From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ed1-x52d.google.com (mail-ed1-x52d.google.com [IPv6:2a00:1450:4864:20::52d]) by sourceware.org (Postfix) with ESMTPS id 488E93858D20 for ; Tue, 13 Feb 2024 07:36:49 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 488E93858D20 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=linaro.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 488E93858D20 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2a00:1450:4864:20::52d ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1707809811; cv=none; b=FYTyoix1/2nYEHhSNr1jD3v/YWxFqS343y5eBUhAU41H7YZayls0Btk2xP1OEXoQbjE6/u6th3mttqrCH5uLUcYozOCLZMrevk+1Axef1W153O1NyCMqBo50vBm7aY7g0QAtyOt0kW32KW/sk3EgW5nAryUHBaRvfr1tvWiX/og= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1707809811; c=relaxed/simple; bh=LCoG8rj0OyVcp2tqEJ/d/YBoHKeOlXNUkoW2/3q6NZI=; h=DKIM-Signature:Mime-Version:Subject:From:Date:Message-Id:To; b=TKfTL6IwzmdS+f2LacRIVqC6D8Ckn8hyuO4mDgR3aRQau2rq01/l/B5VeVlQLQB3UK7er2Xdp0QQm5EuTGKtTttKqbyxdI8cvw3JoA0jZ2nwjx9fgaLTZg6aL8/8ZEa7yRMlf64on/mw9RsvqD707Ej6CkFNMAXgj2nsHtxBpCc= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-ed1-x52d.google.com with SMTP id 4fb4d7f45d1cf-56089a3e28cso626789a12.0 for ; Mon, 12 Feb 2024 23:36:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1707809808; x=1708414608; darn=sourceware.org; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=VSmtnzEt24qRjRWTUFwov6VzLoer8dLlayM645k2s7M=; b=Uj30Kh2VP0AqABOZXNpjBe2N2EU3kEVsJJsFEf8ZATsJPTuMKcub3ahyONf6EUVC2/ 6Rqto0JgomPTzvHrofqCYZyHoFigmz1eBr1cAgIev0Ke2csV8U+l5a6ZN31yk8ug+Od6 v5NA2UeZnV90GO01RC6qI+AbB2WvGq1YeIcbPH2JU9ZpP0nYV/Fb7WYJVfeSlwf0nTbW nDiyLXU4j4wE9p20mbCf2jDBMrW0KN3DPNMfthb7EQwBczEC47GknYpLXCA1OfnQDtn7 Kz/ZtKs34WRmjF2dW4+XJDzELJ137RSx4uS94wh1MD1iiliZcLSFfFSwoD4KngoCHUrz SdSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1707809808; x=1708414608; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=VSmtnzEt24qRjRWTUFwov6VzLoer8dLlayM645k2s7M=; b=ShYqinrjNfwMJHAXvp0FkVHcargL0/RXPumFJc5zz0kJdaqx4lXSZD/kSsmt0JZg8Y 1Pkvtj2EV1NfEtGTpwLW0FjgGDgW4y6lkfTIj7f/dE2l7BsDjalNwx3F+oPSD6srakmQ gBM7M5GQxdRmbi99DYVxrtYux8GHpAIrndvwcz1gRihAvNIj966U6WXzkG3u7l70eFEx 6qK0p5tZp7qfrJTHou0/6VDMjWUvd3szOnN1ZXyyA8DVZAi3t+ODGd+O0DMuZ8scYqVS DO4P2ehgTO7Kquvvqm3hRtCfXnnpmM4tLWC3Eu0h3H7tuW04UFZ0Nrb285EfBl2eJ5Io uB3g== X-Gm-Message-State: AOJu0YxHiqeDv+cYjQZJ9kn2xJZXipdUE0sD1nrxswxDG5+XNZRPSO2E mb9qfJu5n6/1SjWYKVYmSEVS7W/B28PvcG/zUZ9t82BsQVRPOk+XPwsycw82QeJWOV3ej/lDgLg EoQ== X-Google-Smtp-Source: AGHT+IETcEPEka8AhC3x10bXDoagoiB2BavBPhqYfxWLGHOerSjoUciOzv8H5ae4M4AJ2B8mx4niCw== X-Received: by 2002:a17:906:3089:b0:a3b:b097:3173 with SMTP id 9-20020a170906308900b00a3bb0973173mr5404781ejv.6.1707809807891; Mon, 12 Feb 2024 23:36:47 -0800 (PST) X-Forwarded-Encrypted: i=1; AJvYcCWBFMO0yMkgqUuM7JdOSohg/lbZD07kgPmwugHPzgRmDLxvBwxVC5c3YuJi+2WstrU+opm7c66J01ufS9x1jVYBzfY= Received: from smtpclient.apple ([37.252.94.180]) by smtp.gmail.com with ESMTPSA id gl15-20020a170906e0cf00b00a367bdce1fcsm1012420ejb.64.2024.02.12.23.36.46 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 12 Feb 2024 23:36:46 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.300.61.1.2\)) Subject: Re: [PATCH v2] tests: gracefully handle AppArmor userns containment From: Maxim Kuvyrkov In-Reply-To: <20240206105932.127820-1-simon.chopin@canonical.com> Date: Tue, 13 Feb 2024 11:36:34 +0400 Cc: GNU C Library , Xi Ruoyao Content-Transfer-Encoding: quoted-printable Message-Id: References: <20240201120104.143973-1-simon.chopin@canonical.com> <20240206105932.127820-1-simon.chopin@canonical.com> To: Simon Chopin X-Mailer: Apple Mail (2.3774.300.61.1.2) X-Spam-Status: No, score=-9.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,RCVD_IN_BARRACUDACENTRAL,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: > On Feb 6, 2024, at 14:59, Simon Chopin = wrote: >=20 > Recent AppArmor containment allows restricting unprivileged user > namespaces, which is enabled by default on recent Ubuntu systems. >=20 > When that happens, the affected tests will now be considered = unsupported > rather than simply failing. >=20 > Further information: >=20 > * = https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restricti= on > * = https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespac= es >=20 > V2: > * Fix duplicated line in check_unshare_hints > * Also handle similar failure in tst-pidfd_getpid Looks good, with below comments addressed. Please CC reviewers of the previous versions of the patch -- Xi Ruoyao = in this case. >=20 > Signed-off-by: Simon Chopin > --- > support/test-container.c | 7 +++++-- > sysdeps/unix/sysv/linux/tst-pidfd_getpid.c | 3 ++- > 2 files changed, 7 insertions(+), 3 deletions(-) >=20 > diff --git a/support/test-container.c b/support/test-container.c > index adf2b30215..af66cece51 100644 > --- a/support/test-container.c > +++ b/support/test-container.c > @@ -682,6 +682,8 @@ check_for_unshare_hints (int require_pidns) > { "/proc/sys/kernel/unprivileged_userns_clone", 0, 1, 0 }, > /* ALT Linux has an alternate way of doing the same. */ > { "/proc/sys/kernel/userns_restrict", 1, 0, 0 }, > + /* AppArmor can also disable unprivileged user namespaces */ GNU coding style is to finish comment sentences with a dot, followed by = two spaces. E.g., /* My new comment. */ > + { "/proc/sys/kernel/apparmor_restrict_unprivileged_userns", 1, 0, = 0 }, > /* Linux kernel >=3D 4.9 has a configurable limit on the number of > each namespace. Some distros set the limit to zero to disable = the > corresponding namespace as a "security policy". */ > @@ -1108,10 +1110,11 @@ main (int argc, char **argv) > { > /* Older kernels may not support all the options, or security > policy may block this call. */ > - if (errno =3D=3D EINVAL || errno =3D=3D EPERM || errno =3D=3D = ENOSPC) > + if (errno =3D=3D EINVAL || errno =3D=3D EPERM > + || errno =3D=3D ENOSPC || errno =3D=3D EACCES) Where is EACCES coming from? I could not find documentation mentioning = EACCES as a possible error condition for unshare(). > { > int saved_errno =3D errno; > - if (errno =3D=3D EPERM || errno =3D=3D ENOSPC) > + if (errno =3D=3D EPERM || errno =3D=3D ENOSPC || errno =3D=3D = EACCES) > check_for_unshare_hints (require_pidns); > FAIL_UNSUPPORTED ("unable to unshare user/fs: %s", strerror = (saved_errno)); > } > diff --git a/sysdeps/unix/sysv/linux/tst-pidfd_getpid.c = b/sysdeps/unix/sysv/linux/tst-pidfd_getpid.c > index 0354da5abb..ef62fbe941 100644 > --- a/sysdeps/unix/sysv/linux/tst-pidfd_getpid.c > +++ b/sysdeps/unix/sysv/linux/tst-pidfd_getpid.c > @@ -61,7 +61,8 @@ do_test (void) > { > /* Older kernels may not support all the options, or security > policy may block this call. */ > - if (errno =3D=3D EINVAL || errno =3D=3D EPERM || errno =3D=3D = ENOSPC) > + if (errno =3D=3D EINVAL || errno =3D=3D EPERM > + || errno =3D=3D ENOSPC || errno =3D=3D EACCES) > exit (EXIT_UNSUPPORTED); > FAIL_EXIT1 ("unshare user/fs/pid failed: %m"); > } >=20 > base-commit: fa3eb7d5e7d32ca1ad48b48a7eb6d15b8382c3a7 > --=20 > 2.40.1 >=20 Thanks, -- Maxim Kuvyrkov https://www.linaro.org