Re: selftests/capabilities: test FAIL on linux mainline and linux-next and PASS on linux-4.4.70+

From: Shuah Khan
Date: Tue Jun 27 2017 - 19:18:19 EST


On 06/27/2017 09:16 AM, Greg KH wrote:
> On Tue, Jun 27, 2017 at 05:13:59PM +0200, Greg KH wrote:
>> On Tue, Jun 27, 2017 at 02:10:32PM +0530, Naresh Kamboju wrote:
>>> selftest capabilities test failed on linux mainline and linux-next and
>>> PASS on linux-4.4.70+
>>
>> Odd. Any chance you can use 'git bisect' to track down the offending
>> commit?
>>
>> Does this also fail on x86 or any other platform you have available?
>> Let me go try this on my laptop...
>
> Ok, Linus's current tree (4.12.0-rc7+) also fails on this. I'm guessing
> it's failing, it's hard to understand the output. If only we had TAP
> output for this test :)

As far as the output, it isn't bad. Not TAP13 will help make it better.
The problem seems to with the individual messages error/info. messages
themselves. This test has the quality of a developer unit test and the
messages could be improved for non-developer use.

I ran the test on 4.11.8-rc1+ and 4.9.35-rc1 see the same failure.
It would be difficult to bisect this since it spans multiple releases.
I am hoping Andy can give us some insight.

[RUN] +++ Tests with uid == 0 +++
[NOTE] Using global UIDs for tests
[RUN] Root => ep
[OK] Capabilities after execve were correct
[OK] Child succeeded
[OK] Check cap_ambient manipulation rules
[OK] PR_CAP_AMBIENT_RAISE failed on non-inheritable cap
[OK] PR_CAP_AMBIENT_RAISE failed on non-permitted cap
[OK] PR_CAP_AMBIENT_RAISE worked
[OK] Basic manipulation appears to work
[RUN] Root +i => eip
[OK] Capabilities after execve were correct
[OK] Child succeeded
[RUN] UID 0 +ia => eipa
[OK] Capabilities after execve were correct
[OK] Child succeeded
[RUN] Root +ia, suidroot => eipa
[OK] Capabilities after execve were correct
[OK] Child succeeded
[RUN] Root +ia, suidnonroot => ip
[FAIL] Wrong effective state (AT_SECURE is not set)
[FAIL] Child failed
[RUN] Root +ia, sgidroot => eipa
[OK] Capabilities after execve were correct
[OK] Child succeeded
[RUN] Root, gid != 0, +ia, sgidroot => eip
[FAIL] Wrong ambient state (AT_SECURE is not set)
[FAIL] Child failed
[RUN] Root +ia, sgidnonroot => eip
[FAIL] Wrong ambient state (AT_SECURE is not set)
[FAIL] Child failed
[FAIL] Child failed
[RUN] +++ Tests with uid != 0 +++
[NOTE] Using global UIDs for tests
[RUN] Non-root => no caps
[OK] Capabilities after execve were correct
[OK] Child succeeded
[OK] Check cap_ambient manipulation rules
[OK] PR_CAP_AMBIENT_RAISE failed on non-inheritable cap
[OK] PR_CAP_AMBIENT_RAISE failed on non-permitted cap
[OK] PR_CAP_AMBIENT_RAISE worked
[OK] Basic manipulation appears to work
[RUN] Non-root +i => i
[OK] Capabilities after execve were correct
[OK] Child succeeded
[RUN] UID 1 +ia => eipa
[OK] Capabilities after execve were correct
[OK] Child succeeded
[RUN] Non-root +ia, sgidnonroot => i
[FAIL] Wrong effective state (AT_SECURE is not set)
[FAIL] Child failed

thanks,
-- Shuah