1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Author: Aleksa Sarai <cyphar@cyphar.com> 4 * Copyright (C) 2025 SUSE LLC. 5 */ 6 7 #include <assert.h> 8 #include <errno.h> 9 #include <fcntl.h> 10 #include <sched.h> 11 #include <stdbool.h> 12 #include <stdlib.h> 13 #include <string.h> 14 #include <unistd.h> 15 #include <stdio.h> 16 #include <sys/mount.h> 17 #include <sys/stat.h> 18 #include <sys/prctl.h> 19 20 #include "kselftest_harness.h" 21 22 #define ASSERT_ERRNO(expected, _t, seen) \ 23 __EXPECT(expected, #expected, \ 24 ({__typeof__(seen) _tmp_seen = (seen); \ 25 _tmp_seen >= 0 ? _tmp_seen : -errno; }), #seen, _t, 1) 26 27 #define ASSERT_ERRNO_EQ(expected, seen) \ 28 ASSERT_ERRNO(expected, ==, seen) 29 30 #define ASSERT_SUCCESS(seen) \ 31 ASSERT_ERRNO(0, <=, seen) 32 33 static int touch(char *path) 34 { 35 int fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC, 0644); 36 if (fd < 0) 37 return -1; 38 return close(fd); 39 } 40 41 FIXTURE(ns) 42 { 43 int host_mntns, host_pidns; 44 int dummy_pidns; 45 }; 46 47 FIXTURE_SETUP(ns) 48 { 49 /* Stash the old mntns. */ 50 self->host_mntns = open("/proc/self/ns/mnt", O_RDONLY|O_CLOEXEC); 51 ASSERT_SUCCESS(self->host_mntns); 52 53 /* Create a new mount namespace and make it private. */ 54 ASSERT_SUCCESS(unshare(CLONE_NEWNS)); 55 ASSERT_SUCCESS(mount(NULL, "/", NULL, MS_PRIVATE|MS_REC, NULL)); 56 57 /* 58 * Create a proper tmpfs that we can use and will disappear once we 59 * leave this mntns. 60 */ 61 ASSERT_SUCCESS(mount("tmpfs", "/tmp", "tmpfs", 0, NULL)); 62 63 /* 64 * Create a pidns we can use for later tests. We need to fork off a 65 * child so that we get a usable nsfd that we can bind-mount and open. 66 */ 67 ASSERT_SUCCESS(mkdir("/tmp/dummy", 0755)); 68 ASSERT_SUCCESS(touch("/tmp/dummy/pidns")); 69 ASSERT_SUCCESS(mkdir("/tmp/dummy/proc", 0755)); 70 71 self->host_pidns = open("/proc/self/ns/pid", O_RDONLY|O_CLOEXEC); 72 ASSERT_SUCCESS(self->host_pidns); 73 ASSERT_SUCCESS(unshare(CLONE_NEWPID)); 74 75 pid_t pid = fork(); 76 ASSERT_SUCCESS(pid); 77 if (!pid) { 78 prctl(PR_SET_PDEATHSIG, SIGKILL); 79 ASSERT_SUCCESS(mount("/proc/self/ns/pid", "/tmp/dummy/pidns", NULL, MS_BIND, NULL)); 80 ASSERT_SUCCESS(mount("proc", "/tmp/dummy/proc", "proc", 0, NULL)); 81 exit(0); 82 } 83 84 int wstatus; 85 ASSERT_EQ(waitpid(pid, &wstatus, 0), pid); 86 ASSERT_TRUE(WIFEXITED(wstatus)); 87 ASSERT_EQ(WEXITSTATUS(wstatus), 0); 88 89 ASSERT_SUCCESS(setns(self->host_pidns, CLONE_NEWPID)); 90 91 self->dummy_pidns = open("/tmp/dummy/pidns", O_RDONLY|O_CLOEXEC); 92 ASSERT_SUCCESS(self->dummy_pidns); 93 } 94 95 FIXTURE_TEARDOWN(ns) 96 { 97 ASSERT_SUCCESS(setns(self->host_mntns, CLONE_NEWNS)); 98 ASSERT_SUCCESS(close(self->host_mntns)); 99 100 ASSERT_SUCCESS(close(self->host_pidns)); 101 ASSERT_SUCCESS(close(self->dummy_pidns)); 102 } 103 104 TEST_F(ns, pidns_mount_string_path) 105 { 106 ASSERT_SUCCESS(mkdir("/tmp/proc-host", 0755)); 107 ASSERT_SUCCESS(mount("proc", "/tmp/proc-host", "proc", 0, "pidns=/proc/self/ns/pid")); 108 ASSERT_SUCCESS(access("/tmp/proc-host/self/", X_OK)); 109 110 ASSERT_SUCCESS(mkdir("/tmp/proc-dummy", 0755)); 111 ASSERT_SUCCESS(mount("proc", "/tmp/proc-dummy", "proc", 0, "pidns=/tmp/dummy/pidns")); 112 ASSERT_ERRNO_EQ(-ENOENT, access("/tmp/proc-dummy/1/", X_OK)); 113 ASSERT_ERRNO_EQ(-ENOENT, access("/tmp/proc-dummy/self/", X_OK)); 114 } 115 116 TEST_F(ns, pidns_fsconfig_string_path) 117 { 118 int fsfd = fsopen("proc", FSOPEN_CLOEXEC); 119 ASSERT_SUCCESS(fsfd); 120 121 ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_SET_STRING, "pidns", "/tmp/dummy/pidns", 0)); 122 ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0)); 123 124 int mountfd = fsmount(fsfd, FSMOUNT_CLOEXEC, 0); 125 ASSERT_SUCCESS(mountfd); 126 127 ASSERT_ERRNO_EQ(-ENOENT, faccessat(mountfd, "1/", X_OK, 0)); 128 ASSERT_ERRNO_EQ(-ENOENT, faccessat(mountfd, "self/", X_OK, 0)); 129 130 ASSERT_SUCCESS(close(fsfd)); 131 ASSERT_SUCCESS(close(mountfd)); 132 } 133 134 TEST_F(ns, pidns_fsconfig_fd) 135 { 136 int fsfd = fsopen("proc", FSOPEN_CLOEXEC); 137 ASSERT_SUCCESS(fsfd); 138 139 ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_SET_FD, "pidns", NULL, self->dummy_pidns)); 140 ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0)); 141 142 int mountfd = fsmount(fsfd, FSMOUNT_CLOEXEC, 0); 143 ASSERT_SUCCESS(mountfd); 144 145 ASSERT_ERRNO_EQ(-ENOENT, faccessat(mountfd, "1/", X_OK, 0)); 146 ASSERT_ERRNO_EQ(-ENOENT, faccessat(mountfd, "self/", X_OK, 0)); 147 148 ASSERT_SUCCESS(close(fsfd)); 149 ASSERT_SUCCESS(close(mountfd)); 150 } 151 152 TEST_F(ns, pidns_reconfigure_remount) 153 { 154 ASSERT_SUCCESS(mkdir("/tmp/proc", 0755)); 155 ASSERT_SUCCESS(mount("proc", "/tmp/proc", "proc", 0, "")); 156 157 ASSERT_SUCCESS(access("/tmp/proc/1/", X_OK)); 158 ASSERT_SUCCESS(access("/tmp/proc/self/", X_OK)); 159 160 ASSERT_ERRNO_EQ(-EBUSY, mount(NULL, "/tmp/proc", NULL, MS_REMOUNT, "pidns=/tmp/dummy/pidns")); 161 162 ASSERT_SUCCESS(access("/tmp/proc/1/", X_OK)); 163 ASSERT_SUCCESS(access("/tmp/proc/self/", X_OK)); 164 } 165 166 TEST_F(ns, pidns_reconfigure_fsconfig_string_path) 167 { 168 int fsfd = fsopen("proc", FSOPEN_CLOEXEC); 169 ASSERT_SUCCESS(fsfd); 170 171 ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0)); 172 173 int mountfd = fsmount(fsfd, FSMOUNT_CLOEXEC, 0); 174 ASSERT_SUCCESS(mountfd); 175 176 ASSERT_SUCCESS(faccessat(mountfd, "1/", X_OK, 0)); 177 ASSERT_SUCCESS(faccessat(mountfd, "self/", X_OK, 0)); 178 179 ASSERT_ERRNO_EQ(-EBUSY, fsconfig(fsfd, FSCONFIG_SET_STRING, "pidns", "/tmp/dummy/pidns", 0)); 180 ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_CMD_RECONFIGURE, NULL, NULL, 0)); /* noop */ 181 182 ASSERT_SUCCESS(faccessat(mountfd, "1/", X_OK, 0)); 183 ASSERT_SUCCESS(faccessat(mountfd, "self/", X_OK, 0)); 184 185 ASSERT_SUCCESS(close(fsfd)); 186 ASSERT_SUCCESS(close(mountfd)); 187 } 188 189 TEST_F(ns, pidns_reconfigure_fsconfig_fd) 190 { 191 int fsfd = fsopen("proc", FSOPEN_CLOEXEC); 192 ASSERT_SUCCESS(fsfd); 193 194 ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0)); 195 196 int mountfd = fsmount(fsfd, FSMOUNT_CLOEXEC, 0); 197 ASSERT_SUCCESS(mountfd); 198 199 ASSERT_SUCCESS(faccessat(mountfd, "1/", X_OK, 0)); 200 ASSERT_SUCCESS(faccessat(mountfd, "self/", X_OK, 0)); 201 202 ASSERT_ERRNO_EQ(-EBUSY, fsconfig(fsfd, FSCONFIG_SET_FD, "pidns", NULL, self->dummy_pidns)); 203 ASSERT_SUCCESS(fsconfig(fsfd, FSCONFIG_CMD_RECONFIGURE, NULL, NULL, 0)); /* noop */ 204 205 ASSERT_SUCCESS(faccessat(mountfd, "1/", X_OK, 0)); 206 ASSERT_SUCCESS(faccessat(mountfd, "self/", X_OK, 0)); 207 208 ASSERT_SUCCESS(close(fsfd)); 209 ASSERT_SUCCESS(close(mountfd)); 210 } 211 212 TEST_HARNESS_MAIN 213