From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 22C0F8045D for ; Mon, 2 Nov 2026 17:24:53 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A2HNakn027546; Mon, 2 Nov 2026 20:23:37 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A2HNakn027546 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="FuqLRI38" Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A2HNZ9W027542 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 2 Nov 2026 20:23:35 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A2HNZ9W027542 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-48e011829easo2238859f8f.3 for ; Mon, 02 Nov 2026 09:23:35 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBx7VSKFT5YZQtjktiyhqWdzSHgfw9826ksW02owWrkqxnmXGV+FTzfc07knHIPXwERRDSoebw==@openvz.org X-Gm-Message-State: AFq9FYLK5mU/7RytkNfkGRlC5mc0R6beU3qayNq8UztzLpiE3tj6vd/t Iqc42mFTMQ4yS3ghhDiEzfOhUMoME8ud+vrFFUb7vQfDN/HN1XWz/K/Vqw5ixqRumx/dxgkm8UZ /3HsjBRsxv1LJTPyPEWu+M+tHx7p+nYx3z3XNv1IQ5LCIxFQ2/3nNhA== X-Gm-Gg: AYBFou2ALM551tnjb/eiGzdFoc6QtbvgWA4s7M+rmHXBclK2jQfxPQk5SQR21K/hcEt VnY3hLg+rgIgTYFdJ8JjmA0pQ3TjSweEQPhuGPuoD0lQVBUkxeNa3g+z+fgSzYTZnUAvjAMqUsW 1AtnV4uS3SS2xFtLqKwfzJo+SS/ugV7vcQmpmcsQPwRI7P3RY5h+rY9N8YRofbmHEJtxuNEbrtA XfvmqC22O4e3PsGWgMmUnl87zwlEjf+uET80B5Ad5SosZHRozNaQdFwsBJAKogHOAnda1KFAbUl BcZTteRZmIHCu2iefOh3ZSb/jilvrW2Rjb2hKQr8u/Ks7Y4C1VZo3sMjbYXGUbWzSEITrkAyOYp ZLj7GjMHCd7DY27cD X-Received: by 2002:a05:600c:6215:b0:4a1:a45a:88f with SMTP id 5b1f17b1804b1-4ac187a6c3amr232189625e9.20.1793640215036; Mon, 02 Nov 2026 09:23:35 -0800 (PST) X-Received: by 2002:a05:600c:6215:b0:4a1:a45a:88f with SMTP id 5b1f17b1804b1-4ac187a6c3amr232189225e9.20.1793640214530; Mon, 02 Nov 2026 09:23:34 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793640214; cv=none; d=google.com; s=arc-20260327; b=EdcrmOGJfV6I9XM2Pbx8mAny56sufLbfATyLmzxqe9xykqygxr5bw8kM3SX3rvpgbC cTKP5bxSoYB+mjz6JMgB/ykkWSJzwd1rJwdsHgOJOBjZQQPw/uVIabjHPN5knMB3HU/y bAh55uV5/p2OA0TpsQIefPDx2cuP1rToPKKVDcYvJYdKWelOQtRRgGSw7e7iI1DpAuvV I70nFkMrAFgp1Sc8KK2Z7qNF9HGUT05rFYw/uDPUSw5laia3d2X73fItPuxNiE3bGJct takryy3fhNnJFe4y20XteHOVTaqqYeFKTGQqcLWOcawdPIyOYAFhUQw3+E4pv4G+pwL4 2LBQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=message-id:date:references:in-reply-to:cc:to:from:subject :content-transfer-encoding:mime-version:dkim-signature; bh=RfumoxDicoIfpp7YU333cgIfn1f0ztA7M89Eg9Kk144=; fh=CTF2GHyV+XdzB5TROrdG4fdLri6JSHNOBC+LNuNq5bA=; b=dy0+UGvXDQB7gbNt6ERuEld24/qkcVW7vFOwtiaBpNdHVaY7vJq1tr//JG5V0LKq+S j1GcSurPqkyf3aWviYupSwPDWqzTVutOTw0Bgt9m8FYH1m8CMN7KWjoWE8n8ggIMGqmz LetoKzysHG3hEDCKVasgb+k8BSXt5dik9Zqd+0vUaCH+XmPmePjtCcH8pS4+vMPqhWRP exC30CKgQXwHqUEhUlMYiKiQzg+hlBQpO+Hr11g3mvJEhpYIX7TZ44TbN0GAom1s6TV5 ak6mX2N7EaUGIjuH0ntHL7B8aBvAb0H5AkyoYdbS2MuD8Utm6eNEWKHGvjGzqbF+SzCM gJlg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=FuqLRI38; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48e71bafe91si20061004f8f.195.2026.11.02.09.23.34 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 09:23:34 -0800 (PST) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=FuqLRI38; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Date:From:Subject:Content-Type: MIME-Version; bh=RfumoxDicoIfpp7YU333cgIfn1f0ztA7M89Eg9Kk144=; b=FuqLRI38ml9H MFtTBFx6P/q6DHh64xwHdDethtX1Klm7Lsh4TFzci4m4NJ9guaCWDYPnU/ZNDZOryQu0Mow5L3G9u 1ljhBEN6yUTgDxSXEPnf96hYW7vgDli/NfxI2YxYi9mhJuzNgMYE5+fRWecSlgeklXPWgC1qdgP1U 9Bth/BIlEJ6QbQEWO+eFlBQ0paB0nF6GmH5PiUN4hHZUNa31AQw+6Oyeojdev1ayrA+4m+RTKJ6MP FVLhb4O3QZJBp8POl4+dRTv26WXmAFw5ydoFA71afuF1hNad4vpB5SmU9CrCZQPEOuZAdNC0WjCoP eB+Z2cb2z4f5fkUDwOFL2w==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xNvgx-0006YS-2l; Mon, 02 Nov 2026 18:23:25 +0100 MIME-Version: 1.0 From: Konstantin Khorenko To: Eva Kurchatova In-Reply-To: <20261102140914.2315569-1-eva.kurchatova@virtuozzo.com> References: <20261102140914.2315569-1-eva.kurchatova@virtuozzo.com> Date: Mon, 02 Nov 2026 18:23:31 +0100 Message-Id: <179364021154.2253555.17574871801711737184.b4-review@b4> X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2414; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=TFYH5d9OQkADp7I/D2j+SnKuMkfQloEmmiMfeqQayig=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBq6McV5mnWeNinCGTtEn1HpL91CrFzOx+3V+yQh e2QPhDDpiGJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCaujHFQAKCRBRlgpH+WFc KiZ+D/9v+ogvv6Oj/Qvyl72lOcdQSGUjJk64hswUFMr8bROrPEZYz3SJNjDCcROABBvoF0EVgs3 Edbn0SSpK30pHi7ggbTypGn002U68iP83AZ9KAMEAM2hR0lNlQ+F6/isyKXYmP+dvOnNjqckvHM R4lDf5ts+JlgHSjX+Mj9bxWnSjWGH0R0n/hEz0EIPWLG8xFRKS1sSYvCgLfnBy2UlGdCzyppziH bND3FNDZu3iZB4k+EucQa2SpVVt+MSWOZN+6RPl6L0vxV2nNXWOy/6ruw5WS06sSCKnsyOKt2d6 5cV57Hgj+97Qli9gZf8+osYNRA/U7R/qojEwVY/mWVhx20cYxZUTvtxlFkU+7Gql+Tz8jjpRFzy dVMU1OeeLLYgQGDXUIV9L3OBpS1gaKh9jaKf1l8o5fLXZApFXd2zzF0NqEqQh13lLJ+7vl7LTX/ T8yaz6Yag/5n6xXJvgPjbbfNPiGxqI0aSt0aDmv8UuEsdKpDRhYBeqX3kZlzCAlFUf3bogx1Upg nsxaZRacL71e4H4Xpb95ah8r984HgYRLs2b4cZhD5CK6GIbqAPfbicK2DJYpxI4tiNCMRpR1WLc hjZA7CxEhw708nhhifAdYsW7lOl7id6x1Dz+RSjEXJUzMe1/dHpKJWoVTIeNxP3rAolb3nXAInX a8T3gT4Mwiqe3ZA== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: Re: [Devel] [PATCH hci-8.1] selftests: ve: grant the root directory as well X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org Hi Eva, The fix itself is right. On sysfs a fresh VE cannot traverse /sys without a grant on the root. On proc the "/ x" write is refused with EINVAL, and the proc root needs no grant. Remarks inline, three on the message and one minor on the code. On 11/2/26 16:08, Eva Kurchatova wrote: > allow_path() grants every directory above a file except the root, so a > fresh VE can reach the file only if the default permissions already let > it traverse the root, as vzctl sets them at boot. Without that, > ve_perms.sysfs.enforce_allows fails. ve_perms.sysfs.enforce_denies is affected as well, the other way round: it passed for the wrong reason. Its "granted w only" and "directory granted r only" checks expect EACCES. On such a host they got it from the root, not from the missing r and x bits. This patch is what makes those checks test something, worth one sentence here. > Grant the root too, proc refuses an > entry for its root with EINVAL, as its root is always reachable. Two sentences joined with commas. Also, "as its root is always reachable" reads as the reason proc refuses the entry. The real reason is in proc_perms_set(): an empty path walks to proc_root and is rejected as invalid. Reachability is why the test may ignore that error. Maybe: Grant the root too. proc refuses an entry for its root with EINVAL and needs none: the proc root inode has no per-VE permission check. > Fixes: ce7800c78ae9 ("selftests: ve: grant the directories the files sit in") > Feature: fix selftests The Jira URL line is missing. ce7800c78ae9 carries VSTOR-144955. If this is the same ticket, please add https://virtuozzo.atlassian.net/browse/VSTOR-144955 > @@ -351,6 +351,8 @@ static int allow_path(int cgv2_fd, const char *path, const char *file) > char dir[PATH_MAX]; > const char *sep; > > + if (set_entry(cgv2_fd, path, "/", "x") < 0 && errno != EINVAL) > + return -1; allow_paths() calls allow_path() once per file, so the root is granted NR_FILES times. Unlike the intermediate directories, the root is the same for every file, so it could go into allow_paths(), once, before the loop: if (set_entry(cgv2_fd, path, "/", "x") < 0 && errno != EINVAL) return -1; for (i = 0; i < NR_FILES; i++) if (allow_path(cgv2_fd, path, files[i]) < 0) return -1; -- Konstantin -- Konstantin Khorenko, Virtuozzo Linux Kernel Team _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel