[PATCH 2/4] tst-pkey.c: Handle no permission to alloc memory protection keys

[Mark Wielaard]

Hi Florian,

On Sun, 2022-06-26 at 23:17 +0200, Florian Weimer wrote:
> * Mark Wielaard:
> 
> > pkey_alloc might fail with errno EPERM if there is no permission
> > to allocate memory protection keys. Use FAIL_UNSUPPORTED in that
> > case.
> > ---
> >  sysdeps/unix/sysv/linux/tst-pkey.c | 3 +++
> >  1 file changed, 3 insertions(+)
> > 
> > diff --git a/sysdeps/unix/sysv/linux/tst-pkey.c
> > b/sysdeps/unix/sysv/linux/tst-pkey.c
> > index df51f695bc..48a20fa3e0 100644
> > --- a/sysdeps/unix/sysv/linux/tst-pkey.c
> > +++ b/sysdeps/unix/sysv/linux/tst-pkey.c
> > @@ -203,6 +203,9 @@ do_test (void)
> >          FAIL_UNSUPPORTED
> >            ("no keys available or kernel does not support memory"
> >             " protection keys");
> > +      if (errno == EPERM)
> > +        FAIL_UNSUPPORTED
> > +          ("no permission to alloc memory protection keys");
> >        FAIL_EXIT1 ("pkey_alloc: %m");
> >      }
> >    TEST_COMPARE (pkey_get (keys[0]), 0);
> 
> It's rather weird to restrict access to a hardening tool.  Is this in
> a container, and is the container tool reasonably up to date?  They
> should all have switchted to ENOSYS for reducing the system call
> profile.

It is reasonably up to date. This is a container based on Fedora 36
packages running under Fedora CoreOS stable (36.20220605.3.0, Release
Date: Jun 20, 2022) with moby-engine20.10.16.

You are thinking of the fix to set errno to ENOSYS for syscalls that
are "unknown". That is a syscall number higher than any syscall number
mentioned in the seccomp filter. But the pkey calls are simply not
mentioned in the default seccomp filter. And newer syscalls are listed.
So this (EPERM) is the default errno returned in such cases till the
pkey calls are in the default seccomp profile.

https://github.com/moby/moby/issues/43481
https://github.com/moby/moby/issues/42871

In general I think if we detect pkey_alloc fails we should not try to
test and/or FAIL the pkey tests but simply mark it as UNSUPPORTED.
Whether we believe the errno value really should be ENOSYS, ENOSPC or
EINVAL. It isn't really that helpful to explicitly FAIL on EPERM. Sadly
this issue will be with us for a long time.

Cheers,

Mark