From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id D3096802A7 for ; Fri, 2 Oct 2026 04:45:58 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6924igxO014391; Fri, 2 Oct 2026 07:44:43 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6924igxO014391 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="SleA1Xf3" Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6924iaDZ014372 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Fri, 2 Oct 2026 07:44:36 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6924iaDZ014372 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-48c430f0f01so3194f8f.1 for ; Thu, 01 Oct 2026 21:44:36 -0700 (PDT) X-Gm-Message-State: AFq9FYJVkSvb/tveCtSyfhTw+tjDw1MoC1o4XfIGokbq0+xLq1pWjuP5 ogLEgJh6PuFU6y4nATowdV+aG2/xFLmYyv7Af27FXy2GJJ2YMsHqMcY74DsF3kf7e4xpJjcMZNG uIk69UrQ9bdANTnGBO9ND/geZrV1xafeEcZO608osllGZ7nEqBdYNZQ== X-Gm-Gg: AYBFou3jKCoXCxBGmHaraTlTXgM3St2SaJ5ZX0RBh5gATMgrk/6QgRFBK1rKPZYfYpp Qk7xhFpGE0u7zkhLmTtluhSA3J7xd7kvucowq3i8liws6F/zMMEfebcY5NmnRtAOUqULLWv1oJL fz6l/l6XynEB240Uw04SSmyPqNNSbVHuAuoTr7FWQ7qucxxvEU9UIiVKN2ayNMyKeU75flBYQrC BjDH0Bqfo40vENKul943RCzxuPyZow7HpoOGYK4BlzvZNBzCMWX4aBavLGRslA1s7jm/mg0Wype j4JG368sURQU2ou5tdgM0LwO5dgTEUiliBLIf0ca2d9nf7UKYQkMdM0vvwpOHFNKsDdP+3yjJsQ gMFpe5VeLKrKA6fslBP5vwqh7Gg== X-Received: by 2002:adf:ed45:0:b0:488:654b:54d4 with SMTP id ffacd0b85a97d-48b1275aaf3mr1903267f8f.50.1790916276520; Thu, 01 Oct 2026 21:44:36 -0700 (PDT) X-Received: by 2002:adf:ed45:0:b0:488:654b:54d4 with SMTP id ffacd0b85a97d-48b1275aaf3mr1903255f8f.50.1790916276027; Thu, 01 Oct 2026 21:44:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1790916276; cv=none; d=google.com; s=arc-20260327; b=L+s5W7HbOUX/ftFEA8jyDnqOSTJeJ/rxnSRha1v4mEHHINwZSMW8OwYhdWlpV4F5PC +dNd622QB33ZFZk0l3Gf1yOTSzQB5sLjZpsFXuOe95dj0ReQOgsNXnHGDUn3zILNGyq9 PG+S9ZLFFuIcFC27r6pF2diDtG/5Qsf19kkM9mgs8ZwJ1pXLZeJaSOvuM68rMv1fRlZi kIk6QCJA34mtL+5jFxOcRnT+q/KN06+EBmr3U5+gIp1CJr4YC/SDeOloqmXkQSQ8/PYE /7eWpG42nRyol719Z/EDY1BdWc7HEIKUSU3SDliEwBEyjue7LQ7nB/oCqe1cAdEiBbTS 5HWQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=/BHY6MGQXtjZsMYOkHRboi8Foz64EHIJBm7TUlTesLE=; fh=WpT6aB7RBAGHZeWZzqAr71yzRFbPTYkPWKsRagLn48Q=; b=Tz5W+r0nVKoImWnaXsyMulbG0m2H1Oc/vIj9gLVgxO8nLFq0PQoY3Wspd4xh2/25rG ffuxQRM75fp5Z5EZ8foxcKOQrP28Kz6RrXua7kks3kguqFob7WdeHvOQ++EyKDA8Cyfe UxubQuCYkK3sg/MdNepXc0Lv/pIh4bs3qgJkr2pWfv3u5w15HKKdST+L6FrofujbnABw /Ewawa/f7HOOBsV+CmmQvOiS2jU4ihuv4uhRmOg2qTv4pB7XeWop0rPEhLtFYrLtlu2M tXFT7bRKjrmgxdOiCJZ51RRvSdy8Sj3avJ50m4pcTkvetXJCy3NIqEKzGrPyb1rEA6N3 rPEQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=SleA1Xf3; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48b5b320c7csi2172812f8f.186.2026.10.01.21.44.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 01 Oct 2026 21:44:36 -0700 (PDT) Received-SPF: pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=SleA1Xf3; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=/BHY6MGQXtjZsMYOkHRboi8Foz64EHIJBm7TUlTesLE=; b=SleA1Xf3Q9G2 4iezDBTNjW9fIy+njC3M3dbA2DLJ2Ie3Ym37jnYCLX67tUj8KxALRZS+xOysy2EcfUV2CCBRi6Qfv BwS/ReJLoY920m4wFoOpOraXOyjXcsc0IoIj79fJGdH0ovwhfQJ/G1zpulMRgp/zMImg67ilQxPYC 9W/WCTHbe2uUOmy8tYgn6OTteDjVW5b5tQ1eg2z8cOyxyr6GW9ylq6gvtfe1xB4Ww/zpVjT8UWkGM Dj9yflTcGc3KNogQvG24ShSPOP9871azVYxZUx+09zw6UEhdtx25PHxjDEt43ZyAH30p2MpOSNsUB AV5BESxb6ebG22JLLH/guw==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=LekKit-T14) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xCV5F-00F2fs-1n; Fri, 02 Oct 2026 06:44:32 +0200 From: Eva Kurchatova To: khorenko@virtuozzo.com Date: Fri, 2 Oct 2026 07:43:13 +0300 Message-ID: <20261002044431.1632888-2-eva.kurchatova@virtuozzo.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261002044431.1632888-1-eva.kurchatova@virtuozzo.com> References: <20261002044431.1632888-1-eva.kurchatova@virtuozzo.com> MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v6 1/2] selftests: ve: grant the directories the files sit in X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org The sysfs variant names nested leaves, kernel/vmcoreinfo and kernel/notes, while the proc one names files at the top of the filesystem. Both enforcement tests grant the leaves and nothing else, so in the sysfs case the lookup stops at /sys/kernel, which a fresh VE cannot traverse, and every open answers ENOENT. Grant x on each directory along the way, taken from the path the variant already gives. Fixes: 303ce49b7446 ("selftests/ve: add ve_perms test for proc and sysfs") https://virtuozzo.atlassian.net/browse/VSTOR-144955 Feature: fix selftests Signed-off-by: Eva Kurchatova --- tools/testing/selftests/ve/ve_perms_test.c | 34 ++++++++++++++++++++-- 1 file changed, 32 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/ve/ve_perms_test.c b/tools/testing/selftests/ve/ve_perms_test.c index 25ffbd42c380..8096b1fa3b43 100644 --- a/tools/testing/selftests/ve/ve_perms_test.c +++ b/tools/testing/selftests/ve/ve_perms_test.c @@ -114,9 +114,11 @@ static int ve_open_rel(int cgv2_fd, int ctid, const char *prefix, static int set_entry(int cgv2_fd, const char *path, const char *entry, const char *mask) { - char line[256]; + char line[PATH_MAX]; - snprintf(line, sizeof(line), "%s %s", entry, mask); + if (snprintf(line, sizeof(line), "%s %s", entry, mask) >= + (int)sizeof(line)) + return -1; return write_file_at(cgv2_fd, path, line); } @@ -343,6 +345,32 @@ TEST_F(ve_perms, write_parser) EXPECT_LT(write_file_at(self->cgv2_fd, path, file), 0); } +/* A leaf is reachable only once every directory above it can be traversed */ +static int allow_path(int cgv2_fd, const char *path, const char *file) +{ + char dir[PATH_MAX]; + const char *sep; + + for (sep = strchr(file, '/'); sep; sep = strchr(sep + 1, '/')) { + if (snprintf(dir, sizeof(dir), "%.*s", (int)(sep - file), + file) >= (int)sizeof(dir)) + return -1; + if (set_entry(cgv2_fd, path, dir, "x") < 0) + return -1; + } + return 0; +} + +static int allow_paths(int cgv2_fd, const char *path, const char *const files[]) +{ + int i; + + for (i = 0; i < NR_FILES; i++) + if (allow_path(cgv2_fd, path, files[i]) < 0) + return -1; + return 0; +} + /* * Enforcement, allowed side: from inside a VE, granting r lets each file be * read, and granting x on the directory lets it be traversed (the lookup then @@ -358,6 +386,7 @@ TEST_F(ve_perms, enforce_allows) ve_file(path, sizeof(path), self->ctid_a, variant->fs); + ASSERT_EQ(allow_paths(self->cgv2_fd, path, variant->files), 0); ASSERT_EQ(set_entries(self->cgv2_fd, path, variant->files, "r"), 0); for (i = 0; i < NR_FILES; i++) EXPECT_EQ(ve_open_rel(self->cgv2_fd, self->ctid_a, @@ -400,6 +429,7 @@ TEST_F(ve_perms, enforce_denies) O_RDONLY), 0); /* Granted w only: visible but not readable. */ + ASSERT_EQ(allow_paths(self->cgv2_fd, path, variant->files), 0); ASSERT_EQ(set_entries(self->cgv2_fd, path, variant->files, "w"), 0); for (i = 0; i < NR_FILES; i++) EXPECT_EQ(ve_open_rel(self->cgv2_fd, self->ctid_a, -- 2.55.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel