linux-kernel - Re: selftests/capabilities: test FAIL on linux mainline and linux-next and PASS on linux-4.4.70+

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 27 Jun 2017 17:16:00 +0200
From:   Greg KH <greg@...ah.com>
To:     Naresh Kamboju <naresh.kamboju@...aro.org>
Cc:     luto@...nel.org, keescook@...omium.org,
        Shuah Khan <shuahkh@....samsung.com>,
        linux-kselftest@...r.kernel.org,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: selftests/capabilities: test FAIL on linux mainline and
 linux-next and PASS on linux-4.4.70+

On Tue, Jun 27, 2017 at 05:13:59PM +0200, Greg KH wrote:
> On Tue, Jun 27, 2017 at 02:10:32PM +0530, Naresh Kamboju wrote:
> > selftest capabilities test failed on linux mainline and linux-next and
> > PASS on linux-4.4.70+
> 
> Odd.  Any chance you can use 'git bisect' to track down the offending
> commit?
> 
> Does this also fail on x86 or any other platform you have available?
> Let me go try this on my laptop...

Ok, Linus's current tree (4.12.0-rc7+) also fails on this.  I'm guessing
it's failing, it's hard to understand the output.  If only we had TAP
output for this test :)

[RUN]   +++ Tests with uid == 0 +++
[NOTE]  Using global UIDs for tests
[RUN]   Root => ep
[OK]    Capabilities after execve were correct
[OK]    Child succeeded
[OK]    Check cap_ambient manipulation rules
[OK]    PR_CAP_AMBIENT_RAISE failed on non-inheritable cap
[OK]    PR_CAP_AMBIENT_RAISE failed on non-permitted cap
[OK]    PR_CAP_AMBIENT_RAISE worked
[OK]    Basic manipulation appears to work
[RUN]   Root +i => eip
[OK]    Capabilities after execve were correct
[OK]    Child succeeded
[RUN]   UID 0 +ia => eipa
[OK]    Capabilities after execve were correct
[OK]    Child succeeded
[RUN]   Root +ia, suidroot => eipa
[OK]    Capabilities after execve were correct
[OK]    Child succeeded
[RUN]   Root +ia, suidnonroot => ip
[FAIL]  Wrong effective state (AT_SECURE is not set)
[FAIL]  Child failed
[RUN]   Root +ia, sgidroot => eipa
[OK]    Capabilities after execve were correct
[OK]    Child succeeded
[RUN]   Root, gid != 0, +ia, sgidroot => eip
[FAIL]  Wrong ambient state (AT_SECURE is not set)
[FAIL]  Child failed
[RUN]   Root +ia, sgidnonroot => eip
[FAIL]  Wrong ambient state (AT_SECURE is not set)
[FAIL]  Child failed
[FAIL]  Child failed
[RUN]   +++ Tests with uid != 0 +++
[NOTE]  Using global UIDs for tests
[RUN]   Non-root => no caps
[OK]    Capabilities after execve were correct
[OK]    Child succeeded
[OK]    Check cap_ambient manipulation rules
[OK]    PR_CAP_AMBIENT_RAISE failed on non-inheritable cap
[OK]    PR_CAP_AMBIENT_RAISE failed on non-permitted cap
[OK]    PR_CAP_AMBIENT_RAISE worked
[OK]    Basic manipulation appears to work
[RUN]   Non-root +i => i
[OK]    Capabilities after execve were correct
[OK]    Child succeeded
[RUN]   UID 1 +ia => eipa
[OK]    Capabilities after execve were correct
[OK]    Child succeeded
[RUN]   Non-root +ia, sgidnonroot => i
[FAIL]  Wrong effective state (AT_SECURE is not set)
[FAIL]  Child failed