Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1677819

Re: selftests/capabilities: test FAIL on linux mainline and linux-next and PASS on linux-4.4.70+

Show all headers | View raw

ebiederm@xmission.com (Eric W. Biederman) writes:

> Andy Lutomirski <luto@kernel.org> writes:
>>
>> Hi Eric-
>>
>> This is rather odd.  The selftest
>> (tools/testing/selftests/capabilities/test_execve), run as root, fails
>> on current kernels.  The failure is worked around by this:
>>
>> diff --git a/tools/testing/selftests/capabilities/test_execve.c
>> b/tools/testing/selftests/capabilities/test_execve.c
>> index 10a21a958aaf..6db60889b211 100644
>> --- a/tools/testing/selftests/capabilities/test_execve.c
>> +++ b/tools/testing/selftests/capabilities/test_execve.c
>> @@ -139,8 +139,8 @@ static void chdir_to_tmpfs(void)
>>         if (chdir(cwd) != 0)
>>                 err(1, "chdir to private tmpfs");
>>
>> -       if (umount2(".", MNT_DETACH) != 0)
>> -               err(1, "detach private tmpfs");
>> +//     if (umount2(".", MNT_DETACH) != 0)
>> +//             err(1, "detach private tmpfs");
>>  }
>>
>>  static void copy_fromat_to(int fromfd, const char *fromname, const
>> char *toname)
>>
>> I think this is due to the line:
>>
>> p->mnt_ns = NULL;
>>
>> in umount_tree().  The test is putting us into a situation in which
>> our cwd has ->mnt_ns = NULL, which is making it act as if it's nosuid.
>> I can imagine this breaking some weird user code (like my test!).  Is
>> it a real problem, though?

I just wanted to follow up and say this the mnt_may_suid test appears
to be doing exactly what it was designed to do.

It's goal is not to allow a suid exec from another mount namespace and
in this test the umount2(".", MNT_DETACH) creates a poor man's mount
namespace.

So assuming that we want to not allow execing executables from other
mount namespaces the behavior appears to be exactly correct in this
case.

Eric

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

selftests/capabilities: test FAIL on linux mainline and linux-next  and PASS on linux-4.4.70+ Naresh Kamboju <naresh.kamboju@linaro.org> - 2017-06-27 10:50 +0200
  Re: selftests/capabilities: test FAIL on linux mainline and  linux-next and PASS on linux-4.4.70+ Greg KH <greg@kroah.com> - 2017-06-27 17:40 +0200
    Re: selftests/capabilities: test FAIL on linux mainline and  linux-next and PASS on linux-4.4.70+ Greg KH <greg@kroah.com> - 2017-06-27 17:40 +0200
      Re: selftests/capabilities: test FAIL on linux mainline and  linux-next and PASS on linux-4.4.70+ Shuah Khan <shuahkh@osg.samsung.com> - 2017-06-28 01:20 +0200
        Re: selftests/capabilities: test FAIL on linux mainline and  linux-next and PASS on linux-4.4.70+ Kees Cook <keescook@chromium.org> - 2017-06-28 06:40 +0200
          Re: selftests/capabilities: test FAIL on linux mainline and  linux-next and PASS on linux-4.4.70+ Andy Lutomirski <luto@kernel.org> - 2017-06-28 23:30 +0200
            Re: selftests/capabilities: test FAIL on linux mainline and linux-next and PASS on linux-4.4.70+ ebiederm@xmission.com (Eric W. Biederman) - 2017-06-29 16:20 +0200
              Re: selftests/capabilities: test FAIL on linux mainline and linux-next and PASS on linux-4.4.70+ ebiederm@xmission.com (Eric W. Biederman) - 2017-06-29 16:40 +0200
                Re: selftests/capabilities: test FAIL on linux mainline and  linux-next and PASS on linux-4.4.70+ Andy Lutomirski <luto@kernel.org> - 2017-06-29 17:50 +0200
                Re: selftests/capabilities: test FAIL on linux mainline and linux-next and PASS on linux-4.4.70+ ebiederm@xmission.com (Eric W. Biederman) - 2017-06-29 18:40 +0200
  Re: selftests/capabilities: test FAIL on linux mainline and  linux-next and PASS on linux-4.4.70+ Shuah Khan <shuahkh@osg.samsung.com> - 2017-06-27 17:40 +0200
    Re: selftests/capabilities: test FAIL on linux mainline and  linux-next and PASS on linux-4.4.70+ Shuah Khan <shuahkh@osg.samsung.com> - 2017-06-27 17:50 +0200

csiph-web