From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id E26F98015D for ; Wed, 16 Sep 2026 12:32:50 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68GCVXoB014991; Wed, 16 Sep 2026 15:31:34 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68GCVXoB014991 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="iko3+QdJ" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68GCVVxd014983 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 16 Sep 2026 15:31:31 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68GCVVxd014983 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-486f3dbf7d2so3852409f8f.0 for ; Wed, 16 Sep 2026 05:31:31 -0700 (PDT) X-Gm-Message-State: AFuF++m9/85umAXoNt8XfzxZehv86yg+iz6ss7/sBpa02AsyEQDtMd1+ g2QS1cpesErL/U9nzJMQyqgwRyu5KfBSQo/z9/RTOdVcyR7sRWsX4n4zmcZZFwxuDZVyQe8tOA9 EHLwySGDSBl2WGuE/WcFINbV6q+LcJ30iJBJc1TfX+1LmTeQDqY7GAg== X-Gm-Gg: AYBFou0Tb5zsxoYTI9g7cM6IjOYAT2GMoFvtIo2Iktwqta7hLuBv7PlEYj/3hatiCXU rkxVJDXY6kzhwIvZyhsknN2CLAqX10qSBXMihjgmup38/whIQKd77Q581u6yWlsBFFLRZFzy3y2 zN0RCkeh4ihq/+OO8lvdJHMgnXnmaxaR80beCuxL7+2Y097T332RYBGV7pktqWVl4vO/LBMvLik a2KhUUTAArpeGJhW9ROjnwWRCsuPMrhIL24yElnz3B7ZdNiKjRHIh4qAKzSH8jWGtmV28778znF /NGJdmkRBHEEJeoHzGhBBUmuuctaETh5vJiHDLsHmMUbtCHjQ6QYCtsBL9lF9VDNeKJ8h1EjTxd LUMR2OACot8pTY6bwt6FaGV7KLg== X-Received: by 2002:a05:6000:27db:10b0:485:1bcc:67f8 with SMTP id ffacd0b85a97d-4870cf206e1mr2564861f8f.13.1789561890929; Wed, 16 Sep 2026 05:31:30 -0700 (PDT) X-Received: by 2002:a05:6000:27db:10b0:485:1bcc:67f8 with SMTP id ffacd0b85a97d-4870cf206e1mr2564812f8f.13.1789561890378; Wed, 16 Sep 2026 05:31:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1789561890; cv=none; d=google.com; s=arc-20260327; b=NrS/KyAdykJyqM/hoRLc01lIw269tw/xDRsYwtgLzCjVrzZnJZp2jBPKJ7UsWXmOQi zg1U9AAf5a9hNFBYtgyQczsWoeLN01qKiJDN0i5vsqQqlzbEWlCVSq6SfsHNpDDCum1L uk16j+1OUT6ArS5OfV476mIqpSToSA4X3z/5YkjvfBjmiEa9q0iCxqJdn143Sa9hChAj qZsaJYZBVETxFppZ3W2+0MSJPRVGZ41jovoEEllwDGAnSMdERQtgB/dUij/zC++WR/Cf FGLC/zAonfL9s823ITXCwNGGnidg7LpUgHXy89KePb4W4oqgPHNhUgm8J6V1BXorJ3xX zwHA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=//fpGLM1PIUf7xVeP6kOi/JVsjW+TtHaPIMEyTmUdeI=; fh=WpT6aB7RBAGHZeWZzqAr71yzRFbPTYkPWKsRagLn48Q=; b=H+10u8GWPzPzDY2M5Ha4np8MQesO06ER7UW0U524VAmm535TbFco93qG5afw6ZHEJI SDMNUQjgEknO9vXLRBf1Najlz5HYMdqFlE+qSZfZ8k/yyDeddm0eD/CyPtOcDXEIiMyH bOPf2zRKMxgKAqik0WDHZ+Ffx4O2+98kcNSEYAA46L2MtcENYtHFyxpzWS5H1sZ9CL6g Jd0NejGgWxo3QflIRWMRqwq9m+pYkBQNAQAkJN2DrIFzplLgZh0jpfyYQre/AwIfeIf7 NRmOkB8ApropFvJgWoK1mIjS7snx+S+Ml7Be4/45ey9P7JUMC6f16RAHdB1eYhOf0jaC Bp0A==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=iko3+QdJ; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-4870bf2f7e1si4987293f8f.87.2026.09.16.05.31.30 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 16 Sep 2026 05:31:30 -0700 (PDT) Received-SPF: pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=iko3+QdJ; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=//fpGLM1PIUf7xVeP6kOi/JVsjW+TtHaPIMEyTmUdeI=; b=iko3+QdJlE1A hn9eCYTPi3L6nctfImuHRwll3zll/v8PUTNtz3otYzN2zCgehnrSe8hDRTO9w3TBeCxZKxgXWVZhl mtS2qWLStfJYY/Ansut2JLeFPCQXycYppRWXAqMHFSBRHcGdn4mT9Rwi+I0Q+n+/KZzTNB+b82WEe 1npkW2nelD2JejTDrbQB7MdEBcmKtyEFcZ2VlNd3kXzLnvFoM6z8cnzl05O2Rl0pdfYGsdawdCRmD iek4G32EPFBUYTlFvtzBVtbdyO0Nkt2EyQ6IHaT8zBQ3wKYJLW0TYj9dwh80yLbdgmbNIpMFogZdu 0cjH/qyTGGuEq8JOm3LNpQ==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=LekKit-T14) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1x6okh-003Db4-2D; Wed, 16 Sep 2026 14:31:29 +0200 From: Eva Kurchatova To: khorenko@virtuozzo.com Date: Wed, 16 Sep 2026 15:31:19 +0300 Message-ID: <20260916123128.799429-1-eva.kurchatova@virtuozzo.com> X-Mailer: git-send-email 2.55.0 MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH vz10 v2 1/2] selftests: ve: grant the directories the files sit in X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org The sysfs variant names nested leaves, kernel/vmcoreinfo and kernel/notes, while the proc one names files at the top of the filesystem. Both enforcement tests grant the leaves and nothing else, so in the sysfs case the lookup stops at /sys/kernel, which a fresh VE cannot traverse, and every open answers ENOENT: not ok 14 ve_perms.sysfs.enforce_allows not ok 15 ve_perms.sysfs.enforce_denies Grant x on each directory along the way, taken from the path the variant already gives. A file at the top of the filesystem has none and needs nothing, so the proc variant is unaffected. The suite then passes 16 of 16, where it passed 14 before. Fixes: 303ce49b7446 ("selftests/ve: add ve_perms test for proc and sysfs") https://virtuozzo.atlassian.net/browse/VSTOR-144955 Feature: fix vz selftests Signed-off-by: Eva Kurchatova --- tools/testing/selftests/ve/ve_perms_test.c | 33 ++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/tools/testing/selftests/ve/ve_perms_test.c b/tools/testing/selftests/ve/ve_perms_test.c index 25ffbd42c380..2b542dc30139 100644 --- a/tools/testing/selftests/ve/ve_perms_test.c +++ b/tools/testing/selftests/ve/ve_perms_test.c @@ -348,6 +348,37 @@ TEST_F(ve_perms, write_parser) * read, and granting x on the directory lets it be traversed (the lookup then * fails ENOENT on the missing child, not EACCES). */ +/* + * A leaf is only reachable once every directory above it can be traversed. + * The variants name their files relative to the mount point, so grant x on + * each directory along the way; a file at the top of the filesystem has + * none and needs nothing. + */ +static int allow_path(int cgv2_fd, const char *path, const char *file) +{ + char dir[240]; /* set_entry() writes " " into 256 */ + const char *sep; + + for (sep = strchr(file, '/'); sep; sep = strchr(sep + 1, '/')) { + if (sep - file >= (long)sizeof(dir)) + return -1; + snprintf(dir, sizeof(dir), "%.*s", (int)(sep - file), file); + if (set_entry(cgv2_fd, path, dir, "x") < 0) + return -1; + } + return 0; +} + +static int allow_paths(int cgv2_fd, const char *path, const char *const files[]) +{ + int i; + + for (i = 0; i < NR_FILES; i++) + if (allow_path(cgv2_fd, path, files[i]) < 0) + return -1; + return 0; +} + TEST_F(ve_perms, enforce_allows) { char path[PATH_MAX], absent[128]; @@ -358,6 +389,7 @@ TEST_F(ve_perms, enforce_allows) ve_file(path, sizeof(path), self->ctid_a, variant->fs); + ASSERT_EQ(allow_paths(self->cgv2_fd, path, variant->files), 0); ASSERT_EQ(set_entries(self->cgv2_fd, path, variant->files, "r"), 0); for (i = 0; i < NR_FILES; i++) EXPECT_EQ(ve_open_rel(self->cgv2_fd, self->ctid_a, @@ -400,6 +432,7 @@ TEST_F(ve_perms, enforce_denies) O_RDONLY), 0); /* Granted w only: visible but not readable. */ + ASSERT_EQ(allow_paths(self->cgv2_fd, path, variant->files), 0); ASSERT_EQ(set_entries(self->cgv2_fd, path, variant->files, "w"), 0); for (i = 0; i < NR_FILES; i++) EXPECT_EQ(ve_open_rel(self->cgv2_fd, self->ctid_a, -- 2.55.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel