Hi Daniel,
Thanks for initiating the analysis.
On Fri, Mar 31, 2023 at 10:57 AM Daniel Verkamp <dverkamp@xxxxxxxxxxxx> wrote:
>
> On Fri, Mar 31, 2023 at 8:05 AM kernel test robot <yujie.liu@xxxxxxxxx> wrote:
> >
> > Hello,
> >
> > kernel test robot noticed kernel-selftests.memfd.run_fuse_test.sh.fail due to commit (built with gcc-11):
> >
> > commit: 11f75a01448f1b7a739e75dbd8f17b844fcfc510 ("selftests/memfd: add tests for MFD_NOEXEC_SEAL MFD_EXEC")
> > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> >
> > in testcase: kernel-selftests
> > version: kernel-selftests-x86_64-d4cf28ee-1_20230110
> > with following parameters:
> >
> > group: group-02
> >
> > test-description: The kernel contains a set of "self tests" under the tools/testing/selftests/ directory. These are intended to be small unit tests to exercise individual code paths in the kernel.
> > test-url: https://www.kernel.org/doc/Documentation/kselftest.txt
> >
> > on test machine: 4 threads Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz (Skylake) with 16G memory
> >
> > caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
> >
> >
> > # selftests: memfd: run_fuse_test.sh
> > # Aborted
> > not ok 2 selftests: memfd: run_fuse_test.sh # exit=134
> >
> > $ ./run_fuse_test.sh
> > opening: ./mnt/memfd
> > 8 != 40 = GET_SEALS(4)
> > Aborted
>
> Hi Jeff,
>
> I think this is caused by test_sysctl() in memfd_test, which sets
> /proc/sys/vm/memfd_noexec to a non-zero value and does not restore it
> at the end of the test. If fuse_test runs after that, it will
> unexpectedly get F_SEAL_EXEC in its memfd seals in addition to the
> F_SEAL_WRITE that it intended to add.
The sysctl for /proc/sys/vm/memfd_noexec is pid-namespaced, and designed to
be non-reservable due to security reasons.
I think the fix is to run this set of test_sysctl in a child
namespace, instead of init namespace.
I will work on a fix for this.
> I'm not sure how kernel selftests normally perform cleanup (e.g. an
> atexit() hook to make sure it cleans up if a test fails?), but at
> least we should probably set /proc/sys/vm/memfd_noexec back to its
> original value after test_sysctl().
>
> Thanks,
> -- Daniel
Thanks!
-Jeff
-Jeff
