[Devel] [PATCH hci-8.1 v3 1/2] selftests: ve: grant the directories the files sit in

[Konstantin Khorenko]

changelog v2->v3 ?

+ none of my comments are fixed in both those patches.

NAK for both.

And ask Claude + Fable to review your patches before sending them in the list.

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 9/24/26 17:01, Eva Kurchatova wrote:
> The sysfs variant names nested leaves, kernel/vmcoreinfo and
> kernel/notes, while the proc one names files at the top of the
> filesystem. Both enforcement tests grant the leaves and nothing else,
> so in the sysfs case the lookup stops at /sys/kernel, which a fresh VE
> cannot traverse, and every open answers ENOENT:
> 
>   not ok 14 ve_perms.sysfs.enforce_allows
>   not ok 15 ve_perms.sysfs.enforce_denies
> 
> Grant x on each directory along the way, taken from the path the
> variant already gives.
> 
> Fixes: 303ce49b7446 ("selftests/ve: add ve_perms test for proc and sysfs")
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-144955
> 
> Feature: fix vz selftests
> Signed-off-by: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
> ---
>  tools/testing/selftests/ve/ve_perms_test.c | 33 ++++++++++++++++++++++
>  1 file changed, 33 insertions(+)
> 
> diff --git a/tools/testing/selftests/ve/ve_perms_test.c b/tools/testing/selftests/ve/ve_perms_test.c
> index 25ffbd42c380..2b542dc30139 100644
> --- a/tools/testing/selftests/ve/ve_perms_test.c
> +++ b/tools/testing/selftests/ve/ve_perms_test.c
> @@ -348,6 +348,37 @@ TEST_F(ve_perms, write_parser)
>   * read, and granting x on the directory lets it be traversed (the lookup then
>   * fails ENOENT on the missing child, not EACCES).
>   */
> +/*
> + * A leaf is only reachable once every directory above it can be traversed.
> + * The variants name their files relative to the mount point, so grant x on
> + * each directory along the way; a file at the top of the filesystem has
> + * none and needs nothing.
> + */
> +static int allow_path(int cgv2_fd, const char *path, const char *file)
> +{
> +	char dir[240];	/* set_entry() writes "<dir> <mask>" into 256 */
> +	const char *sep;
> +
> +	for (sep = strchr(file, '/'); sep; sep = strchr(sep + 1, '/')) {
> +		if (sep - file >= (long)sizeof(dir))
> +			return -1;
> +		snprintf(dir, sizeof(dir), "%.*s", (int)(sep - file), file);
> +		if (set_entry(cgv2_fd, path, dir, "x") < 0)
> +			return -1;
> +	}
> +	return 0;
> +}
> +
> +static int allow_paths(int cgv2_fd, const char *path, const char *const files[])
> +{
> +	int i;
> +
> +	for (i = 0; i < NR_FILES; i++)
> +		if (allow_path(cgv2_fd, path, files[i]) < 0)
> +			return -1;
> +	return 0;
> +}
> +
>  TEST_F(ve_perms, enforce_allows)
>  {
>  	char path[PATH_MAX], absent[128];
> @@ -358,6 +389,7 @@ TEST_F(ve_perms, enforce_allows)
>  
>  	ve_file(path, sizeof(path), self->ctid_a, variant->fs);
>  
> +	ASSERT_EQ(allow_paths(self->cgv2_fd, path, variant->files), 0);
>  	ASSERT_EQ(set_entries(self->cgv2_fd, path, variant->files, "r"), 0);
>  	for (i = 0; i < NR_FILES; i++)
>  		EXPECT_EQ(ve_open_rel(self->cgv2_fd, self->ctid_a,
> @@ -400,6 +432,7 @@ TEST_F(ve_perms, enforce_denies)
>  				      O_RDONLY), 0);
>  
>  	/* Granted w only: visible but not readable. */
> +	ASSERT_EQ(allow_paths(self->cgv2_fd, path, variant->files), 0);
>  	ASSERT_EQ(set_entries(self->cgv2_fd, path, variant->files, "w"), 0);
>  	for (i = 0; i < NR_FILES; i++)
>  		EXPECT_EQ(ve_open_rel(self->cgv2_fd, self->ctid_a,