projects/linux·blob master · refs

671 lines · 19.1 KiB

1// SPDX-License-Identifier: GPL-2.0
2
3#define _GNU_SOURCE
4#include <errno.h>
5#include <fcntl.h>
6#include <limits.h>
7#include <linux/types.h>
8#include <sched.h>
9#include <signal.h>
10#include <stdio.h>
11#include <stdlib.h>
12#include <string.h>
13#include <syscall.h>
14#include <sys/prctl.h>
15#include <sys/wait.h>
16#include <unistd.h>
17#include <sys/socket.h>
18#include <sys/stat.h>
19
20#include "pidfd.h"
21#include "kselftest_harness.h"
22
23enum {
24 PIDFD_NS_USER,
25 PIDFD_NS_MNT,
26 PIDFD_NS_PID,
27 PIDFD_NS_UTS,
28 PIDFD_NS_IPC,
29 PIDFD_NS_NET,
30 PIDFD_NS_CGROUP,
31 PIDFD_NS_PIDCLD,
32 PIDFD_NS_TIME,
33 PIDFD_NS_TIMECLD,
34 PIDFD_NS_MAX
35};
36
37const struct ns_info {
38 const char *name;
39 int flag;
40 unsigned int pidfd_ioctl;
41} ns_info[] = {
42 [PIDFD_NS_USER] = { "user", CLONE_NEWUSER, PIDFD_GET_USER_NAMESPACE, },
43 [PIDFD_NS_MNT] = { "mnt", CLONE_NEWNS, PIDFD_GET_MNT_NAMESPACE, },
44 [PIDFD_NS_PID] = { "pid", CLONE_NEWPID, PIDFD_GET_PID_NAMESPACE, },
45 [PIDFD_NS_UTS] = { "uts", CLONE_NEWUTS, PIDFD_GET_UTS_NAMESPACE, },
46 [PIDFD_NS_IPC] = { "ipc", CLONE_NEWIPC, PIDFD_GET_IPC_NAMESPACE, },
47 [PIDFD_NS_NET] = { "net", CLONE_NEWNET, PIDFD_GET_NET_NAMESPACE, },
48 [PIDFD_NS_CGROUP] = { "cgroup", CLONE_NEWCGROUP, PIDFD_GET_CGROUP_NAMESPACE, },
49 [PIDFD_NS_TIME] = { "time", CLONE_NEWTIME, PIDFD_GET_TIME_NAMESPACE, },
50 [PIDFD_NS_PIDCLD] = { "pid_for_children", 0, PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE, },
51 [PIDFD_NS_TIMECLD] = { "time_for_children", 0, PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE, },
52};
53
54FIXTURE(current_nsset)
55{
56 pid_t pid;
57 int pidfd;
58 int nsfds[PIDFD_NS_MAX];
59 int child_pidfd_derived_nsfds[PIDFD_NS_MAX];
60
61 pid_t child_pid_exited;
62 int child_pidfd_exited;
63
64 pid_t child_pid1;
65 int child_pidfd1;
66 int child_nsfds1[PIDFD_NS_MAX];
67 int child_pidfd_derived_nsfds1[PIDFD_NS_MAX];
68
69 pid_t child_pid2;
70 int child_pidfd2;
71 int child_nsfds2[PIDFD_NS_MAX];
72 int child_pidfd_derived_nsfds2[PIDFD_NS_MAX];
73};
74
75static bool switch_timens(void)
76{
77 int fd, ret;
78
79 if (unshare(CLONE_NEWTIME))
80 return false;
81
82 fd = open("/proc/self/ns/time_for_children", O_RDONLY | O_CLOEXEC);
83 if (fd < 0)
84 return false;
85
86 ret = setns(fd, CLONE_NEWTIME);
87 close(fd);
88 return ret == 0;
89}
90
91FIXTURE_SETUP(current_nsset)
92{
93 int i, proc_fd, ret;
94 int ipc_sockets[2];
95 char c;
96
97 for (i = 0; i < PIDFD_NS_MAX; i++) {
98 self->nsfds[i] = -EBADF;
99 self->child_nsfds1[i] = -EBADF;
100 self->child_nsfds2[i] = -EBADF;
101 self->child_pidfd_derived_nsfds[i] = -EBADF;
102 self->child_pidfd_derived_nsfds1[i] = -EBADF;
103 self->child_pidfd_derived_nsfds2[i] = -EBADF;
104 }
105
106 proc_fd = open("/proc/self/ns", O_DIRECTORY | O_CLOEXEC);
107 ASSERT_GE(proc_fd, 0) {
108 TH_LOG("%m - Failed to open /proc/self/ns");
109 }
110
111 self->pid = getpid();
112 self->pidfd = sys_pidfd_open(self->pid, 0);
113 EXPECT_GT(self->pidfd, 0) {
114 TH_LOG("%m - Failed to open pidfd for process %d", self->pid);
115 }
116
117 for (i = 0; i < PIDFD_NS_MAX; i++) {
118 const struct ns_info *info = &ns_info[i];
119 self->nsfds[i] = openat(proc_fd, info->name, O_RDONLY | O_CLOEXEC);
120 if (self->nsfds[i] < 0) {
121 EXPECT_EQ(errno, ENOENT) {
122 TH_LOG("%m - Failed to open %s namespace for process %d",
123 info->name, self->pid);
124 }
125 }
126
127 self->child_pidfd_derived_nsfds[i] = ioctl(self->pidfd, info->pidfd_ioctl, 0);
128 if (self->child_pidfd_derived_nsfds[i] < 0) {
129 EXPECT_EQ(errno, EOPNOTSUPP) {
130 TH_LOG("%m - Failed to derive %s namespace from pidfd of process %d",
131 info->name, self->pid);
132 }
133 }
134 }
135
136 /* Create task that exits right away. */
137 self->child_pid_exited = create_child(&self->child_pidfd_exited, 0);
138 EXPECT_GE(self->child_pid_exited, 0);
139
140 if (self->child_pid_exited == 0) {
141 if (self->nsfds[PIDFD_NS_USER] >= 0 && unshare(CLONE_NEWUSER) < 0)
142 _exit(EXIT_FAILURE);
143 if (self->nsfds[PIDFD_NS_NET] >= 0 && unshare(CLONE_NEWNET) < 0)
144 _exit(EXIT_FAILURE);
145 _exit(EXIT_SUCCESS);
146 }
147
148 ASSERT_EQ(sys_waitid(P_PID, self->child_pid_exited, NULL, WEXITED | WNOWAIT), 0);
149
150 self->pidfd = sys_pidfd_open(self->pid, 0);
151 EXPECT_GE(self->pidfd, 0) {
152 TH_LOG("%m - Failed to open pidfd for process %d", self->pid);
153 }
154
155 ret = socketpair(AF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0, ipc_sockets);
156 EXPECT_EQ(ret, 0);
157
158 /* Create tasks that will be stopped. */
159 if (self->nsfds[PIDFD_NS_USER] >= 0 && self->nsfds[PIDFD_NS_PID] >= 0)
160 self->child_pid1 = create_child(&self->child_pidfd1, CLONE_NEWUSER | CLONE_NEWPID);
161 else if (self->nsfds[PIDFD_NS_PID] >= 0)
162 self->child_pid1 = create_child(&self->child_pidfd1, CLONE_NEWPID);
163 else if (self->nsfds[PIDFD_NS_USER] >= 0)
164 self->child_pid1 = create_child(&self->child_pidfd1, CLONE_NEWUSER);
165 else
166 self->child_pid1 = create_child(&self->child_pidfd1, 0);
167 EXPECT_GE(self->child_pid1, 0);
168
169 if (self->child_pid1 == 0) {
170 close(ipc_sockets[0]);
171
172 if (self->nsfds[PIDFD_NS_MNT] >= 0 && unshare(CLONE_NEWNS) < 0) {
173 TH_LOG("%m - Failed to unshare mount namespace for process %d", self->pid);
174 _exit(EXIT_FAILURE);
175 }
176 if (self->nsfds[PIDFD_NS_CGROUP] >= 0 && unshare(CLONE_NEWCGROUP) < 0) {
177 TH_LOG("%m - Failed to unshare cgroup namespace for process %d", self->pid);
178 _exit(EXIT_FAILURE);
179 }
180 if (self->nsfds[PIDFD_NS_IPC] >= 0 && unshare(CLONE_NEWIPC) < 0) {
181 TH_LOG("%m - Failed to unshare ipc namespace for process %d", self->pid);
182 _exit(EXIT_FAILURE);
183 }
184 if (self->nsfds[PIDFD_NS_UTS] >= 0 && unshare(CLONE_NEWUTS) < 0) {
185 TH_LOG("%m - Failed to unshare uts namespace for process %d", self->pid);
186 _exit(EXIT_FAILURE);
187 }
188 if (self->nsfds[PIDFD_NS_NET] >= 0 && unshare(CLONE_NEWNET) < 0) {
189 TH_LOG("%m - Failed to unshare net namespace for process %d", self->pid);
190 _exit(EXIT_FAILURE);
191 }
192 if (self->nsfds[PIDFD_NS_TIME] >= 0 && !switch_timens()) {
193 TH_LOG("%m - Failed to unshare time namespace for process %d", self->pid);
194 _exit(EXIT_FAILURE);
195 }
196
197 if (write_nointr(ipc_sockets[1], "1", 1) < 0)
198 _exit(EXIT_FAILURE);
199
200 close(ipc_sockets[1]);
201
202 pause();
203 _exit(EXIT_SUCCESS);
204 }
205
206 close(ipc_sockets[1]);
207 ASSERT_EQ(read_nointr(ipc_sockets[0], &c, 1), 1);
208 close(ipc_sockets[0]);
209
210 ret = socketpair(AF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0, ipc_sockets);
211 EXPECT_EQ(ret, 0);
212
213 if (self->nsfds[PIDFD_NS_USER] >= 0 && self->nsfds[PIDFD_NS_PID] >= 0)
214 self->child_pid2 = create_child(&self->child_pidfd2, CLONE_NEWUSER | CLONE_NEWPID);
215 else if (self->nsfds[PIDFD_NS_PID] >= 0)
216 self->child_pid2 = create_child(&self->child_pidfd2, CLONE_NEWPID);
217 else if (self->nsfds[PIDFD_NS_USER] >= 0)
218 self->child_pid2 = create_child(&self->child_pidfd2, CLONE_NEWUSER);
219 else
220 self->child_pid2 = create_child(&self->child_pidfd2, 0);
221 EXPECT_GE(self->child_pid2, 0);
222
223 if (self->child_pid2 == 0) {
224 close(ipc_sockets[0]);
225
226 if (self->nsfds[PIDFD_NS_MNT] >= 0 && unshare(CLONE_NEWNS) < 0) {
227 TH_LOG("%m - Failed to unshare mount namespace for process %d", self->pid);
228 _exit(EXIT_FAILURE);
229 }
230 if (self->nsfds[PIDFD_NS_CGROUP] >= 0 && unshare(CLONE_NEWCGROUP) < 0) {
231 TH_LOG("%m - Failed to unshare cgroup namespace for process %d", self->pid);
232 _exit(EXIT_FAILURE);
233 }
234 if (self->nsfds[PIDFD_NS_IPC] >= 0 && unshare(CLONE_NEWIPC) < 0) {
235 TH_LOG("%m - Failed to unshare ipc namespace for process %d", self->pid);
236 _exit(EXIT_FAILURE);
237 }
238 if (self->nsfds[PIDFD_NS_UTS] >= 0 && unshare(CLONE_NEWUTS) < 0) {
239 TH_LOG("%m - Failed to unshare uts namespace for process %d", self->pid);
240 _exit(EXIT_FAILURE);
241 }
242 if (self->nsfds[PIDFD_NS_NET] >= 0 && unshare(CLONE_NEWNET) < 0) {
243 TH_LOG("%m - Failed to unshare net namespace for process %d", self->pid);
244 _exit(EXIT_FAILURE);
245 }
246 if (self->nsfds[PIDFD_NS_TIME] >= 0 && !switch_timens()) {
247 TH_LOG("%m - Failed to unshare time namespace for process %d", self->pid);
248 _exit(EXIT_FAILURE);
249 }
250
251 if (write_nointr(ipc_sockets[1], "1", 1) < 0)
252 _exit(EXIT_FAILURE);
253
254 close(ipc_sockets[1]);
255
256 pause();
257 _exit(EXIT_SUCCESS);
258 }
259
260 close(ipc_sockets[1]);
261 ASSERT_EQ(read_nointr(ipc_sockets[0], &c, 1), 1);
262 close(ipc_sockets[0]);
263
264 for (i = 0; i < PIDFD_NS_MAX; i++) {
265 char p[100];
266
267 const struct ns_info *info = &ns_info[i];
268
269 self->nsfds[i] = openat(proc_fd, info->name, O_RDONLY | O_CLOEXEC);
270 if (self->nsfds[i] < 0) {
271 EXPECT_EQ(errno, ENOENT) {
272 TH_LOG("%m - Failed to open %s namespace for process %d",
273 info->name, self->pid);
274 }
275 }
276
277 ret = snprintf(p, sizeof(p), "/proc/%d/ns/%s",
278 self->child_pid1, info->name);
279 EXPECT_GT(ret, 0);
280 EXPECT_LT(ret, sizeof(p));
281
282 self->child_nsfds1[i] = open(p, O_RDONLY | O_CLOEXEC);
283 if (self->child_nsfds1[i] < 0) {
284 EXPECT_EQ(errno, ENOENT) {
285 TH_LOG("%m - Failed to open %s namespace for process %d",
286 info->name, self->child_pid1);
287 }
288 }
289
290 ret = snprintf(p, sizeof(p), "/proc/%d/ns/%s",
291 self->child_pid2, info->name);
292 EXPECT_GT(ret, 0);
293 EXPECT_LT(ret, sizeof(p));
294
295 self->child_nsfds2[i] = open(p, O_RDONLY | O_CLOEXEC);
296 if (self->child_nsfds2[i] < 0) {
297 EXPECT_EQ(errno, ENOENT) {
298 TH_LOG("%m - Failed to open %s namespace for process %d",
299 info->name, self->child_pid1);
300 }
301 }
302
303 self->child_pidfd_derived_nsfds1[i] = ioctl(self->child_pidfd1, info->pidfd_ioctl, 0);
304 if (self->child_pidfd_derived_nsfds1[i] < 0) {
305 EXPECT_EQ(errno, EOPNOTSUPP) {
306 TH_LOG("%m - Failed to derive %s namespace from pidfd of process %d",
307 info->name, self->child_pid1);
308 }
309 }
310
311 self->child_pidfd_derived_nsfds2[i] = ioctl(self->child_pidfd2, info->pidfd_ioctl, 0);
312 if (self->child_pidfd_derived_nsfds2[i] < 0) {
313 EXPECT_EQ(errno, EOPNOTSUPP) {
314 TH_LOG("%m - Failed to derive %s namespace from pidfd of process %d",
315 info->name, self->child_pid2);
316 }
317 }
318 }
319
320 close(proc_fd);
321}
322
323FIXTURE_TEARDOWN(current_nsset)
324{
325 int i;
326
327 ASSERT_EQ(sys_pidfd_send_signal(self->child_pidfd1,
328 SIGKILL, NULL, 0), 0);
329 ASSERT_EQ(sys_pidfd_send_signal(self->child_pidfd2,
330 SIGKILL, NULL, 0), 0);
331
332 for (i = 0; i < PIDFD_NS_MAX; i++) {
333 if (self->nsfds[i] >= 0)
334 close(self->nsfds[i]);
335 if (self->child_nsfds1[i] >= 0)
336 close(self->child_nsfds1[i]);
337 if (self->child_nsfds2[i] >= 0)
338 close(self->child_nsfds2[i]);
339 if (self->child_pidfd_derived_nsfds[i] >= 0)
340 close(self->child_pidfd_derived_nsfds[i]);
341 if (self->child_pidfd_derived_nsfds1[i] >= 0)
342 close(self->child_pidfd_derived_nsfds1[i]);
343 if (self->child_pidfd_derived_nsfds2[i] >= 0)
344 close(self->child_pidfd_derived_nsfds2[i]);
345 }
346
347 if (self->child_pidfd1 >= 0)
348 EXPECT_EQ(0, close(self->child_pidfd1));
349 if (self->child_pidfd2 >= 0)
350 EXPECT_EQ(0, close(self->child_pidfd2));
351 ASSERT_EQ(sys_waitid(P_PID, self->child_pid_exited, NULL, WEXITED), 0);
352 ASSERT_EQ(sys_waitid(P_PID, self->child_pid1, NULL, WEXITED), 0);
353 ASSERT_EQ(sys_waitid(P_PID, self->child_pid2, NULL, WEXITED), 0);
354}
355
356static int preserve_ns(const int pid, const char *ns)
357{
358 int ret;
359 char path[50];
360
361 ret = snprintf(path, sizeof(path), "/proc/%d/ns/%s", pid, ns);
362 if (ret < 0 || (size_t)ret >= sizeof(path))
363 return -EIO;
364
365 return open(path, O_RDONLY | O_CLOEXEC);
366}
367
368static int in_same_namespace(int ns_fd1, pid_t pid2, const char *ns)
369{
370 int ns_fd2 = -EBADF;
371 int ret = -1;
372 struct stat ns_st1, ns_st2;
373
374 ret = fstat(ns_fd1, &ns_st1);
375 if (ret < 0)
376 return -1;
377
378 ns_fd2 = preserve_ns(pid2, ns);
379 if (ns_fd2 < 0)
380 return -1;
381
382 ret = fstat(ns_fd2, &ns_st2);
383 close(ns_fd2);
384 if (ret < 0)
385 return -1;
386
387 /* processes are in the same namespace */
388 if ((ns_st1.st_dev == ns_st2.st_dev) &&
389 (ns_st1.st_ino == ns_st2.st_ino))
390 return 1;
391
392 /* processes are in different namespaces */
393 return 0;
394}
395
396/* Test that we can't pass garbage to the kernel. */
397TEST_F(current_nsset, invalid_flags)
398{
399 ASSERT_NE(setns(self->pidfd, 0), 0);
400 EXPECT_EQ(errno, EINVAL);
401
402 ASSERT_NE(setns(self->pidfd, -1), 0);
403 EXPECT_EQ(errno, EINVAL);
404
405 ASSERT_NE(setns(self->pidfd, CLONE_VM), 0);
406 EXPECT_EQ(errno, EINVAL);
407
408 ASSERT_NE(setns(self->pidfd, CLONE_NEWUSER | CLONE_VM), 0);
409 EXPECT_EQ(errno, EINVAL);
410}
411
412/* Test that we can't attach to a task that has already exited. */
413TEST_F(current_nsset, pidfd_exited_child)
414{
415 int i;
416 pid_t pid;
417
418 ASSERT_NE(setns(self->child_pidfd_exited, CLONE_NEWUSER | CLONE_NEWNET),
419 0);
420 EXPECT_EQ(errno, ESRCH);
421
422 pid = getpid();
423 for (i = 0; i < PIDFD_NS_MAX; i++) {
424 const struct ns_info *info = &ns_info[i];
425 /* Verify that we haven't changed any namespaces. */
426 if (self->nsfds[i] >= 0)
427 ASSERT_EQ(in_same_namespace(self->nsfds[i], pid, info->name), 1);
428 }
429}
430
431TEST_F(current_nsset, pidfd_incremental_setns)
432{
433 int i;
434 pid_t pid;
435
436 pid = getpid();
437 for (i = 0; i < PIDFD_NS_MAX; i++) {
438 const struct ns_info *info = &ns_info[i];
439 int nsfd;
440
441 if (self->child_nsfds1[i] < 0)
442 continue;
443
444 if (info->flag) {
445 ASSERT_EQ(setns(self->child_pidfd1, info->flag), 0) {
446 TH_LOG("%m - Failed to setns to %s namespace of %d via pidfd %d",
447 info->name, self->child_pid1,
448 self->child_pidfd1);
449 }
450 }
451
452 /* Verify that we have changed to the correct namespaces. */
453 if (info->flag == CLONE_NEWPID)
454 nsfd = self->nsfds[i];
455 else
456 nsfd = self->child_nsfds1[i];
457 ASSERT_EQ(in_same_namespace(nsfd, pid, info->name), 1) {
458 TH_LOG("setns failed to place us correctly into %s namespace of %d via pidfd %d",
459 info->name, self->child_pid1,
460 self->child_pidfd1);
461 }
462 TH_LOG("Managed to correctly setns to %s namespace of %d via pidfd %d",
463 info->name, self->child_pid1, self->child_pidfd1);
464 }
465}
466
467TEST_F(current_nsset, nsfd_incremental_setns)
468{
469 int i;
470 pid_t pid;
471
472 pid = getpid();
473 for (i = 0; i < PIDFD_NS_MAX; i++) {
474 const struct ns_info *info = &ns_info[i];
475 int nsfd;
476
477 if (self->child_nsfds1[i] < 0)
478 continue;
479
480 if (info->flag) {
481 ASSERT_EQ(setns(self->child_nsfds1[i], info->flag), 0) {
482 TH_LOG("%m - Failed to setns to %s namespace of %d via nsfd %d",
483 info->name, self->child_pid1,
484 self->child_nsfds1[i]);
485 }
486 }
487
488 /* Verify that we have changed to the correct namespaces. */
489 if (info->flag == CLONE_NEWPID)
490 nsfd = self->nsfds[i];
491 else
492 nsfd = self->child_nsfds1[i];
493 ASSERT_EQ(in_same_namespace(nsfd, pid, info->name), 1) {
494 TH_LOG("setns failed to place us correctly into %s namespace of %d via nsfd %d",
495 info->name, self->child_pid1,
496 self->child_nsfds1[i]);
497 }
498 TH_LOG("Managed to correctly setns to %s namespace of %d via nsfd %d",
499 info->name, self->child_pid1, self->child_nsfds1[i]);
500 }
501}
502
503TEST_F(current_nsset, pidfd_derived_nsfd_incremental_setns)
504{
505 int i;
506 pid_t pid;
507
508 pid = getpid();
509 for (i = 0; i < PIDFD_NS_MAX; i++) {
510 const struct ns_info *info = &ns_info[i];
511 int nsfd;
512
513 if (self->child_pidfd_derived_nsfds1[i] < 0)
514 continue;
515
516 if (info->flag) {
517 ASSERT_EQ(setns(self->child_pidfd_derived_nsfds1[i], info->flag), 0) {
518 TH_LOG("%m - Failed to setns to %s namespace of %d via nsfd %d",
519 info->name, self->child_pid1,
520 self->child_pidfd_derived_nsfds1[i]);
521 }
522 }
523
524 /* Verify that we have changed to the correct namespaces. */
525 if (info->flag == CLONE_NEWPID)
526 nsfd = self->child_pidfd_derived_nsfds[i];
527 else
528 nsfd = self->child_pidfd_derived_nsfds1[i];
529 ASSERT_EQ(in_same_namespace(nsfd, pid, info->name), 1) {
530 TH_LOG("setns failed to place us correctly into %s namespace of %d via nsfd %d",
531 info->name, self->child_pid1,
532 self->child_pidfd_derived_nsfds1[i]);
533 }
534 TH_LOG("Managed to correctly setns to %s namespace of %d via nsfd %d",
535 info->name, self->child_pid1, self->child_pidfd_derived_nsfds1[i]);
536 }
537}
538
539TEST_F(current_nsset, pidfd_one_shot_setns)
540{
541 unsigned flags = 0;
542 int i;
543 pid_t pid;
544
545 for (i = 0; i < PIDFD_NS_MAX; i++) {
546 const struct ns_info *info = &ns_info[i];
547
548 if (self->child_nsfds1[i] < 0)
549 continue;
550
551 flags |= info->flag;
552 TH_LOG("Adding %s namespace of %d to list of namespaces to attach to",
553 info->name, self->child_pid1);
554 }
555
556 ASSERT_EQ(setns(self->child_pidfd1, flags), 0) {
557 TH_LOG("%m - Failed to setns to namespaces of %d",
558 self->child_pid1);
559 }
560
561 pid = getpid();
562 for (i = 0; i < PIDFD_NS_MAX; i++) {
563 const struct ns_info *info = &ns_info[i];
564 int nsfd;
565
566 if (self->child_nsfds1[i] < 0)
567 continue;
568
569 /* Verify that we have changed to the correct namespaces. */
570 if (info->flag == CLONE_NEWPID)
571 nsfd = self->nsfds[i];
572 else
573 nsfd = self->child_nsfds1[i];
574 ASSERT_EQ(in_same_namespace(nsfd, pid, info->name), 1) {
575 TH_LOG("setns failed to place us correctly into %s namespace of %d",
576 info->name, self->child_pid1);
577 }
578 TH_LOG("Managed to correctly setns to %s namespace of %d",
579 info->name, self->child_pid1);
580 }
581}
582
583TEST_F(current_nsset, no_foul_play)
584{
585 unsigned flags = 0;
586 int i;
587
588 for (i = 0; i < PIDFD_NS_MAX; i++) {
589 const struct ns_info *info = &ns_info[i];
590
591 if (self->child_nsfds1[i] < 0)
592 continue;
593
594 flags |= info->flag;
595 if (info->flag) /* No use logging pid_for_children. */
596 TH_LOG("Adding %s namespace of %d to list of namespaces to attach to",
597 info->name, self->child_pid1);
598 }
599
600 ASSERT_EQ(setns(self->child_pidfd1, flags), 0) {
601 TH_LOG("%m - Failed to setns to namespaces of %d vid pidfd %d",
602 self->child_pid1, self->child_pidfd1);
603 }
604
605 /*
606 * Can't setns to a user namespace outside of our hierarchy since we
607 * don't have caps in there and didn't create it. That means that under
608 * no circumstances should we be able to setns to any of the other
609 * ones since they aren't owned by our user namespace.
610 */
611 for (i = 0; i < PIDFD_NS_MAX; i++) {
612 const struct ns_info *info = &ns_info[i];
613
614 if (self->child_nsfds2[i] < 0 || !info->flag)
615 continue;
616
617 ASSERT_NE(setns(self->child_pidfd2, info->flag), 0) {
618 TH_LOG("Managed to setns to %s namespace of %d via pidfd %d",
619 info->name, self->child_pid2,
620 self->child_pidfd2);
621 }
622 TH_LOG("%m - Correctly failed to setns to %s namespace of %d via pidfd %d",
623 info->name, self->child_pid2,
624 self->child_pidfd2);
625
626 ASSERT_NE(setns(self->child_nsfds2[i], info->flag), 0) {
627 TH_LOG("Managed to setns to %s namespace of %d via nsfd %d",
628 info->name, self->child_pid2,
629 self->child_nsfds2[i]);
630 }
631 TH_LOG("%m - Correctly failed to setns to %s namespace of %d via nsfd %d",
632 info->name, self->child_pid2,
633 self->child_nsfds2[i]);
634 }
635
636 /*
637 * Can't setns to a user namespace outside of our hierarchy since we
638 * don't have caps in there and didn't create it. That means that under
639 * no circumstances should we be able to setns to any of the other
640 * ones since they aren't owned by our user namespace.
641 */
642 for (i = 0; i < PIDFD_NS_MAX; i++) {
643 const struct ns_info *info = &ns_info[i];
644
645 if (self->child_pidfd_derived_nsfds2[i] < 0 || !info->flag)
646 continue;
647
648 ASSERT_NE(setns(self->child_pidfd_derived_nsfds2[i], info->flag), 0) {
649 TH_LOG("Managed to setns to %s namespace of %d via nsfd %d",
650 info->name, self->child_pid2,
651 self->child_pidfd_derived_nsfds2[i]);
652 }
653 TH_LOG("%m - Correctly failed to setns to %s namespace of %d via nsfd %d",
654 info->name, self->child_pid2,
655 self->child_pidfd_derived_nsfds2[i]);
656 }
657}
658
659TEST(setns_einval)
660{
661 int fd;
662
663 fd = sys_memfd_create("rostock", 0);
664 EXPECT_GT(fd, 0);
665
666 ASSERT_NE(setns(fd, 0), 0);
667 EXPECT_EQ(errno, EINVAL);
668 close(fd);
669}
670
671TEST_HARNESS_MAIN