run_vmtests.sh runs on-fault-limit as the nobody user via
"sudo -u nobody ./on-fault-limit", guarded by a check that nobody
can access the binary ("sudo -u nobody ls ./on-fault-limit").
The guard resolves the relative path from the inherited working
directory, which only requires search permission on the test
directory itself. Classic sudo passes the relative path through to
execve() the same way, so the two agree. However, sudo-rs (the
default sudo implementation since Ubuntu 25.10) canonicalizes the
command to an absolute path before executing it, which requires
search permission on every ancestor directory. When the kernel tree
lives under a private home directory (mode 0750, the Ubuntu default
for new users since 21.04), the guard passes but the execution fails
with "command not found", and the test is reported as a false FAIL:
# running sudo -u nobody ./on-fault-limit
sudo: './on-fault-limit': command not found
# [FAIL]
Wrap the command in "sh -c" so that sudo only resolves the shell
binary, and the relative path is resolved by nobody's shell from the
inherited working directory, matching what the guard checks. This is
the only "sudo -u nobody" invocation in the script; uid, cwd,
rlimits (including RLIMIT_MEMLOCK, which this test exercises) and
the exit status are unchanged through sh.
Verified on Ubuntu 26.04 (sudo-rs 0.2.13): the test now runs and
passes instead of failing. Verified on Ubuntu 24.04 (sudo 1.9.15p5):
behavior is unchanged.
Fixes: 5d2146a3354f ("selftests/mm: skip mlock tests if nobody user can't read
it")
Cc: Brendan Jackman <[email protected]>
Signed-off-by: Injae Ryou <[email protected]>
---
tools/testing/selftests/mm/run_vmtests.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/mm/run_vmtests.sh
b/tools/testing/selftests/mm/run_vmtests.sh
index a60b9f9f16e..687d115e3bd 100755
--- a/tools/testing/selftests/mm/run_vmtests.sh
+++ b/tools/testing/selftests/mm/run_vmtests.sh
@@ -302,7 +302,7 @@ CATEGORY="compaction" run_test ./compaction_test
if command -v sudo &> /dev/null && sudo -u nobody ls ./on-fault-limit
>/dev/null;
then
- CATEGORY="mlock" run_test sudo -u nobody ./on-fault-limit
+ CATEGORY="mlock" run_test sudo -u nobody sh -c ./on-fault-limit
else
echo "# SKIP ./on-fault-limit"
fi
--
2.53.0
