From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 072178015D for ; Mon, 14 Sep 2026 09:18:05 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68E9GarH028229; Mon, 14 Sep 2026 12:16:37 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68E9GarH028229 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="FbX43GsZ" Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68E9GYpa028220 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 14 Sep 2026 12:16:35 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68E9GYpa028220 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-486f77056cfso1316511f8f.2 for ; Mon, 14 Sep 2026 02:16:34 -0700 (PDT) X-Gm-Message-State: AFuF++n6rJGvIHLQA2qxAdZmm+FCaeAy5SmtuMn16ipjsNjDVBnK0sFM 6lBfscmznAlpAKQ5K5MBhihDU0B19T3EzNpGkA45hPBotDTJEn1fzpGVHP5W5JmywLfvZS9rpB5 t3tnNtyr5vQvZwreWWHuSokRJhsJfCaDF43oamIp/VlMDAb0rkEu4IA== X-Gm-Gg: AYBFou1MYkokd1lRpZ+S9XlrDk/JJFnaNpK8Aod48FZ+faZtvguc7QlGsSDqHNn8tzg O8IZBc4xeW5U4O/7+wCmjmp223FeqXnmoCIO7kQG0AoWyjW7fWLFU56Lpzmu1MDBJlf3kN4cLxP ScyZKzdyyyl8/l96s2xQbDZoawF3K1p3hCMfvsgaBCs6giC2phlgjj9L4uViPeqew3xagIHc4bb xo83gk5MEZfZx4dLHrjNjuZ5K0gqcXLcYcijla2cyaC1CExvC1p/eDukNpYhFGiNrHnbCbm+URx /RZI9m+kbq7igC4B+4yu38kdMhXQ027veeiV2VNCmDZBDDieM6/eyCxny0IRrpL/nMOaABrRDIo JvTXdfaOGi8ys5ZbwX90QQ7Ct X-Received: by 2002:a5d:5f08:0:b0:486:e723:1982 with SMTP id ffacd0b85a97d-48702ac3458mr1601449f8f.21.1789377394549; Mon, 14 Sep 2026 02:16:34 -0700 (PDT) X-Received: by 2002:a5d:5f08:0:b0:486:e723:1982 with SMTP id ffacd0b85a97d-48702ac3458mr1601392f8f.21.1789377393953; Mon, 14 Sep 2026 02:16:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1789377393; cv=none; d=google.com; s=arc-20260327; b=ktjHadPjdjzTsvb2Q6weSKpwQvLN8xs33mi0Orb7yZUbTlEnAQ5fpk5WcJ+I5E9aUT 7aMqtJTLGq5kKlrdpJBg9pu+8bdvfl0nMtJlh2pQmwW+9Pe707DUYbKBxejVPlNc6okV 76Osak3rN9mvLsD1Zt3Ra0p07j1EYIGtCIq+RldECmo6ySqm1kRzDo2F+/bHCKNE+SE6 iVYeX7OTYLQ4Xtez3fx7Vb3Z4NDrm4Xw9/1CgQS5d85DgTefEtciNL0wCBTY8FiTdKKS 1HQyd7qKwOVInes6UBCxkINXfyfFpxKVzLnjH++Dvp4Sbk6QHRMkWtR22NReM+puTU3e dVYA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=vQ39DgypmkdANNT+d/1ptu/PdqiJACZVS5q/ZUBXu74=; fh=WpT6aB7RBAGHZeWZzqAr71yzRFbPTYkPWKsRagLn48Q=; b=iUQWLa9Eq4oxCYZiHhcWVnnqsAUHKIwncsBGQFhFmRjMSLYtPaN6Lcf48JdkOlancf j03IijrYozcl/NsOYWUCubMIE2maBeRLK+URyKpBm+x+MOfoIMk6oMKlgMXdQFzJdPfa rHd1xLBqbBQgqg/mlawirz7ezcnZ52nIQaScO3QwVxtLZNBJnR0lDCzAbYq//Azh9ejY uM6QMAZNJW9ACcM7Fm1eznbsbRiOmq3WMegN0OC259fWuuVPGjtpDBFoSaMqGFmwBr7n yrL128XzIRhBdMTm8sZe+d1rgsh3EZ6q+dmUcYS/ixiDyV03LIt6GmAkune2A7N939u0 EX8w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=FbX43GsZ; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-486ebe4d8fesi18935145f8f.412.2026.09.14.02.16.33 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 14 Sep 2026 02:16:33 -0700 (PDT) Received-SPF: pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=FbX43GsZ; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=vQ39DgypmkdANNT+d/1ptu/PdqiJACZVS5q/ZUBXu74=; b=FbX43GsZbgXn dABYpkj8zf/DsjQdu9rHTvzL+uV0dnsyDq8EiZMVaGZxCbh2/WCW8VSX0oSr+Ed9QTuizKMzJwtSU sf8zn6fK/sa28Zp6/ZyQLW4O6aUBzTNYataO6q1ZykY6zJBzZr5PliTjQXL0A0+A9fLMF/crSAwVw sEmXOw96Exq4Td5z9ZVCa6r/ATXa4bwtGnXEMR9gISkv/rcjSBYGCXxDyGXcGjKIZZVyQT6Mk1UzF d/uaR7SpGvn631UGsguatSwodrb1SUFoIRw5fMS1BNmiTrA60SLGsow3tPj33oaycaua5kbcDtBjm QEoTvUSq3aRAhLO4FMaClA==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=LekKit-T14) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1x62l0-00ErAH-0F; Mon, 14 Sep 2026 11:16:25 +0200 From: Eva Kurchatova To: khorenko@virtuozzo.com Date: Mon, 14 Sep 2026 12:16:25 +0300 Message-ID: <20260914091631.631032-1-eva.kurchatova@virtuozzo.com> X-Mailer: git-send-email 2.55.0 MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH vz10 1/2] selftests: ve: grant the directories the files sit in X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org The sysfs variant names nested leaves, kernel/vmcoreinfo and kernel/notes, while the proc one names files at the top of the filesystem. Both enforcement tests grant the leaves and nothing else, so in the sysfs case the lookup stops at /sys/kernel, which a fresh VE cannot traverse, and every open answers ENOENT: not ok 14 ve_perms.sysfs.enforce_allows not ok 15 ve_perms.sysfs.enforce_denies Grant x on each directory along the way, taken from the path the variant already gives. A file at the top of the filesystem has none and needs nothing, so the proc variant is unaffected. The suite then passes 16 of 16, where it passed 14 before. https://virtuozzo.atlassian.net/browse/VSTOR-144955 Feature: fix vz selftests Signed-off-by: Eva Kurchatova --- tools/testing/selftests/ve/ve_perms_test.c | 33 ++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/tools/testing/selftests/ve/ve_perms_test.c b/tools/testing/selftests/ve/ve_perms_test.c index 25ffbd42c380..2b542dc30139 100644 --- a/tools/testing/selftests/ve/ve_perms_test.c +++ b/tools/testing/selftests/ve/ve_perms_test.c @@ -348,6 +348,37 @@ TEST_F(ve_perms, write_parser) * read, and granting x on the directory lets it be traversed (the lookup then * fails ENOENT on the missing child, not EACCES). */ +/* + * A leaf is only reachable once every directory above it can be traversed. + * The variants name their files relative to the mount point, so grant x on + * each directory along the way; a file at the top of the filesystem has + * none and needs nothing. + */ +static int allow_path(int cgv2_fd, const char *path, const char *file) +{ + char dir[240]; /* set_entry() writes " " into 256 */ + const char *sep; + + for (sep = strchr(file, '/'); sep; sep = strchr(sep + 1, '/')) { + if (sep - file >= (long)sizeof(dir)) + return -1; + snprintf(dir, sizeof(dir), "%.*s", (int)(sep - file), file); + if (set_entry(cgv2_fd, path, dir, "x") < 0) + return -1; + } + return 0; +} + +static int allow_paths(int cgv2_fd, const char *path, const char *const files[]) +{ + int i; + + for (i = 0; i < NR_FILES; i++) + if (allow_path(cgv2_fd, path, files[i]) < 0) + return -1; + return 0; +} + TEST_F(ve_perms, enforce_allows) { char path[PATH_MAX], absent[128]; @@ -358,6 +389,7 @@ TEST_F(ve_perms, enforce_allows) ve_file(path, sizeof(path), self->ctid_a, variant->fs); + ASSERT_EQ(allow_paths(self->cgv2_fd, path, variant->files), 0); ASSERT_EQ(set_entries(self->cgv2_fd, path, variant->files, "r"), 0); for (i = 0; i < NR_FILES; i++) EXPECT_EQ(ve_open_rel(self->cgv2_fd, self->ctid_a, @@ -400,6 +432,7 @@ TEST_F(ve_perms, enforce_denies) O_RDONLY), 0); /* Granted w only: visible but not readable. */ + ASSERT_EQ(allow_paths(self->cgv2_fd, path, variant->files), 0); ASSERT_EQ(set_entries(self->cgv2_fd, path, variant->files, "w"), 0); for (i = 0; i < NR_FILES; i++) EXPECT_EQ(ve_open_rel(self->cgv2_fd, self->ctid_a, -- 2.55.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel