[Devel] [PATCH vz10 v3 9/9] selftests/ve: add ve_perms test for proc and sysfs

[Vladimir Riabchun]

On 17.07.2026 01:25, Mirian Shilakadze wrote:
> Add a test for the per-VE permission allowlist. It runs against both
> interfaces through a fixture variant, ve.proc_permissions and
> ve.sysfs_permissions, which share the leaf logic in fs/ve_perms.c.
> Each variant names a few host-only files and a host-only directory,
> all registered nodes outside a container's default view. Reading the
> list back is a seq file, so the test adds a read_file_at helper to the
> shared ve_selftest.h.
> 
>  From the host it grants read on a file, widens to rwx and removes it
> checking the list each time, confirms an entry granted to one VE is
> not seen by another, and confirms an unknown path is rejected. It
> covers the write parser in one test: comment lines skipped, several
> entries in one write, a later grant replacing an earlier one, a
> duplicate op keeping the last, remove of an absent entry, and a
> missing mask rejected, and checks each entry renders at its true
> depth with a directory getting a trailing slash.
> 
> Enforcement is checked end to end from inside a VE, split into an
> allowed and a denied test. A task enters the VE cgroup, unshares
> CLONE_NEWVE and opens the entry on the inherited host /proc or /sys.
> Granting r makes each file readable and granting x on the directory
> lets it be traversed, while an ungranted file stays hidden, a file
> granted only w cannot be read, and a directory granted only r cannot
> be traversed.
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-135286
> Signed-off-by: Mirian Shilakadze <mirian.shilakadze at virtuozzo.com>

Reviewed-by: Vladimir Riabchun <vladimir.riabchun at virtuozzo.com>

> ---
>   tools/testing/selftests/ve/.gitignore      |   1 +
>   tools/testing/selftests/ve/Makefile        |   1 +
>   tools/testing/selftests/ve/ve_perms_test.c | 360 +++++++++++++++++++++
>   tools/testing/selftests/ve/ve_selftest.h   |  26 ++
>   4 files changed, 388 insertions(+)
>   create mode 100644 tools/testing/selftests/ve/ve_perms_test.c
> 
> ...
--
Best regards, Riabchun Vladimir
Linux Kernel Developer, Virtuozzo