Re: [PATCH 3/4] tst-pidfd.c: Test is UNSUPPORTED without PTRACE_MODE_ATTACH_REALCREDS

[Florian Weimer <fweimer@redhat.com>]

* Mark Wielaard:

> Hi Florian,
>
> On Sun, 2022-06-26 at 23:20 +0200, Florian Weimer wrote:
>> * Mark Wielaard:
>> 
>> > pidfd_getfd will fail with errno EPERM if the calling process did
>> > not
>> > have PTRACE_MODE_ATTACH_REALCREDS permissions. Use FAIL_UNSUPPORTED
>> > in that case.
>> > ---
>> >  sysdeps/unix/sysv/linux/tst-pidfd.c | 6 ++++--
>> >  1 file changed, 4 insertions(+), 2 deletions(-)
>> > 
>> > diff --git a/sysdeps/unix/sysv/linux/tst-pidfd.c
>> > b/sysdeps/unix/sysv/linux/tst-pidfd.c
>> > index d93b6faa6f..28349b2f91 100644
>> > --- a/sysdeps/unix/sysv/linux/tst-pidfd.c
>> > +++ b/sysdeps/unix/sysv/linux/tst-pidfd.c
>> > @@ -95,8 +95,10 @@ do_test (void)
>> >         kernel has pidfd support that we can test.  */
>> >      int r = pidfd_getfd (0, 0, 1);
>> >      TEST_VERIFY_EXIT (r == -1);
>> > -    if (errno == ENOSYS)
>> > -      FAIL_UNSUPPORTED ("kernel does not support pidfd_getfd,
>> > skipping test");
>> > +    if (errno == ENOSYS || errno == EPERM)
>> > +      FAIL_UNSUPPORTED ("kernel does not support pidfd_getfd,"
>> > +			" or we don't have
>> > PTRACE_MODE_ATTACH_REALCREDS"
>> > +			" permissions, skipping test");
>> >    }
>> 
>> This also hints towards a broken seccomp filter.
>
> pidfd_getfd is mentioned (and allowed) by the seccomp filter, but the
> syscall also needs the process to have PTRACE_MODE_ATTACH_REALCREDS
> (which is really PTRACE_MODE_ATTACH | PTRACE_MODE_REALCREDS). Which it
> doesn't have. If the process doesn't then pidfd_getfd is defined as
> failing and setting errno to EPERM.

But what does it mean for a process to have PTRACE_MODE_REALCREDS?
Don't we have to acquire that in some way, and can we check if *that*
fails?

Thanks,
Florian