On Mon, Feb 17, 2025 at 11:20 AM Christian Brauner <brauner@xxxxxxxxxx> wrote:
>
> Add a simple test to verify that the new "override_creds" option works.
>
> Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx>
> ---
> .../filesystems/overlayfs/set_layers_via_fds.c | 89 ++++++++++++++++++++++
> 1 file changed, 89 insertions(+)
>
> diff --git a/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c b/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c
> index e65d95d97846..6c9f4df5df8d 100644
> --- a/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c
> +++ b/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c
> @@ -6,11 +6,13 @@
> #include <sched.h>
> #include <stdio.h>
> #include <string.h>
> +#include <sys/fsuid.h>
> #include <sys/stat.h>
> #include <sys/mount.h>
> #include <unistd.h>
>
> #include "../../kselftest_harness.h"
> +#include "../../pidfd/pidfd.h"
> #include "log.h"
> #include "wrappers.h"
>
> @@ -409,4 +411,91 @@ TEST_F(set_layers_via_fds, set_layers_via_detached_mount_fds)
> ASSERT_EQ(fclose(f_mountinfo), 0);
> }
>
> +TEST_F(set_layers_via_fds, set_override_creds)
> +{
> + int fd_context, fd_tmpfs, fd_overlay;
> + int layer_fds[] = { [0 ... 3] = -EBADF };
> + pid_t pid;
> + int pidfd;
> +
> + ASSERT_EQ(unshare(CLONE_NEWNS), 0);
> + ASSERT_EQ(sys_mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL), 0);
> +
> + fd_context = sys_fsopen("tmpfs", 0);
> + ASSERT_GE(fd_context, 0);
> +
> + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_CMD_CREATE, NULL, NULL, 0), 0);
> + fd_tmpfs = sys_fsmount(fd_context, 0, 0);
> + ASSERT_GE(fd_tmpfs, 0);
> + ASSERT_EQ(close(fd_context), 0);
> +
> + ASSERT_EQ(mkdirat(fd_tmpfs, "w", 0755), 0);
> + ASSERT_EQ(mkdirat(fd_tmpfs, "u", 0755), 0);
> + ASSERT_EQ(mkdirat(fd_tmpfs, "l1", 0755), 0);
> + ASSERT_EQ(mkdirat(fd_tmpfs, "l2", 0755), 0);
> +
> + layer_fds[0] = openat(fd_tmpfs, "w", O_DIRECTORY);
> + ASSERT_GE(layer_fds[0], 0);
> +
> + layer_fds[1] = openat(fd_tmpfs, "u", O_DIRECTORY);
> + ASSERT_GE(layer_fds[1], 0);
> +
> + layer_fds[2] = openat(fd_tmpfs, "l1", O_DIRECTORY);
> + ASSERT_GE(layer_fds[2], 0);
> +
> + layer_fds[3] = openat(fd_tmpfs, "l2", O_DIRECTORY);
> + ASSERT_GE(layer_fds[3], 0);
> +
> + ASSERT_EQ(sys_move_mount(fd_tmpfs, "", -EBADF, "/tmp", MOVE_MOUNT_F_EMPTY_PATH), 0);
> + ASSERT_EQ(close(fd_tmpfs), 0);
> +
> + fd_context = sys_fsopen("overlay", 0);
> + ASSERT_GE(fd_context, 0);
> +
> + ASSERT_NE(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir", NULL, layer_fds[2]), 0);
> +
> + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "workdir", NULL, layer_fds[0]), 0);
> + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "upperdir", NULL, layer_fds[1]), 0);
> + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir+", NULL, layer_fds[2]), 0);
> + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir+", NULL, layer_fds[3]), 0);
> +
> + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_STRING, "metacopy", "on", 0), 0);
> +
> + pid = create_child(&pidfd, CLONE_NEWUSER);
> + EXPECT_GE(pid, 0);
> + if (pid == 0) {
> + if (!sys_fsconfig(fd_context, FSCONFIG_SET_FLAG, "override_creds", NULL, 0)) {
> + TH_LOG("sys_fsconfig should have failed");
> + _exit(EXIT_FAILURE);
> + }
> +
> + _exit(EXIT_SUCCESS);
> + }
> + EXPECT_EQ(sys_waitid(P_PID, pid, NULL, WEXITED), 0);
> + EXPECT_EQ(close(pidfd), 0);
> +
> + pid = create_child(&pidfd, 0);
> + EXPECT_GE(pid, 0);
> + if (pid == 0) {
> + if (sys_fsconfig(fd_context, FSCONFIG_SET_FLAG, "override_creds", NULL, 0)) {
> + TH_LOG("sys_fsconfig should have succeeded");
> + _exit(EXIT_FAILURE);
> + }
> +
> + _exit(EXIT_SUCCESS);
> + }
> + EXPECT_EQ(sys_waitid(P_PID, pid, NULL, WEXITED), 0);
> + EXPECT_EQ(close(pidfd), 0);
> +
Suggest to verify functionality:
execute FSCONFIG_CMD_CREATE from a child which removes CAP_MKNOD...
> + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_CMD_CREATE, NULL, NULL, 0), 0);
> +
> + fd_overlay = sys_fsmount(fd_context, 0, 0);
> + ASSERT_GE(fd_overlay, 0);
> +
> + ASSERT_EQ(sys_move_mount(fd_overlay, "", -EBADF, "/set_layers_via_fds", MOVE_MOUNT_F_EMPTY_PATH), 0);
> +
... and verify that you can mknod(2) on ovl mount.
Other than that you may add:
Reviewed-by: Amir Goldstein <amir73il@xxxxxxxxx>
Thanks,
Amir.
