From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 2BF458017D for ; Mon, 28 Sep 2026 15:19:40 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68SFIJ8M010636; Mon, 28 Sep 2026 18:18:20 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68SFIJ8M010636 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="iC6Ile2B" Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68SFIARP010614 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 28 Sep 2026 18:18:11 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68SFIARP010614 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-49e64b80b94so17181615e9.3 for ; Mon, 28 Sep 2026 08:18:10 -0700 (PDT) X-Gm-Message-State: AFuF++m19DFU5VZBnuOVZdjEUzbNliihgs//3xqa0kFOGc4a4Yh4eWDR bxH6HjVAs27xBiU6BlONijOCy3wdWAcoNDLUBFWzjP68OQeoiPbMnu9aiDv4rDZdQWDDn67Xw+l JM7xa8EGt2cRrVeJoJc9yb2e42cskif954YuORXIRwhn7ohZ5yflhiQ== X-Gm-Gg: AYBFou2WmoyDOYDfQ7K7uC1XDQf6o4G17DQOX8s67Uancj78RaHlkfs1Z1+nZ2K5YBV UUrZ+vCScDCEiYfu1tJORUm9N1CbhrNwWI2oXx0VzAiMs3uEP0Z/WEj+RQhj/j2C3JaCM3yHOu2 16bFDreZ7CgkC4cW/L9KMYhf+nX3IBTNjVpo0VfQArsXMec885nobqnEB+sYCIQQ39BUiUa1eci RnNhffUBGYkffvcm2Zl4U5ReNul+9aOyTjP/mOjibU+qVM/ARyoej/DnGJHcTuC1kZUroctZELW Do30kDPe9clSafdYsvMAlfwFeD5NjrmecF3Ak6lMM56XxSqnY4PJ6ZTRd7fXTYKsk/AiJw8GUaQ u1eb8GkInRmBmBUFU5E/3Ubi7zw== X-Received: by 2002:a05:600c:4689:b0:49f:fe48:d171 with SMTP id 5b1f17b1804b1-49ffe48d27amr106447735e9.35.1790608690454; Mon, 28 Sep 2026 08:18:10 -0700 (PDT) X-Received: by 2002:a05:600c:4689:b0:49f:fe48:d171 with SMTP id 5b1f17b1804b1-49ffe48d27amr106446955e9.35.1790608689774; Mon, 28 Sep 2026 08:18:09 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1790608689; cv=none; d=google.com; s=arc-20260327; b=SGHoAbXZe5f0OIjRPHmDYMn5HvpMIsK+iqv7zysJ705wC8VX/SWExYpJoZGEMXsoAW YZfK8YF4GTTQ4DxmRuaxY3XStIl6yqrC0bYBsYXdOOodxTqDlC3rUcTEHN5AwKzUMYIG OKAvwzTBCfAIySzLzUYkV54q0Loc0JWHMA+22BmjwgHJwx3dDNtB/7rE5I0bTw6JTwVe 1pjLhrD291DPVNYB3UoO8so4gAWzO7ShrWOwaa2v2OvsDBC+8kMEk91F2wSMG+lN6QEL WIws7dYUIrblKze4IuaRu7pEF+m340uqCELe8gC7gYKNiNkwTv3AOkPW8i9SG8fg+KRv h1Yg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=gKbF4ux+yNesVYZv6/BqMUGZGRq8lOGaQZf7T6pAQr4=; fh=WpT6aB7RBAGHZeWZzqAr71yzRFbPTYkPWKsRagLn48Q=; b=bS+wuRHgkPFz55mA5QBfi26kUXBLFIKol1DUkC/nGfACJqh2d3rLp2wSRuHK6SvhBd DI8n94W4USmzW5IiBywAVoprsVY/8np+RgA3CS1wmvZ0rSIixkflVIDPn6laqW9ksG9S 7iTNr+n0IJI3agHGneTpIOV58UFJfIABe2vbegcXuGAfCqhwQJXXNWNJdIqi//wO3r4b VyrBuxe2MmZu9gx540k2VzQIBbBGhEaccinjWmsVc2aoEjRBmF37qRx0fHrvuhMxgA+O VsMtuq8vGnlGlFiOUQj/UgeOXB4krOHKHrfgHUHPB4RkCa2tMRyQpCsD9LqzrRym9MMl uY1A==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=iC6Ile2B; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id 5b1f17b1804b1-49ff9cd90c1si147111995e9.16.2026.09.28.08.18.09 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 28 Sep 2026 08:18:09 -0700 (PDT) Received-SPF: pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=iC6Ile2B; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=gKbF4ux+yNesVYZv6/BqMUGZGRq8lOGaQZf7T6pAQr4=; b=iC6Ile2BpzoI 7Xl+gjh3nXr4Z75KgcIEN/n5+AvQV8kAQ+imVOxsf27HBH5aoo+0hFBHbJbbsQ9Dt4JPMn2Wjgm00 nDkapZy574dSHWuGFnP6n5Lz221TISnziHpFLVZWXPdpMWOzthim2QbPFru5spg2caStNKPxlOcOs wM/xx+mUpXPCdyKBjprSsOUB2G6xE6qzjADEeqjz3OMj1Sek04k9HhgWELibY2wnFisr5N23fYdnF W8sx0rJ1QQzL7Lf529/JbH67lJ7tMf/dqkc10x0pyD8vJcUdXcGjCkPnMWDSvRqFbfyuuRxfJ3kne /NbtNvhtUZeP7OhASiEZPA==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=LekKit-T14) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xBD4G-004xNU-20; Mon, 28 Sep 2026 17:18:01 +0200 From: Eva Kurchatova To: khorenko@virtuozzo.com Date: Mon, 28 Sep 2026 18:16:17 +0300 Message-ID: <20260928151802.377553-2-eva.kurchatova@virtuozzo.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260928151802.377553-1-eva.kurchatova@virtuozzo.com> References: <20260928151802.377553-1-eva.kurchatova@virtuozzo.com> MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v4 1/2] selftests: ve: grant the directories the files sit in X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org The sysfs variant names nested leaves, kernel/vmcoreinfo and kernel/notes, while the proc one names files at the top of the filesystem. Both enforcement tests grant the leaves and nothing else, so in the sysfs case the lookup stops at /sys/kernel, which a fresh VE cannot traverse, and every open answers ENOENT: not ok 14 ve_perms.sysfs.enforce_allows not ok 15 ve_perms.sysfs.enforce_denies Grant x on each directory along the way, taken from the path the variant already gives. Fixes: 303ce49b7446 ("selftests/ve: add ve_perms test for proc and sysfs") https://virtuozzo.atlassian.net/browse/VSTOR-144955 Feature: fix selftests Signed-off-by: Eva Kurchatova --- tools/testing/selftests/ve/ve_perms_test.c | 34 ++++++++++++++++++++-- 1 file changed, 32 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/ve/ve_perms_test.c b/tools/testing/selftests/ve/ve_perms_test.c index 25ffbd42c380..8096b1fa3b43 100644 --- a/tools/testing/selftests/ve/ve_perms_test.c +++ b/tools/testing/selftests/ve/ve_perms_test.c @@ -114,9 +114,11 @@ static int ve_open_rel(int cgv2_fd, int ctid, const char *prefix, static int set_entry(int cgv2_fd, const char *path, const char *entry, const char *mask) { - char line[256]; + char line[PATH_MAX]; - snprintf(line, sizeof(line), "%s %s", entry, mask); + if (snprintf(line, sizeof(line), "%s %s", entry, mask) >= + (int)sizeof(line)) + return -1; return write_file_at(cgv2_fd, path, line); } @@ -343,6 +345,32 @@ TEST_F(ve_perms, write_parser) EXPECT_LT(write_file_at(self->cgv2_fd, path, file), 0); } +/* A leaf is reachable only once every directory above it can be traversed */ +static int allow_path(int cgv2_fd, const char *path, const char *file) +{ + char dir[PATH_MAX]; + const char *sep; + + for (sep = strchr(file, '/'); sep; sep = strchr(sep + 1, '/')) { + if (snprintf(dir, sizeof(dir), "%.*s", (int)(sep - file), + file) >= (int)sizeof(dir)) + return -1; + if (set_entry(cgv2_fd, path, dir, "x") < 0) + return -1; + } + return 0; +} + +static int allow_paths(int cgv2_fd, const char *path, const char *const files[]) +{ + int i; + + for (i = 0; i < NR_FILES; i++) + if (allow_path(cgv2_fd, path, files[i]) < 0) + return -1; + return 0; +} + /* * Enforcement, allowed side: from inside a VE, granting r lets each file be * read, and granting x on the directory lets it be traversed (the lookup then @@ -358,6 +386,7 @@ TEST_F(ve_perms, enforce_allows) ve_file(path, sizeof(path), self->ctid_a, variant->fs); + ASSERT_EQ(allow_paths(self->cgv2_fd, path, variant->files), 0); ASSERT_EQ(set_entries(self->cgv2_fd, path, variant->files, "r"), 0); for (i = 0; i < NR_FILES; i++) EXPECT_EQ(ve_open_rel(self->cgv2_fd, self->ctid_a, @@ -400,6 +429,7 @@ TEST_F(ve_perms, enforce_denies) O_RDONLY), 0); /* Granted w only: visible but not readable. */ + ASSERT_EQ(allow_paths(self->cgv2_fd, path, variant->files), 0); ASSERT_EQ(set_entries(self->cgv2_fd, path, variant->files, "w"), 0); for (i = 0; i < NR_FILES; i++) EXPECT_EQ(ve_open_rel(self->cgv2_fd, self->ctid_a, -- 2.55.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel