* [LTP] [PATCH v13 0/3] open16: allow restricted O_CREAT of FIFOs and regular files
@ 2026-08-31 1:59 Wei Gao via ltp
2026-08-31 1:59 ` [LTP] [PATCH v13 1/3] lib/tst_uid: Remove spurious TERRNO from tst_get_free_gid success path Wei Gao via ltp
` (2 more replies)
0 siblings, 3 replies; 9+ messages in thread
From: Wei Gao via ltp @ 2026-08-31 1:59 UTC (permalink / raw)
To: ltp
v12->v13:
- remove unrelated comments
- remove SAFE_WAITPID
Wei Gao (3):
lib/tst_uid: Remove spurious TERRNO from tst_get_free_gid success path
lib: New library function tst_get_free_uid
open16: allow restricted O_CREAT of FIFOs and regular files
include/tst_uid.h | 14 +++
lib/tst_uid.c | 30 ++++-
runtest/syscalls | 1 +
testcases/kernel/syscalls/open/.gitignore | 1 +
testcases/kernel/syscalls/open/open16.c | 133 ++++++++++++++++++++++
5 files changed, 178 insertions(+), 1 deletion(-)
create mode 100644 testcases/kernel/syscalls/open/open16.c
--
2.55.0
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply [flat|nested] 9+ messages in thread* [LTP] [PATCH v13 1/3] lib/tst_uid: Remove spurious TERRNO from tst_get_free_gid success path 2026-08-31 1:59 [LTP] [PATCH v13 0/3] open16: allow restricted O_CREAT of FIFOs and regular files Wei Gao via ltp @ 2026-08-31 1:59 ` Wei Gao via ltp 2026-08-31 3:53 ` [LTP] " linuxtestproject.agent 2026-09-04 10:37 ` [LTP] [PATCH v13 1/3] " Andrea Cervesato via ltp 2026-08-31 1:59 ` [LTP] [PATCH v13 2/3] lib: New library function tst_get_free_uid Wei Gao via ltp 2026-08-31 1:59 ` [LTP] [PATCH v13 3/3] open16: allow restricted O_CREAT of FIFOs and regular files Wei Gao via ltp 2 siblings, 2 replies; 9+ messages in thread From: Wei Gao via ltp @ 2026-08-31 1:59 UTC (permalink / raw) To: ltp tst_get_free_gid_() prints the found GID when it succeeds, but it incorrectly includes TERRNO in tst_res_(). This prints whatever value happens to be in errno (often 0 or a stale value) which is confusing in a success path. Remove the spurious TERRNO flag from the tst_res_() success message. Signed-off-by: Wei Gao <wegao@suse.com> --- lib/tst_uid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/tst_uid.c b/lib/tst_uid.c index af4ef8cf7..b0b087362 100644 --- a/lib/tst_uid.c +++ b/lib/tst_uid.c @@ -24,7 +24,7 @@ gid_t tst_get_free_gid_(const char *file, const int lineno, gid_t skip) continue; if (errno == 0 || errno == ENOENT || errno == ESRCH) { - tst_res_(file, lineno, TINFO | TERRNO, + tst_res_(file, lineno, TINFO, "Found unused GID %d", (int)ret); return ret; } -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [LTP] lib/tst_uid: Remove spurious TERRNO from tst_get_free_gid success path 2026-08-31 1:59 ` [LTP] [PATCH v13 1/3] lib/tst_uid: Remove spurious TERRNO from tst_get_free_gid success path Wei Gao via ltp @ 2026-08-31 3:53 ` linuxtestproject.agent 2026-09-04 10:37 ` [LTP] [PATCH v13 1/3] " Andrea Cervesato via ltp 1 sibling, 0 replies; 9+ messages in thread From: linuxtestproject.agent @ 2026-08-31 3:53 UTC (permalink / raw) To: Wei Gao; +Cc: ltp Hi Wei, On Mon, Aug 31, 2026, Wei Gao wrote: > lib/tst_uid: Remove spurious TERRNO from tst_get_free_gid success path Verdict - Reviewed --- Note: The agent can sometimes produce false positives although often its findings are genuine. If you find issues with the review, please comment this email or ignore the suggestions. Regards, LTP AI Reviewer -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [LTP] [PATCH v13 1/3] lib/tst_uid: Remove spurious TERRNO from tst_get_free_gid success path 2026-08-31 1:59 ` [LTP] [PATCH v13 1/3] lib/tst_uid: Remove spurious TERRNO from tst_get_free_gid success path Wei Gao via ltp 2026-08-31 3:53 ` [LTP] " linuxtestproject.agent @ 2026-09-04 10:37 ` Andrea Cervesato via ltp 1 sibling, 0 replies; 9+ messages in thread From: Andrea Cervesato via ltp @ 2026-09-04 10:37 UTC (permalink / raw) To: Wei Gao; +Cc: ltp Reviewed-by: Andrea Cervesato <andrea.cervesato@suse.com> -- Andrea Cervesato SUSE QE Automation Engineer Linux andrea.cervesato@suse.com -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 9+ messages in thread
* [LTP] [PATCH v13 2/3] lib: New library function tst_get_free_uid 2026-08-31 1:59 [LTP] [PATCH v13 0/3] open16: allow restricted O_CREAT of FIFOs and regular files Wei Gao via ltp 2026-08-31 1:59 ` [LTP] [PATCH v13 1/3] lib/tst_uid: Remove spurious TERRNO from tst_get_free_gid success path Wei Gao via ltp @ 2026-08-31 1:59 ` Wei Gao via ltp 2026-09-04 10:39 ` Andrea Cervesato via ltp 2026-08-31 1:59 ` [LTP] [PATCH v13 3/3] open16: allow restricted O_CREAT of FIFOs and regular files Wei Gao via ltp 2 siblings, 1 reply; 9+ messages in thread From: Wei Gao via ltp @ 2026-08-31 1:59 UTC (permalink / raw) To: ltp Add tst_get_free_uid() to dynamically find unused UIDs for tests. Some tests need a completely unassigned, unused UID. This is used by open16 to verify restricted O_CREAT in sticky directories by running as a sandboxed user with no file ownership or privileges. Signed-off-by: Wei Gao <wegao@suse.com> --- include/tst_uid.h | 14 ++++++++++++++ lib/tst_uid.c | 28 ++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+) diff --git a/include/tst_uid.h b/include/tst_uid.h index 2237ddcbf..03f9dc073 100644 --- a/include/tst_uid.h +++ b/include/tst_uid.h @@ -7,6 +7,20 @@ #include <sys/types.h> +uid_t tst_get_free_uid_(const char *file, const int lineno, uid_t skip); + +/** + * tst_get_free_uid() - Find a UID not assigned to any user. + * @skip: UID value to skip (pass 0 to skip none). + * + * Scans the password database for the first unused UID starting + * from 1, skipping @skip. Calls tst_brk(TBROK) if no free UID + * is found or a lookup error occurs. + * + * Return: An unused uid_t value. + */ +#define tst_get_free_uid(skip) tst_get_free_uid_(__FILE__, __LINE__, (skip)) + /* * Find unassigned gid. The skip argument can be used to ignore e.g. the main * group of a specific user in case it's not listed in the group file. If you diff --git a/lib/tst_uid.c b/lib/tst_uid.c index b0b087362..47c267bc4 100644 --- a/lib/tst_uid.c +++ b/lib/tst_uid.c @@ -5,6 +5,7 @@ #include <sys/types.h> #include <grp.h> +#include <pwd.h> #include <errno.h> #define TST_NO_DEFAULT_MAIN @@ -12,6 +13,33 @@ #include "tst_uid.h" #define MAX_GID 32767 +#define MAX_UID 32767 + +uid_t tst_get_free_uid_(const char *file, const int lineno, uid_t skip) +{ + uid_t ret; + + for (ret = 1; ret < MAX_UID; ret++) { + if (ret == skip) + continue; + + errno = 0; + if (getpwuid(ret)) + continue; + + if (errno == 0 || errno == ENOENT || errno == ESRCH) { + tst_res_(file, lineno, TINFO, + "Found unused UID %d", (int)ret); + return ret; + } + + tst_brk_(file, lineno, TBROK | TERRNO, "User ID lookup failed"); + return (uid_t)-1; + } + + tst_brk_(file, lineno, TBROK, "No free user ID found"); + return (uid_t)-1; +} gid_t tst_get_free_gid_(const char *file, const int lineno, gid_t skip) { -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [LTP] [PATCH v13 2/3] lib: New library function tst_get_free_uid 2026-08-31 1:59 ` [LTP] [PATCH v13 2/3] lib: New library function tst_get_free_uid Wei Gao via ltp @ 2026-09-04 10:39 ` Andrea Cervesato via ltp 0 siblings, 0 replies; 9+ messages in thread From: Andrea Cervesato via ltp @ 2026-09-04 10:39 UTC (permalink / raw) To: Wei Gao; +Cc: ltp Reviewed-by: Andrea Cervesato <andrea.cervesato@suse.com> -- Andrea Cervesato SUSE QE Automation Engineer Linux andrea.cervesato@suse.com -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 9+ messages in thread
* [LTP] [PATCH v13 3/3] open16: allow restricted O_CREAT of FIFOs and regular files 2026-08-31 1:59 [LTP] [PATCH v13 0/3] open16: allow restricted O_CREAT of FIFOs and regular files Wei Gao via ltp 2026-08-31 1:59 ` [LTP] [PATCH v13 1/3] lib/tst_uid: Remove spurious TERRNO from tst_get_free_gid success path Wei Gao via ltp 2026-08-31 1:59 ` [LTP] [PATCH v13 2/3] lib: New library function tst_get_free_uid Wei Gao via ltp @ 2026-08-31 1:59 ` Wei Gao via ltp 2026-09-04 10:37 ` Andrea Cervesato via ltp 2026-09-16 13:01 ` Petr Vorel 2 siblings, 2 replies; 9+ messages in thread From: Wei Gao via ltp @ 2026-08-31 1:59 UTC (permalink / raw) To: ltp Add LTP coverage for kernel commit 30aba6656f61 (Linux 4.19), which introduced protection against spoofing attacks via O_CREAT of FIFOs and regular files in world-writable or group-writable sticky directories. This commit adds test cases to verify these security restrictions (Level 1 and Level 2 protections) for opening FIFOs and regular files in world-writable or group-writable sticky directories when the file is not owned by the opener. Signed-off-by: Wei Gao <wegao@suse.com> --- runtest/syscalls | 1 + testcases/kernel/syscalls/open/.gitignore | 1 + testcases/kernel/syscalls/open/open16.c | 133 ++++++++++++++++++++++ 3 files changed, 135 insertions(+) create mode 100644 testcases/kernel/syscalls/open/open16.c diff --git a/runtest/syscalls b/runtest/syscalls index a021c79da..4fd62efa8 100644 --- a/runtest/syscalls +++ b/runtest/syscalls @@ -1008,6 +1008,7 @@ open12 open12 open13 open13 open14 open14 open15 open15 +open16 open16 openat01 openat01 openat02 openat02 diff --git a/testcases/kernel/syscalls/open/.gitignore b/testcases/kernel/syscalls/open/.gitignore index af5997572..d2cacc02e 100644 --- a/testcases/kernel/syscalls/open/.gitignore +++ b/testcases/kernel/syscalls/open/.gitignore @@ -13,3 +13,4 @@ /open13 /open14 /open15 +/open16 diff --git a/testcases/kernel/syscalls/open/open16.c b/testcases/kernel/syscalls/open/open16.c new file mode 100644 index 000000000..3d29a56ca --- /dev/null +++ b/testcases/kernel/syscalls/open/open16.c @@ -0,0 +1,133 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Copyright (c) 2026 Wei Gao <wegao@suse.com> + */ + +/*\ + * Verify restricted opening (:manpage:`open(2)` and :manpage:`openat(2)`) of + * FIFOs and regular files in sticky directories. This test covers the positive + * case where access is allowed when protection is disabled (level 0), and the + * negative cases where access is disallowed (EACCES) in world-writable (level + * 1) or group-writable (level 2) sticky directories when the file is not owned + * by the opener. + * + * This test requires root to modify /proc/sys/fs/protected_* sysctls and + * to manage file ownership and permissions in sticky directories. + */ + +#include <pwd.h> +#include <stdlib.h> +#include "tst_test.h" +#include "tst_safe_file_at.h" +#include "tst_uid.h" + +#define DIR "ltp_tmp_check1" +#define TEST_FILE "test_file_1" +#define TEST_FIFO "test_fifo_1" +#define PROTECTED_REGULAR "/proc/sys/fs/protected_regular" +#define PROTECTED_FIFOS "/proc/sys/fs/protected_fifos" +#define TEST_FIFO_PATH DIR "/" TEST_FIFO + +static int dir_fd = -1; +static uid_t uid1, uid2; +static gid_t gid1; + +static struct tcase { + char *level; + int exp_errno; + uid_t owner_uid; + int use_nobody_gid; + mode_t dir_mode; +} tcases[] = { + {"0", 0, 0, 0, 0777 | S_ISVTX}, + {"1", EACCES, 0, 0, 0777 | S_ISVTX}, + {"2", EACCES, -1, 1, 0030 | S_ISVTX}, +}; + +static void verify_open(unsigned int n) +{ + struct tcase *tc = &tcases[n]; + pid_t pid; + + SAFE_FILE_PRINTF(PROTECTED_REGULAR, "%s", tc->level); + SAFE_FILE_PRINTF(PROTECTED_FIFOS, "%s", tc->level); + + if (tc->owner_uid != (uid_t)-1 || tc->use_nobody_gid) { + gid_t gid = tc->use_nobody_gid ? gid1 : 0; + + SAFE_CHOWN(DIR, tc->owner_uid, gid); + } + + if (tc->dir_mode) + SAFE_CHMOD(DIR, tc->dir_mode); + + pid = SAFE_FORK(); + if (!pid) { + SAFE_SETGID(gid1); + SAFE_SETUID(uid2); + + if (tc->exp_errno) { + TST_EXP_FAIL2(openat(dir_fd, TEST_FILE, O_RDWR | O_CREAT, 0777), + tc->exp_errno, "openat %s (Level %s)", TEST_FILE, tc->level); + TST_EXP_FAIL2(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777), + tc->exp_errno, "open %s (Level %s)", TEST_FIFO, tc->level); + } else { + int fd = TST_EXP_FD(openat(dir_fd, TEST_FILE, O_CREAT | O_RDWR, 0777)); + + if (TST_PASS) + SAFE_CLOSE(fd); + + fd = TST_EXP_FD(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777)); + if (TST_PASS) + SAFE_CLOSE(fd); + } + + exit(0); + } +} + +static void setup(void) +{ + struct passwd *pw; + + pw = SAFE_GETPWNAM("nobody"); + uid1 = pw->pw_uid; + gid1 = pw->pw_gid; + uid2 = tst_get_free_uid(uid1); + + umask(0); + SAFE_MKDIR(DIR, 0777 | S_ISVTX); + dir_fd = SAFE_OPEN(DIR, O_DIRECTORY); + + int fd = SAFE_OPENAT(dir_fd, TEST_FILE, O_CREAT | O_RDWR, 0777); + + SAFE_CLOSE(fd); + SAFE_MKFIFO(TEST_FIFO_PATH, 0777); + SAFE_CHOWN(TEST_FIFO_PATH, uid1, gid1); + SAFE_CHOWN(DIR "/" TEST_FILE, uid1, gid1); +} + +static void cleanup(void) +{ + if (dir_fd != -1) + SAFE_CLOSE(dir_fd); +} + +static struct tst_test test = { + .setup = setup, + .cleanup = cleanup, + .needs_root = 1, + .tcnt = ARRAY_SIZE(tcases), + .test = verify_open, + .needs_tmpdir = 1, + .forks_child = 1, + .save_restore = (const struct tst_path_val[]) { + {PROTECTED_REGULAR, NULL, TST_SR_TCONF}, + {PROTECTED_FIFOS, NULL, TST_SR_TCONF}, + {} + }, + .tags = (const struct tst_tag[]) { + {"linux-git", "30aba6656f61"}, + {} + } +}; -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [LTP] [PATCH v13 3/3] open16: allow restricted O_CREAT of FIFOs and regular files 2026-08-31 1:59 ` [LTP] [PATCH v13 3/3] open16: allow restricted O_CREAT of FIFOs and regular files Wei Gao via ltp @ 2026-09-04 10:37 ` Andrea Cervesato via ltp 2026-09-16 13:01 ` Petr Vorel 1 sibling, 0 replies; 9+ messages in thread From: Andrea Cervesato via ltp @ 2026-09-04 10:37 UTC (permalink / raw) To: Wei Gao; +Cc: ltp Reviewed-by: Andrea Cervesato <andrea.cervesato@suse.com> -- Andrea Cervesato SUSE QE Automation Engineer Linux andrea.cervesato@suse.com -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [LTP] [PATCH v13 3/3] open16: allow restricted O_CREAT of FIFOs and regular files 2026-08-31 1:59 ` [LTP] [PATCH v13 3/3] open16: allow restricted O_CREAT of FIFOs and regular files Wei Gao via ltp 2026-09-04 10:37 ` Andrea Cervesato via ltp @ 2026-09-16 13:01 ` Petr Vorel 1 sibling, 0 replies; 9+ messages in thread From: Petr Vorel @ 2026-09-16 13:01 UTC (permalink / raw) To: Wei Gao; +Cc: ltp Hi Wei, > Add LTP coverage for kernel commit 30aba6656f61 (Linux 4.19), which > introduced protection against spoofing attacks via O_CREAT of FIFOs > and regular files in world-writable or group-writable sticky > directories. > This commit adds test cases to verify these security restrictions > (Level 1 and Level 2 protections) for opening FIFOs and regular > files in world-writable or group-writable sticky directories when the > file is not owned by the opener. I was thinking what level you're talking about. ... > diff --git a/testcases/kernel/syscalls/open/open16.c b/testcases/kernel/syscalls/open/open16.c > new file mode 100644 > index 000000000..3d29a56ca > --- /dev/null > +++ b/testcases/kernel/syscalls/open/open16.c > @@ -0,0 +1,133 @@ > +// SPDX-License-Identifier: GPL-2.0-or-later > +/* > + * Copyright (c) 2026 Wei Gao <wegao@suse.com> > + */ > + > +/*\ > + * Verify restricted opening (:manpage:`open(2)` and :manpage:`openat(2)`) of > + * FIFOs and regular files in sticky directories. This test covers the positive > + * case where access is allowed when protection is disabled (level 0), and the > + * negative cases where access is disallowed (EACCES) in world-writable (level > + * 1) or group-writable (level 2) sticky directories when the file is not owned > + * by the opener. Even here it's not clear. Could you just mention that these are /proc/sys/fs/protected_fifos values? man proc_sys_fs(5) which document it does not talk about levels at all. > + * > + * This test requires root to modify /proc/sys/fs/protected_* sysctls and > + * to manage file ownership and permissions in sticky directories. > + */ > + ... > +#define PROTECTED_REGULAR "/proc/sys/fs/protected_regular" > +#define PROTECTED_FIFOS "/proc/sys/fs/protected_fifos" Could you please add these 2 into include/tst_path_defs.h? > +#define TEST_FIFO_PATH DIR "/" TEST_FIFO > + > +static int dir_fd = -1; > +static uid_t uid1, uid2; > +static gid_t gid1; > + > +static struct tcase { > + char *level; How about define level as int? I would even not define it and use unsigned int n in verify_open() since the values are the same, but up to you. > + int exp_errno; > + uid_t owner_uid; > + int use_nobody_gid; > + mode_t dir_mode; > +} tcases[] = { > + {"0", 0, 0, 0, 0777 | S_ISVTX}, > + {"1", EACCES, 0, 0, 0777 | S_ISVTX}, > + {"2", EACCES, -1, 1, 0030 | S_ISVTX}, > +}; I usually prefer using designated initializers to 1) not having to specify 0 2) > + > +static void verify_open(unsigned int n) > +{ > + struct tcase *tc = &tcases[n]; > + pid_t pid; > + > + SAFE_FILE_PRINTF(PROTECTED_REGULAR, "%s", tc->level); > + SAFE_FILE_PRINTF(PROTECTED_FIFOS, "%s", tc->level); > + > + if (tc->owner_uid != (uid_t)-1 || tc->use_nobody_gid) { > + gid_t gid = tc->use_nobody_gid ? gid1 : 0; > + > + SAFE_CHOWN(DIR, tc->owner_uid, gid); > + } > + > + if (tc->dir_mode) > + SAFE_CHMOD(DIR, tc->dir_mode); > + > + pid = SAFE_FORK(); > + if (!pid) { How about: 1) using SAFE_FORK() directly 2) return for parent to save indent (readability) if (SAFE_FORK()) return; SAFE_SETGID(gid1); SAFE_SETUID(uid2); ... > + SAFE_SETGID(gid1); > + SAFE_SETUID(uid2); > + > + if (tc->exp_errno) { > + TST_EXP_FAIL2(openat(dir_fd, TEST_FILE, O_RDWR | O_CREAT, 0777), > + tc->exp_errno, "openat %s (Level %s)", TEST_FILE, tc->level); > + TST_EXP_FAIL2(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777), > + tc->exp_errno, "open %s (Level %s)", TEST_FIFO, tc->level); > + } else { > + int fd = TST_EXP_FD(openat(dir_fd, TEST_FILE, O_CREAT | O_RDWR, 0777)); nit: we don't have to define fd when it's not used, we can use TST_RET. > + > + if (TST_PASS) > + SAFE_CLOSE(fd); > + > + fd = TST_EXP_FD(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777)); > + if (TST_PASS) > + SAFE_CLOSE(fd); > + } This else branch use the same code, how about to use TST_EXP_FD_OR_FAIL()? TST_EXP_FD_OR_FAIL(openat(dir_fd, TEST_FILE, O_RDWR | O_CREAT, 0777), tc->exp_errno, "openat %s (Level %s)", TEST_FILE, tc->level); if (TST_RET != -1) SAFE_CLOSE(TST_RET); TST_EXP_FD_OR_FAIL(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777), tc->exp_errno, "open %s (Level %s)", TEST_FIFO, tc->level); if (TST_RET != -1) SAFE_CLOSE(TST_RET); @Cyril @Li: I always wondered if TST_EXP_FD_OR_FAIL() should use TST_EXP_FAIL2(). > + > + exit(0); I guess we need to bother with exit(0) at this point, right? > + } > +} > + > +static void setup(void) > +{ > + struct passwd *pw; > + > + pw = SAFE_GETPWNAM("nobody"); > + uid1 = pw->pw_uid; > + gid1 = pw->pw_gid; > + uid2 = tst_get_free_uid(uid1); > + > + umask(0); > + SAFE_MKDIR(DIR, 0777 | S_ISVTX); > + dir_fd = SAFE_OPEN(DIR, O_DIRECTORY); > + > + int fd = SAFE_OPENAT(dir_fd, TEST_FILE, O_CREAT | O_RDWR, 0777); > + > + SAFE_CLOSE(fd); > + SAFE_MKFIFO(TEST_FIFO_PATH, 0777); > + SAFE_CHOWN(TEST_FIFO_PATH, uid1, gid1); > + SAFE_CHOWN(DIR "/" TEST_FILE, uid1, gid1); > +} > + > +static void cleanup(void) > +{ > + if (dir_fd != -1) > + SAFE_CLOSE(dir_fd); > +} > + > +static struct tst_test test = { > + .setup = setup, > + .cleanup = cleanup, > + .needs_root = 1, > + .tcnt = ARRAY_SIZE(tcases), > + .test = verify_open, > + .needs_tmpdir = 1, > + .forks_child = 1, > + .save_restore = (const struct tst_path_val[]) { > + {PROTECTED_REGULAR, NULL, TST_SR_TCONF}, > + {PROTECTED_FIFOS, NULL, TST_SR_TCONF}, > + {} > + }, > + .tags = (const struct tst_tag[]) { > + {"linux-git", "30aba6656f61"}, 30aba6656f61 notes many CVEs, IMHO we should add them as well: CVE-2000-1134 CVE-2007-3852 CVE-2008-0525 CVE-2009-0416 CVE-2011-4834 CVE-2015-1838 CVE-2015-7442 CVE-2016-7489 > + {} > + } > +}; Feel free to speedup with this (still TODO CVE and using int for "level"). Kind regards, Petr diff --git testcases/kernel/syscalls/open/open16.c testcases/kernel/syscalls/open/open16.c index 3d29a56ca7..0741102103 100644 --- testcases/kernel/syscalls/open/open16.c +++ testcases/kernel/syscalls/open/open16.c @@ -47,7 +47,6 @@ static struct tcase { static void verify_open(unsigned int n) { struct tcase *tc = &tcases[n]; - pid_t pid; SAFE_FILE_PRINTF(PROTECTED_REGULAR, "%s", tc->level); SAFE_FILE_PRINTF(PROTECTED_FIFOS, "%s", tc->level); @@ -61,29 +60,21 @@ static void verify_open(unsigned int n) if (tc->dir_mode) SAFE_CHMOD(DIR, tc->dir_mode); - pid = SAFE_FORK(); - if (!pid) { - SAFE_SETGID(gid1); - SAFE_SETUID(uid2); + if (SAFE_FORK()) + return; - if (tc->exp_errno) { - TST_EXP_FAIL2(openat(dir_fd, TEST_FILE, O_RDWR | O_CREAT, 0777), - tc->exp_errno, "openat %s (Level %s)", TEST_FILE, tc->level); - TST_EXP_FAIL2(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777), - tc->exp_errno, "open %s (Level %s)", TEST_FIFO, tc->level); - } else { - int fd = TST_EXP_FD(openat(dir_fd, TEST_FILE, O_CREAT | O_RDWR, 0777)); + SAFE_SETGID(gid1); + SAFE_SETUID(uid2); - if (TST_PASS) - SAFE_CLOSE(fd); + TST_EXP_FD_OR_FAIL(openat(dir_fd, TEST_FILE, O_RDWR | O_CREAT, 0777), + tc->exp_errno, "openat %s (Level %s)", TEST_FILE, tc->level); + if (TST_RET != -1) + SAFE_CLOSE(TST_RET); - fd = TST_EXP_FD(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777)); - if (TST_PASS) - SAFE_CLOSE(fd); - } - - exit(0); - } + TST_EXP_FD_OR_FAIL(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777), + tc->exp_errno, "open %s (Level %s)", TEST_FIFO, tc->level); + if (TST_RET != -1) + SAFE_CLOSE(TST_RET); } static void setup(void) -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply related [flat|nested] 9+ messages in thread
end of thread, other threads:[~2026-09-16 13:02 UTC | newest] Thread overview: 9+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-08-31 1:59 [LTP] [PATCH v13 0/3] open16: allow restricted O_CREAT of FIFOs and regular files Wei Gao via ltp 2026-08-31 1:59 ` [LTP] [PATCH v13 1/3] lib/tst_uid: Remove spurious TERRNO from tst_get_free_gid success path Wei Gao via ltp 2026-08-31 3:53 ` [LTP] " linuxtestproject.agent 2026-09-04 10:37 ` [LTP] [PATCH v13 1/3] " Andrea Cervesato via ltp 2026-08-31 1:59 ` [LTP] [PATCH v13 2/3] lib: New library function tst_get_free_uid Wei Gao via ltp 2026-09-04 10:39 ` Andrea Cervesato via ltp 2026-08-31 1:59 ` [LTP] [PATCH v13 3/3] open16: allow restricted O_CREAT of FIFOs and regular files Wei Gao via ltp 2026-09-04 10:37 ` Andrea Cervesato via ltp 2026-09-16 13:01 ` Petr Vorel
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).