file_handle_test.c

   1// SPDX-License-Identifier: GPL-2.0
   2#define _GNU_SOURCE
   3#include <errno.h>
   4#include <fcntl.h>
   5#include <grp.h>
   6#include <limits.h>
   7#include <sched.h>
   8#include <stdio.h>
   9#include <stdlib.h>
  10#include <string.h>
  11#include <sys/mount.h>
  12#include <sys/stat.h>
  13#include <sys/types.h>
  14#include <sys/wait.h>
  15#include <unistd.h>
  16#include <linux/unistd.h>
  17#include "kselftest_harness.h"
  18
  19#ifndef FD_NSFS_ROOT
  20#define FD_NSFS_ROOT -10003 /* Root of the nsfs filesystem */
  21#endif
  22
  23TEST(nsfs_net_handle)
  24{
  25	struct file_handle *handle;
  26	int mount_id;
  27	int ret;
  28	int fd;
  29	int ns_fd;
  30	struct stat st1, st2;
  31
  32	/* Drop to unprivileged uid/gid */
  33	ASSERT_EQ(setresgid(65534, 65534, 65534), 0); /* nogroup */
  34	ASSERT_EQ(setresuid(65534, 65534, 65534), 0); /* nobody */
  35
  36	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
  37	ASSERT_NE(handle, NULL);
  38
  39	/* Open a namespace file descriptor */
  40	ns_fd = open("/proc/self/ns/net", O_RDONLY);
  41	ASSERT_GE(ns_fd, 0);
  42
  43	/* Get handle for the namespace */
  44	handle->handle_bytes = MAX_HANDLE_SZ;
  45	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
  46	if (ret < 0 && errno == EOPNOTSUPP) {
  47		SKIP(free(handle); close(ns_fd);
  48		     return, "nsfs doesn't support file handles");
  49	}
  50	ASSERT_EQ(ret, 0);
  51	ASSERT_GT(handle->handle_bytes, 0);
  52
  53	/* Try to open using FD_NSFS_ROOT as unprivileged user */
  54	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
  55	if (fd < 0 && (errno == EINVAL || errno == EOPNOTSUPP)) {
  56		SKIP(free(handle); close(ns_fd);
  57		     return,
  58			   "open_by_handle_at with FD_NSFS_ROOT not supported");
  59	}
  60	if (fd < 0 && errno == EPERM) {
  61		SKIP(free(handle); close(ns_fd);
  62		     return,
  63			   "Permission denied for unprivileged user (expected)");
  64	}
  65	ASSERT_GE(fd, 0);
  66
  67	/* Verify we opened the correct namespace */
  68	ASSERT_EQ(fstat(ns_fd, &st1), 0);
  69	ASSERT_EQ(fstat(fd, &st2), 0);
  70	ASSERT_EQ(st1.st_ino, st2.st_ino);
  71	ASSERT_EQ(st1.st_dev, st2.st_dev);
  72
  73	close(fd);
  74	close(ns_fd);
  75	free(handle);
  76}
  77
  78TEST(nsfs_uts_handle)
  79{
  80	struct file_handle *handle;
  81	int mount_id;
  82	int ret;
  83	int fd;
  84	int ns_fd;
  85	struct stat st1, st2;
  86
  87	/* Drop to unprivileged uid/gid */
  88	ASSERT_EQ(setresgid(65534, 65534, 65534), 0); /* nogroup */
  89	ASSERT_EQ(setresuid(65534, 65534, 65534), 0); /* nobody */
  90
  91	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
  92	ASSERT_NE(handle, NULL);
  93
  94	/* Open UTS namespace file descriptor */
  95	ns_fd = open("/proc/self/ns/uts", O_RDONLY);
  96	ASSERT_GE(ns_fd, 0);
  97
  98	/* Get handle for the namespace */
  99	handle->handle_bytes = MAX_HANDLE_SZ;
 100	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
 101	if (ret < 0 && errno == EOPNOTSUPP) {
 102		SKIP(free(handle); close(ns_fd);
 103		     return, "nsfs doesn't support file handles");
 104	}
 105	ASSERT_EQ(ret, 0);
 106	ASSERT_GT(handle->handle_bytes, 0);
 107
 108	/* Try to open using FD_NSFS_ROOT */
 109	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
 110	if (fd < 0 && (errno == EINVAL || errno == EOPNOTSUPP)) {
 111		SKIP(free(handle); close(ns_fd);
 112		     return,
 113			   "open_by_handle_at with FD_NSFS_ROOT not supported");
 114	}
 115	ASSERT_GE(fd, 0);
 116
 117	/* Verify we opened the correct namespace */
 118	ASSERT_EQ(fstat(ns_fd, &st1), 0);
 119	ASSERT_EQ(fstat(fd, &st2), 0);
 120	ASSERT_EQ(st1.st_ino, st2.st_ino);
 121	ASSERT_EQ(st1.st_dev, st2.st_dev);
 122
 123	close(fd);
 124	close(ns_fd);
 125	free(handle);
 126}
 127
 128TEST(nsfs_ipc_handle)
 129{
 130	struct file_handle *handle;
 131	int mount_id;
 132	int ret;
 133	int fd;
 134	int ns_fd;
 135	struct stat st1, st2;
 136
 137	/* Drop to unprivileged uid/gid */
 138	ASSERT_EQ(setresgid(65534, 65534, 65534), 0); /* nogroup */
 139	ASSERT_EQ(setresuid(65534, 65534, 65534), 0); /* nobody */
 140
 141	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
 142	ASSERT_NE(handle, NULL);
 143
 144	/* Open IPC namespace file descriptor */
 145	ns_fd = open("/proc/self/ns/ipc", O_RDONLY);
 146	ASSERT_GE(ns_fd, 0);
 147
 148	/* Get handle for the namespace */
 149	handle->handle_bytes = MAX_HANDLE_SZ;
 150	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
 151	if (ret < 0 && errno == EOPNOTSUPP) {
 152		SKIP(free(handle); close(ns_fd);
 153		     return, "nsfs doesn't support file handles");
 154	}
 155	ASSERT_EQ(ret, 0);
 156	ASSERT_GT(handle->handle_bytes, 0);
 157
 158	/* Try to open using FD_NSFS_ROOT */
 159	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
 160	if (fd < 0 && (errno == EINVAL || errno == EOPNOTSUPP)) {
 161		SKIP(free(handle); close(ns_fd);
 162		     return,
 163			   "open_by_handle_at with FD_NSFS_ROOT not supported");
 164	}
 165	ASSERT_GE(fd, 0);
 166
 167	/* Verify we opened the correct namespace */
 168	ASSERT_EQ(fstat(ns_fd, &st1), 0);
 169	ASSERT_EQ(fstat(fd, &st2), 0);
 170	ASSERT_EQ(st1.st_ino, st2.st_ino);
 171	ASSERT_EQ(st1.st_dev, st2.st_dev);
 172
 173	close(fd);
 174	close(ns_fd);
 175	free(handle);
 176}
 177
 178TEST(nsfs_pid_handle)
 179{
 180	struct file_handle *handle;
 181	int mount_id;
 182	int ret;
 183	int fd;
 184	int ns_fd;
 185	struct stat st1, st2;
 186
 187	/* Drop to unprivileged uid/gid */
 188	ASSERT_EQ(setresgid(65534, 65534, 65534), 0); /* nogroup */
 189	ASSERT_EQ(setresuid(65534, 65534, 65534), 0); /* nobody */
 190
 191	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
 192	ASSERT_NE(handle, NULL);
 193
 194	/* Open PID namespace file descriptor */
 195	ns_fd = open("/proc/self/ns/pid", O_RDONLY);
 196	ASSERT_GE(ns_fd, 0);
 197
 198	/* Get handle for the namespace */
 199	handle->handle_bytes = MAX_HANDLE_SZ;
 200	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
 201	if (ret < 0 && errno == EOPNOTSUPP) {
 202		SKIP(free(handle); close(ns_fd);
 203		     return, "nsfs doesn't support file handles");
 204	}
 205	ASSERT_EQ(ret, 0);
 206	ASSERT_GT(handle->handle_bytes, 0);
 207
 208	/* Try to open using FD_NSFS_ROOT */
 209	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
 210	if (fd < 0 && (errno == EINVAL || errno == EOPNOTSUPP)) {
 211		SKIP(free(handle); close(ns_fd);
 212		     return,
 213			   "open_by_handle_at with FD_NSFS_ROOT not supported");
 214	}
 215	ASSERT_GE(fd, 0);
 216
 217	/* Verify we opened the correct namespace */
 218	ASSERT_EQ(fstat(ns_fd, &st1), 0);
 219	ASSERT_EQ(fstat(fd, &st2), 0);
 220	ASSERT_EQ(st1.st_ino, st2.st_ino);
 221	ASSERT_EQ(st1.st_dev, st2.st_dev);
 222
 223	close(fd);
 224	close(ns_fd);
 225	free(handle);
 226}
 227
 228TEST(nsfs_mnt_handle)
 229{
 230	struct file_handle *handle;
 231	int mount_id;
 232	int ret;
 233	int fd;
 234	int ns_fd;
 235	struct stat st1, st2;
 236
 237	/* Drop to unprivileged uid/gid */
 238	ASSERT_EQ(setresgid(65534, 65534, 65534), 0); /* nogroup */
 239	ASSERT_EQ(setresuid(65534, 65534, 65534), 0); /* nobody */
 240
 241	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
 242	ASSERT_NE(handle, NULL);
 243
 244	/* Open mount namespace file descriptor */
 245	ns_fd = open("/proc/self/ns/mnt", O_RDONLY);
 246	ASSERT_GE(ns_fd, 0);
 247
 248	/* Get handle for the namespace */
 249	handle->handle_bytes = MAX_HANDLE_SZ;
 250	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
 251	if (ret < 0 && errno == EOPNOTSUPP) {
 252		SKIP(free(handle); close(ns_fd);
 253		     return, "nsfs doesn't support file handles");
 254	}
 255	ASSERT_EQ(ret, 0);
 256	ASSERT_GT(handle->handle_bytes, 0);
 257
 258	/* Try to open using FD_NSFS_ROOT */
 259	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
 260	if (fd < 0 && (errno == EINVAL || errno == EOPNOTSUPP)) {
 261		SKIP(free(handle); close(ns_fd);
 262		     return,
 263			   "open_by_handle_at with FD_NSFS_ROOT not supported");
 264	}
 265	ASSERT_GE(fd, 0);
 266
 267	/* Verify we opened the correct namespace */
 268	ASSERT_EQ(fstat(ns_fd, &st1), 0);
 269	ASSERT_EQ(fstat(fd, &st2), 0);
 270	ASSERT_EQ(st1.st_ino, st2.st_ino);
 271	ASSERT_EQ(st1.st_dev, st2.st_dev);
 272
 273	close(fd);
 274	close(ns_fd);
 275	free(handle);
 276}
 277
 278TEST(nsfs_user_handle)
 279{
 280	struct file_handle *handle;
 281	int mount_id;
 282	int ret;
 283	int fd;
 284	int ns_fd;
 285	struct stat st1, st2;
 286
 287	/* Drop to unprivileged uid/gid */
 288	ASSERT_EQ(setresgid(65534, 65534, 65534), 0); /* nogroup */
 289	ASSERT_EQ(setresuid(65534, 65534, 65534), 0); /* nobody */
 290
 291	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
 292	ASSERT_NE(handle, NULL);
 293
 294	/* Open user namespace file descriptor */
 295	ns_fd = open("/proc/self/ns/user", O_RDONLY);
 296	ASSERT_GE(ns_fd, 0);
 297
 298	/* Get handle for the namespace */
 299	handle->handle_bytes = MAX_HANDLE_SZ;
 300	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
 301	if (ret < 0 && errno == EOPNOTSUPP) {
 302		SKIP(free(handle); close(ns_fd);
 303		     return, "nsfs doesn't support file handles");
 304	}
 305	ASSERT_EQ(ret, 0);
 306	ASSERT_GT(handle->handle_bytes, 0);
 307
 308	/* Try to open using FD_NSFS_ROOT */
 309	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
 310	if (fd < 0 && (errno == EINVAL || errno == EOPNOTSUPP)) {
 311		SKIP(free(handle); close(ns_fd);
 312		     return,
 313			   "open_by_handle_at with FD_NSFS_ROOT not supported");
 314	}
 315	ASSERT_GE(fd, 0);
 316
 317	/* Verify we opened the correct namespace */
 318	ASSERT_EQ(fstat(ns_fd, &st1), 0);
 319	ASSERT_EQ(fstat(fd, &st2), 0);
 320	ASSERT_EQ(st1.st_ino, st2.st_ino);
 321	ASSERT_EQ(st1.st_dev, st2.st_dev);
 322
 323	close(fd);
 324	close(ns_fd);
 325	free(handle);
 326}
 327
 328TEST(nsfs_cgroup_handle)
 329{
 330	struct file_handle *handle;
 331	int mount_id;
 332	int ret;
 333	int fd;
 334	int ns_fd;
 335	struct stat st1, st2;
 336
 337	/* Drop to unprivileged uid/gid */
 338	ASSERT_EQ(setresgid(65534, 65534, 65534), 0); /* nogroup */
 339	ASSERT_EQ(setresuid(65534, 65534, 65534), 0); /* nobody */
 340
 341	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
 342	ASSERT_NE(handle, NULL);
 343
 344	/* Open cgroup namespace file descriptor */
 345	ns_fd = open("/proc/self/ns/cgroup", O_RDONLY);
 346	if (ns_fd < 0) {
 347		SKIP(free(handle); return, "cgroup namespace not available");
 348	}
 349
 350	/* Get handle for the namespace */
 351	handle->handle_bytes = MAX_HANDLE_SZ;
 352	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
 353	if (ret < 0 && errno == EOPNOTSUPP) {
 354		SKIP(free(handle); close(ns_fd);
 355		     return, "nsfs doesn't support file handles");
 356	}
 357	ASSERT_EQ(ret, 0);
 358	ASSERT_GT(handle->handle_bytes, 0);
 359
 360	/* Try to open using FD_NSFS_ROOT */
 361	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
 362	if (fd < 0 && (errno == EINVAL || errno == EOPNOTSUPP)) {
 363		SKIP(free(handle); close(ns_fd);
 364		     return,
 365			   "open_by_handle_at with FD_NSFS_ROOT not supported");
 366	}
 367	ASSERT_GE(fd, 0);
 368
 369	/* Verify we opened the correct namespace */
 370	ASSERT_EQ(fstat(ns_fd, &st1), 0);
 371	ASSERT_EQ(fstat(fd, &st2), 0);
 372	ASSERT_EQ(st1.st_ino, st2.st_ino);
 373	ASSERT_EQ(st1.st_dev, st2.st_dev);
 374
 375	close(fd);
 376	close(ns_fd);
 377	free(handle);
 378}
 379
 380TEST(nsfs_time_handle)
 381{
 382	struct file_handle *handle;
 383	int mount_id;
 384	int ret;
 385	int fd;
 386	int ns_fd;
 387	struct stat st1, st2;
 388
 389	/* Drop to unprivileged uid/gid */
 390	ASSERT_EQ(setresgid(65534, 65534, 65534), 0); /* nogroup */
 391	ASSERT_EQ(setresuid(65534, 65534, 65534), 0); /* nobody */
 392
 393	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
 394	ASSERT_NE(handle, NULL);
 395
 396	/* Open time namespace file descriptor */
 397	ns_fd = open("/proc/self/ns/time", O_RDONLY);
 398	if (ns_fd < 0) {
 399		SKIP(free(handle); return, "time namespace not available");
 400	}
 401
 402	/* Get handle for the namespace */
 403	handle->handle_bytes = MAX_HANDLE_SZ;
 404	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
 405	if (ret < 0 && errno == EOPNOTSUPP) {
 406		SKIP(free(handle); close(ns_fd);
 407		     return, "nsfs doesn't support file handles");
 408	}
 409	ASSERT_EQ(ret, 0);
 410	ASSERT_GT(handle->handle_bytes, 0);
 411
 412	/* Try to open using FD_NSFS_ROOT */
 413	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
 414	if (fd < 0 && (errno == EINVAL || errno == EOPNOTSUPP)) {
 415		SKIP(free(handle); close(ns_fd);
 416		     return,
 417			   "open_by_handle_at with FD_NSFS_ROOT not supported");
 418	}
 419	ASSERT_GE(fd, 0);
 420
 421	/* Verify we opened the correct namespace */
 422	ASSERT_EQ(fstat(ns_fd, &st1), 0);
 423	ASSERT_EQ(fstat(fd, &st2), 0);
 424	ASSERT_EQ(st1.st_ino, st2.st_ino);
 425	ASSERT_EQ(st1.st_dev, st2.st_dev);
 426
 427	close(fd);
 428	close(ns_fd);
 429	free(handle);
 430}
 431
 432TEST(nsfs_user_net_namespace_isolation)
 433{
 434	struct file_handle *handle;
 435	int mount_id;
 436	int ret;
 437	int fd;
 438	int ns_fd;
 439	pid_t pid;
 440	int status;
 441	int pipefd[2];
 442	char result;
 443
 444	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
 445	ASSERT_NE(handle, NULL);
 446
 447	/* Create pipe for communication */
 448	ASSERT_EQ(pipe(pipefd), 0);
 449
 450	/* Get handle for current network namespace */
 451	ns_fd = open("/proc/self/ns/net", O_RDONLY);
 452	ASSERT_GE(ns_fd, 0);
 453
 454	handle->handle_bytes = MAX_HANDLE_SZ;
 455	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
 456	if (ret < 0 && errno == EOPNOTSUPP) {
 457		SKIP(free(handle); close(ns_fd); close(pipefd[0]);
 458		     close(pipefd[1]);
 459		     return, "nsfs doesn't support file handles");
 460	}
 461	ASSERT_EQ(ret, 0);
 462	close(ns_fd);
 463
 464	pid = fork();
 465	ASSERT_GE(pid, 0);
 466
 467	if (pid == 0) {
 468		/* Child process */
 469		close(pipefd[0]);
 470
 471		/* First create new user namespace to drop privileges */
 472		ret = unshare(CLONE_NEWUSER);
 473		if (ret < 0) {
 474			write(pipefd[1], "U",
 475			      1); /* Unable to create user namespace */
 476			close(pipefd[1]);
 477			exit(0);
 478		}
 479
 480		/* Write uid/gid mappings to maintain some capabilities */
 481		int uid_map_fd = open("/proc/self/uid_map", O_WRONLY);
 482		int gid_map_fd = open("/proc/self/gid_map", O_WRONLY);
 483		int setgroups_fd = open("/proc/self/setgroups", O_WRONLY);
 484
 485		if (uid_map_fd < 0 || gid_map_fd < 0 || setgroups_fd < 0) {
 486			write(pipefd[1], "M", 1); /* Unable to set mappings */
 487			close(pipefd[1]);
 488			exit(0);
 489		}
 490
 491		/* Disable setgroups to allow gid mapping */
 492		write(setgroups_fd, "deny", 4);
 493		close(setgroups_fd);
 494
 495		/* Map current uid/gid to root in the new namespace */
 496		char mapping[64];
 497		snprintf(mapping, sizeof(mapping), "0 %d 1", getuid());
 498		write(uid_map_fd, mapping, strlen(mapping));
 499		close(uid_map_fd);
 500
 501		snprintf(mapping, sizeof(mapping), "0 %d 1", getgid());
 502		write(gid_map_fd, mapping, strlen(mapping));
 503		close(gid_map_fd);
 504
 505		/* Now create new network namespace */
 506		ret = unshare(CLONE_NEWNET);
 507		if (ret < 0) {
 508			write(pipefd[1], "N",
 509			      1); /* Unable to create network namespace */
 510			close(pipefd[1]);
 511			exit(0);
 512		}
 513
 514		/* Try to open parent's network namespace handle from new user+net namespace */
 515		fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
 516
 517		if (fd >= 0) {
 518			/* Should NOT succeed - we're in a different user namespace */
 519			write(pipefd[1], "S", 1); /* Unexpected success */
 520			close(fd);
 521		} else if (errno == ESTALE) {
 522			/* Expected: Stale file handle */
 523			write(pipefd[1], "P", 1);
 524		} else {
 525			/* Other error */
 526			write(pipefd[1], "F", 1);
 527		}
 528
 529		close(pipefd[1]);
 530		exit(0);
 531	}
 532
 533	/* Parent process */
 534	close(pipefd[1]);
 535	ASSERT_EQ(read(pipefd[0], &result, 1), 1);
 536
 537	waitpid(pid, &status, 0);
 538	ASSERT_TRUE(WIFEXITED(status));
 539	ASSERT_EQ(WEXITSTATUS(status), 0);
 540
 541	if (result == 'U') {
 542		SKIP(free(handle); close(pipefd[0]);
 543		     return, "Cannot create new user namespace");
 544	}
 545	if (result == 'M') {
 546		SKIP(free(handle); close(pipefd[0]);
 547		     return, "Cannot set uid/gid mappings");
 548	}
 549	if (result == 'N') {
 550		SKIP(free(handle); close(pipefd[0]);
 551		     return, "Cannot create new network namespace");
 552	}
 553
 554	/* Should fail with permission denied since we're in a different user namespace */
 555	ASSERT_EQ(result, 'P');
 556
 557	close(pipefd[0]);
 558	free(handle);
 559}
 560
 561TEST(nsfs_user_uts_namespace_isolation)
 562{
 563	struct file_handle *handle;
 564	int mount_id;
 565	int ret;
 566	int fd;
 567	int ns_fd;
 568	pid_t pid;
 569	int status;
 570	int pipefd[2];
 571	char result;
 572
 573	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
 574	ASSERT_NE(handle, NULL);
 575
 576	/* Create pipe for communication */
 577	ASSERT_EQ(pipe(pipefd), 0);
 578
 579	/* Get handle for current UTS namespace */
 580	ns_fd = open("/proc/self/ns/uts", O_RDONLY);
 581	ASSERT_GE(ns_fd, 0);
 582
 583	handle->handle_bytes = MAX_HANDLE_SZ;
 584	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
 585	if (ret < 0 && errno == EOPNOTSUPP) {
 586		SKIP(free(handle); close(ns_fd); close(pipefd[0]);
 587		     close(pipefd[1]);
 588		     return, "nsfs doesn't support file handles");
 589	}
 590	ASSERT_EQ(ret, 0);
 591	close(ns_fd);
 592
 593	pid = fork();
 594	ASSERT_GE(pid, 0);
 595
 596	if (pid == 0) {
 597		/* Child process */
 598		close(pipefd[0]);
 599
 600		/* First create new user namespace to drop privileges */
 601		ret = unshare(CLONE_NEWUSER);
 602		if (ret < 0) {
 603			write(pipefd[1], "U",
 604			      1); /* Unable to create user namespace */
 605			close(pipefd[1]);
 606			exit(0);
 607		}
 608
 609		/* Write uid/gid mappings to maintain some capabilities */
 610		int uid_map_fd = open("/proc/self/uid_map", O_WRONLY);
 611		int gid_map_fd = open("/proc/self/gid_map", O_WRONLY);
 612		int setgroups_fd = open("/proc/self/setgroups", O_WRONLY);
 613
 614		if (uid_map_fd < 0 || gid_map_fd < 0 || setgroups_fd < 0) {
 615			write(pipefd[1], "M", 1); /* Unable to set mappings */
 616			close(pipefd[1]);
 617			exit(0);
 618		}
 619
 620		/* Disable setgroups to allow gid mapping */
 621		write(setgroups_fd, "deny", 4);
 622		close(setgroups_fd);
 623
 624		/* Map current uid/gid to root in the new namespace */
 625		char mapping[64];
 626		snprintf(mapping, sizeof(mapping), "0 %d 1", getuid());
 627		write(uid_map_fd, mapping, strlen(mapping));
 628		close(uid_map_fd);
 629
 630		snprintf(mapping, sizeof(mapping), "0 %d 1", getgid());
 631		write(gid_map_fd, mapping, strlen(mapping));
 632		close(gid_map_fd);
 633
 634		/* Now create new UTS namespace */
 635		ret = unshare(CLONE_NEWUTS);
 636		if (ret < 0) {
 637			write(pipefd[1], "N",
 638			      1); /* Unable to create UTS namespace */
 639			close(pipefd[1]);
 640			exit(0);
 641		}
 642
 643		/* Try to open parent's UTS namespace handle from new user+uts namespace */
 644		fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
 645
 646		if (fd >= 0) {
 647			/* Should NOT succeed - we're in a different user namespace */
 648			write(pipefd[1], "S", 1); /* Unexpected success */
 649			close(fd);
 650		} else if (errno == ESTALE) {
 651			/* Expected: Stale file handle */
 652			write(pipefd[1], "P", 1);
 653		} else {
 654			/* Other error */
 655			write(pipefd[1], "F", 1);
 656		}
 657
 658		close(pipefd[1]);
 659		exit(0);
 660	}
 661
 662	/* Parent process */
 663	close(pipefd[1]);
 664	ASSERT_EQ(read(pipefd[0], &result, 1), 1);
 665
 666	waitpid(pid, &status, 0);
 667	ASSERT_TRUE(WIFEXITED(status));
 668	ASSERT_EQ(WEXITSTATUS(status), 0);
 669
 670	if (result == 'U') {
 671		SKIP(free(handle); close(pipefd[0]);
 672		     return, "Cannot create new user namespace");
 673	}
 674	if (result == 'M') {
 675		SKIP(free(handle); close(pipefd[0]);
 676		     return, "Cannot set uid/gid mappings");
 677	}
 678	if (result == 'N') {
 679		SKIP(free(handle); close(pipefd[0]);
 680		     return, "Cannot create new UTS namespace");
 681	}
 682
 683	/* Should fail with ESTALE since we're in a different user namespace */
 684	ASSERT_EQ(result, 'P');
 685
 686	close(pipefd[0]);
 687	free(handle);
 688}
 689
 690TEST(nsfs_user_ipc_namespace_isolation)
 691{
 692	struct file_handle *handle;
 693	int mount_id;
 694	int ret;
 695	int fd;
 696	int ns_fd;
 697	pid_t pid;
 698	int status;
 699	int pipefd[2];
 700	char result;
 701
 702	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
 703	ASSERT_NE(handle, NULL);
 704
 705	/* Create pipe for communication */
 706	ASSERT_EQ(pipe(pipefd), 0);
 707
 708	/* Get handle for current IPC namespace */
 709	ns_fd = open("/proc/self/ns/ipc", O_RDONLY);
 710	ASSERT_GE(ns_fd, 0);
 711
 712	handle->handle_bytes = MAX_HANDLE_SZ;
 713	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
 714	if (ret < 0 && errno == EOPNOTSUPP) {
 715		SKIP(free(handle); close(ns_fd); close(pipefd[0]);
 716		     close(pipefd[1]);
 717		     return, "nsfs doesn't support file handles");
 718	}
 719	ASSERT_EQ(ret, 0);
 720	close(ns_fd);
 721
 722	pid = fork();
 723	ASSERT_GE(pid, 0);
 724
 725	if (pid == 0) {
 726		/* Child process */
 727		close(pipefd[0]);
 728
 729		/* First create new user namespace to drop privileges */
 730		ret = unshare(CLONE_NEWUSER);
 731		if (ret < 0) {
 732			write(pipefd[1], "U",
 733			      1); /* Unable to create user namespace */
 734			close(pipefd[1]);
 735			exit(0);
 736		}
 737
 738		/* Write uid/gid mappings to maintain some capabilities */
 739		int uid_map_fd = open("/proc/self/uid_map", O_WRONLY);
 740		int gid_map_fd = open("/proc/self/gid_map", O_WRONLY);
 741		int setgroups_fd = open("/proc/self/setgroups", O_WRONLY);
 742
 743		if (uid_map_fd < 0 || gid_map_fd < 0 || setgroups_fd < 0) {
 744			write(pipefd[1], "M", 1); /* Unable to set mappings */
 745			close(pipefd[1]);
 746			exit(0);
 747		}
 748
 749		/* Disable setgroups to allow gid mapping */
 750		write(setgroups_fd, "deny", 4);
 751		close(setgroups_fd);
 752
 753		/* Map current uid/gid to root in the new namespace */
 754		char mapping[64];
 755		snprintf(mapping, sizeof(mapping), "0 %d 1", getuid());
 756		write(uid_map_fd, mapping, strlen(mapping));
 757		close(uid_map_fd);
 758
 759		snprintf(mapping, sizeof(mapping), "0 %d 1", getgid());
 760		write(gid_map_fd, mapping, strlen(mapping));
 761		close(gid_map_fd);
 762
 763		/* Now create new IPC namespace */
 764		ret = unshare(CLONE_NEWIPC);
 765		if (ret < 0) {
 766			write(pipefd[1], "N",
 767			      1); /* Unable to create IPC namespace */
 768			close(pipefd[1]);
 769			exit(0);
 770		}
 771
 772		/* Try to open parent's IPC namespace handle from new user+ipc namespace */
 773		fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
 774
 775		if (fd >= 0) {
 776			/* Should NOT succeed - we're in a different user namespace */
 777			write(pipefd[1], "S", 1); /* Unexpected success */
 778			close(fd);
 779		} else if (errno == ESTALE) {
 780			/* Expected: Stale file handle */
 781			write(pipefd[1], "P", 1);
 782		} else {
 783			/* Other error */
 784			write(pipefd[1], "F", 1);
 785		}
 786
 787		close(pipefd[1]);
 788		exit(0);
 789	}
 790
 791	/* Parent process */
 792	close(pipefd[1]);
 793	ASSERT_EQ(read(pipefd[0], &result, 1), 1);
 794
 795	waitpid(pid, &status, 0);
 796	ASSERT_TRUE(WIFEXITED(status));
 797	ASSERT_EQ(WEXITSTATUS(status), 0);
 798
 799	if (result == 'U') {
 800		SKIP(free(handle); close(pipefd[0]);
 801		     return, "Cannot create new user namespace");
 802	}
 803	if (result == 'M') {
 804		SKIP(free(handle); close(pipefd[0]);
 805		     return, "Cannot set uid/gid mappings");
 806	}
 807	if (result == 'N') {
 808		SKIP(free(handle); close(pipefd[0]);
 809		     return, "Cannot create new IPC namespace");
 810	}
 811
 812	/* Should fail with ESTALE since we're in a different user namespace */
 813	ASSERT_EQ(result, 'P');
 814
 815	close(pipefd[0]);
 816	free(handle);
 817}
 818
 819TEST(nsfs_user_mnt_namespace_isolation)
 820{
 821	struct file_handle *handle;
 822	int mount_id;
 823	int ret;
 824	int fd;
 825	int ns_fd;
 826	pid_t pid;
 827	int status;
 828	int pipefd[2];
 829	char result;
 830
 831	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
 832	ASSERT_NE(handle, NULL);
 833
 834	/* Create pipe for communication */
 835	ASSERT_EQ(pipe(pipefd), 0);
 836
 837	/* Get handle for current mount namespace */
 838	ns_fd = open("/proc/self/ns/mnt", O_RDONLY);
 839	ASSERT_GE(ns_fd, 0);
 840
 841	handle->handle_bytes = MAX_HANDLE_SZ;
 842	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
 843	if (ret < 0 && errno == EOPNOTSUPP) {
 844		SKIP(free(handle); close(ns_fd); close(pipefd[0]);
 845		     close(pipefd[1]);
 846		     return, "nsfs doesn't support file handles");
 847	}
 848	ASSERT_EQ(ret, 0);
 849	close(ns_fd);
 850
 851	pid = fork();
 852	ASSERT_GE(pid, 0);
 853
 854	if (pid == 0) {
 855		/* Child process */
 856		close(pipefd[0]);
 857
 858		/* First create new user namespace to drop privileges */
 859		ret = unshare(CLONE_NEWUSER);
 860		if (ret < 0) {
 861			write(pipefd[1], "U",
 862			      1); /* Unable to create user namespace */
 863			close(pipefd[1]);
 864			exit(0);
 865		}
 866
 867		/* Write uid/gid mappings to maintain some capabilities */
 868		int uid_map_fd = open("/proc/self/uid_map", O_WRONLY);
 869		int gid_map_fd = open("/proc/self/gid_map", O_WRONLY);
 870		int setgroups_fd = open("/proc/self/setgroups", O_WRONLY);
 871
 872		if (uid_map_fd < 0 || gid_map_fd < 0 || setgroups_fd < 0) {
 873			write(pipefd[1], "M", 1); /* Unable to set mappings */
 874			close(pipefd[1]);
 875			exit(0);
 876		}
 877
 878		/* Disable setgroups to allow gid mapping */
 879		write(setgroups_fd, "deny", 4);
 880		close(setgroups_fd);
 881
 882		/* Map current uid/gid to root in the new namespace */
 883		char mapping[64];
 884		snprintf(mapping, sizeof(mapping), "0 %d 1", getuid());
 885		write(uid_map_fd, mapping, strlen(mapping));
 886		close(uid_map_fd);
 887
 888		snprintf(mapping, sizeof(mapping), "0 %d 1", getgid());
 889		write(gid_map_fd, mapping, strlen(mapping));
 890		close(gid_map_fd);
 891
 892		/* Now create new mount namespace */
 893		ret = unshare(CLONE_NEWNS);
 894		if (ret < 0) {
 895			write(pipefd[1], "N",
 896			      1); /* Unable to create mount namespace */
 897			close(pipefd[1]);
 898			exit(0);
 899		}
 900
 901		/* Try to open parent's mount namespace handle from new user+mnt namespace */
 902		fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
 903
 904		if (fd >= 0) {
 905			/* Should NOT succeed - we're in a different user namespace */
 906			write(pipefd[1], "S", 1); /* Unexpected success */
 907			close(fd);
 908		} else if (errno == ESTALE) {
 909			/* Expected: Stale file handle */
 910			write(pipefd[1], "P", 1);
 911		} else {
 912			/* Other error */
 913			write(pipefd[1], "F", 1);
 914		}
 915
 916		close(pipefd[1]);
 917		exit(0);
 918	}
 919
 920	/* Parent process */
 921	close(pipefd[1]);
 922	ASSERT_EQ(read(pipefd[0], &result, 1), 1);
 923
 924	waitpid(pid, &status, 0);
 925	ASSERT_TRUE(WIFEXITED(status));
 926	ASSERT_EQ(WEXITSTATUS(status), 0);
 927
 928	if (result == 'U') {
 929		SKIP(free(handle); close(pipefd[0]);
 930		     return, "Cannot create new user namespace");
 931	}
 932	if (result == 'M') {
 933		SKIP(free(handle); close(pipefd[0]);
 934		     return, "Cannot set uid/gid mappings");
 935	}
 936	if (result == 'N') {
 937		SKIP(free(handle); close(pipefd[0]);
 938		     return, "Cannot create new mount namespace");
 939	}
 940
 941	/* Should fail with ESTALE since we're in a different user namespace */
 942	ASSERT_EQ(result, 'P');
 943
 944	close(pipefd[0]);
 945	free(handle);
 946}
 947
 948TEST(nsfs_user_cgroup_namespace_isolation)
 949{
 950	struct file_handle *handle;
 951	int mount_id;
 952	int ret;
 953	int fd;
 954	int ns_fd;
 955	pid_t pid;
 956	int status;
 957	int pipefd[2];
 958	char result;
 959
 960	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
 961	ASSERT_NE(handle, NULL);
 962
 963	/* Create pipe for communication */
 964	ASSERT_EQ(pipe(pipefd), 0);
 965
 966	/* Get handle for current cgroup namespace */
 967	ns_fd = open("/proc/self/ns/cgroup", O_RDONLY);
 968	if (ns_fd < 0) {
 969		SKIP(free(handle); close(pipefd[0]); close(pipefd[1]);
 970		     return, "cgroup namespace not available");
 971	}
 972
 973	handle->handle_bytes = MAX_HANDLE_SZ;
 974	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
 975	if (ret < 0 && errno == EOPNOTSUPP) {
 976		SKIP(free(handle); close(ns_fd); close(pipefd[0]);
 977		     close(pipefd[1]);
 978		     return, "nsfs doesn't support file handles");
 979	}
 980	ASSERT_EQ(ret, 0);
 981	close(ns_fd);
 982
 983	pid = fork();
 984	ASSERT_GE(pid, 0);
 985
 986	if (pid == 0) {
 987		/* Child process */
 988		close(pipefd[0]);
 989
 990		/* First create new user namespace to drop privileges */
 991		ret = unshare(CLONE_NEWUSER);
 992		if (ret < 0) {
 993			write(pipefd[1], "U",
 994			      1); /* Unable to create user namespace */
 995			close(pipefd[1]);
 996			exit(0);
 997		}
 998
 999		/* Write uid/gid mappings to maintain some capabilities */
1000		int uid_map_fd = open("/proc/self/uid_map", O_WRONLY);
1001		int gid_map_fd = open("/proc/self/gid_map", O_WRONLY);
1002		int setgroups_fd = open("/proc/self/setgroups", O_WRONLY);
1003
1004		if (uid_map_fd < 0 || gid_map_fd < 0 || setgroups_fd < 0) {
1005			write(pipefd[1], "M", 1); /* Unable to set mappings */
1006			close(pipefd[1]);
1007			exit(0);
1008		}
1009
1010		/* Disable setgroups to allow gid mapping */
1011		write(setgroups_fd, "deny", 4);
1012		close(setgroups_fd);
1013
1014		/* Map current uid/gid to root in the new namespace */
1015		char mapping[64];
1016		snprintf(mapping, sizeof(mapping), "0 %d 1", getuid());
1017		write(uid_map_fd, mapping, strlen(mapping));
1018		close(uid_map_fd);
1019
1020		snprintf(mapping, sizeof(mapping), "0 %d 1", getgid());
1021		write(gid_map_fd, mapping, strlen(mapping));
1022		close(gid_map_fd);
1023
1024		/* Now create new cgroup namespace */
1025		ret = unshare(CLONE_NEWCGROUP);
1026		if (ret < 0) {
1027			write(pipefd[1], "N",
1028			      1); /* Unable to create cgroup namespace */
1029			close(pipefd[1]);
1030			exit(0);
1031		}
1032
1033		/* Try to open parent's cgroup namespace handle from new user+cgroup namespace */
1034		fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
1035
1036		if (fd >= 0) {
1037			/* Should NOT succeed - we're in a different user namespace */
1038			write(pipefd[1], "S", 1); /* Unexpected success */
1039			close(fd);
1040		} else if (errno == ESTALE) {
1041			/* Expected: Stale file handle */
1042			write(pipefd[1], "P", 1);
1043		} else {
1044			/* Other error */
1045			write(pipefd[1], "F", 1);
1046		}
1047
1048		close(pipefd[1]);
1049		exit(0);
1050	}
1051
1052	/* Parent process */
1053	close(pipefd[1]);
1054	ASSERT_EQ(read(pipefd[0], &result, 1), 1);
1055
1056	waitpid(pid, &status, 0);
1057	ASSERT_TRUE(WIFEXITED(status));
1058	ASSERT_EQ(WEXITSTATUS(status), 0);
1059
1060	if (result == 'U') {
1061		SKIP(free(handle); close(pipefd[0]);
1062		     return, "Cannot create new user namespace");
1063	}
1064	if (result == 'M') {
1065		SKIP(free(handle); close(pipefd[0]);
1066		     return, "Cannot set uid/gid mappings");
1067	}
1068	if (result == 'N') {
1069		SKIP(free(handle); close(pipefd[0]);
1070		     return, "Cannot create new cgroup namespace");
1071	}
1072
1073	/* Should fail with ESTALE since we're in a different user namespace */
1074	ASSERT_EQ(result, 'P');
1075
1076	close(pipefd[0]);
1077	free(handle);
1078}
1079
1080TEST(nsfs_user_pid_namespace_isolation)
1081{
1082	struct file_handle *handle;
1083	int mount_id;
1084	int ret;
1085	int fd;
1086	int ns_fd;
1087	pid_t pid;
1088	int status;
1089	int pipefd[2];
1090	char result;
1091
1092	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
1093	ASSERT_NE(handle, NULL);
1094
1095	/* Create pipe for communication */
1096	ASSERT_EQ(pipe(pipefd), 0);
1097
1098	/* Get handle for current PID namespace */
1099	ns_fd = open("/proc/self/ns/pid", O_RDONLY);
1100	ASSERT_GE(ns_fd, 0);
1101
1102	handle->handle_bytes = MAX_HANDLE_SZ;
1103	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
1104	if (ret < 0 && errno == EOPNOTSUPP) {
1105		SKIP(free(handle); close(ns_fd); close(pipefd[0]);
1106		     close(pipefd[1]);
1107		     return, "nsfs doesn't support file handles");
1108	}
1109	ASSERT_EQ(ret, 0);
1110	close(ns_fd);
1111
1112	pid = fork();
1113	ASSERT_GE(pid, 0);
1114
1115	if (pid == 0) {
1116		/* Child process */
1117		close(pipefd[0]);
1118
1119		/* First create new user namespace to drop privileges */
1120		ret = unshare(CLONE_NEWUSER);
1121		if (ret < 0) {
1122			write(pipefd[1], "U",
1123			      1); /* Unable to create user namespace */
1124			close(pipefd[1]);
1125			exit(0);
1126		}
1127
1128		/* Write uid/gid mappings to maintain some capabilities */
1129		int uid_map_fd = open("/proc/self/uid_map", O_WRONLY);
1130		int gid_map_fd = open("/proc/self/gid_map", O_WRONLY);
1131		int setgroups_fd = open("/proc/self/setgroups", O_WRONLY);
1132
1133		if (uid_map_fd < 0 || gid_map_fd < 0 || setgroups_fd < 0) {
1134			write(pipefd[1], "M", 1); /* Unable to set mappings */
1135			close(pipefd[1]);
1136			exit(0);
1137		}
1138
1139		/* Disable setgroups to allow gid mapping */
1140		write(setgroups_fd, "deny", 4);
1141		close(setgroups_fd);
1142
1143		/* Map current uid/gid to root in the new namespace */
1144		char mapping[64];
1145		snprintf(mapping, sizeof(mapping), "0 %d 1", getuid());
1146		write(uid_map_fd, mapping, strlen(mapping));
1147		close(uid_map_fd);
1148
1149		snprintf(mapping, sizeof(mapping), "0 %d 1", getgid());
1150		write(gid_map_fd, mapping, strlen(mapping));
1151		close(gid_map_fd);
1152
1153		/* Now create new PID namespace - requires fork to take effect */
1154		ret = unshare(CLONE_NEWPID);
1155		if (ret < 0) {
1156			write(pipefd[1], "N",
1157			      1); /* Unable to create PID namespace */
1158			close(pipefd[1]);
1159			exit(0);
1160		}
1161
1162		/* Fork again for PID namespace to take effect */
1163		pid_t child_pid = fork();
1164		if (child_pid < 0) {
1165			write(pipefd[1], "N",
1166			      1); /* Unable to fork in PID namespace */
1167			close(pipefd[1]);
1168			exit(0);
1169		}
1170
1171		if (child_pid == 0) {
1172			/* Grandchild in new PID namespace */
1173			/* Try to open parent's PID namespace handle from new user+pid namespace */
1174			fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
1175
1176			if (fd >= 0) {
1177				/* Should NOT succeed - we're in a different user namespace */
1178				write(pipefd[1], "S",
1179				      1); /* Unexpected success */
1180				close(fd);
1181			} else if (errno == ESTALE) {
1182				/* Expected: Stale file handle */
1183				write(pipefd[1], "P", 1);
1184			} else {
1185				/* Other error */
1186				write(pipefd[1], "F", 1);
1187			}
1188
1189			close(pipefd[1]);
1190			exit(0);
1191		}
1192
1193		/* Wait for grandchild */
1194		waitpid(child_pid, NULL, 0);
1195		exit(0);
1196	}
1197
1198	/* Parent process */
1199	close(pipefd[1]);
1200	ASSERT_EQ(read(pipefd[0], &result, 1), 1);
1201
1202	waitpid(pid, &status, 0);
1203	ASSERT_TRUE(WIFEXITED(status));
1204	ASSERT_EQ(WEXITSTATUS(status), 0);
1205
1206	if (result == 'U') {
1207		SKIP(free(handle); close(pipefd[0]);
1208		     return, "Cannot create new user namespace");
1209	}
1210	if (result == 'M') {
1211		SKIP(free(handle); close(pipefd[0]);
1212		     return, "Cannot set uid/gid mappings");
1213	}
1214	if (result == 'N') {
1215		SKIP(free(handle); close(pipefd[0]);
1216		     return, "Cannot create new PID namespace");
1217	}
1218
1219	/* Should fail with ESTALE since we're in a different user namespace */
1220	ASSERT_EQ(result, 'P');
1221
1222	close(pipefd[0]);
1223	free(handle);
1224}
1225
1226TEST(nsfs_user_time_namespace_isolation)
1227{
1228	struct file_handle *handle;
1229	int mount_id;
1230	int ret;
1231	int fd;
1232	int ns_fd;
1233	pid_t pid;
1234	int status;
1235	int pipefd[2];
1236	char result;
1237
1238	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
1239	ASSERT_NE(handle, NULL);
1240
1241	/* Create pipe for communication */
1242	ASSERT_EQ(pipe(pipefd), 0);
1243
1244	/* Get handle for current time namespace */
1245	ns_fd = open("/proc/self/ns/time", O_RDONLY);
1246	if (ns_fd < 0) {
1247		SKIP(free(handle); close(pipefd[0]); close(pipefd[1]);
1248		     return, "time namespace not available");
1249	}
1250
1251	handle->handle_bytes = MAX_HANDLE_SZ;
1252	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
1253	if (ret < 0 && errno == EOPNOTSUPP) {
1254		SKIP(free(handle); close(ns_fd); close(pipefd[0]);
1255		     close(pipefd[1]);
1256		     return, "nsfs doesn't support file handles");
1257	}
1258	ASSERT_EQ(ret, 0);
1259	close(ns_fd);
1260
1261	pid = fork();
1262	ASSERT_GE(pid, 0);
1263
1264	if (pid == 0) {
1265		/* Child process */
1266		close(pipefd[0]);
1267
1268		/* First create new user namespace to drop privileges */
1269		ret = unshare(CLONE_NEWUSER);
1270		if (ret < 0) {
1271			write(pipefd[1], "U",
1272			      1); /* Unable to create user namespace */
1273			close(pipefd[1]);
1274			exit(0);
1275		}
1276
1277		/* Write uid/gid mappings to maintain some capabilities */
1278		int uid_map_fd = open("/proc/self/uid_map", O_WRONLY);
1279		int gid_map_fd = open("/proc/self/gid_map", O_WRONLY);
1280		int setgroups_fd = open("/proc/self/setgroups", O_WRONLY);
1281
1282		if (uid_map_fd < 0 || gid_map_fd < 0 || setgroups_fd < 0) {
1283			write(pipefd[1], "M", 1); /* Unable to set mappings */
1284			close(pipefd[1]);
1285			exit(0);
1286		}
1287
1288		/* Disable setgroups to allow gid mapping */
1289		write(setgroups_fd, "deny", 4);
1290		close(setgroups_fd);
1291
1292		/* Map current uid/gid to root in the new namespace */
1293		char mapping[64];
1294		snprintf(mapping, sizeof(mapping), "0 %d 1", getuid());
1295		write(uid_map_fd, mapping, strlen(mapping));
1296		close(uid_map_fd);
1297
1298		snprintf(mapping, sizeof(mapping), "0 %d 1", getgid());
1299		write(gid_map_fd, mapping, strlen(mapping));
1300		close(gid_map_fd);
1301
1302		/* Now create new time namespace - requires fork to take effect */
1303		ret = unshare(CLONE_NEWTIME);
1304		if (ret < 0) {
1305			write(pipefd[1], "N",
1306			      1); /* Unable to create time namespace */
1307			close(pipefd[1]);
1308			exit(0);
1309		}
1310
1311		/* Fork again for time namespace to take effect */
1312		pid_t child_pid = fork();
1313		if (child_pid < 0) {
1314			write(pipefd[1], "N",
1315			      1); /* Unable to fork in time namespace */
1316			close(pipefd[1]);
1317			exit(0);
1318		}
1319
1320		if (child_pid == 0) {
1321			/* Grandchild in new time namespace */
1322			/* Try to open parent's time namespace handle from new user+time namespace */
1323			fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDONLY);
1324
1325			if (fd >= 0) {
1326				/* Should NOT succeed - we're in a different user namespace */
1327				write(pipefd[1], "S",
1328				      1); /* Unexpected success */
1329				close(fd);
1330			} else if (errno == ESTALE) {
1331				/* Expected: Stale file handle */
1332				write(pipefd[1], "P", 1);
1333			} else {
1334				/* Other error */
1335				write(pipefd[1], "F", 1);
1336			}
1337
1338			close(pipefd[1]);
1339			exit(0);
1340		}
1341
1342		/* Wait for grandchild */
1343		waitpid(child_pid, NULL, 0);
1344		exit(0);
1345	}
1346
1347	/* Parent process */
1348	close(pipefd[1]);
1349	ASSERT_EQ(read(pipefd[0], &result, 1), 1);
1350
1351	waitpid(pid, &status, 0);
1352	ASSERT_TRUE(WIFEXITED(status));
1353	ASSERT_EQ(WEXITSTATUS(status), 0);
1354
1355	if (result == 'U') {
1356		SKIP(free(handle); close(pipefd[0]);
1357		     return, "Cannot create new user namespace");
1358	}
1359	if (result == 'M') {
1360		SKIP(free(handle); close(pipefd[0]);
1361		     return, "Cannot set uid/gid mappings");
1362	}
1363	if (result == 'N') {
1364		SKIP(free(handle); close(pipefd[0]);
1365		     return, "Cannot create new time namespace");
1366	}
1367
1368	/* Should fail with ESTALE since we're in a different user namespace */
1369	ASSERT_EQ(result, 'P');
1370
1371	close(pipefd[0]);
1372	free(handle);
1373}
1374
1375TEST(nsfs_open_flags)
1376{
1377	struct file_handle *handle;
1378	int mount_id;
1379	int ret;
1380	int fd;
1381	int ns_fd;
1382
1383	handle = malloc(sizeof(*handle) + MAX_HANDLE_SZ);
1384	ASSERT_NE(handle, NULL);
1385
1386	/* Open a namespace file descriptor */
1387	ns_fd = open("/proc/self/ns/net", O_RDONLY);
1388	ASSERT_GE(ns_fd, 0);
1389
1390	/* Get handle for the namespace */
1391	handle->handle_bytes = MAX_HANDLE_SZ;
1392	ret = name_to_handle_at(ns_fd, "", handle, &mount_id, AT_EMPTY_PATH);
1393	if (ret < 0 && errno == EOPNOTSUPP) {
1394		SKIP(free(handle); close(ns_fd);
1395		     return, "nsfs doesn't support file handles");
1396	}
1397	ASSERT_EQ(ret, 0);
1398	ASSERT_GT(handle->handle_bytes, 0);
1399
1400	/* Test invalid flags that should fail */
1401	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_WRONLY);
1402	ASSERT_LT(fd, 0);
1403	ASSERT_EQ(errno, EPERM);
1404
1405	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_RDWR);
1406	ASSERT_LT(fd, 0);
1407	ASSERT_EQ(errno, EPERM);
1408
1409	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_TRUNC);
1410	ASSERT_LT(fd, 0);
1411	ASSERT_EQ(errno, EPERM);
1412
1413	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_DIRECT);
1414	ASSERT_LT(fd, 0);
1415	ASSERT_EQ(errno, EINVAL);
1416
1417	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_TMPFILE);
1418	ASSERT_LT(fd, 0);
1419	ASSERT_EQ(errno, EINVAL);
1420
1421	fd = open_by_handle_at(FD_NSFS_ROOT, handle, O_DIRECTORY);
1422	ASSERT_LT(fd, 0);
1423	ASSERT_EQ(errno, ENOTDIR);
1424
1425	close(ns_fd);
1426	free(handle);
1427}
1428
1429TEST_HARNESS_MAIN