selftests/namespaces: first listns() permission test

Test that unprivileged users can only see namespaces they're currently
in. Create a namespace, drop privileges, verify we can only see our own
namespaces.

Link: https://patch.msgid.link/20251029-work-namespace-nstree-listns-v4-48-2e6f823ebdc0@kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>

diff --git a/tools/testing/selftests/namespaces/.gitignore b/tools/testing/selftests/namespaces/.gitignore
index 5065f07e92c97080c3400d24dee094d3a0d865a3..17f9c675a60bc85ee7421150c2d52e44a7b9ec74 100644 (file)
--- a/tools/testing/selftests/namespaces/.gitignore
+++ b/tools/testing/selftests/namespaces/.gitignore
@@ -3,3 +3,4 @@ file_handle_test
 init_ino_test
 ns_active_ref_test
 listns_test
+listns_permissions_test

diff --git a/tools/testing/selftests/namespaces/Makefile b/tools/testing/selftests/namespaces/Makefile
index de708f4df1596105fd6a3dae3f459e8f0049ab5e..2dd22bc68b89b6491d83b8a2bc6e6666eb6e7d03 100644 (file)
--- a/tools/testing/selftests/namespaces/Makefile
+++ b/tools/testing/selftests/namespaces/Makefile
@@ -2,10 +2,11 @@
 CFLAGS += -Wall -O0 -g $(KHDR_INCLUDES) $(TOOLS_INCLUDES)
 LDLIBS += -lcap
 
-TEST_GEN_PROGS := nsid_test file_handle_test init_ino_test ns_active_ref_test listns_test
+TEST_GEN_PROGS := nsid_test file_handle_test init_ino_test ns_active_ref_test listns_test listns_permissions_test
 
 include ../lib.mk
 
 $(OUTPUT)/ns_active_ref_test: ../filesystems/utils.c
 $(OUTPUT)/listns_test: ../filesystems/utils.c
+$(OUTPUT)/listns_permissions_test: ../filesystems/utils.c
 

diff --git a/tools/testing/selftests/namespaces/listns_permissions_test.c b/tools/testing/selftests/namespaces/listns_permissions_test.c
new file mode 100644 (file)
index 0000000..907fe41
--- /dev/null
+++ b/tools/testing/selftests/namespaces/listns_permissions_test.c
@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <sched.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <linux/nsfs.h>
+#include <sys/capability.h>
+#include <sys/ioctl.h>
+#include <sys/prctl.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include "../kselftest_harness.h"
+#include "../filesystems/utils.h"
+#include "wrappers.h"
+
+/*
+ * Test that unprivileged users can only see namespaces they're currently in.
+ * Create a namespace, drop privileges, verify we can only see our own namespaces.
+ */
+TEST(listns_unprivileged_current_only)
+{
+       struct ns_id_req req = {
+               .size = sizeof(req),
+               .spare = 0,
+               .ns_id = 0,
+               .ns_type = CLONE_NEWNET,
+               .spare2 = 0,
+               .user_ns_id = 0,
+       };
+       __u64 ns_ids[100];
+       ssize_t ret;
+       int pipefd[2];
+       pid_t pid;
+       int status;
+       bool found_ours;
+       int unexpected_count;
+
+       ASSERT_EQ(pipe(pipefd), 0);
+
+       pid = fork();
+       ASSERT_GE(pid, 0);
+
+       if (pid == 0) {
+               int fd;
+               __u64 our_netns_id;
+               bool found_ours;
+               int unexpected_count;
+
+               close(pipefd[0]);
+
+               /* Create user namespace to be unprivileged */
+               if (setup_userns() < 0) {
+                       close(pipefd[1]);
+                       exit(1);
+               }
+
+               /* Create a network namespace */
+               if (unshare(CLONE_NEWNET) < 0) {
+                       close(pipefd[1]);
+                       exit(1);
+               }
+
+               /* Get our network namespace ID */
+               fd = open("/proc/self/ns/net", O_RDONLY);
+               if (fd < 0) {
+                       close(pipefd[1]);
+                       exit(1);
+               }
+
+               if (ioctl(fd, NS_GET_ID, &our_netns_id) < 0) {
+                       close(fd);
+                       close(pipefd[1]);
+                       exit(1);
+               }
+               close(fd);
+
+               /* Now we're unprivileged - list all network namespaces */
+               ret = sys_listns(&req, ns_ids, ARRAY_SIZE(ns_ids), 0);
+               if (ret < 0) {
+                       close(pipefd[1]);
+                       exit(1);
+               }
+
+               /* We should only see our own network namespace */
+               found_ours = false;
+               unexpected_count = 0;
+
+               for (ssize_t i = 0; i < ret; i++) {
+                       if (ns_ids[i] == our_netns_id) {
+                               found_ours = true;
+                       } else {
+                               /* This is either init_net (which we can see) or unexpected */
+                               unexpected_count++;
+                       }
+               }
+
+               /* Send results to parent */
+               write(pipefd[1], &found_ours, sizeof(found_ours));
+               write(pipefd[1], &unexpected_count, sizeof(unexpected_count));
+               close(pipefd[1]);
+               exit(0);
+       }
+
+       /* Parent */
+       close(pipefd[1]);
+
+       found_ours = false;
+       unexpected_count = 0;
+       read(pipefd[0], &found_ours, sizeof(found_ours));
+       read(pipefd[0], &unexpected_count, sizeof(unexpected_count));
+       close(pipefd[0]);
+
+       waitpid(pid, &status, 0);
+       ASSERT_TRUE(WIFEXITED(status));
+       ASSERT_EQ(WEXITSTATUS(status), 0);
+
+       /* Child should have seen its own namespace */
+       ASSERT_TRUE(found_ours);
+
+       TH_LOG("Unprivileged child saw its own namespace, plus %d others (likely init_net)",
+                       unexpected_count);
+}
+
+TEST_HARNESS_MAIN