d",
+				WTERMSIG(cpid2status));
+		} else if (WIFEXITED(cpid2status) &&
+			WEXITSTATUS(cpid2status) != 0) {
+			tst_resm(TBROK, "child2 exited abnormally");
+		} else
+			tst_resm(TPASS, "Uid and the gid are right.");
+	}
+	tst_exit();
+}
-- 
1.9.1


------------------------------------------------------------------------------
_______________________________________________
Ltp-list mailing list
Ltp-list@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/ltp-list

Re: [LTP] [PATCH V2] containers: new testcase userns03

[Jan Stancek]

On 06/09/2015 11:01 AM, Yuan Sun wrote:
>   ID-outside-ns is interpreted according to which process is opening the file.
> If the process opening the file is in the same user namespace as the process
> PID, then ID-outside-ns is defined with respect to the parent user namespace.
> If the process opening the file is in a different user namespace, then
> ID-outside-ns is defined with respect to the user namespace of the process
> opening the file.
>   If kernel version >= 3.19.0, the case will ignore the git check.
> 
> Signed-off-by: Yuan Sun <sunyuan3@huawei.com>

Hi,

> ---
>  testcases/kernel/containers/userns/userns03.c | 250 ++++++++++++++++++++++++++

please also add it to .gitignore and container runtest file.

>  1 file changed, 250 insertions(+)
>  create mode 100644 testcases/kernel/containers/userns/userns03.c
> 
> diff --git a/testcases/kernel/containers/userns/userns03.c b/testcases/kernel/containers/userns/userns03.c
> new file mode 100644
> index 0000000..01308f6
> --- /dev/null
> +++ b/testcases/kernel/containers/userns/userns03.c
> @@ -0,0 +1,250 @@
> +/*
> +* Copyright (c) Huawei Technologies Co., Ltd., 2015
> +* This program is free software; you can redistribute it and/or modify it
> +* under the terms of the GNU General Public License as published by the Free
> +* Software Foundation; either version 2 of the License, or (at your option)
> +* any later version. This program is distributed in the hope that it will be
> +* useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
> +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
> +* Public License for more details. You should have received a copy of the GNU
> +* General Public License along with this program.
> +*/
> +
> +/*
> +* Verify that:
> +* /proc/PID/uid_map and /proc/PID/gid_map contains three values separated by
> +* white space:
> +* ID-inside-ns   ID-outside-ns   length
> +*
> +*  ID-outside-ns is interpreted according to which process is opening the file.
> +* If the process opening the file is in the same user namespace as the process
> +* PID, then ID-outside-ns is defined with respect to the parent user namespace.
> +* If the process opening the file is in a different user namespace, then
> +* ID-outside-ns is defined with respect to the user namespace of the process
> +* opening the file.
> +*/
> +
> +#define _GNU_SOURCE
> +#include <sys/wait.h>
> +#include <assert.h>
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <stdbool.h>
> +#include <unistd.h>
> +#include <string.h>
> +#include <errno.h>
> +#include "test.h"
> +#include "libclone.h"
> +#include "userns_helper.h"
> +
> +char *TCID = "user_namespace3";
> +int TST_TOTAL = 1;
> +static int cpid1, parentuid, parentgid;
> +static bool setgroups;

I'd suggest to use different name, since there already is setgroups(2) function.

> +
> +#define CHILD1UID 0
> +#define CHILD1GID 0
> +#define CHILD2UID 200
> +#define CHILD2GID 200
> +
> +/*
> + * child_fn1() - Inside a new user namespace
> + */
> +static int child_fn1(void)
> +{
> +	TST_SAFE_CHECKPOINT_WAKE_AND_WAIT(NULL, 0);
> +	return 0;
> +}
> +
> +
> +/*
> + * child_fn2() - Inside a new user namespace
> + */
> +static int child_fn2(void)
> +{
> +	int exit_val;
> +	int uid, gid;
> +	char cpid1uidpath[BUFSIZ];
> +	char cpid1gidpath[BUFSIZ];
> +	int idinsidens, idoutsidens, length;
> +
> +	uid = geteuid();
> +	gid = getegid();
> +
> +	if (uid == CHILD2UID) {
> +		printf("Got expected uid.\n");
> +		exit_val = 0;
> +	} else {
> +		printf("unexpected uid=%d\n", uid);
> +		exit_val = 1;
> +	}
> +
> +	if (setgroups == 0) {
> +		if (uid == CHILD2UID && gid == CHILD2GID) {

You are comparing uid twice, but that's just a minor.

> +			printf("Got expected uid and gid.\n");
> +			exit_val = 0;
> +		} else {
> +			printf("unexpected: uid=%d gid=%d\n", uid, gid);
> +			exit_val = 1;
> +		}
> +	}
> +	/*Get the uid parameters of the child_fn2 process.*/
> +	SAFE_FILE_SCANF(NULL, "/proc/self/uid_map", "%d %d %d", &idinsidens,
> +		&idoutsidens, &length);
> +
> +	/* map file format:ID-inside-ns   ID-outside-ns   length
> +	If the process opening the file is in the same user namespace as
> +	the process PID, then ID-outside-ns is defined with respect to the
> +	 parent user namespace.*/
> +	if (idinsidens != CHILD2UID || idoutsidens != parentuid) {
> +		printf("child_fn2 checks /proc/cpid2/uid_map:\n");
> +		printf("unexpected: idinsidens=%d idoutsidens=%d\n",
> +			idinsidens, idoutsidens);
> +		exit_val = 1;
> +	}
> +
> +	sprintf(cpid1uidpath, "/proc/%d/uid_map", cpid1);
> +	SAFE_FILE_SCANF(NULL, cpid1uidpath, "%d %d %d", &idinsidens,
> +		&idoutsidens, &length);
> +
> +	/* If the process opening the file is in a different user namespace,
> +	then ID-outside-ns is defined with respect to the user namespace
> +	of the process opening the file.*/
> +	if (idinsidens != CHILD1UID || idoutsidens != CHILD2UID) {
> +		printf("child_fn2 checks /proc/cpid1/uid_map:\n");
> +		printf("unexpected: idinsidens=%d idoutsidens=%d\n",
> +			idinsidens, idoutsidens);
> +		exit_val = 1;
> +	}
> +
> +	if (setgroups == 0) {
> +		sprintf(cpid1gidpath, "/proc/%d/gid_map", cpid1);
> +		SAFE_FILE_SCANF(NULL, "/proc/self/gid_map", "%d %d %d",
> +			 &idinsidens, &idoutsidens, &length);
> +
> +		if (idinsidens != CHILD2GID || idoutsidens != parentgid) {
> +			printf("child_fn2 checks /proc/cpid2/gid_map:\n");
> +			printf("unexpected: idinsidens=%d idoutsidens=%d\n",
> +				idinsidens, idoutsidens);
> +			exit_val = 1;
> +		}
> +
> +		SAFE_FILE_SCANF(NULL, cpid1gidpath, "%d %d %d", &idinsidens,
> +			&idoutsidens, &length);
> +
> +		if (idinsidens != CHILD1GID || idoutsidens != CHILD2GID) {
> +			printf("child_fn1 checks /proc/cpid1/gid_map:\n");
> +			printf("unexpected: idinsidens=%d idoutsidens=%d\n",
> +				idinsidens, idoutsidens);
> +			exit_val = 1;
> +		}
> +	}
> +	TST_SAFE_CHECKPOINT_WAKE_AND_WAIT(NULL, 1);
> +	return exit_val;
> +}
> +
> +
> +static void setup(void)
> +{
> +	char read_buf[BUFSIZ];
> +
> +	check_newuser();
> +	tst_tmpdir();
> +	TST_CHECKPOINT_INIT(NULL);
> +	if (tst_kvercmp(3, 19, 0) >= 0) {

I'm thinking if we shouldn't replace kernel version check with check that
"/proc/self/setgroups" exists. Then it would work on kernels that backport
those patches. What do you think?

> +		SAFE_FILE_SCANF(NULL, "/proc/self/setgroups", "%s", read_buf);
> +		if (strcmp(read_buf, "deny") == 0)
> +			setgroups = 0;
> +		else
> +			setgroups = 1;

You could drop one of these branches, static variable already defaults to 0.

> +	}
> +}
> +
> +static void cleanup(void)
> +{
> +	tst_rmdir();
> +}
> +
> +/*type: 0->uid; 1->git */

typo here, git -> gid

I'd suggest a define for these, it would be easier to read something like
UID_MAP, GID_MAP instead of 0 and 1.

> +static int updatemap(int cpid, bool type, int idnum, int parentmappid)
> +{
> +	char path[BUFSIZ];
> +	char content[BUFSIZ];
> +	int fd;
> +
> +	if (type == 0)
> +		sprintf(path, "/proc/%d/uid_map", cpid);
> +	else if (type == 1)
> +		sprintf(path, "/proc/%d/gid_map", cpid);
> +	else
> +		tst_brkm(TFAIL, NULL, "invalid type parameter");
> +
> +	sprintf(content, "%d %d 1", idnum, parentmappid);
> +	fd = SAFE_OPEN(NULL, path, O_WRONLY, 0644);
> +	SAFE_WRITE(NULL, 1, fd, content, strlen(content));

You should pass cleanup to SAFE_ functions above.

You are leaking fd here. Try to run it as ./netns03 -i 10000 and you get
  errno=EMFILE(24): Too many open files

> +	return 0;
> +}
> +
> +int main(int argc, char *argv[])
> +{
> +	pid_t cpid2;
> +	int cpid1status, cpid2status;
> +	int lc;
> +
> +	tst_parse_opts(argc, argv, NULL, NULL);
> +	setup();
> +
> +	for (lc = 0; TEST_LOOPING(lc); lc++) {
> +		tst_count = 0;
> +
> +		parentuid = geteuid();
> +		parentgid = getegid();
> +
> +		cpid1 = ltp_clone_quick(CLONE_NEWUSER | SIGCHLD,
> +			(void *)child_fn1, NULL);
> +		if (cpid1 < 0)
> +			tst_brkm(TFAIL | TERRNO, cleanup,
> +				"cpid1 clone failed");
> +
> +		cpid2 = ltp_clone_quick(CLONE_NEWUSER | SIGCHLD,
> +			(void *)child_fn2, NULL);
> +		if (cpid2 < 0)
> +			tst_brkm(TFAIL | TERRNO, cleanup,
> +				"cpid2 clone failed");
> +
> +		updatemap(cpid1, 0, CHILD1UID, parentuid);
> +		updatemap(cpid2, 0, CHILD2UID, parentuid);
> +
> +		if (setgroups == 0) {
> +			updatemap(cpid1, 1, CHILD1GID, parentuid);
> +			updatemap(cpid2, 1, CHILD2GID, parentuid);
> +		}
> +
> +		TST_SAFE_CHECKPOINT_WAIT(NULL, 0);
> +		TST_SAFE_CHECKPOINT_WAIT(NULL, 1);
> +		TST_SAFE_CHECKPOINT_WAKE(NULL, 0);
> +		TST_SAFE_CHECKPOINT_WAKE(NULL, 1);

cleanup here as well

> +
> +		if ((waitpid(cpid1, &cpid1status, 0) < 0) ||
> +			(waitpid(cpid2, &cpid2status, 0) < 0))
> +				tst_resm(TBROK, "parent: waitpid failed.");

tst_brkm(TBROK | TERRNO, cleanup, ...


> +
> +		if (WIFSIGNALED(cpid1status)) {
> +			tst_resm(TBROK, "child1 was killed with signal = %d",

tst_resm(TFAIL

> +				WTERMSIG(cpid1status));
> +		} else if (WIFEXITED(cpid1status) &&
> +			WEXITSTATUS(cpid1status) != 0) {
> +			tst_resm(TBROK, "child1 exited abnormally");

tst_resm(TFAIL

> +		}
> +
> +		if (WIFSIGNALED(cpid2status)) {
> +			tst_resm(TBROK, "child2 was killed with signal = %d",
> +				WTERMSIG(cpid2status));

tst_resm(TFAIL

> +		} else if (WIFEXITED(cpid2status) &&
> +			WEXITSTATUS(cpid2status) != 0) {
> +			tst_resm(TBROK, "child2 exited abnormally");

tst_resm(TFAIL

Regards,
Jan


> +		} else
> +			tst_resm(TPASS, "Uid and the gid are right.");
> +	}
> +	tst_exit();
> +}
> 


------------------------------------------------------------------------------
_______________________________________________
Ltp-list mailing list
Ltp-list@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/ltp-list

Re: [LTP] [PATCH V2] containers: new testcase userns03

[Yuan Sun]

On 2015/6/11 21:55, Jan Stancek wrote:
> On 06/09/2015 11:01 AM, Yuan Sun wrote:
> I'm thinking if we shouldn't replace kernel version check with check that
> "/proc/self/setgroups" exists. Then it would work on kernels that backport
> those patches. What do you think?

Hi Jan,
     It is better to judge whether /proc/self/setgroups" exists. Thanks 
for your helpful
comment. I will update code according your suggestion.
     Yuan

------------------------------------------------------------------------------
_______________________________________________
Ltp-list mailing list
Ltp-list@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/ltp-list