VSOCK_CMD_DEV_NETNS_SET refuses callers without CAP_NET_ADMIN in the
init user namespace.
Add two tests: one confirms that CAP_NET_ADMIN is required even by a
privileged user and the other confirms that CAP_NET_ADMIN in an
unprivileged user ns alone is insufficient.
CONFIG_USER_NS is needed to test the CAP_NET_ADMIN + unprivileged user
ns case.
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
---
Changes in v4:
- Require EPERM in the privilege tests, cli.py does print the errno, and
probe unshare -Urn so a setup failure skips (Sashiko)
Changes in v3:
- Require setpriv only for the ns_guest_ tests, not the whole script
Changes in v2:
- Assert only that the command fails, not EPERM: ynl's cli.py does not
report the errno (Sashiko)
- Use ynl cli.py for the assign
---
tools/testing/selftests/vsock/config | 1 +
tools/testing/selftests/vsock/vmtest.sh | 50 ++++++++++++++++++++++++++++++++-
2 files changed, 50 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/vsock/config b/tools/testing/selftests/vsock/config
index 5f0a4f17dfc9..4b31085558fa 100644
--- a/tools/testing/selftests/vsock/config
+++ b/tools/testing/selftests/vsock/config
@@ -109,3 +109,4 @@ CONFIG_FS_DAX=y
CONFIG_MEMORY_HOTPLUG=y
CONFIG_MEMORY_HOTREMOVE=y
CONFIG_ZONE_DEVICE=y
+CONFIG_USER_NS=y
diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh
index f8aee1336a09..5bd90a0c2380 100755
--- a/tools/testing/selftests/vsock/vmtest.sh
+++ b/tools/testing/selftests/vsock/vmtest.sh
@@ -93,6 +93,8 @@ readonly TEST_NAMES=(
ns_guest_assign_g2h_netns_host_connect_ok
ns_guest_assign_g2h_netns_pins_ns_ok
ns_guest_assign_g2h_netns_old_conn_send_fails
+ ns_guest_assign_g2h_netns_no_cap_net_admin_fails
+ ns_guest_assign_g2h_netns_unpriv_user_ns_fails
)
readonly TEST_DESCS=(
# vm_server_host_client
@@ -187,6 +189,12 @@ readonly TEST_DESCS=(
# ns_guest_assign_g2h_netns_old_conn_send_fails
"Check connections made before the assign stop sending once they lose the device."
+
+ # ns_guest_assign_g2h_netns_no_cap_net_admin_fails
+ "Check assigning the guest's vsock device to a namespace needs CAP_NET_ADMIN."
+
+ # ns_guest_assign_g2h_netns_unpriv_user_ns_fails
+ "Check an unprivileged user cannot claim the guest's vsock device via a user ns."
)
readonly USE_SHARED_VM=(
@@ -199,6 +207,8 @@ readonly USE_SHARED_VM=(
ns_guest_assign_g2h_netns_host_connect_ok
ns_guest_assign_g2h_netns_pins_ns_ok
ns_guest_assign_g2h_netns_old_conn_send_fails
+ ns_guest_assign_g2h_netns_no_cap_net_admin_fails
+ ns_guest_assign_g2h_netns_unpriv_user_ns_fails
)
readonly NS_MODES=("local" "global")
@@ -368,7 +378,7 @@ check_ns_guest_deps() {
return 0
fi
- for dep in unshare python3; do
+ for dep in unshare setpriv python3; do
if [[ ! -x $(command -v "${dep}") ]]; then
log_host "no ${dep} for test ${tname}"
return 1@@ -1909,6 +1919,44 @@ test_ns_guest_assign_g2h_netns_pins_ns_ok() {
return "${KSFT_PASS}"
}
+check_assign_g2h_eperm() {
+ local wrapper=$1
+ local out
+
+ if out=$(vm_ssh "init_ns" -- "${wrapper}" python3 /root/ynl/cli.py \
+ --no-schema --spec /root/ynl/vsock.yaml \
+ --do dev-netns-set 2>&1); then
+ log_host "assign unexpectedly succeeded under '${wrapper}'"
+ return "${KSFT_FAIL}"
+ fi
+
+ if [[ "${out}" != *"Operation not permitted"* ]]; then
+ log_host "no EPERM under '${wrapper}': [${out}]"
+ return "${KSFT_FAIL}"
+ fi
+
+ return "${KSFT_PASS}"
+}
+
+test_ns_guest_assign_g2h_netns_no_cap_net_admin_fails() {
+ check_assign_g2h_eperm "unshare -n setpriv --bounding-set=-net_admin"
+}
+
+test_ns_guest_assign_g2h_netns_unpriv_user_ns_fails() {
+ local unpriv_uid=65534
+ local unpriv
+
+ unpriv="setpriv --reuid=${unpriv_uid} --regid=${unpriv_uid}"
+ unpriv="${unpriv} --clear-groups"
+
+ if ! vm_ssh "init_ns" -- "${unpriv} unshare -Urn true"; then
+ log_host "unprivileged user namespaces unavailable, skipping"
+ return "${KSFT_SKIP}"
+ fi
+
+ check_assign_g2h_eperm "${unpriv} unshare -Urn"
+}
+
shared_vm_test() {
local tname
--
2.53.0-Meta