AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-21 12:30:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

tests: gracefully handle AppArmor userns containment

Browse Source 
Recent AppArmor containment allows restricting unprivileged user
namespaces, which is enabled by default on recent Ubuntu systems.
When this happens, as is common with Linux Security Modules, the syscall
will fail with -EACCESS.

When that happens, the affected tests will now be considered unsupported
rather than simply failing.

Further information:

* https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction
* https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
* https://manpages.ubuntu.com/manpages/jammy/man5/apparmor.d.5.html (for
  the return code)

V2:
* Fix duplicated line in check_unshare_hints
* Also handle similar failure in tst-pidfd_getpid

V3:
* Comment formatting
* Aded some more documentation on syscall return value

Signed-off-by: Simon Chopin <simon.chopin@canonical.com>
This commit is contained in:
Simon Chopin 2024-02-16 17:38:49 +01:00 committed by Adhemerval Zanella
parent fe00366b63
commit 59e0441d4a
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
support/test-container.c
View File

@ -682,6 +682,8 @@ check_for_unshare_hints (int require_pidns)
{ "/proc/sys/kernel/unprivileged_userns_clone", 0, 1, 0 }, { "/proc/sys/kernel/unprivileged_userns_clone", 0, 1, 0 },
/* ALT Linux has an alternate way of doing the same. */ /* ALT Linux has an alternate way of doing the same. */
{ "/proc/sys/kernel/userns_restrict", 1, 0, 0 }, { "/proc/sys/kernel/userns_restrict", 1, 0, 0 },
/* AppArmor can also disable unprivileged user namespaces. */
{ "/proc/sys/kernel/apparmor_restrict_unprivileged_userns", 1, 0, 0 },
/* Linux kernel >= 4.9 has a configurable limit on the number of /* Linux kernel >= 4.9 has a configurable limit on the number of
each namespace. Some distros set the limit to zero to disable the each namespace. Some distros set the limit to zero to disable the
corresponding namespace as a "security policy". */ corresponding namespace as a "security policy". */
@ -1108,10 +1110,11 @@ main (int argc, char **argv)
{ {
/* Older kernels may not support all the options, or security /* Older kernels may not support all the options, or security
policy may block this call. */ policy may block this call. */
if (errno == EINVAL || errno == EPERM || errno == ENOSPC) if (errno == EINVAL || errno == EPERM
|| errno == ENOSPC || errno == EACCES)
{ {
int saved_errno = errno; int saved_errno = errno;
if (errno == EPERM || errno == ENOSPC) if (errno == EPERM || errno == ENOSPC || errno == EACCES)
check_for_unshare_hints (require_pidns); check_for_unshare_hints (require_pidns);
FAIL_UNSUPPORTED ("unable to unshare user/fs: %s", strerror (saved_errno)); FAIL_UNSUPPORTED ("unable to unshare user/fs: %s", strerror (saved_errno));
} }

3
sysdeps/unix/sysv/linux/tst-pidfd_getpid.c
View File

@ -61,7 +61,8 @@ do_test (void)
{ {
/* Older kernels may not support all the options, or security /* Older kernels may not support all the options, or security
policy may block this call. */ policy may block this call. */
if (errno == EINVAL || errno == EPERM || errno == ENOSPC) if (errno == EINVAL || errno == EPERM
|| errno == ENOSPC || errno == EACCES)
exit (EXIT_UNSUPPORTED); exit (EXIT_UNSUPPORTED);
FAIL_EXIT1 ("unshare user/fs/pid failed: %m"); FAIL_EXIT1 ("unshare user/fs/pid failed: %m");
} }