tools/testing/selftests/namespaces/file_handle_test.c

Source file repositories/reference/linux-study-clean/tools/testing/selftests/namespaces/file_handle_test.c

File Facts

System
Linux kernel
Corpus path
tools/testing/selftests/namespaces/file_handle_test.c
Extension
.c
Size
36526 bytes
Lines
1430
Domain
Support Tooling And Documentation
Bucket
tools
Inferred role
Support Tooling And Documentation: implementation source
Status
source implementation candidate

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

if (ret < 0) {
			write(pipefd[1], "U",
			      1); /* Unable to create user namespace */
			close(pipefd[1]);
			exit(0);
		}

		/* Write uid/gid mappings to maintain some capabilities */
		int uid_map_fd = open("/proc/self/uid_map", O_WRONLY);
		int gid_map_fd = open("/proc/self/gid_map", O_WRONLY);
		int setgroups_fd = open("/proc/self/setgroups", O_WRONLY);

		if (uid_map_fd < 0 || gid_map_fd < 0 || setgroups_fd < 0) {
			write(pipefd[1], "M", 1); /* Unable to set mappings */
			close(pipefd[1]);
			exit(0);
		}

		/* Disable setgroups to allow gid mapping */
		write(setgroups_fd, "deny", 4);
		close(setgroups_fd);

		/* Map current uid/gid to root in the new namespace */
		char mapping[64];
		snprintf(mapping, sizeof(mapping), "0 %d 1", getuid());
		write(uid_map_fd, mapping, strlen(mapping));
		close(uid_map_fd);

		snprintf(mapping, sizeof(mapping), "0 %d 1", getgid());
		write(gid_map_fd, mapping, strlen(mapping));
		close(gid_map_fd);

		/* Now create new network namespace */
		ret = unshare(CLONE_NEWNET);
		if (ret < 0) {
			write(pipefd[1], "N",
			      1); /* Unable to create network namespace */
			close(pipefd[1]);
			exit(0);
		}

		/* Try to open parent's network namespace handle from new user+net namespace */
		fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);

		if (fd >= 0) {
			/* Should NOT succeed - we're in a different user namespace */
			write(pipefd[1], "S", 1); /* Unexpected success */
			close(fd);
		} else if (errno == ESTALE) {
			/* Expected: Stale file handle */
			write(pipefd[1], "P", 1);
		} else {
			/* Other error */
			write(pipefd[1], "F", 1);
		}

		close(pipefd[1]);
		exit(0);
	}

	/* Parent process */
	close(pipefd[1]);
	ASSERT_EQ(read(pipefd[0], &result, 1), 1);

	waitpid(pid, &status, 0);
	ASSERT_TRUE(WIFEXITED(status));
	ASSERT_EQ(WEXITSTATUS(status), 0);

	if (result == 'U') {
		SKIP(free(handle); close(pipefd[0]);
		     return, "Cannot create new user namespace");
	}
	if (result == 'M') {
		SKIP(free(handle); close(pipefd[0]);
		     return, "Cannot set uid/gid mappings");
	}
	if (result == 'N') {
		SKIP(free(handle); close(pipefd[0]);
		     return, "Cannot create new network namespace");
	}

	/* Should fail with permission denied since we're in a different user namespace */
	ASSERT_EQ(result, 'P');

	close(pipefd[0]);
	free(handle);
}

TEST(nsfs_user_uts_namespace_isolation)
{

Annotation

Implementation Notes