Commit 796a3bae authored by Andy Lutomirski's avatar Andy Lutomirski Committed by Shuah Khan

selftests/capabilities: Fix the test_execve test

test_execve does rather odd mount manipulations to safely create
temporary setuid and setgid executables that aren't visible to the
rest of the system.  Those executables end up in the test's cwd, but
that cwd is MNT_DETACHed.

The core namespace code considers MNT_DETACHed trees to belong to no
mount namespace at all and, in general, MNT_DETACHed trees are only
barely function.  This interacted with commit 380cf5ba ("fs:
Treat foreign mounts as nosuid") to cause all MNT_DETACHed trees to
act as though they're nosuid, breaking the test.

Fix it by just not detaching the tree.  It's still in a private
mount namespace and is therefore still invisible to the rest of the
system (except via /proc, and the same nosuid logic will protect all
other programs on the system from believing in test_execve's setuid
bits).

While we're at it, fix some blatant whitespace problems.
Reported-by: default avatarNaresh Kamboju <naresh.kamboju@linaro.org>
Fixes: 380cf5ba ("fs: Treat foreign mounts as nosuid")
Cc: stable@vger.kernel.org
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Shuah Khan <shuahkh@osg.samsung.com>
Cc: Greg KH <greg@kroah.com>
Cc: linux-kselftest@vger.kernel.org
Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
Acked-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarShuah Khan <shuahkh@osg.samsung.com>
parent 4ca90c21
...@@ -138,9 +138,6 @@ static void chdir_to_tmpfs(void) ...@@ -138,9 +138,6 @@ static void chdir_to_tmpfs(void)
if (chdir(cwd) != 0) if (chdir(cwd) != 0)
err(1, "chdir to private tmpfs"); err(1, "chdir to private tmpfs");
if (umount2(".", MNT_DETACH) != 0)
err(1, "detach private tmpfs");
} }
static void copy_fromat_to(int fromfd, const char *fromname, const char *toname) static void copy_fromat_to(int fromfd, const char *fromname, const char *toname)
...@@ -248,7 +245,7 @@ static int do_tests(int uid, const char *our_path) ...@@ -248,7 +245,7 @@ static int do_tests(int uid, const char *our_path)
err(1, "chown"); err(1, "chown");
if (chmod("validate_cap_sgidnonroot", S_ISGID | 0710) != 0) if (chmod("validate_cap_sgidnonroot", S_ISGID | 0710) != 0)
err(1, "chmod"); err(1, "chmod");
} }
capng_get_caps_process(); capng_get_caps_process();
...@@ -384,7 +381,7 @@ static int do_tests(int uid, const char *our_path) ...@@ -384,7 +381,7 @@ static int do_tests(int uid, const char *our_path)
} else { } else {
printf("[RUN]\tNon-root +ia, sgidnonroot => i\n"); printf("[RUN]\tNon-root +ia, sgidnonroot => i\n");
exec_other_validate_cap("./validate_cap_sgidnonroot", exec_other_validate_cap("./validate_cap_sgidnonroot",
false, false, true, false); false, false, true, false);
if (fork_wait()) { if (fork_wait()) {
printf("[RUN]\tNon-root +ia, sgidroot => i\n"); printf("[RUN]\tNon-root +ia, sgidroot => i\n");
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment