selftests/seccomp: Handle EINVAL on unshare(CLONE_NEWPID)

commit ecaaa55c9fa5e8058445a8b891070b12208cdb6d upstream.

unshare(CLONE_NEWPID) can return EINVAL if the kernel does not have the
CONFIG_PID_NS option enabled.

Add a check on these calls to skip the test if we receive EINVAL.

Signed-off-by: Terry Tritton <terry.tritton@linaro.org>
Link: https://lore.kernel.org/r/20240124141357.1243457-2-terry.tritton@linaro.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 827c1213be4f83b170d2805bd4f6888d017abdd9..cacf6507f6905519e88a262e8398323c53b2c34b 100644 (file)
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -3709,7 +3709,12 @@ TEST(user_notification_sibling_pid_ns)
        ASSERT_GE(pid, 0);
 
        if (pid == 0) {
-               ASSERT_EQ(unshare(CLONE_NEWPID), 0);
+               ASSERT_EQ(unshare(CLONE_NEWPID), 0) {
+                       if (errno == EPERM)
+                               SKIP(return, "CLONE_NEWPID requires CAP_SYS_ADMIN");
+                       else if (errno == EINVAL)
+                               SKIP(return, "CLONE_NEWPID is invalid (missing CONFIG_PID_NS?)");
+               }
 
                pid2 = fork();
                ASSERT_GE(pid2, 0);
@@ -3727,6 +3732,8 @@ TEST(user_notification_sibling_pid_ns)
        ASSERT_EQ(unshare(CLONE_NEWPID), 0) {
                if (errno == EPERM)
                        SKIP(return, "CLONE_NEWPID requires CAP_SYS_ADMIN");
+               else if (errno == EINVAL)
+                       SKIP(return, "CLONE_NEWPID is invalid (missing CONFIG_PID_NS?)");
        }
        ASSERT_EQ(errno, 0);