Re: [PATCH 3/4] tst-pidfd.c: Test is UNSUPPORTED without PTRACE_MODE_ATTACH_REALCREDS

[Mark Wielaard <mark@klomp.org>]

Hi Florian,

On Sun, 2022-06-26 at 23:20 +0200, Florian Weimer wrote:
> * Mark Wielaard:
> 
> > pidfd_getfd will fail with errno EPERM if the calling process did
> > not
> > have PTRACE_MODE_ATTACH_REALCREDS permissions. Use FAIL_UNSUPPORTED
> > in that case.
> > ---
> >  sysdeps/unix/sysv/linux/tst-pidfd.c | 6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> > 
> > diff --git a/sysdeps/unix/sysv/linux/tst-pidfd.c
> > b/sysdeps/unix/sysv/linux/tst-pidfd.c
> > index d93b6faa6f..28349b2f91 100644
> > --- a/sysdeps/unix/sysv/linux/tst-pidfd.c
> > +++ b/sysdeps/unix/sysv/linux/tst-pidfd.c
> > @@ -95,8 +95,10 @@ do_test (void)
> >         kernel has pidfd support that we can test.  */
> >      int r = pidfd_getfd (0, 0, 1);
> >      TEST_VERIFY_EXIT (r == -1);
> > -    if (errno == ENOSYS)
> > -      FAIL_UNSUPPORTED ("kernel does not support pidfd_getfd,
> > skipping test");
> > +    if (errno == ENOSYS || errno == EPERM)
> > +      FAIL_UNSUPPORTED ("kernel does not support pidfd_getfd,"
> > +			" or we don't have
> > PTRACE_MODE_ATTACH_REALCREDS"
> > +			" permissions, skipping test");
> >    }
> 
> This also hints towards a broken seccomp filter.

pidfd_getfd is mentioned (and allowed) by the seccomp filter, but the
syscall also needs the process to have PTRACE_MODE_ATTACH_REALCREDS
(which is really PTRACE_MODE_ATTACH | PTRACE_MODE_REALCREDS). Which it
doesn't have. If the process doesn't then pidfd_getfd is defined as
failing and setting errno to EPERM.

But it is confusing I test for errno == ENOSYS || errno == EPERM. I'll
turn that into separate tests and FAIL_UNSUPPORTED messages, so it is
clear which is which in v2.

Thanks,

Mark