projects/linux·blob master · refs

679 lines · 14.7 KiB

1// SPDX-License-Identifier: GPL-2.0
2#define _GNU_SOURCE
3#include <errno.h>
4#include <fcntl.h>
5#include <limits.h>
6#include <sched.h>
7#include <stdio.h>
8#include <stdlib.h>
9#include <string.h>
10#include <linux/nsfs.h>
11#include <sys/ioctl.h>
12#include <sys/socket.h>
13#include <sys/stat.h>
14#include <sys/syscall.h>
15#include <sys/types.h>
16#include <sys/wait.h>
17#include <unistd.h>
18#include "../kselftest_harness.h"
19#include "../filesystems/utils.h"
20#include "wrappers.h"
21
22/*
23 * Test basic listns() functionality with the unified namespace tree.
24 * List all active namespaces globally.
25 */
26TEST(listns_basic_unified)
27{
28 struct ns_id_req req = {
29 .size = sizeof(req),
30 .spare = 0,
31 .ns_id = 0,
32 .ns_type = 0, /* All types */
33 .spare2 = 0,
34 .user_ns_id = 0, /* Global listing */
35 };
36 __u64 ns_ids[100];
37 ssize_t ret;
38
39 ret = sys_listns(&req, ns_ids, ARRAY_SIZE(ns_ids), 0);
40 if (ret < 0) {
41 if (errno == ENOSYS)
42 SKIP(return, "listns() not supported");
43 TH_LOG("listns failed: %s (errno=%d)", strerror(errno), errno);
44 ASSERT_TRUE(false);
45 }
46
47 /* Should find at least the initial namespaces */
48 ASSERT_GT(ret, 0);
49 TH_LOG("Found %zd active namespaces", ret);
50
51 /* Verify all returned IDs are non-zero */
52 for (ssize_t i = 0; i < ret; i++) {
53 ASSERT_NE(ns_ids[i], 0);
54 TH_LOG(" [%zd] ns_id: %llu", i, (unsigned long long)ns_ids[i]);
55 }
56}
57
58/*
59 * Test listns() with type filtering.
60 * List only network namespaces.
61 */
62TEST(listns_filter_by_type)
63{
64 struct ns_id_req req = {
65 .size = sizeof(req),
66 .spare = 0,
67 .ns_id = 0,
68 .ns_type = CLONE_NEWNET, /* Only network namespaces */
69 .spare2 = 0,
70 .user_ns_id = 0,
71 };
72 __u64 ns_ids[100];
73 ssize_t ret;
74
75 ret = sys_listns(&req, ns_ids, ARRAY_SIZE(ns_ids), 0);
76 if (ret < 0) {
77 if (errno == ENOSYS)
78 SKIP(return, "listns() not supported");
79 TH_LOG("listns failed: %s (errno=%d)", strerror(errno), errno);
80 ASSERT_TRUE(false);
81 }
82 ASSERT_GE(ret, 0);
83
84 /* Should find at least init_net */
85 ASSERT_GT(ret, 0);
86 TH_LOG("Found %zd active network namespaces", ret);
87
88 /* Verify we can open each namespace and it's actually a network namespace */
89 for (ssize_t i = 0; i < ret && i < 5; i++) {
90 struct nsfs_file_handle nsfh = {
91 .ns_id = ns_ids[i],
92 .ns_type = CLONE_NEWNET,
93 .ns_inum = 0,
94 };
95 struct file_handle *fh;
96 int fd;
97
98 fh = (struct file_handle *)malloc(sizeof(*fh) + sizeof(nsfh));
99 ASSERT_NE(fh, NULL);
100 fh->handle_bytes = sizeof(nsfh);
101 fh->handle_type = 0;
102 memcpy(fh->f_handle, &nsfh, sizeof(nsfh));
103
104 fd = open_by_handle_at(-10003, fh, O_RDONLY);
105 free(fh);
106
107 if (fd >= 0) {
108 int ns_type;
109 /* Verify it's a network namespace via ioctl */
110 ns_type = ioctl(fd, NS_GET_NSTYPE);
111 if (ns_type >= 0) {
112 ASSERT_EQ(ns_type, CLONE_NEWNET);
113 }
114 close(fd);
115 }
116 }
117}
118
119/*
120 * Test listns() pagination.
121 * List namespaces in batches.
122 */
123TEST(listns_pagination)
124{
125 struct ns_id_req req = {
126 .size = sizeof(req),
127 .spare = 0,
128 .ns_id = 0,
129 .ns_type = 0,
130 .spare2 = 0,
131 .user_ns_id = 0,
132 };
133 __u64 batch1[2], batch2[2];
134 ssize_t ret1, ret2;
135
136 /* Get first batch */
137 ret1 = sys_listns(&req, batch1, ARRAY_SIZE(batch1), 0);
138 if (ret1 < 0) {
139 if (errno == ENOSYS)
140 SKIP(return, "listns() not supported");
141 TH_LOG("listns failed: %s (errno=%d)", strerror(errno), errno);
142 ASSERT_TRUE(false);
143 }
144 ASSERT_GE(ret1, 0);
145
146 if (ret1 == 0)
147 SKIP(return, "No namespaces found");
148
149 TH_LOG("First batch: %zd namespaces", ret1);
150
151 /* Get second batch using last ID from first batch */
152 if (ret1 == ARRAY_SIZE(batch1)) {
153 req.ns_id = batch1[ret1 - 1];
154 ret2 = sys_listns(&req, batch2, ARRAY_SIZE(batch2), 0);
155 ASSERT_GE(ret2, 0);
156
157 TH_LOG("Second batch: %zd namespaces (after ns_id=%llu)",
158 ret2, (unsigned long long)req.ns_id);
159
160 /* If we got more results, verify IDs are monotonically increasing */
161 if (ret2 > 0) {
162 ASSERT_GT(batch2[0], batch1[ret1 - 1]);
163 TH_LOG("Pagination working: %llu > %llu",
164 (unsigned long long)batch2[0],
165 (unsigned long long)batch1[ret1 - 1]);
166 }
167 } else {
168 TH_LOG("All namespaces fit in first batch");
169 }
170}
171
172/*
173 * Test listns() with LISTNS_CURRENT_USER.
174 * List namespaces owned by current user namespace.
175 */
176TEST(listns_current_user)
177{
178 struct ns_id_req req = {
179 .size = sizeof(req),
180 .spare = 0,
181 .ns_id = 0,
182 .ns_type = 0,
183 .spare2 = 0,
184 .user_ns_id = LISTNS_CURRENT_USER,
185 };
186 __u64 ns_ids[100];
187 ssize_t ret;
188
189 ret = sys_listns(&req, ns_ids, ARRAY_SIZE(ns_ids), 0);
190 if (ret < 0) {
191 if (errno == ENOSYS)
192 SKIP(return, "listns() not supported");
193 TH_LOG("listns failed: %s (errno=%d)", strerror(errno), errno);
194 ASSERT_TRUE(false);
195 }
196 ASSERT_GE(ret, 0);
197
198 /* Should find at least the initial namespaces if we're in init_user_ns */
199 TH_LOG("Found %zd namespaces owned by current user namespace", ret);
200
201 for (ssize_t i = 0; i < ret; i++)
202 TH_LOG(" [%zd] ns_id: %llu", i, (unsigned long long)ns_ids[i]);
203}
204
205/*
206 * Test that listns() only returns active namespaces.
207 * Create a namespace, let it become inactive, verify it's not listed.
208 */
209TEST(listns_only_active)
210{
211 struct ns_id_req req = {
212 .size = sizeof(req),
213 .spare = 0,
214 .ns_id = 0,
215 .ns_type = CLONE_NEWNET,
216 .spare2 = 0,
217 .user_ns_id = 0,
218 };
219 __u64 ns_ids_before[100], ns_ids_after[100];
220 ssize_t ret_before, ret_after;
221 int pipefd[2];
222 pid_t pid;
223 __u64 new_ns_id = 0;
224 int status;
225
226 /* Get initial list */
227 ret_before = sys_listns(&req, ns_ids_before, ARRAY_SIZE(ns_ids_before), 0);
228 if (ret_before < 0) {
229 if (errno == ENOSYS)
230 SKIP(return, "listns() not supported");
231 TH_LOG("listns failed: %s (errno=%d)", strerror(errno), errno);
232 ASSERT_TRUE(false);
233 }
234 ASSERT_GE(ret_before, 0);
235
236 TH_LOG("Before: %zd active network namespaces", ret_before);
237
238 /* Create a new namespace in a child process and get its ID */
239 ASSERT_EQ(pipe(pipefd), 0);
240
241 pid = fork();
242 ASSERT_GE(pid, 0);
243
244 if (pid == 0) {
245 int fd;
246 __u64 ns_id;
247
248 close(pipefd[0]);
249
250 /* Create new network namespace */
251 if (unshare(CLONE_NEWNET) < 0) {
252 close(pipefd[1]);
253 exit(1);
254 }
255
256 /* Get its ID */
257 fd = open("/proc/self/ns/net", O_RDONLY);
258 if (fd < 0) {
259 close(pipefd[1]);
260 exit(1);
261 }
262
263 if (ioctl(fd, NS_GET_ID, &ns_id) < 0) {
264 close(fd);
265 close(pipefd[1]);
266 exit(1);
267 }
268 close(fd);
269
270 /* Send ID to parent */
271 write(pipefd[1], &ns_id, sizeof(ns_id));
272 close(pipefd[1]);
273
274 /* Keep namespace active briefly */
275 usleep(100000);
276 exit(0);
277 }
278
279 /* Parent reads the new namespace ID */
280 {
281 int bytes;
282
283 close(pipefd[1]);
284 bytes = read(pipefd[0], &new_ns_id, sizeof(new_ns_id));
285 close(pipefd[0]);
286
287 if (bytes == sizeof(new_ns_id)) {
288 __u64 ns_ids_during[100];
289 int ret_during;
290
291 TH_LOG("Child created namespace with ID %llu", (unsigned long long)new_ns_id);
292
293 /* List namespaces while child is still alive - should see new one */
294 ret_during = sys_listns(&req, ns_ids_during, ARRAY_SIZE(ns_ids_during), 0);
295 ASSERT_GE(ret_during, 0);
296 TH_LOG("During: %d active network namespaces", ret_during);
297
298 /* Should have more namespaces than before */
299 ASSERT_GE(ret_during, ret_before);
300 }
301 }
302
303 /* Wait for child to exit */
304 waitpid(pid, &status, 0);
305
306 /* Give time for namespace to become inactive */
307 usleep(100000);
308
309 /* List namespaces after child exits - should not see new one */
310 ret_after = sys_listns(&req, ns_ids_after, ARRAY_SIZE(ns_ids_after), 0);
311 ASSERT_GE(ret_after, 0);
312 TH_LOG("After: %zd active network namespaces", ret_after);
313
314 /* Verify the new namespace ID is not in the after list */
315 if (new_ns_id != 0) {
316 bool found = false;
317
318 for (ssize_t i = 0; i < ret_after; i++) {
319 if (ns_ids_after[i] == new_ns_id) {
320 found = true;
321 break;
322 }
323 }
324 ASSERT_FALSE(found);
325 }
326}
327
328/*
329 * Test listns() with specific user namespace ID.
330 * Create a user namespace and list namespaces it owns.
331 */
332TEST(listns_specific_userns)
333{
334 struct ns_id_req req = {
335 .size = sizeof(req),
336 .spare = 0,
337 .ns_id = 0,
338 .ns_type = 0,
339 .spare2 = 0,
340 .user_ns_id = 0, /* Will be filled with created userns ID */
341 };
342 __u64 ns_ids[100];
343 int sv[2];
344 pid_t pid;
345 int status;
346 __u64 user_ns_id = 0;
347 int bytes;
348 ssize_t ret;
349
350 ASSERT_EQ(socketpair(AF_UNIX, SOCK_STREAM, 0, sv), 0);
351
352 pid = fork();
353 ASSERT_GE(pid, 0);
354
355 if (pid == 0) {
356 int fd;
357 __u64 ns_id;
358 char buf;
359
360 close(sv[0]);
361
362 /* Create new user namespace */
363 if (setup_userns() < 0) {
364 close(sv[1]);
365 exit(1);
366 }
367
368 /* Get user namespace ID */
369 fd = open("/proc/self/ns/user", O_RDONLY);
370 if (fd < 0) {
371 close(sv[1]);
372 exit(1);
373 }
374
375 if (ioctl(fd, NS_GET_ID, &ns_id) < 0) {
376 close(fd);
377 close(sv[1]);
378 exit(1);
379 }
380 close(fd);
381
382 /* Send ID to parent */
383 if (write(sv[1], &ns_id, sizeof(ns_id)) != sizeof(ns_id)) {
384 close(sv[1]);
385 exit(1);
386 }
387
388 /* Create some namespaces owned by this user namespace */
389 unshare(CLONE_NEWNET);
390 unshare(CLONE_NEWUTS);
391
392 /* Wait for parent signal */
393 if (read(sv[1], &buf, 1) != 1) {
394 close(sv[1]);
395 exit(1);
396 }
397 close(sv[1]);
398 exit(0);
399 }
400
401 /* Parent */
402 close(sv[1]);
403 bytes = read(sv[0], &user_ns_id, sizeof(user_ns_id));
404
405 if (bytes != sizeof(user_ns_id)) {
406 close(sv[0]);
407 kill(pid, SIGKILL);
408 waitpid(pid, NULL, 0);
409 SKIP(return, "Failed to get user namespace ID from child");
410 }
411
412 TH_LOG("Child created user namespace with ID %llu", (unsigned long long)user_ns_id);
413
414 /* List namespaces owned by this user namespace */
415 req.user_ns_id = user_ns_id;
416 ret = sys_listns(&req, ns_ids, ARRAY_SIZE(ns_ids), 0);
417
418 if (ret < 0) {
419 TH_LOG("listns failed: %s (errno=%d)", strerror(errno), errno);
420 close(sv[0]);
421 kill(pid, SIGKILL);
422 waitpid(pid, NULL, 0);
423 if (errno == ENOSYS) {
424 SKIP(return, "listns() not supported");
425 }
426 ASSERT_GE(ret, 0);
427 }
428
429 TH_LOG("Found %zd namespaces owned by user namespace %llu", ret,
430 (unsigned long long)user_ns_id);
431
432 /* Should find at least the network and UTS namespaces we created */
433 if (ret > 0) {
434 for (ssize_t i = 0; i < ret && i < 10; i++)
435 TH_LOG(" [%zd] ns_id: %llu", i, (unsigned long long)ns_ids[i]);
436 }
437
438 /* Signal child to exit */
439 if (write(sv[0], "X", 1) != 1) {
440 close(sv[0]);
441 kill(pid, SIGKILL);
442 waitpid(pid, NULL, 0);
443 ASSERT_TRUE(false);
444 }
445 close(sv[0]);
446 waitpid(pid, &status, 0);
447}
448
449/*
450 * Test listns() with multiple namespace types filter.
451 */
452TEST(listns_multiple_types)
453{
454 struct ns_id_req req = {
455 .size = sizeof(req),
456 .spare = 0,
457 .ns_id = 0,
458 .ns_type = CLONE_NEWNET | CLONE_NEWUTS, /* Network and UTS */
459 .spare2 = 0,
460 .user_ns_id = 0,
461 };
462 __u64 ns_ids[100];
463 ssize_t ret;
464
465 ret = sys_listns(&req, ns_ids, ARRAY_SIZE(ns_ids), 0);
466 if (ret < 0) {
467 if (errno == ENOSYS)
468 SKIP(return, "listns() not supported");
469 TH_LOG("listns failed: %s (errno=%d)", strerror(errno), errno);
470 ASSERT_TRUE(false);
471 }
472 ASSERT_GE(ret, 0);
473
474 TH_LOG("Found %zd active network/UTS namespaces", ret);
475
476 for (ssize_t i = 0; i < ret; i++)
477 TH_LOG(" [%zd] ns_id: %llu", i, (unsigned long long)ns_ids[i]);
478}
479
480/*
481 * Test that hierarchical active reference propagation keeps parent
482 * user namespaces visible in listns().
483 */
484TEST(listns_hierarchical_visibility)
485{
486 struct ns_id_req req = {
487 .size = sizeof(req),
488 .spare = 0,
489 .ns_id = 0,
490 .ns_type = CLONE_NEWUSER,
491 .spare2 = 0,
492 .user_ns_id = 0,
493 };
494 __u64 parent_ns_id = 0, child_ns_id = 0;
495 int sv[2];
496 pid_t pid;
497 int status;
498 int bytes;
499 __u64 ns_ids[100];
500 ssize_t ret;
501 bool found_parent, found_child;
502
503 ASSERT_EQ(socketpair(AF_UNIX, SOCK_STREAM, 0, sv), 0);
504
505 pid = fork();
506 ASSERT_GE(pid, 0);
507
508 if (pid == 0) {
509 int fd;
510 char buf;
511
512 close(sv[0]);
513
514 /* Create parent user namespace */
515 if (setup_userns() < 0) {
516 close(sv[1]);
517 exit(1);
518 }
519
520 fd = open("/proc/self/ns/user", O_RDONLY);
521 if (fd < 0) {
522 close(sv[1]);
523 exit(1);
524 }
525
526 if (ioctl(fd, NS_GET_ID, &parent_ns_id) < 0) {
527 close(fd);
528 close(sv[1]);
529 exit(1);
530 }
531 close(fd);
532
533 /* Create child user namespace */
534 if (setup_userns() < 0) {
535 close(sv[1]);
536 exit(1);
537 }
538
539 fd = open("/proc/self/ns/user", O_RDONLY);
540 if (fd < 0) {
541 close(sv[1]);
542 exit(1);
543 }
544
545 if (ioctl(fd, NS_GET_ID, &child_ns_id) < 0) {
546 close(fd);
547 close(sv[1]);
548 exit(1);
549 }
550 close(fd);
551
552 /* Send both IDs to parent */
553 if (write(sv[1], &parent_ns_id, sizeof(parent_ns_id)) != sizeof(parent_ns_id)) {
554 close(sv[1]);
555 exit(1);
556 }
557 if (write(sv[1], &child_ns_id, sizeof(child_ns_id)) != sizeof(child_ns_id)) {
558 close(sv[1]);
559 exit(1);
560 }
561
562 /* Wait for parent signal */
563 if (read(sv[1], &buf, 1) != 1) {
564 close(sv[1]);
565 exit(1);
566 }
567 close(sv[1]);
568 exit(0);
569 }
570
571 /* Parent */
572 close(sv[1]);
573
574 /* Read both namespace IDs */
575 bytes = read(sv[0], &parent_ns_id, sizeof(parent_ns_id));
576 bytes += read(sv[0], &child_ns_id, sizeof(child_ns_id));
577
578 if (bytes != (int)(2 * sizeof(__u64))) {
579 close(sv[0]);
580 kill(pid, SIGKILL);
581 waitpid(pid, NULL, 0);
582 SKIP(return, "Failed to get namespace IDs from child");
583 }
584
585 TH_LOG("Parent user namespace ID: %llu", (unsigned long long)parent_ns_id);
586 TH_LOG("Child user namespace ID: %llu", (unsigned long long)child_ns_id);
587
588 /* List all user namespaces */
589 ret = sys_listns(&req, ns_ids, ARRAY_SIZE(ns_ids), 0);
590
591 if (ret < 0 && errno == ENOSYS) {
592 close(sv[0]);
593 kill(pid, SIGKILL);
594 waitpid(pid, NULL, 0);
595 SKIP(return, "listns() not supported");
596 }
597
598 ASSERT_GE(ret, 0);
599 TH_LOG("Found %zd active user namespaces", ret);
600
601 /* Both parent and child should be visible (active due to child process) */
602 found_parent = false;
603 found_child = false;
604 for (ssize_t i = 0; i < ret; i++) {
605 if (ns_ids[i] == parent_ns_id)
606 found_parent = true;
607 if (ns_ids[i] == child_ns_id)
608 found_child = true;
609 }
610
611 TH_LOG("Parent namespace %s, child namespace %s",
612 found_parent ? "found" : "NOT FOUND",
613 found_child ? "found" : "NOT FOUND");
614
615 ASSERT_TRUE(found_child);
616 /* With hierarchical propagation, parent should also be active */
617 ASSERT_TRUE(found_parent);
618
619 /* Signal child to exit */
620 if (write(sv[0], "X", 1) != 1) {
621 close(sv[0]);
622 kill(pid, SIGKILL);
623 waitpid(pid, NULL, 0);
624 ASSERT_TRUE(false);
625 }
626 close(sv[0]);
627 waitpid(pid, &status, 0);
628}
629
630/*
631 * Test error cases for listns().
632 */
633TEST(listns_error_cases)
634{
635 struct ns_id_req req = {
636 .size = sizeof(req),
637 .spare = 0,
638 .ns_id = 0,
639 .ns_type = 0,
640 .spare2 = 0,
641 .user_ns_id = 0,
642 };
643 __u64 ns_ids[10];
644 int ret;
645
646 /* Test with invalid flags */
647 ret = sys_listns(&req, ns_ids, ARRAY_SIZE(ns_ids), 0xFFFF);
648 if (errno == ENOSYS) {
649 /* listns() not supported, skip this check */
650 } else {
651 ASSERT_LT(ret, 0);
652 ASSERT_EQ(errno, EINVAL);
653 }
654
655 /* Test with NULL ns_ids array */
656 ret = sys_listns(&req, NULL, 10, 0);
657 ASSERT_LT(ret, 0);
658
659 /* Test with invalid spare field */
660 req.spare = 1;
661 ret = sys_listns(&req, ns_ids, ARRAY_SIZE(ns_ids), 0);
662 if (errno == ENOSYS) {
663 /* listns() not supported, skip this check */
664 } else {
665 ASSERT_LT(ret, 0);
666 ASSERT_EQ(errno, EINVAL);
667 }
668 req.spare = 0;
669
670 /* Test with huge nr_ns_ids */
671 ret = sys_listns(&req, ns_ids, 2000000, 0);
672 if (errno == ENOSYS) {
673 /* listns() not supported, skip this check */
674 } else {
675 ASSERT_LT(ret, 0);
676 }
677}
678
679TEST_HARNESS_MAIN