[PATCHv3] tst-pidfd.c: UNSUPPORTED if we get EPERM on pidfd_open or pidfd_getfd

[Mark Wielaard]

Hi Adhemerval,

On Mon, Jul 04, 2022 at 04:46:58PM -0300, Adhemerval Zanella wrote:
> > On 1 Jul 2022, at 08:25, Mark Wielaard <mark@klomp.org> wrote:
> > diff --git a/sysdeps/unix/sysv/linux/tst-pidfd.c b/sysdeps/unix/sysv/linux/tst-pidfd.c
> > index d93b6faa6f..2655d94636 100644
> > --- a/sysdeps/unix/sysv/linux/tst-pidfd.c
> > +++ b/sysdeps/unix/sysv/linux/tst-pidfd.c
> > @@ -92,11 +92,15 @@ do_test (void)
> >   {
> >     /* The pidfd_getfd syscall was the last in the set of pidfd related
> >        syscalls added to the kernel.  Use pidfd_getfd to decide if this
> > -       kernel has pidfd support that we can test.  */
> > +       kernel has pidfd support that we can test.  And that we have
> > +       permission to use pidfd_getfd.  */
> >     int r = pidfd_getfd (0, 0, 1);
> >     TEST_VERIFY_EXIT (r == -1);
> >     if (errno == ENOSYS)
> >       FAIL_UNSUPPORTED ("kernel does not support pidfd_getfd, skipping test");
> > +    if (errno == EPERM)
> > +      FAIL_UNSUPPORTED ("don't have permission to use pidfd_getfd, "
> > +			"skipping test");
> 
> Sorry, but if this is really failing with EPERM for a valid call the
> syscall filtering is broken: either kernel should return ENOSYS
> or EINVAL (assuming 1 in an invalid flag, we might need to update
> it once kernel starts to implement possible flags).

The call isn't really valid and I don't think we can assume the flag
value is checked first and just produces an EINVAL in this case. The
point of the check is that we cannot run the test if we get an EPERM
at this point. pidfd_getfd can fail with EPERM for various reasons (an
LSM module, a ptrace mode check, a [broken] seccomp filter). In all
cases we simply record the issue and mark the testcase as UNSUPPORTED.

Cheers,

Mark