From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 427D18013F for ; Tue, 22 Sep 2026 17:49:00 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68MHlfto020037; Tue, 22 Sep 2026 20:47:42 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68MHlfto020037 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="wztyNvqQ" Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68MHldNs020029 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 22 Sep 2026 20:47:39 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68MHldNs020029 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-49e73659ac5so587915e9.2 for ; Tue, 22 Sep 2026 10:47:39 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBwSXRDsGbou6MkdG0dt3FESzwhr4K4kja6IkFYXn5RXGRI1Y2nfV6wLLJXFPk6Xb0EgRiPjxg==@openvz.org X-Gm-Message-State: AFuF++kLC+ahv3wCVl7mjDNX/R3O6Zw/GD37LJqSgoeplJivKhMRei7Y dRoV5ufTHb91szAt7mEpA7cgp2jcCm14j9xupySY04LhzQjhdYkqQc/BU7vV5P+0jPsVSKy0Te9 BgvcCvLjQtzVf1DHDyv6zn0z8qDD1QCOETW9bEB3z41wxkrVGm++xBQ== X-Gm-Gg: AYBFou1/ZTNppJY8OLGiNHclDLdee8S6ba4OIedxVcn0fbokSGRz9JBUDzBSYXOoik8 JnIvTGbeDZ+SGPpNP6iLxZsxJWo4aXYz1AylJeLhrfb176TGL8N4b9v87F5asb+U5inX8tdAOsA KV8AB/deNTcdy7LfM9rbrgxN+p7gLnk4dImroo6ZOR9lpEyYS6kvSnbyo9jUCpgFDDmzZHAMgkc efv4MbVl+OgABJdb0z6opoX20ArLaUK7rBLBPgDr0U7vjH/N49QbyMJxvpROiHp0XaeHAyuqHG6 PZbMX8O27JbZIbT2gGOk9sPNwS4MuIiz5FHqLDvNmmD5m5/3VKgheH31leysHbBHY5+6N3TUetS ORZZrHd6VPre3RUxfQw== X-Received: by 2002:a05:600c:4ed4:b0:49c:cee2:a508 with SMTP id 5b1f17b1804b1-49fc5728f9amr189945805e9.16.1790099258784; Tue, 22 Sep 2026 10:47:38 -0700 (PDT) X-Received: by 2002:a05:600c:4ed4:b0:49c:cee2:a508 with SMTP id 5b1f17b1804b1-49fc5728f9amr189945555e9.16.1790099258290; Tue, 22 Sep 2026 10:47:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1790099258; cv=none; d=google.com; s=arc-20260327; b=kFsyNDmkQiU8MYJf6W1qCcav6ElWujFdByXYseVtrfTh6n769HVwQv0LJunt/eK5OD EmXPcvBnJTjKnlFhK7JJI2CUp5VtDQtTClPBR74f+R4YHWQU4KtRhRiIRR9HOfwY3q2u 6SWnyVR4SYa/BKAIFegYUnGRZyAHXcR5LEbRPUxBgoYPwgWslWa9sixJti58IhN8ovp7 i9VR8+KvriV1OWScaqjazxJLCx+E3tQeytHdMQJ3iHZ0S+D4A7UiIVvKFDeZZrPPmBzU G4fueKXf6GLE+BSqeoiyLpiCJ3Cko60iPDyzSU5M284Sru/OclAtZ052O0d1/ss4SzZA lV8g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=message-id:date:references:in-reply-to:cc:to:from:subject :content-transfer-encoding:mime-version:dkim-signature; bh=4Ffo+/bvKvWOmyyL8v5T1FeI+a1wcA7XzfqYoZUlBYc=; fh=CTF2GHyV+XdzB5TROrdG4fdLri6JSHNOBC+LNuNq5bA=; b=feqbDRew6htOfaXV7pg1AJAY0IiSCydGD7r8pNfYI9xlxBUY4TLPOHz+fW3bdrM8Ck DHXFMfKYyV2kbYSnUIuI2t3rDNQjaQwPBYw1Gb+6wMBQHUMX0C318lJpf6IWlq0Y66Yz 16SlOx6HZP617tGJDOau8Q8HV6QGv6xQae328bwMxA4zMpW8jQj1Da8ZpGAJeI41Qttf spOkJ2i8aNDHB2f5ihjblalFQqiAko6i8NripQE8rC1Ui+smubDV8NUL2Xtn8tg2oW+j dFANzlQksr7vHEUfHfIgNPXhAfntViX+hIfijZkleN/5uHuNxp8ZgiplHscWJ/YMNyQg 7cQw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=wztyNvqQ; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-488627c12casi4290509f8f.160.2026.09.22.10.47.38 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 22 Sep 2026 10:47:38 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=wztyNvqQ; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Date:From:Subject:Content-Type: MIME-Version; bh=4Ffo+/bvKvWOmyyL8v5T1FeI+a1wcA7XzfqYoZUlBYc=; b=wztyNvqQzy32 ulem7W3pNFkinhxgXzgnh8a4MxtAhXdhkd+4nw7cm2UbNZ/nBB627aolXdQhcTiqEKAHdJTVs6aMc VhrZH7JE6lu/Scvzd6p+wSUKZyMbVjgBwOTLScnWaoDgeYhaFYVntelZEWJj4bgRtda6okUjXqA0e z3mpzNQK52UnjNgqr5hU8GmuUgmBzTkbgoyVNxeAUz925YeLG7vfNm9VQFNDh5cTZHcYStVRVMVgY 3mcvV3j0M2I9s4mpmeHiG7nj+vkvPQIBZjnJ0zrWf159xMS9Ha2u/uzA0xHPUm+wOEAhe1xhUH8kg +S6QVIszIkCavdJup2Gybg==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1x94Xl-00GRST-3A; Tue, 22 Sep 2026 19:47:27 +0200 MIME-Version: 1.0 From: Konstantin Khorenko To: Eva Kurchatova In-Reply-To: <20260916123128.799429-1-eva.kurchatova@virtuozzo.com> References: <20260916123128.799429-1-eva.kurchatova@virtuozzo.com> Date: Tue, 22 Sep 2026 19:47:34 +0200 Message-Id: <179009925448.3038143.53022307520091714.b4-review@b4> X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4077; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=YRfGy6J/sf/DCIMUkfbZP6upOmA27aq+8adMFEFwyck=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBqsr84BNSZhWtdbUnlyrGK9DeppaCaYDb2QwdEH b21P6NATs+JAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCarK/OAAKCRBRlgpH+WFc KvHnD/9rI8ybI5JF5f8QNg7ddOrn/z6pnNeU2nvD2/MF90K0gOv2cP86Z3HKdQSZ/X0/YAKyrlJ 8PGBc6CKIG/9/LhNKcXQ+al95+EE7p+KOCjO5fqKIiyOhONQNqTBIlFE+ujk3SJWGEMMRjKc+sa sF9uJeQTV7pqwFLr4vfddKAJSqj4uqhQvCGY94KaO1EmwgG9zveNUb+xxYztbvBx7DrkrkvOQUo CANLPtBPyNDe4+LEOZjGbNSkv9/0sdNM4JDcxYdi4xHLUouqJ4sEgpAp06mH2QITLpYl+cXUg3a axZ4Ul+QsoOOtlSCVaGh+v16KfF4ppKUHHRxRXsCePSlZX3WoHSbHlaG/DIHYNFbrkxn/UzDJIZ KeQhLi6eDQCLM6UcHLUe/oqJWNgOKGT2O+RLwZ9rhLYjPtC6zORENOtVcsnZNzxP0TCraWS5sx7 c7dib1J0IlOx5oFSqJzDMbHo2YMgStVXbZXHIvzgJPXRpL85U7aGYUIDYfbEPe4+5iUPemlhuy4 iLFRDt7nYekXwQk6o7khRbFdqg2hLUq/kpB++W7aJc+mXbB/yflfWV90QLm5FVu58uUhDOMdZ7X 6yohNAkddMjR8gHTnZQAVqzIqS10BHTYiIQ4sbp9GDsk03lSL63q4s2D91bFOIQpVd+aLxdUwRh lARqNyH5E/Y1NDA== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: Re: [Devel] [PATCH vz10 v2 1/2] selftests: ve: grant the directories the files sit in X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org > The sysfs variant names nested leaves, kernel/vmcoreinfo and > kernel/notes, while the proc one names files at the top of the > filesystem. Both enforcement tests grant the leaves and nothing else, > so in the sysfs case the lookup stops at /sys/kernel, which a fresh VE > cannot traverse, and every open answers ENOENT: > > not ok 14 ve_perms.sysfs.enforce_allows > not ok 15 ve_perms.sysfs.enforce_denies > > Grant x on each directory along the way, taken from the path the > variant already gives. A file at the top of the filesystem has none > and needs nothing, so the proc variant is unaffected. > > The suite then passes 16 of 16, where it passed 14 before. This line is redundant, please remove. In general, please try to avoid numbers in commit messages which (numbers) will change soon - this time it's enough just to add one more test and that's it. > > Fixes: 303ce49b7446 ("selftests/ve: add ve_perms test for proc and sysfs") > > https://virtuozzo.atlassian.net/browse/VSTOR-144955 > > Feature: fix vz selftests > Signed-off-by: Eva Kurchatova > > diff --git a/tools/testing/selftests/ve/ve_perms_test.c b/tools/testing/selftests/ve/ve_perms_test.c > index 25ffbd42c3802..2b542dc301394 100644 > --- a/tools/testing/selftests/ve/ve_perms_test.c > +++ b/tools/testing/selftests/ve/ve_perms_test.c > @@ -348,6 +348,37 @@ TEST_F(ve_perms, write_parser) > * read, and granting x on the directory lets it be traversed (the lookup then > * fails ENOENT on the missing child, not EACCES). > */ Those helpers were inserted between a test comment and the test itself. > +/* > + * A leaf is only reachable once every directory above it can be traversed. > + * The variants name their files relative to the mount point, so grant x on > + * each directory along the way; a file at the top of the filesystem has > + * none and needs nothing. > + */ > +static int allow_path(int cgv2_fd, const char *path, const char *file) > +{ > + char dir[240]; /* set_entry() writes " " into 256 */ The 240 is tied to the 256 inside set_entry() by a comment only, and set_entry() itself still truncates silently: a long entry is written to the cgroup file cut short instead of failing. The file already has the idiom for this in ve_open_rel(), which checks the snprintf() result against sizeof(). Apply the same in set_entry() and the caller no longer needs its own length arithmetic: static int set_entry(int cgv2_fd, const char *path, const char *entry, const char *mask) { - char line[256]; + char line[PATH_MAX]; - snprintf(line, sizeof(line), "%s %s", entry, mask); + if (snprintf(line, sizeof(line), "%s %s", entry, mask) >= + (int)sizeof(line)) + return -1; return write_file_at(cgv2_fd, path, line); } static int allow_path(int cgv2_fd, const char *path, const char *file) { - char dir[240]; /* set_entry() writes " " into 256 */ + char dir[PATH_MAX]; const char *sep; for (sep = strchr(file, '/'); sep; sep = strchr(sep + 1, '/')) { - if (sep - file >= (long)sizeof(dir)) - return -1; - snprintf(dir, sizeof(dir), "%.*s", (int)(sep - file), file); + if (snprintf(dir, sizeof(dir), "%.*s", (int)(sep - file), + file) >= (int)sizeof(dir)) + return -1; if (set_entry(cgv2_fd, path, dir, "x") < 0) return -1; } return 0; } The set_entry() part fixes a pre-existing function, so it can go in its own commit if you prefer, but it is small enough to stay here. -- Konstantin Khorenko _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel