From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id A97C580067 for ; Thu, 24 Sep 2026 15:02:47 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68OF1Nf8017402; Thu, 24 Sep 2026 18:01:24 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68OF1Nf8017402 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="Nx5Z89K5" Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68OF1Kfk017394 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Thu, 24 Sep 2026 18:01:20 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68OF1Kfk017394 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-4871575eebbso1815266f8f.2 for ; Thu, 24 Sep 2026 08:01:20 -0700 (PDT) X-Gm-Message-State: AFuF++mPQybnmTvJa+ro5CAdAxlmofyzn0dFNc/aJTicvrVtHVTWQ3hd YGbEW+/LrU161FFV58D8Ddn7cBvqnP47c6oIG+xKh+tiemA0tdn7gx+kK8bkGu5sTagKrUu9Od2 N41kW5f3gf+u0FPBVlNC4ej8utS9xoxsDM3mVawvepiAQYYlHn1fRdw== X-Gm-Gg: AYBFou2D+2D86xUmF2vTnXWTo/ZHyPJifwn50hTQ9JO8P5aln0yuWpEV8hB6dj63aVC 5+n/c4Xqfx/IvYMg2+ktyXczK9HsdR/SpsYi5MX/b04TNSJ2ea171aj71hAoP/JGGMqB0VFv1h+ P72Gk5sufXjyumivLSU5GzMVPURQxfcyfxAm6cfWAg/UxkrfFVlRNZ2gcoXxpOBTaDWEi1ZB+5B DaiAMTCayNgTcfQhp5r8JUkKhymoGnoPOKCbxhmGbP1a9XQDUbG9rSnuHcUpzlFWSrNXZ4nuRkq JzHA6uj0Z34Y4P4WJMnLkHr4177D+XgF6xypzZQBhhQKbWVpSyJ9aLuQtwABR+GyXnyAwlIt65O PPrmKds1zWMiyppP7DuA3ClVzwA== X-Received: by 2002:a05:6000:4804:b0:487:37f:9ea7 with SMTP id ffacd0b85a97d-4887175e6d0mr5195384f8f.32.1790262080003; Thu, 24 Sep 2026 08:01:20 -0700 (PDT) X-Received: by 2002:a05:6000:4804:b0:487:37f:9ea7 with SMTP id ffacd0b85a97d-4887175e6d0mr5195250f8f.32.1790262079201; Thu, 24 Sep 2026 08:01:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1790262079; cv=none; d=google.com; s=arc-20260327; b=oud6JZffZA7hY66vP5tZNPjGwqOEZEazBrnfau0ZYGnZ3NHl8eZedrq1Zzpk2OEkuH FU5BLxXkls6ORmWEM/8myDGMBV81cffQc+9uj5saCwoBVQLQcA026h7ZHrIzItAy38wj IsF18g7/TSsEV79bIW6SZam+WCS4OFqCgvjZvtDtVxUbCbFMRfXv1dwxfo6IW+s+woEG 6sG0vyIVZn+lAslGDGBKuJ0MzTI2ZYxBiByEbuPjufE7/rMOCYpDUUD0GvlSwmkM9jto SW+8S+uIPeqVHie1TzCjO70YTYfMdZujdB/GfwBDtwcwBGDHT6PQ87/vz6l8F89M+M51 bdwg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=q4rM7la/daQ4avTuiA9l28/tdrgVvptoo9hvYwMg3tg=; fh=bRmlDJ6vflC8xapCpe8SIKiBemLWBr+xozKix8GBr/Q=; b=YHVLRmCeExy+m0U7TU6iGvnxUaV5kx1j8ac+BXs4Qe/LA8hoBc/uO35T5MeJAR455T ULK6eSssEmfi6vJ+UrdILrNG1lU+FGvRZw4m7ubSRTnKTRRd6vizMIt9S8g7gFWdtNej Sraj9q6j6tqbMSXXmnGqT4I8eQNK9Wx3e4D+bDSpuTsITo/G8/SeujdFfdYbgNDse7L+ KiCDMSYT4/+yM+WjJu+hydZ5Ve/GrafMLOMMRVa1aJOrylMkoUDJTVh9a13A7EzhlCfO dRBWHWcGQTEy/h7J2j/C0E5orim6icuvRbt8BWhAfGEUZIgDThFm4RMatdTN9lGUS6mL g/Og==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=Nx5Z89K5; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-488688c0987si10828986f8f.242.2026.09.24.08.01.19 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Sep 2026 08:01:19 -0700 (PDT) Received-SPF: pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=Nx5Z89K5; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=q4rM7la/daQ4avTuiA9l28/tdrgVvptoo9hvYwMg3tg=; b=Nx5Z89K5zpau o+quqSk/2icfl6NICRTw6uDHbAGL+2yTEJtrLD7CUTZpsMFw7fXtBjKlKFKLuIBXpHEtBO0F2Dkty NxN54rwaHlDQ+DMjThoka6x+jv2t9nxkkQzxjEB1FU+lQU/6sBl8TJwzWlZh0hgI+u0cNQfP00iJu qozXFKJd+1pFzhAX+jtNB0prcOOfO8RebQQpOJMA6/y0VkIQCooJl7N4IG3Dw20W7JI+kLYo7exo8 /N0hOY65CyadRN322nShGf5aUP8zz3lma17QFYyggVKthbNc3ceTsUXcfltkfMAFH2TbTWebE5y+A T+HNDV6ML/4AeWXoBmuN6A==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=LekKit-T14) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1x9ktr-00HF72-2z; Thu, 24 Sep 2026 17:01:16 +0200 From: Eva Kurchatova To: vasileios.almpanis@virtuozzo.com Date: Thu, 24 Sep 2026 18:01:12 +0300 Message-ID: <20260924150116.3258992-1-eva.kurchatova@virtuozzo.com> X-Mailer: git-send-email 2.55.0 MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v3 1/2] selftests: ve: grant the directories the files sit in X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org The sysfs variant names nested leaves, kernel/vmcoreinfo and kernel/notes, while the proc one names files at the top of the filesystem. Both enforcement tests grant the leaves and nothing else, so in the sysfs case the lookup stops at /sys/kernel, which a fresh VE cannot traverse, and every open answers ENOENT: not ok 14 ve_perms.sysfs.enforce_allows not ok 15 ve_perms.sysfs.enforce_denies Grant x on each directory along the way, taken from the path the variant already gives. Fixes: 303ce49b7446 ("selftests/ve: add ve_perms test for proc and sysfs") https://virtuozzo.atlassian.net/browse/VSTOR-144955 Feature: fix vz selftests Signed-off-by: Eva Kurchatova --- tools/testing/selftests/ve/ve_perms_test.c | 33 ++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/tools/testing/selftests/ve/ve_perms_test.c b/tools/testing/selftests/ve/ve_perms_test.c index 25ffbd42c380..2b542dc30139 100644 --- a/tools/testing/selftests/ve/ve_perms_test.c +++ b/tools/testing/selftests/ve/ve_perms_test.c @@ -348,6 +348,37 @@ TEST_F(ve_perms, write_parser) * read, and granting x on the directory lets it be traversed (the lookup then * fails ENOENT on the missing child, not EACCES). */ +/* + * A leaf is only reachable once every directory above it can be traversed. + * The variants name their files relative to the mount point, so grant x on + * each directory along the way; a file at the top of the filesystem has + * none and needs nothing. + */ +static int allow_path(int cgv2_fd, const char *path, const char *file) +{ + char dir[240]; /* set_entry() writes " " into 256 */ + const char *sep; + + for (sep = strchr(file, '/'); sep; sep = strchr(sep + 1, '/')) { + if (sep - file >= (long)sizeof(dir)) + return -1; + snprintf(dir, sizeof(dir), "%.*s", (int)(sep - file), file); + if (set_entry(cgv2_fd, path, dir, "x") < 0) + return -1; + } + return 0; +} + +static int allow_paths(int cgv2_fd, const char *path, const char *const files[]) +{ + int i; + + for (i = 0; i < NR_FILES; i++) + if (allow_path(cgv2_fd, path, files[i]) < 0) + return -1; + return 0; +} + TEST_F(ve_perms, enforce_allows) { char path[PATH_MAX], absent[128]; @@ -358,6 +389,7 @@ TEST_F(ve_perms, enforce_allows) ve_file(path, sizeof(path), self->ctid_a, variant->fs); + ASSERT_EQ(allow_paths(self->cgv2_fd, path, variant->files), 0); ASSERT_EQ(set_entries(self->cgv2_fd, path, variant->files, "r"), 0); for (i = 0; i < NR_FILES; i++) EXPECT_EQ(ve_open_rel(self->cgv2_fd, self->ctid_a, @@ -400,6 +432,7 @@ TEST_F(ve_perms, enforce_denies) O_RDONLY), 0); /* Granted w only: visible but not readable. */ + ASSERT_EQ(allow_paths(self->cgv2_fd, path, variant->files), 0); ASSERT_EQ(set_entries(self->cgv2_fd, path, variant->files, "w"), 0); for (i = 0; i < NR_FILES; i++) EXPECT_EQ(ve_open_rel(self->cgv2_fd, self->ctid_a, -- 2.55.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel