security/commoncap_test.c

Source file repositories/reference/linux-study-clean/security/commoncap_test.c

File Facts

System
Linux kernel
Corpus path
security/commoncap_test.c
Extension
.c
Size
9459 bytes
Lines
289
Domain
Core OS
Bucket
Security And Isolation
Inferred role
Core OS: implementation source
Status
source implementation candidate

Why This File Exists

Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.

Dependency Surface

Detected Declarations

Annotated Snippet

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * KUnit tests for commoncap.c security functions
 *
 * Tests for security-critical functions in the capability subsystem,
 * particularly namespace-related capability checks.
 */

#include <kunit/test.h>
#include <linux/user_namespace.h>
#include <linux/uidgid.h>
#include <linux/cred.h>
#include <linux/mnt_idmapping.h>
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/refcount.h>

#ifdef CONFIG_SECURITY_COMMONCAP_KUNIT_TEST

/* Functions are static in commoncap.c, but we can call them since we're
 * included in the same compilation unit when tests are enabled.
 */

/**
 * test_vfsuid_root_in_currentns_init_ns - Test vfsuid_root_in_currentns with init ns
 *
 * Verifies that UID 0 in the init namespace correctly owns the current
 * namespace when running in init_user_ns.
 *
 * @test: KUnit test context
 */
static void test_vfsuid_root_in_currentns_init_ns(struct kunit *test)
{
	vfsuid_t vfsuid;
	kuid_t kuid;

	/* Create UID 0 in init namespace */
	kuid = KUIDT_INIT(0);
	vfsuid = VFSUIDT_INIT(kuid);

	/* In init namespace, UID 0 should own current namespace */
	KUNIT_EXPECT_TRUE(test, vfsuid_root_in_currentns(vfsuid));
}

/**
 * test_vfsuid_root_in_currentns_invalid - Test vfsuid_root_in_currentns with invalid vfsuid
 *
 * Verifies that an invalid vfsuid correctly returns false.
 *
 * @test: KUnit test context
 */
static void test_vfsuid_root_in_currentns_invalid(struct kunit *test)
{
	vfsuid_t invalid_vfsuid;

	/* Use the predefined invalid vfsuid */
	invalid_vfsuid = INVALID_VFSUID;

	/* Invalid vfsuid should return false */
	KUNIT_EXPECT_FALSE(test, vfsuid_root_in_currentns(invalid_vfsuid));
}

/**
 * test_vfsuid_root_in_currentns_nonzero - Test vfsuid_root_in_currentns with non-zero UID
 *
 * Verifies that a non-zero UID correctly returns false.
 *
 * @test: KUnit test context
 */
static void test_vfsuid_root_in_currentns_nonzero(struct kunit *test)
{
	vfsuid_t vfsuid;
	kuid_t kuid;

	/* Create a non-zero UID */
	kuid = KUIDT_INIT(1000);
	vfsuid = VFSUIDT_INIT(kuid);

	/* Non-zero UID should return false */
	KUNIT_EXPECT_FALSE(test, vfsuid_root_in_currentns(vfsuid));
}

/**
 * test_kuid_root_in_ns_init_ns_uid0 - Test kuid_root_in_ns with init namespace and UID 0
 *
 * Verifies that kuid_root_in_ns correctly identifies UID 0 in init namespace.
 * This tests the core namespace traversal logic. In init namespace, UID 0
 * maps to itself, so it should own the namespace.
 *
 * @test: KUnit test context

Annotation

Implementation Notes