From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) by sourceware.org (Postfix) with ESMTPS id 49E473858D38 for ; Thu, 23 Jul 2020 20:04:18 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 49E473858D38 Received: by mail-io1-xd2e.google.com with SMTP id s189so327094iod.2 for ; Thu, 23 Jul 2020 13:04:18 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=uDOZCPwJT1prr0JpCGbSwWLYw07BiCgP/+LCHyuRo8A=; b=mKycDj+HUv9nYMkPh/BfGsC7dVndmzEn2OwX8IHG1YFsWj4MzNXdV6OEGzm4kYZppV kOjlxFMUj1dcmy46JsImPX1OeK8yjCVnvFPQZy0BWe0k92NYvYuvTEDCjsfRZPRmjREU LQEUZfiQ9juOeAPAk2pbJN5Bz+IPS62N86NdlDk1ILeQc9SCcevpdnzZ5At3dgxL2N6z NHI8DI7vhlrVLapr7ot9m3Zb00L1G/pCc1/xSmeq+GNOxN5dzRogLdm/dX70pk4RP3ru AdaVrlk2CnlqQ9YiO+X5hpydr8ID/IsdREHCHIoALUlZqwKJ4bPfr0/6FVUF3iP58oSj 3UPQ== X-Gm-Message-State: AOAM533gF79zQfTTqlJsTaZnAFnkWBDn5kqUo88Br1onO0GiTijSPOi6 MqXcU30sDQd9iWw7y27yCPR9NPEWN9msmu6oPyc= X-Google-Smtp-Source: ABdhPJy5wb3a4BK7yL7HHRwnP3EKLd3BhtJbucDOy0KwJedWLONxaQMRs2OmGZvsj2b5N2GNahMB62JQiw5kaV9YL1U= X-Received: by 2002:a05:6638:1187:: with SMTP id f7mr6846627jas.58.1595534657626; Thu, 23 Jul 2020 13:04:17 -0700 (PDT) MIME-Version: 1.0 References: <20200716112651.2257283-1-hjl.tools@gmail.com> <87o8ofy8e7.fsf@oldenburg2.str.redhat.com> <56cafa21-37ea-b39e-8c84-afb258f0d17a@redhat.com> <87sgdqp434.fsf@oldenburg2.str.redhat.com> <180ab9db-d012-52c9-736f-437eecafc35b@redhat.com> <91e0af7e-5f5c-a994-d7bf-dd94c45dcd71@redhat.com> In-Reply-To: <91e0af7e-5f5c-a994-d7bf-dd94c45dcd71@redhat.com> From: "H.J. Lu" Date: Thu, 23 Jul 2020 13:03:41 -0700 Message-ID: Subject: Re: [PATCH] nptl: Zero-extend arguments to SETXID syscalls [BZ #26248] To: "Carlos O'Donell" Cc: Florian Weimer , "H.J. Lu via Libc-alpha" Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-4.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 20:04:19 -0000 On Fri, Jul 17, 2020 at 2:22 PM Carlos O'Donell wrote: > > On 7/17/20 3:31 PM, H.J. Lu wrote: > > On Fri, Jul 17, 2020 at 8:52 AM Carlos O'Donell wrote: > >> > >> On 7/17/20 11:13 AM, Florian Weimer wrote: > >>> * Carlos O'Donell: > >>> > >>>> This test should run in a container, and it should attempt two setgroups > >>>> calls, one with groups and one empty with a bad address. > >>> > >>> Why do you think this needs a container? > >> > >> We are trying to successfully call setgroups(), and to do that we need > >> CAP_SETGID. The way this test is exercising this is by making the test > >> an xtests which can require root and thus you get CAP_SETGID in that way. > >> > >> My suggestion is to move the test from xtests to tests-container to increase > >> the usage of the test. In the container we have a CLONE_NEWUSER so we have > >> a distinct usersnamespace that can be used in conjunction with becoming > >> root, getting CAP_SETGID, and calling setgroups() without restricting this > >> test to `make xcheck`. > > > > I see su in tst-localedef-path-norm.script. But when I removed "su" from > > tst-localedef-path-norm.script, tst-localedef-path-norm still passed. There are > > The use "su" changes uid_map and gid_map to map our users to user 0 in the > container, but doesn't explicitly deny us from writing to the files in the > filesytem. The use of "su" in this test was belt-and-suspenders in case > some code internally checked the uid/gid values. > > > [hjl@gnu-cfl-2 build-x86_64-linux]$ ls -l testroot.root > > total 44 > > drwxr-xr-x 2 hjl hjl 4096 Jul 17 09:16 bin > > drwxr-xr-x 2 hjl hjl 4096 Jul 17 12:23 dev > > drwxr-xr-x 2 hjl hjl 4096 Jul 17 09:34 etc > > drwxr-xr-x 4 hjl hjl 4096 Jul 17 12:23 export > > -rw-r--r-- 1 hjl hjl 0 Jul 17 09:16 install.stamp > > drwxr-xr-x 2 hjl hjl 4096 Jul 17 09:16 libx32 > > -rw-r--r-- 1 hjl hjl 0 Jul 17 12:26 lock.fd > > drwxr-xr-x 5 hjl hjl 4096 Jul 17 12:23 output > > drwxr-xr-x 2 hjl hjl 4096 Jul 17 12:23 proc > > drwxr-xr-x 2 hjl hjl 4096 Jul 17 09:16 sbin > > drwxr-xr-x 2 hjl hjl 4096 Jul 17 12:23 tmp > > drwxr-xr-x 9 hjl hjl 4096 Jul 17 09:16 usr > > drwxr-xr-x 3 hjl hjl 4096 Jul 17 09:34 var > > [hjl@gnu-cfl-2 build-x86_64-linux]$ > > > > I don't think su is needed since testroot.root is owned by me. > > Correct. > > >> I see that we don't explicitly say `make xcheck` may require root. > >> Is this something I just taught myself implicitly? :-) > >> > >> Note: We may need to adjust the gid_map writing code in test-container. > >> > > > > Can you help me to make tst-setgroups pass when not running as root? > > Sure, let me have a look at running it as a test in the container. > Any update on this? -- H.J.