From: Cyril Hrubis <chrubis@suse.cz>
To: Andrea Cervesato <andrea.cervesato@suse.com>
Cc: Linux Test Project <ltp@lists.linux.it>
Subject: Re: [LTP] [PATCH STAGING v2 06/16] fchroot03: test fchroot() permission checks
Date: Fri, 28 Aug 2026 15:51:05 +0200 [thread overview]
Message-ID: <apGSSZrHmOe4M4yO@yuki.lan> (raw)
In-Reply-To: <6a918e90.62f374cd.18666e.d1ad@mx.google.com>
Hi!
> > > Verify that with a regular directory fd the kernel first checks the
> > > execute permission on the directory and then CAP_SYS_CHROOT: an
> > > unprivileged process with an accessible directory fails with EPERM and
> > > a process without execute permission fails with EACCES.
> >
> > Here as well, the order of the checks is subject to change.
>
> sorry I don't get the review, can you please explain where is the
> issue? it's a description problem only?
>
> same for the other reviews
The problem here is that the order in which kernel checks for
CAP_SYS_ROOT or invalid fchroot() flags is not defined. It checks for
CAP_SYS_ROOT last now, but that is not something we can take for
granted.
--
Cyril Hrubis
chrubis@suse.cz
--
Mailing list info: https://lists.linux.it/listinfo/ltp
next prev parent reply other threads:[~2026-08-28 13:51 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-20 7:44 [LTP] [PATCH v2 00/16] fchroot: add fchroot() testing suite Andrea Cervesato
2026-08-20 7:44 ` [LTP] [PATCH v2 01/16] syscalls: add v7.3 syscall numbers Andrea Cervesato
2026-08-20 8:34 ` [LTP] " linuxtestproject.agent
2026-08-20 8:37 ` Andrea Cervesato via ltp
2026-08-20 7:44 ` [LTP] [PATCH v2 02/16] syscalls: update outdated syscall entries Andrea Cervesato
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 03/16] lapi: fallback fchroot() parameters Andrea Cervesato
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 04/16] fchroot01: test fchroot() with a directory fd Andrea Cervesato
2026-08-20 14:13 ` Cyril Hrubis
2026-08-20 14:23 ` Andrea Cervesato via ltp
2026-08-20 14:58 ` Cyril Hrubis
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 05/16] fchroot02: test fchroot() invalid arguments Andrea Cervesato
2026-08-20 14:10 ` Cyril Hrubis
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 06/16] fchroot03: test fchroot() permission checks Andrea Cervesato
2026-08-20 14:19 ` Cyril Hrubis
2026-08-28 13:35 ` Andrea Cervesato via ltp
2026-08-28 13:51 ` Cyril Hrubis [this message]
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 07/16] fchroot04: test fchroot() into failfs as root Andrea Cervesato
2026-08-20 14:24 ` Cyril Hrubis
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 08/16] fchroot05: test failfs root can not be referenced Andrea Cervesato
2026-08-20 14:37 ` Cyril Hrubis
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 09/16] fchroot06: test path walks under failfs root Andrea Cervesato
2026-08-20 15:54 ` Cyril Hrubis
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 10/16] fchroot07: test execve blocked by " Andrea Cervesato
2026-08-20 16:17 ` Cyril Hrubis
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 11/16] fchroot08: test failfs root fork inheritance Andrea Cervesato
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 12/16] fchroot09: test setns escape from failfs root Andrea Cervesato
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 13/16] fchroot10: test failfs entry without no_new_privs Andrea Cervesato
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 14/16] fchroot11: test failfs entry with no_new_privs Andrea Cervesato
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 15/16] fchroot12: test failfs entry with shared fs_struct Andrea Cervesato
2026-08-20 7:44 ` [LTP] [PATCH STAGING v2 16/16] fchroot13: test failfs entry when chrooted Andrea Cervesato
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=apGSSZrHmOe4M4yO@yuki.lan \
--to=chrubis@suse.cz \
--cc=andrea.cervesato@suse.com \
--cc=ltp@lists.linux.it \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox