From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 1791) id 915613858414; Fri, 23 Feb 2024 11:50:51 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 915613858414 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1708689051; bh=5uuFkBjrZOciqZptp/38MOaf85Uw6wwKURzaQRZ/vBA=; h=From:To:Subject:Date:From; b=QvO6IVC8ZK9kndccUICvaQTzOnButEaqosO+mdEj9N9W3D5qw/wb3idfiBdKE88JT LGYz91i1L+xFtgWGpCE8h2szqlrJElJZvx/yrmS5UVekws+p4pYqwPAz1HjEyjIxw3 eK0WePQy4hWkeEo1PCsfYD6axDNdMzp9bja0b07o= Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Adhemerval Zanella To: glibc-cvs@sourceware.org Subject: [glibc] tests: gracefully handle AppArmor userns containment X-Act-Checkin: glibc X-Git-Author: Simon Chopin X-Git-Refname: refs/heads/master X-Git-Oldrev: fe00366b63c5cf1a84864647ec4e15721c04ebcf X-Git-Newrev: 59e0441d4a1198aa9d21643a6e4f370faec4ffbf Message-Id: <20240223115051.915613858414@sourceware.org> Date: Fri, 23 Feb 2024 11:50:51 +0000 (GMT) List-Id: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=59e0441d4a1198aa9d21643a6e4f370faec4ffbf commit 59e0441d4a1198aa9d21643a6e4f370faec4ffbf Author: Simon Chopin Date: Fri Feb 16 17:38:49 2024 +0100 tests: gracefully handle AppArmor userns containment Recent AppArmor containment allows restricting unprivileged user namespaces, which is enabled by default on recent Ubuntu systems. When this happens, as is common with Linux Security Modules, the syscall will fail with -EACCESS. When that happens, the affected tests will now be considered unsupported rather than simply failing. Further information: * https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction * https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces * https://manpages.ubuntu.com/manpages/jammy/man5/apparmor.d.5.html (for the return code) V2: * Fix duplicated line in check_unshare_hints * Also handle similar failure in tst-pidfd_getpid V3: * Comment formatting * Aded some more documentation on syscall return value Signed-off-by: Simon Chopin Diff: --- support/test-container.c | 7 +++++-- sysdeps/unix/sysv/linux/tst-pidfd_getpid.c | 3 ++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/support/test-container.c b/support/test-container.c index adf2b30215..ebcc722da5 100644 --- a/support/test-container.c +++ b/support/test-container.c @@ -682,6 +682,8 @@ check_for_unshare_hints (int require_pidns) { "/proc/sys/kernel/unprivileged_userns_clone", 0, 1, 0 }, /* ALT Linux has an alternate way of doing the same. */ { "/proc/sys/kernel/userns_restrict", 1, 0, 0 }, + /* AppArmor can also disable unprivileged user namespaces. */ + { "/proc/sys/kernel/apparmor_restrict_unprivileged_userns", 1, 0, 0 }, /* Linux kernel >= 4.9 has a configurable limit on the number of each namespace. Some distros set the limit to zero to disable the corresponding namespace as a "security policy". */ @@ -1108,10 +1110,11 @@ main (int argc, char **argv) { /* Older kernels may not support all the options, or security policy may block this call. */ - if (errno == EINVAL || errno == EPERM || errno == ENOSPC) + if (errno == EINVAL || errno == EPERM + || errno == ENOSPC || errno == EACCES) { int saved_errno = errno; - if (errno == EPERM || errno == ENOSPC) + if (errno == EPERM || errno == ENOSPC || errno == EACCES) check_for_unshare_hints (require_pidns); FAIL_UNSUPPORTED ("unable to unshare user/fs: %s", strerror (saved_errno)); } diff --git a/sysdeps/unix/sysv/linux/tst-pidfd_getpid.c b/sysdeps/unix/sysv/linux/tst-pidfd_getpid.c index 0354da5abb..ef62fbe941 100644 --- a/sysdeps/unix/sysv/linux/tst-pidfd_getpid.c +++ b/sysdeps/unix/sysv/linux/tst-pidfd_getpid.c @@ -61,7 +61,8 @@ do_test (void) { /* Older kernels may not support all the options, or security policy may block this call. */ - if (errno == EINVAL || errno == EPERM || errno == ENOSPC) + if (errno == EINVAL || errno == EPERM + || errno == ENOSPC || errno == EACCES) exit (EXIT_UNSUPPORTED); FAIL_EXIT1 ("unshare user/fs/pid failed: %m"); }