2024-04-26 17:28:55

by Mickaël Salaün

Subject: [PATCH v1 2/5] selftests/landlock: Fix FS tests when run on a private mount point

According to the test environment, the mount point of the test's working
directory may be shared or not, which changes the visibility of the
nested "tmp" mount point for the test's parent process calling
umount("tmp").

This was spotted while running tests on different Linux distributions,
with different mount point configurations.

Cc: Günther Noack <[email protected]>
Fixes: 41cca0542d7c ("selftests/harness: Fix TEST_F()'s vfork handling")
Signed-off-by: Mickaël Salaün <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
---
tools/testing/selftests/landlock/fs_test.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
index 9a6036fbf289..46b9effd53e4 100644
--- a/tools/testing/selftests/landlock/fs_test.c
+++ b/tools/testing/selftests/landlock/fs_test.c
@@ -293,7 +293,15 @@ static void prepare_layout(struct __test_metadata *const _metadata)
static void cleanup_layout(struct __test_metadata *const _metadata)
{
set_cap(_metadata, CAP_SYS_ADMIN);
- EXPECT_EQ(0, umount(TMP_DIR));
+ if (umount(TMP_DIR)) {
+ /*
+ * According to the test environment, the mount point of the
+ * current directory may be shared or not, which changes the
+ * visibility of the nested TMP_DIR mount point for the test's
+ * parent process doing this cleanup.
+ */
+ ASSERT_EQ(EINVAL, errno);
+ }
clear_cap(_metadata, CAP_SYS_ADMIN);
EXPECT_EQ(0, remove_path(TMP_DIR));
}
--
2.44.0

2024-04-26 19:38:27

by Kees Cook

Subject: Re: [PATCH v1 2/5] selftests/landlock: Fix FS tests when run on a private mount point

On Fri, Apr 26, 2024 at 07:22:49PM +0200, Micka?l Sala?n wrote:
> According to the test environment, the mount point of the test's working
> directory may be shared or not, which changes the visibility of the
> nested "tmp" mount point for the test's parent process calling
> umount("tmp").
>
> This was spotted while running tests on different Linux distributions,
> with different mount point configurations.

Which distros did what?

>
> Cc: G?nther Noack <[email protected]>
> Fixes: 41cca0542d7c ("selftests/harness: Fix TEST_F()'s vfork handling")
> Signed-off-by: Micka?l Sala?n <[email protected]>
> Link: https://lore.kernel.org/r/[email protected]

Reviewed-by: Kees Cook <[email protected]>

-Kees

> ---
> tools/testing/selftests/landlock/fs_test.c | 10 +++++++++-
> 1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
> index 9a6036fbf289..46b9effd53e4 100644
> --- a/tools/testing/selftests/landlock/fs_test.c
> +++ b/tools/testing/selftests/landlock/fs_test.c
> @@ -293,7 +293,15 @@ static void prepare_layout(struct __test_metadata *const _metadata)
> static void cleanup_layout(struct __test_metadata *const _metadata)
> {
> set_cap(_metadata, CAP_SYS_ADMIN);
> - EXPECT_EQ(0, umount(TMP_DIR));
> + if (umount(TMP_DIR)) {
> + /*
> + * According to the test environment, the mount point of the
> + * current directory may be shared or not, which changes the
> + * visibility of the nested TMP_DIR mount point for the test's
> + * parent process doing this cleanup.
> + */
> + ASSERT_EQ(EINVAL, errno);
> + }
> clear_cap(_metadata, CAP_SYS_ADMIN);
> EXPECT_EQ(0, remove_path(TMP_DIR));
> }
> --
> 2.44.0
>

--
Kees Cook

2024-04-29 12:39:31

by Mickaël Salaün

Subject: Re: [PATCH v1 2/5] selftests/landlock: Fix FS tests when run on a private mount point

On Fri, Apr 26, 2024 at 12:38:17PM -0700, Kees Cook wrote:
> On Fri, Apr 26, 2024 at 07:22:49PM +0200, Mickaël Salaün wrote:
> > According to the test environment, the mount point of the test's working
> > directory may be shared or not, which changes the visibility of the
> > nested "tmp" mount point for the test's parent process calling
> > umount("tmp").
> >
> > This was spotted while running tests on different Linux distributions,
> > with different mount point configurations.
>
> Which distros did what?

Actually it's not related to distros, but rather container runtime
(Docker) vs. non-container environment. With Docker (at least on my
environment) all mount points are private, which is not the case (by
default) when running the same UML environment not in a container. See
https://github.com/landlock-lsm/landlock-test-tools/pull/4

I'll update the description.