Unverified Commit a1579f6b authored by Christian Brauner's avatar Christian Brauner
Browse files

selftests/ovl: add third selftest for "override_creds" 

Add a simple test to verify that the new "override_creds" option works.

Link: https://lore.kernel.org/r/20250219-work-overlayfs-v3-4-46af55e4ceda@kernel.org


Reviewed-by: default avatarAmir Goldstein <amir73il@gmail.com>
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent 6e5ed658

tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c

+80 −0
Original line number Diff line number Diff line
@@ -8,6 +8,7 @@ 
#include <string.h>

#include <sys/socket.h>

#include <sys/stat.h>

#include <sys/sysmacros.h>

#include <sys/mount.h>

#include <unistd.h>
@@ -442,4 +443,83 @@ TEST_F(set_layers_via_fds, set_override_creds_invalid) 
	ASSERT_EQ(close(fd_userns2), 0);

}



TEST_F(set_layers_via_fds, set_override_creds_nomknod)

{

	int fd_context, fd_tmpfs, fd_overlay;

	int layer_fds[] = { [0 ... 3] = -EBADF };

	pid_t pid;

	int pidfd;



	ASSERT_EQ(unshare(CLONE_NEWNS), 0);

	ASSERT_EQ(sys_mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL), 0);



	fd_context = sys_fsopen("tmpfs", 0);

	ASSERT_GE(fd_context, 0);



	ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_CMD_CREATE, NULL, NULL, 0), 0);

	fd_tmpfs = sys_fsmount(fd_context, 0, 0);

	ASSERT_GE(fd_tmpfs, 0);

	ASSERT_EQ(close(fd_context), 0);



	ASSERT_EQ(mkdirat(fd_tmpfs, "w", 0755), 0);

	ASSERT_EQ(mkdirat(fd_tmpfs, "u", 0755), 0);

	ASSERT_EQ(mkdirat(fd_tmpfs, "l1", 0755), 0);

	ASSERT_EQ(mkdirat(fd_tmpfs, "l2", 0755), 0);



	layer_fds[0] = openat(fd_tmpfs, "w", O_DIRECTORY);

	ASSERT_GE(layer_fds[0], 0);



	layer_fds[1] = openat(fd_tmpfs, "u", O_DIRECTORY);

	ASSERT_GE(layer_fds[1], 0);



	layer_fds[2] = openat(fd_tmpfs, "l1", O_DIRECTORY);

	ASSERT_GE(layer_fds[2], 0);



	layer_fds[3] = openat(fd_tmpfs, "l2", O_DIRECTORY);

	ASSERT_GE(layer_fds[3], 0);



	ASSERT_EQ(sys_move_mount(fd_tmpfs, "", -EBADF, "/tmp", MOVE_MOUNT_F_EMPTY_PATH), 0);

	ASSERT_EQ(close(fd_tmpfs), 0);



	fd_context = sys_fsopen("overlay", 0);

	ASSERT_GE(fd_context, 0);



	ASSERT_NE(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir", NULL, layer_fds[2]), 0);



	ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "workdir",   NULL, layer_fds[0]), 0);

	ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "upperdir",  NULL, layer_fds[1]), 0);

	ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir+", NULL, layer_fds[2]), 0);

	ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir+", NULL, layer_fds[3]), 0);

	ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FLAG, "userxattr", NULL, 0), 0);



	pid = create_child(&pidfd, 0);

	ASSERT_GE(pid, 0);

	if (pid == 0) {

		if (!cap_down(CAP_MKNOD))

			_exit(EXIT_FAILURE);



		if (!cap_down(CAP_SYS_ADMIN))

			_exit(EXIT_FAILURE);



		if (sys_fsconfig(fd_context, FSCONFIG_SET_FLAG, "override_creds", NULL, 0))

			_exit(EXIT_FAILURE);



		_exit(EXIT_SUCCESS);

	}

	ASSERT_EQ(sys_waitid(P_PID, pid, NULL, WEXITED), 0);

	ASSERT_GE(close(pidfd), 0);



	ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_CMD_CREATE, NULL, NULL, 0), 0);



	fd_overlay = sys_fsmount(fd_context, 0, 0);

	ASSERT_GE(fd_overlay, 0);



	ASSERT_EQ(sys_move_mount(fd_overlay, "", -EBADF, "/set_layers_via_fds", MOVE_MOUNT_F_EMPTY_PATH), 0);

	ASSERT_EQ(mknodat(fd_overlay, "dev-zero", S_IFCHR | 0644, makedev(1, 5)), -1);

	ASSERT_EQ(errno, EPERM);



	ASSERT_EQ(close(fd_context), 0);

	ASSERT_EQ(close(fd_overlay), 0);

}



TEST_HARNESS_MAIN

tools/testing/selftests/filesystems/utils.c

+27 −0
Original line number Diff line number Diff line
@@ -472,3 +472,30 @@ int caps_down(void) 
	cap_free(caps);

	return fret;

}



/* cap_down - lower an effective cap */

int cap_down(cap_value_t down)

{

	bool fret = false;

	cap_t caps = NULL;

	cap_value_t cap = down;

	int ret = -1;



	caps = cap_get_proc();

	if (!caps)

		goto out;



	ret = cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, 0);

	if (ret)

		goto out;



	ret = cap_set_proc(caps);

	if (ret)

		goto out;



	fret = true;



out:

	cap_free(caps);

	return fret;

}

tools/testing/selftests/filesystems/utils.h

+1 −0
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@ extern int get_userns_fd(unsigned long nsid, unsigned long hostid, 
			 unsigned long range);



extern int caps_down(void);

extern int cap_down(cap_value_t down);



extern bool switch_ids(uid_t uid, gid_t gid);