From: Bobby Eshleman <[email protected]> /dev/vsock IOCTL_VM_SOCKETS_ASSIGN_G2H_NETNS has refuses callers without CAP_NET_ADMIN in the init user namespace.
Add two tests: one confirms that CAP_NET_ADMIN is required even by a privileged user and the other confirms that CAP_NET_ADMIN in an unprivileged user ns alone is insufficient. CONFIG_USER_NS is needed to test the CAP_NET_ADMIN + unprivileged user ns case. Signed-off-by: Bobby Eshleman <[email protected]> --- tools/testing/selftests/vsock/config | 1 + tools/testing/selftests/vsock/vmtest.sh | 59 ++++++++++++++++++++++++++++++++- 2 files changed, 59 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/vsock/config b/tools/testing/selftests/vsock/config index 5f0a4f17dfc9..4b31085558fa 100644 --- a/tools/testing/selftests/vsock/config +++ b/tools/testing/selftests/vsock/config @@ -109,3 +109,4 @@ CONFIG_FS_DAX=y CONFIG_MEMORY_HOTPLUG=y CONFIG_MEMORY_HOTREMOVE=y CONFIG_ZONE_DEVICE=y +CONFIG_USER_NS=y diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index 53591fa07f1a..efb94d17d997 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -28,6 +28,7 @@ readonly WAIT_PERIOD=3 readonly WAIT_PERIOD_MAX=60 readonly WAIT_QEMU=5 readonly PIDFILE_TEMPLATE=/tmp/vsock_vmtest_XXXX.pid +readonly EPERM=1 declare -A PIDFILES # virtme-ng offers a netdev for ssh when using "--ssh", but we also need a @@ -80,6 +81,8 @@ readonly TEST_NAMES=( ns_guest_assign_g2h_netns_host_connect_ok ns_guest_assign_g2h_netns_reset_on_ns_delete_ok ns_guest_assign_g2h_netns_old_conn_send_fails + ns_guest_assign_g2h_netns_no_cap_net_admin_fails + ns_guest_assign_g2h_netns_unpriv_user_ns_fails ) readonly TEST_DESCS=( # vm_server_host_client @@ -174,6 +177,12 @@ readonly TEST_DESCS=( # ns_guest_assign_g2h_netns_old_conn_send_fails "Check connections made before the assign stop sending once they lose the device." + + # ns_guest_assign_g2h_netns_no_cap_net_admin_fails + "Check assigning the guest's vsock device to a namespace needs CAP_NET_ADMIN." + + # ns_guest_assign_g2h_netns_unpriv_user_ns_fails + "Check an unprivileged user cannot claim the guest's vsock device via a user ns." ) readonly USE_SHARED_VM=( @@ -186,6 +195,8 @@ readonly USE_SHARED_VM=( ns_guest_assign_g2h_netns_host_connect_ok ns_guest_assign_g2h_netns_reset_on_ns_delete_ok ns_guest_assign_g2h_netns_old_conn_send_fails + ns_guest_assign_g2h_netns_no_cap_net_admin_fails + ns_guest_assign_g2h_netns_unpriv_user_ns_fails ) readonly NS_MODES=("local" "global") @@ -333,7 +344,8 @@ check_args() { } check_deps() { - for dep in vng ${QEMU} busybox pkill ssh ss socat nsenter unshare; do + for dep in vng ${QEMU} busybox pkill ssh ss socat nsenter unshare \ + setpriv; do if [[ ! -x $(command -v "${dep}") ]]; then echo -e "skip: dependency ${dep} not found!\n" exit "${KSFT_SKIP}" @@ -1805,6 +1817,51 @@ test_ns_guest_assign_g2h_netns_reset_on_ns_delete_ok() { return "${KSFT_PASS}" } +test_ns_guest_assign_g2h_netns_no_cap_net_admin_fails() { + local cmd="unshare -n setpriv --bounding-set=-net_admin" + local rc + + vm_ssh "init_ns" -- "${cmd}" ./vsock_assign_g2h_netns &>/dev/null + rc=$? + + if [[ "${rc}" -ne "${EPERM}" ]]; then + log_host "expected EPERM (${EPERM}) without CAP_NET_ADMIN, got ${rc}" + return "${KSFT_FAIL}" + fi + + return "${KSFT_PASS}" +} + +test_ns_guest_assign_g2h_netns_unpriv_user_ns_fails() { + local helper=/tmp/vsock_assign_g2h_netns + local unpriv_uid=65534 + local unpriv + local rc + + unpriv="setpriv --reuid=${unpriv_uid} --regid=${unpriv_uid}" + unpriv="${unpriv} --clear-groups" + + if ! vm_ssh "init_ns" -- "${unpriv} unshare -U true"; then + log_host "unprivileged user namespaces unavailable, skipping" + return "${KSFT_SKIP}" + fi + + # The home shared with the guest is root-only, so place the helper where + # an unprivileged user can execute it. + vm_ssh "init_ns" -- \ + "cp ./vsock_assign_g2h_netns ${helper} && chmod 755 ${helper}" + + vm_ssh "init_ns" -- "${unpriv} unshare -Urn ${helper}" &>/dev/null + rc=$? + + if [[ "${rc}" -ne "${EPERM}" ]]; then + log_host "expected EPERM (${EPERM}) for an unprivileged user, got ${rc}" + return "${KSFT_FAIL}" + fi + + return "${KSFT_PASS}" +} + shared_vm_test() { local tname -- 2.53.0-Meta
