public inbox for ltp@lists.linux.it
 help / color / mirror / Atom feed
From: Richard Palethorpe <rpalethorpe@suse.de>
To: "xuyang2018.jy@fujitsu.com" <xuyang2018.jy@fujitsu.com>
Cc: ltp@lists.linux.it
Subject: Re: [LTP] [PATCH v4 1/1] mount03: Convert to new API
Date: Thu, 13 Oct 2022 12:31:25 +0100	[thread overview]
Message-ID: <87y1tkx84j.fsf@suse.de> (raw)
In-Reply-To: <bc8d2cb9-e5d9-3284-13e2-acfea09725c2@fujitsu.com>


"xuyang2018.jy@fujitsu.com" <xuyang2018.jy@fujitsu.com> writes:

> Hi Petr
>
>> Hi all,
>> 
>> when running in loop, I sometimes still get error:
>> 
>> i=0; while true; do i=$((i+1)); echo "== $i =="; ./mount03  || break; done
>> ...
>> === 100 ===
>> ...
>> tst_device.c:434: TINFO: No device is mounted at mntpoint
>> tst_test.c:1599: TINFO: Testing on ext4
>> tst_test.c:1065: TINFO: Formatting /dev/loop0 with ext4 opts='' extra opts=''
>> mke2fs 1.46.5 (30-Dec-2021)
>> mount03.c:150: TINFO: Testing flag MS_RDONLY
>> mount03.c:48: TPASS: otfd = open(file, O_CREAT | O_RDWR, 0700) : EROFS (30)
>> mount03.c:150: TINFO: Testing flag MS_NODEV
>> mount03.c:153: TFAIL: mount(tst_device->dev, MNTPOINT, tst_device->fs_type, tc->flag, NULL) failed: EINVAL (22)
>> mount03.c:150: TINFO: Testing flag MS_NOEXEC
>> mount03.c:153: TFAIL: mount(tst_device->dev, MNTPOINT, tst_device->fs_type, tc->flag, NULL) failed: EINVAL (22)
>> mount03.c:150: TINFO: Testing flag MS_RDONLY
>> mount03.c:153: TFAIL: mount(tst_device->dev, MNTPOINT, tst_device->fs_type, tc->flag, NULL) failed: EINVAL (22)
>> mount03.c:150: TINFO: Testing flag MS_NOSUID
>> mount03.c:153: TFAIL: mount(tst_device->dev, MNTPOINT, tst_device->fs_type, tc->flag, NULL) failed: EINVAL (22)
>> mount03.c:150: TINFO: Testing flag MS_NOATIME
>> mount03.c:111: TPASS: st.st_atime == atime (1661183501)
>
> I also meet nosuid work not as expected.
>
> st_test.c:1599: TINFO: Testing on ext4
> tst_test.c:1064: TINFO: Formatting /dev/loop0 with ext4 opts='' extra 
> opts=''
> mke2fs 1.46.5 (30-Dec-2021)
> mount03.c:151: TINFO: Testing flag MS_RDONLY
> mount03.c:48: TPASS: otfd = open(file, O_CREAT | O_RDWR, 0700) : EROFS (30)
> mount03.c:151: TINFO: Testing flag MS_NODEV
> mount03.c:55: TPASS: otfd = open(file, O_RDWR, 0700) : EACCES (13)
> mount03.c:151: TINFO: Testing flag MS_NOEXEC
> mount03.c:63: TPASS: execlp(file, basename(file), NULL) : EACCES (13)
> mount03.c:151: TINFO: Testing flag MS_RDONLY
> mount03.c:70: TPASS: otfd = open(file, O_CREAT | O_RDWR, 0700) returned fd 3
> mount03.c:151: TINFO: Testing flag MS_NOSUID
> mount03_suid_child.c:22: TFAIL: setreuid(getuid(), 0) succeeded
> mount03.c:151: TINFO: Testing flag MS_NOATIME
> mount03.c:112: TPASS: st.st_atime == atime (1661280863)
> tst_device.c:434: TINFO: No device is mounted at mntpoint
>

I added some more debug info:

@@ -86,7 +89,20 @@ static void test_nosuid(void)
 		if (st.st_mode != SUID_MODE)
 			SAFE_CHMOD(BIN_PATH, SUID_MODE);
 
-		SAFE_SETREUID(nobody_uid, nobody_uid);
+		tst_res(TINFO, "dev %d:%d, rdev: %d:%d",
+			major(st.st_dev), minor(st.st_dev), major(st.st_rdev), minor(st.st_rdev));
+		SAFE_SETRESGID(nobody_gid, nobody_gid, nobody_gid);
+		SAFE_SETRESUID(nobody_uid, nobody_uid, nobody_uid);
+
+		uid_t uid, gid, euid, egid, suid, sgid;
+
+		getresuid(&uid, &euid, &suid);
+		getresgid(&gid, &egid, &sgid);
+		tst_res(TINFO, "uid: %d, gid: %d, euid: %d, egid: %d, suid: %d, sgid: %d",
+			uid, gid, euid, egid, suid, sgid);
+
+		tst_system("pwd");
+		tst_system("ls -l " MNTPOINT);
 		SAFE_EXECL(BIN_PATH, BIN_PATH, NULL);
 		tst_brk(TFAIL | TTERRNO, "Failed to execute %s", BIN_PATH);

and in the child

 int main(void)
 {
+	uid_t uid, gid, euid, egid, suid, sgid;
 	tst_reinit();
 
+	getresuid(&uid, &euid, &suid);
+	getresgid(&gid, &egid, &sgid);
+	tst_res(TINFO, "uid: %d, gid: %d, euid: %d, egid: %d, suid: %d, sgid: %d",
+		uid, gid, euid, egid, suid, sgid);
+
 	TST_EXP_FAIL(setreuid(getuid(), 0), EPERM);
 

This shows that BIN_PATH is being accessed from the wrong device AFAICT

mount03.c:166: TINFO: Testing flag MS_NOSUID

...

30 1 0:26 / /tmp rw,relatime - tmpfs ltp rw,size=512000k,inode64
31 30 0:27 / /tmp/mouLkSN2v/mntpoint rw,nosuid,relatime - tmpfs /dev/loop0 rw,inode64
mount03.c:92: TINFO: dev 0:26, rdev: 0:0
mount03.c:101: TINFO: uid: 65534, gid: 65534, euid: 65534, egid: 65534, suid: 65534, sgid: 65534
/tmp/mouLkSN2v
total 688
-r-s--x--x 1 root 0 702952 Oct 13 11:29 mount03_suid_child
mount03_suid_child.c:25: TINFO: uid: 65534, gid: 65534, euid: 0, egid: 65534, suid: 0, sgid: 65534
mount03_suid_child.c:28: TFAIL: setreuid(getuid(), 0) succeeded

The device should be 0:27 not 0:26.

Indeed if I remove SAFE_CHMOD then the euid and suid are set to
nobody. Also if I mount /tmp as nosuid then the test passes. Possibly we
need to use absoute paths to ensure we are going through the mount
point.

-- 
Thank you,
Richard.

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

  reply	other threads:[~2022-10-13 11:42 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-22 15:54 [LTP] [PATCH v4 1/1] mount03: Convert to new API Petr Vorel
2022-08-22 17:06 ` Petr Vorel
2022-08-23  3:58   ` xuyang2018.jy
2022-10-13 11:31     ` Richard Palethorpe [this message]
2022-10-18  6:09       ` xuyang2018.jy
2022-10-18  8:44         ` Richard Palethorpe
2022-10-18  7:19   ` xuyang2018.jy

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87y1tkx84j.fsf@suse.de \
    --to=rpalethorpe@suse.de \
    --cc=ltp@lists.linux.it \
    --cc=xuyang2018.jy@fujitsu.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox