VSOCK_CMD_DEV_NETNS_SET refuses callers without CAP_NET_ADMIN in the init user namespace.
Add two tests: one confirms that CAP_NET_ADMIN is required even by a privileged user and the other confirms that CAP_NET_ADMIN in an unprivileged user ns alone is insufficient. CONFIG_USER_NS is needed to test the CAP_NET_ADMIN + unprivileged user ns case. Signed-off-by: Bobby Eshleman <[email protected]> --- Changes in v4: - Require EPERM in the privilege tests, cli.py does print the errno, and probe unshare -Urn so a setup failure skips (Sashiko) Changes in v3: - Require setpriv only for the ns_guest_ tests, not the whole script Changes in v2: - Assert only that the command fails, not EPERM: ynl's cli.py does not report the errno (Sashiko) - Use ynl cli.py for the assign --- tools/testing/selftests/vsock/config | 1 + tools/testing/selftests/vsock/vmtest.sh | 50 ++++++++++++++++++++++++++++++++- 2 files changed, 50 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/vsock/config b/tools/testing/selftests/vsock/config index 5f0a4f17dfc9..4b31085558fa 100644 --- a/tools/testing/selftests/vsock/config +++ b/tools/testing/selftests/vsock/config @@ -109,3 +109,4 @@ CONFIG_FS_DAX=y CONFIG_MEMORY_HOTPLUG=y CONFIG_MEMORY_HOTREMOVE=y CONFIG_ZONE_DEVICE=y +CONFIG_USER_NS=y diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index f8aee1336a09..5bd90a0c2380 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -93,6 +93,8 @@ readonly TEST_NAMES=( ns_guest_assign_g2h_netns_host_connect_ok ns_guest_assign_g2h_netns_pins_ns_ok ns_guest_assign_g2h_netns_old_conn_send_fails + ns_guest_assign_g2h_netns_no_cap_net_admin_fails + ns_guest_assign_g2h_netns_unpriv_user_ns_fails ) readonly TEST_DESCS=( # vm_server_host_client @@ -187,6 +189,12 @@ readonly TEST_DESCS=( # ns_guest_assign_g2h_netns_old_conn_send_fails "Check connections made before the assign stop sending once they lose the device." + + # ns_guest_assign_g2h_netns_no_cap_net_admin_fails + "Check assigning the guest's vsock device to a namespace needs CAP_NET_ADMIN." + + # ns_guest_assign_g2h_netns_unpriv_user_ns_fails + "Check an unprivileged user cannot claim the guest's vsock device via a user ns." ) readonly USE_SHARED_VM=( @@ -199,6 +207,8 @@ readonly USE_SHARED_VM=( ns_guest_assign_g2h_netns_host_connect_ok ns_guest_assign_g2h_netns_pins_ns_ok ns_guest_assign_g2h_netns_old_conn_send_fails + ns_guest_assign_g2h_netns_no_cap_net_admin_fails + ns_guest_assign_g2h_netns_unpriv_user_ns_fails ) readonly NS_MODES=("local" "global") @@ -368,7 +378,7 @@ check_ns_guest_deps() { return 0 fi - for dep in unshare python3; do + for dep in unshare setpriv python3; do if [[ ! -x $(command -v "${dep}") ]]; then log_host "no ${dep} for test ${tname}" return 1 @@ -1909,6 +1919,44 @@ test_ns_guest_assign_g2h_netns_pins_ns_ok() { return "${KSFT_PASS}" } +check_assign_g2h_eperm() { + local wrapper=$1 + local out + + if out=$(vm_ssh "init_ns" -- "${wrapper}" python3 /root/ynl/cli.py \ + --no-schema --spec /root/ynl/vsock.yaml \ + --do dev-netns-set 2>&1); then + log_host "assign unexpectedly succeeded under '${wrapper}'" + return "${KSFT_FAIL}" + fi + + if [[ "${out}" != *"Operation not permitted"* ]]; then + log_host "no EPERM under '${wrapper}': [${out}]" + return "${KSFT_FAIL}" + fi + + return "${KSFT_PASS}" +} + +test_ns_guest_assign_g2h_netns_no_cap_net_admin_fails() { + check_assign_g2h_eperm "unshare -n setpriv --bounding-set=-net_admin" +} + +test_ns_guest_assign_g2h_netns_unpriv_user_ns_fails() { + local unpriv_uid=65534 + local unpriv + + unpriv="setpriv --reuid=${unpriv_uid} --regid=${unpriv_uid}" + unpriv="${unpriv} --clear-groups" + + if ! vm_ssh "init_ns" -- "${unpriv} unshare -Urn true"; then + log_host "unprivileged user namespaces unavailable, skipping" + return "${KSFT_SKIP}" + fi + + check_assign_g2h_eperm "${unpriv} unshare -Urn" +} + shared_vm_test() { local tname -- 2.53.0-Meta
