// SPDX-License-Identifier: GPL-2.0 #include <assert.h>#include <fcntl.h>#include <inttypes.h>#include <libgen.h>#include <limits.h>#include <pthread.h>#include <signal.h>#include <string.h>#include <sys/mount.h>#include <poll.h>#include <sys/epoll.h>#include <sys/resource.h>#include <sys/stat.h>#include <sys/socket.h>#include <sys/un.h>#include <sys/wait.h>#include <unistd.h>#include <linux/fs.h>#include <linux/limits.h>#include <linux/nsfs.h>#include "kselftest_harness.h" /* Fixture for tests that create child processes */FIXTURE(nsid) {	pid_t child_pid;	pid_t grandchild_pid;}; FIXTURE_SETUP(nsid) {	self->child_pid = 0;	self->grandchild_pid = 0;} FIXTURE_TEARDOWN(nsid) {	/*	 * Kill grandchild first: timens_separate and pidns_separate fork a	 * grandchild that calls pause().  It is reparented to init on child	 * exit and keeps the test runner's tap pipe open, hanging the runner.	 */	if (self->grandchild_pid > 0) {		kill(self->grandchild_pid, SIGKILL);		waitpid(self->grandchild_pid, NULL, 0);	}	if (self->child_pid > 0) {		kill(self->child_pid, SIGKILL);		waitpid(self->child_pid, NULL, 0);	}} TEST(nsid_mntns_basic){	__u64 mnt_ns_id = 0;	int fd_mntns;	int ret; 	/* Open the current mount namespace */	fd_mntns = open("/proc/self/ns/mnt", O_RDONLY);	ASSERT_GE(fd_mntns, 0); 	/* Get the mount namespace ID */	ret = ioctl(fd_mntns, NS_GET_MNTNS_ID, &mnt_ns_id);	ASSERT_EQ(ret, 0);	ASSERT_NE(mnt_ns_id, 0); 	/* Verify we can get the same ID again */	__u64 mnt_ns_id2 = 0;	ret = ioctl(fd_mntns, NS_GET_ID, &mnt_ns_id2);	ASSERT_EQ(ret, 0);	ASSERT_EQ(mnt_ns_id, mnt_ns_id2); 	close(fd_mntns);} TEST_F(nsid, mntns_separate){	__u64 parent_mnt_ns_id = 0;	__u64 child_mnt_ns_id = 0;	int fd_parent_mntns, fd_child_mntns;	int ret;	pid_t pid;	int pipefd[2]; 	/* Get parent's mount namespace ID */	fd_parent_mntns = open("/proc/self/ns/mnt", O_RDONLY);	ASSERT_GE(fd_parent_mntns, 0);	ret = ioctl(fd_parent_mntns, NS_GET_ID, &parent_mnt_ns_id);	ASSERT_EQ(ret, 0);	ASSERT_NE(parent_mnt_ns_id, 0); 	/* Create a pipe for synchronization */	ASSERT_EQ(pipe(pipefd), 0); 	pid = fork();	ASSERT_GE(pid, 0); 	if (pid == 0) {		/* Child process */		close(pipefd[0]); 		/* Create new mount namespace */		ret = unshare(CLONE_NEWNS);		if (ret != 0) {			/* Skip test if we don't have permission */			if (errno == EPERM || errno == EACCES) {				write(pipefd[1], "S", 1); /* Signal skip */				_exit(0);			}			_exit(1);		} 		/* Signal success */		write(pipefd[1], "Y", 1);		close(pipefd[1]); 		/* Keep namespace alive */		pause();		_exit(0);	} 	/* Track child for cleanup */	self->child_pid = pid; 	/* Parent process */	close(pipefd[1]); 	char buf;	ASSERT_EQ(read(pipefd[0], &buf, 1), 1);	close(pipefd[0]); 	if (buf == 'S') {		/* Child couldn't create namespace, skip test */		close(fd_parent_mntns);		SKIP(return, "No permission to create mount namespace");	} 	ASSERT_EQ(buf, 'Y'); 	/* Open child's mount namespace */	char path[256];	snprintf(path, sizeof(path), "/proc/%d/ns/mnt", pid);	fd_child_mntns = open(path, O_RDONLY);	ASSERT_GE(fd_child_mntns, 0); 	/* Get child's mount namespace ID */	ret = ioctl(fd_child_mntns, NS_GET_ID, &child_mnt_ns_id);	ASSERT_EQ(ret, 0);	ASSERT_NE(child_mnt_ns_id, 0); 	/* Parent and child should have different mount namespace IDs */	ASSERT_NE(parent_mnt_ns_id, child_mnt_ns_id); 	close(fd_parent_mntns);	close(fd_child_mntns);} TEST(nsid_cgroupns_basic){	__u64 cgroup_ns_id = 0;	int fd_cgroupns;	int ret; 	/* Open the current cgroup namespace */	fd_cgroupns = open("/proc/self/ns/cgroup", O_RDONLY);	ASSERT_GE(fd_cgroupns, 0); 	/* Get the cgroup namespace ID */	ret = ioctl(fd_cgroupns, NS_GET_ID, &cgroup_ns_id);	ASSERT_EQ(ret, 0);	ASSERT_NE(cgroup_ns_id, 0); 	/* Verify we can get the same ID again */	__u64 cgroup_ns_id2 = 0;	ret = ioctl(fd_cgroupns, NS_GET_ID, &cgroup_ns_id2);	ASSERT_EQ(ret, 0);	ASSERT_EQ(cgroup_ns_id, cgroup_ns_id2); 	close(fd_cgroupns);} TEST_F(nsid, cgroupns_separate){	__u64 parent_cgroup_ns_id = 0;	__u64 child_cgroup_ns_id = 0;	int fd_parent_cgroupns, fd_child_cgroupns;	int ret;	pid_t pid;	int pipefd[2]; 	/* Get parent's cgroup namespace ID */	fd_parent_cgroupns = open("/proc/self/ns/cgroup", O_RDONLY);	ASSERT_GE(fd_parent_cgroupns, 0);	ret = ioctl(fd_parent_cgroupns, NS_GET_ID, &parent_cgroup_ns_id);	ASSERT_EQ(ret, 0);	ASSERT_NE(parent_cgroup_ns_id, 0); 	/* Create a pipe for synchronization */	ASSERT_EQ(pipe(pipefd), 0); 	pid = fork();	ASSERT_GE(pid, 0); 	if (pid == 0) {		/* Child process */		close(pipefd[0]); 		/* Create new cgroup namespace */		ret = unshare(CLONE_NEWCGROUP);		if (ret != 0) {			/* Skip test if we don't have permission */			if (errno == EPERM || errno == EACCES) {				write(pipefd[1], "S", 1); /* Signal skip */				_exit(0);			}			_exit(1);		} 		/* Signal success */		write(pipefd[1], "Y", 1);		close(pipefd[1]); 		/* Keep namespace alive */		pause();		_exit(0);	} 	/* Track child for cleanup */	self->child_pid = pid; 	/* Parent process */	close(pipefd[1]); 	char buf;	ASSERT_EQ(read(pipefd[0], &buf, 1), 1);	close(pipefd[0]); 	if (buf == 'S') {		/* Child couldn't create namespace, skip test */		close(fd_parent_cgroupns);		SKIP(return, "No permission to create cgroup namespace");	} 	ASSERT_EQ(buf, 'Y'); 	/* Open child's cgroup namespace */	char path[256];	snprintf(path, sizeof(path), "/proc/%d/ns/cgroup", pid);	fd_child_cgroupns = open(path, O_RDONLY);	ASSERT_GE(fd_child_cgroupns, 0); 	/* Get child's cgroup namespace ID */	ret = ioctl(fd_child_cgroupns, NS_GET_ID, &child_cgroup_ns_id);	ASSERT_EQ(ret, 0);	ASSERT_NE(child_cgroup_ns_id, 0); 	/* Parent and child should have different cgroup namespace IDs */	ASSERT_NE(parent_cgroup_ns_id, child_cgroup_ns_id); 	close(fd_parent_cgroupns);	close(fd_child_cgroupns);} TEST(nsid_ipcns_basic){	__u64 ipc_ns_id = 0;	int fd_ipcns;	int ret; 	/* Open the current IPC namespace */	fd_ipcns = open("/proc/self/ns/ipc", O_RDONLY);	ASSERT_GE(fd_ipcns, 0); 	/* Get the IPC namespace ID */	ret = ioctl(fd_ipcns, NS_GET_ID, &ipc_ns_id);	ASSERT_EQ(ret, 0);	ASSERT_NE(ipc_ns_id, 0); 	/* Verify we can get the same ID again */	__u64 ipc_ns_id2 = 0;	ret = ioctl(fd_ipcns, NS_GET_ID, &ipc_ns_id2);	ASSERT_EQ(ret, 0);	ASSERT_EQ(ipc_ns_id, ipc_ns_id2); 	close(fd_ipcns);} TEST_F(nsid, ipcns_separate){	__u64 parent_ipc_ns_id = 0;	__u64 child_ipc_ns_id = 0;	int fd_parent_ipcns, fd_child_ipcns;	int ret;	pid_t pid;	int pipefd[2]; 	/* Get parent's IPC namespace ID */	fd_parent_ipcns = open("/proc/self/ns/ipc", O_RDONLY);	ASSERT_GE(fd_parent_ipcns, 0);	ret = ioctl(fd_parent_ipcns, NS_GET_ID, &parent_ipc_ns_id);	ASSERT_EQ(ret, 0);	ASSERT_NE(parent_ipc_ns_id, 0); 	/* Create a pipe for synchronization */	ASSERT_EQ(pipe(pipefd), 0); 	pid = fork();	ASSERT_GE(pid, 0); 	if (pid == 0) {		/* Child process */		close(pipefd[0]); 		/* Create new IPC namespace */		ret = unshare(CLONE_NEWIPC);		if (ret != 0) {			/* Skip test if we don't have permission */			if (errno == EPERM || errno == EACCES) {				write(pipefd[1], "S", 1); /* Signal skip */				_exit(0);			}			_exit(1);		} 		/* Signal success */		write(pipefd[1], "Y", 1);		close(pipefd[1]); 		/* Keep namespace alive */		pause();		_exit(0);	} 	/* Track child for cleanup */	self->child_pid = pid; 	/* Parent process */	close(pipefd[1]); 	char buf;	ASSERT_EQ(read(pipefd[0], &buf, 1), 1);	close(pipefd[0]); 	if (buf == 'S') {		/* Child couldn't create namespace, skip test */		close(fd_parent_ipcns);		SKIP(return, "No permission to create IPC namespace");	} 	ASSERT_EQ(buf, 'Y'); 	/* Open child's IPC namespace */	char path[256];	snprintf(path, sizeof(path), "/proc/%d/ns/ipc", pid);	fd_child_ipcns = open(path, O_RDONLY);	ASSERT_GE(fd_child_ipcns, 0); 	/* Get child's IPC namespace ID */	ret = ioctl(fd_child_ipcns, NS_GET_ID, &child_ipc_ns_id);	ASSERT_EQ(ret, 0);	ASSERT_NE(child_ipc_ns_id, 0); 	/* Parent and child should have different IPC namespace IDs */	ASSERT_NE(parent_ipc_ns_id, child_ipc_ns_id); 	close(fd_parent_ipcns);	close(fd_child_ipcns);} TEST(nsid_utsns_basic){	__u64 uts_ns_id = 0;	int fd_utsns;	int ret; 	/* Open the current UTS namespace */	fd_utsns = open("/proc/self/ns/uts", O_RDONLY);	ASSERT_GE(fd_utsns, 0); 	/* Get the UTS namespace ID */	ret = ioctl(fd_utsns, NS_GET_ID, &uts_ns_id);	ASSERT_EQ(ret, 0);	ASSERT_NE(uts_ns_id, 0); 	/* Verify we can get the same ID again */	__u64 uts_ns_id2 = 0;	ret = ioctl(fd_utsns, NS_GET_ID, &uts_ns_id2);	ASSERT_EQ(ret, 0);	ASSERT_EQ(uts_ns_id, uts_ns_id2); 	close(fd_utsns);} TEST_F(nsid, utsns_separate){	__u64 parent_uts_ns_id = 0;	__u64 child_uts_ns_id = 0;	int fd_parent_utsns, fd_child_utsns;	int ret;	pid_t pid;	int pipefd[2]; 	/* Get parent's UTS namespace ID */	fd_parent_utsns = open("/proc/self/ns/uts", O_RDONLY);	ASSERT_GE(fd_parent_utsns, 0);	ret = ioctl(fd_parent_utsns, NS_GET_ID, &parent_uts_ns_id);	ASSERT_EQ(ret, 0);	ASSERT_NE(parent_uts_ns_id, 0); 	/* Create a pipe for synchronization */	ASSERT_EQ(pipe(pipefd), 0); 	pid = fork();	ASSERT_GE(pid, 0); 	if (pid == 0) {		/* Child process */		close(pipefd[0]); 		/* Create new UTS namespace */		ret = unshare(CLONE_NEWUTS);		if (ret != 0) {			/* Skip test if we don't have permission */			if (errno == EPERM || errno == EACCES) {				write(pipefd[1], "S", 1); /* Signal skip */				_exit(0);			}			_exit(1);		} 		/* Signal success */		write(pipefd[1], "Y", 1);		close(pipefd[1]); 		/* Keep namespace alive */		pause();		_exit(0);	} 	/* Track child for cleanup */	self->child_pid = pid; 	/* Parent process */	close(pipefd[1]); 	char buf;	ASSERT_EQ(read(pipefd[0], &buf, 1), 1);	close(pipefd[0]); 	if (buf == 'S') {		/* Child couldn't create namespace, skip test */		close(fd_parent_utsns);		SKIP(return, "No permission to create UTS namespace");	} 	ASSERT_EQ(buf, 'Y'); 	/* Open child's UTS namespace */	char path[256];	snprintf(path, sizeof(path), "/proc/%d/ns/uts", pid);	fd_child_utsns = open(path, O_RDONLY);	ASSERT_GE(fd_child_utsns, 0); 	/* Get child's UTS namespace ID */	ret = ioctl(fd_child_utsns, NS_GET_ID, &child_uts_ns_id);	ASSERT_EQ(ret, 0);	ASSERT_NE(child_uts_ns_id, 0); 	/* Parent and child should have different UTS namespace IDs */	ASSERT_NE(parent_uts_ns_id, child_uts_ns_id); 	close(fd_parent_utsns);	close(fd_child_utsns);} TEST(nsid_userns_basic){	__u64 user_ns_id = 0;	int fd_userns;	int ret; 	/* Open the current user namespace */	fd_userns = open("/proc/self/ns/user", O_RDONLY);	ASSERT_GE(fd_userns, 0); 	/* Get the user namespace ID */	ret = ioctl(fd_userns, NS_GET_ID, &user_ns_id);	ASSERT_EQ(ret, 0);	ASSERT_NE(user_ns_id, 0); 	/* Verify we can get the same ID again */	__u64 user_ns_id2 = 0;	ret = ioctl(fd_userns, NS_GET_ID, &user_ns_id2);	ASSERT_EQ(ret, 0);	ASSERT_EQ(user_ns_id, user_ns_id2); 	close(fd_userns);} TEST_F(nsid, userns_separate)

Lines 1–500 of 989. Load more