| Message ID | 20250217-work-overlayfs-v2-2-41dfe7718963@kernel.org (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | ovl: add override_creds mount option | expand |
On Mon, Feb 17, 2025 at 11:20 AM Christian Brauner <brauner@kernel.org> wrote: > > Add a simple test to verify that the new "override_creds" option works. > > Signed-off-by: Christian Brauner <brauner@kernel.org> > --- > .../filesystems/overlayfs/set_layers_via_fds.c | 89 ++++++++++++++++++++++ > 1 file changed, 89 insertions(+) > > diff --git a/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c b/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c > index e65d95d97846..6c9f4df5df8d 100644 > --- a/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c > +++ b/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c > @@ -6,11 +6,13 @@ > #include <sched.h> > #include <stdio.h> > #include <string.h> > +#include <sys/fsuid.h> > #include <sys/stat.h> > #include <sys/mount.h> > #include <unistd.h> > > #include "../../kselftest_harness.h" > +#include "../../pidfd/pidfd.h" > #include "log.h" > #include "wrappers.h" > > @@ -409,4 +411,91 @@ TEST_F(set_layers_via_fds, set_layers_via_detached_mount_fds) > ASSERT_EQ(fclose(f_mountinfo), 0); > } > > +TEST_F(set_layers_via_fds, set_override_creds) > +{ > + int fd_context, fd_tmpfs, fd_overlay; > + int layer_fds[] = { [0 ... 3] = -EBADF }; > + pid_t pid; > + int pidfd; > + > + ASSERT_EQ(unshare(CLONE_NEWNS), 0); > + ASSERT_EQ(sys_mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL), 0); > + > + fd_context = sys_fsopen("tmpfs", 0); > + ASSERT_GE(fd_context, 0); > + > + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_CMD_CREATE, NULL, NULL, 0), 0); > + fd_tmpfs = sys_fsmount(fd_context, 0, 0); > + ASSERT_GE(fd_tmpfs, 0); > + ASSERT_EQ(close(fd_context), 0); > + > + ASSERT_EQ(mkdirat(fd_tmpfs, "w", 0755), 0); > + ASSERT_EQ(mkdirat(fd_tmpfs, "u", 0755), 0); > + ASSERT_EQ(mkdirat(fd_tmpfs, "l1", 0755), 0); > + ASSERT_EQ(mkdirat(fd_tmpfs, "l2", 0755), 0); > + > + layer_fds[0] = openat(fd_tmpfs, "w", O_DIRECTORY); > + ASSERT_GE(layer_fds[0], 0); > + > + layer_fds[1] = openat(fd_tmpfs, "u", O_DIRECTORY); > + ASSERT_GE(layer_fds[1], 0); > + > + layer_fds[2] = openat(fd_tmpfs, "l1", O_DIRECTORY); > + ASSERT_GE(layer_fds[2], 0); > + > + layer_fds[3] = openat(fd_tmpfs, "l2", O_DIRECTORY); > + ASSERT_GE(layer_fds[3], 0); > + > + ASSERT_EQ(sys_move_mount(fd_tmpfs, "", -EBADF, "/tmp", MOVE_MOUNT_F_EMPTY_PATH), 0); > + ASSERT_EQ(close(fd_tmpfs), 0); > + > + fd_context = sys_fsopen("overlay", 0); > + ASSERT_GE(fd_context, 0); > + > + ASSERT_NE(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir", NULL, layer_fds[2]), 0); > + > + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "workdir", NULL, layer_fds[0]), 0); > + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "upperdir", NULL, layer_fds[1]), 0); > + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir+", NULL, layer_fds[2]), 0); > + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir+", NULL, layer_fds[3]), 0); > + > + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_STRING, "metacopy", "on", 0), 0); > + > + pid = create_child(&pidfd, CLONE_NEWUSER); > + EXPECT_GE(pid, 0); > + if (pid == 0) { > + if (!sys_fsconfig(fd_context, FSCONFIG_SET_FLAG, "override_creds", NULL, 0)) { > + TH_LOG("sys_fsconfig should have failed"); > + _exit(EXIT_FAILURE); > + } > + > + _exit(EXIT_SUCCESS); > + } > + EXPECT_EQ(sys_waitid(P_PID, pid, NULL, WEXITED), 0); > + EXPECT_EQ(close(pidfd), 0); > + > + pid = create_child(&pidfd, 0); > + EXPECT_GE(pid, 0); > + if (pid == 0) { > + if (sys_fsconfig(fd_context, FSCONFIG_SET_FLAG, "override_creds", NULL, 0)) { > + TH_LOG("sys_fsconfig should have succeeded"); > + _exit(EXIT_FAILURE); > + } > + > + _exit(EXIT_SUCCESS); > + } > + EXPECT_EQ(sys_waitid(P_PID, pid, NULL, WEXITED), 0); > + EXPECT_EQ(close(pidfd), 0); > + Suggest to verify functionality: execute FSCONFIG_CMD_CREATE from a child which removes CAP_MKNOD... > + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_CMD_CREATE, NULL, NULL, 0), 0); > + > + fd_overlay = sys_fsmount(fd_context, 0, 0); > + ASSERT_GE(fd_overlay, 0); > + > + ASSERT_EQ(sys_move_mount(fd_overlay, "", -EBADF, "/set_layers_via_fds", MOVE_MOUNT_F_EMPTY_PATH), 0); > + ... and verify that you can mknod(2) on ovl mount. Other than that you may add: Reviewed-by: Amir Goldstein <amir73il@gmail.com> Thanks, Amir.
diff --git a/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c b/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c index e65d95d97846..6c9f4df5df8d 100644 --- a/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c +++ b/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c @@ -6,11 +6,13 @@ #include <sched.h> #include <stdio.h> #include <string.h> +#include <sys/fsuid.h> #include <sys/stat.h> #include <sys/mount.h> #include <unistd.h> #include "../../kselftest_harness.h" +#include "../../pidfd/pidfd.h" #include "log.h" #include "wrappers.h" @@ -409,4 +411,91 @@ TEST_F(set_layers_via_fds, set_layers_via_detached_mount_fds) ASSERT_EQ(fclose(f_mountinfo), 0); } +TEST_F(set_layers_via_fds, set_override_creds) +{ + int fd_context, fd_tmpfs, fd_overlay; + int layer_fds[] = { [0 ... 3] = -EBADF }; + pid_t pid; + int pidfd; + + ASSERT_EQ(unshare(CLONE_NEWNS), 0); + ASSERT_EQ(sys_mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL), 0); + + fd_context = sys_fsopen("tmpfs", 0); + ASSERT_GE(fd_context, 0); + + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_CMD_CREATE, NULL, NULL, 0), 0); + fd_tmpfs = sys_fsmount(fd_context, 0, 0); + ASSERT_GE(fd_tmpfs, 0); + ASSERT_EQ(close(fd_context), 0); + + ASSERT_EQ(mkdirat(fd_tmpfs, "w", 0755), 0); + ASSERT_EQ(mkdirat(fd_tmpfs, "u", 0755), 0); + ASSERT_EQ(mkdirat(fd_tmpfs, "l1", 0755), 0); + ASSERT_EQ(mkdirat(fd_tmpfs, "l2", 0755), 0); + + layer_fds[0] = openat(fd_tmpfs, "w", O_DIRECTORY); + ASSERT_GE(layer_fds[0], 0); + + layer_fds[1] = openat(fd_tmpfs, "u", O_DIRECTORY); + ASSERT_GE(layer_fds[1], 0); + + layer_fds[2] = openat(fd_tmpfs, "l1", O_DIRECTORY); + ASSERT_GE(layer_fds[2], 0); + + layer_fds[3] = openat(fd_tmpfs, "l2", O_DIRECTORY); + ASSERT_GE(layer_fds[3], 0); + + ASSERT_EQ(sys_move_mount(fd_tmpfs, "", -EBADF, "/tmp", MOVE_MOUNT_F_EMPTY_PATH), 0); + ASSERT_EQ(close(fd_tmpfs), 0); + + fd_context = sys_fsopen("overlay", 0); + ASSERT_GE(fd_context, 0); + + ASSERT_NE(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir", NULL, layer_fds[2]), 0); + + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "workdir", NULL, layer_fds[0]), 0); + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "upperdir", NULL, layer_fds[1]), 0); + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir+", NULL, layer_fds[2]), 0); + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir+", NULL, layer_fds[3]), 0); + + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_STRING, "metacopy", "on", 0), 0); + + pid = create_child(&pidfd, CLONE_NEWUSER); + EXPECT_GE(pid, 0); + if (pid == 0) { + if (!sys_fsconfig(fd_context, FSCONFIG_SET_FLAG, "override_creds", NULL, 0)) { + TH_LOG("sys_fsconfig should have failed"); + _exit(EXIT_FAILURE); + } + + _exit(EXIT_SUCCESS); + } + EXPECT_EQ(sys_waitid(P_PID, pid, NULL, WEXITED), 0); + EXPECT_EQ(close(pidfd), 0); + + pid = create_child(&pidfd, 0); + EXPECT_GE(pid, 0); + if (pid == 0) { + if (sys_fsconfig(fd_context, FSCONFIG_SET_FLAG, "override_creds", NULL, 0)) { + TH_LOG("sys_fsconfig should have succeeded"); + _exit(EXIT_FAILURE); + } + + _exit(EXIT_SUCCESS); + } + EXPECT_EQ(sys_waitid(P_PID, pid, NULL, WEXITED), 0); + EXPECT_EQ(close(pidfd), 0); + + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_CMD_CREATE, NULL, NULL, 0), 0); + + fd_overlay = sys_fsmount(fd_context, 0, 0); + ASSERT_GE(fd_overlay, 0); + + ASSERT_EQ(sys_move_mount(fd_overlay, "", -EBADF, "/set_layers_via_fds", MOVE_MOUNT_F_EMPTY_PATH), 0); + + ASSERT_EQ(close(fd_context), 0); + ASSERT_EQ(close(fd_overlay), 0); +} + TEST_HARNESS_MAIN
Add a simple test to verify that the new "override_creds" option works. Signed-off-by: Christian Brauner <brauner@kernel.org> --- .../filesystems/overlayfs/set_layers_via_fds.c | 89 ++++++++++++++++++++++ 1 file changed, 89 insertions(+)