| Message ID | 20240925084921.16352-1-ice_yangxiao@163.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] syscalls/{fanotify17, getxattr05}: Fix the ENOSPC error | expand |
Hi! > If the value of max_user_namespaces is set to 10 but more than > 10 user namspaces are currently used on system. In this case, > these tests fail with ENOSPC. for example: > > # lsns -t user -n | wc -l > 17 > > # ./fanotify17 > ... > fanotify17.c:174: TINFO: Test #0: Global groups limit in init user ns > fanotify17.c:130: TPASS: Created 128 groups - below groups limit (128) > fanotify17.c:174: TINFO: Test #1: Global groups limit in privileged user ns > fanotify17.c:154: TFAIL: unshare(CLONE_NEWUSER) failed: ENOSPC (28) > tst_test.c:452: TBROK: Invalid child (6958) exit value 1 That's strange the test seems to work for me even if it's over the limit. $ lsns -t user -n | wc -l 14 I suppose that since the test is executed as a root since it has .require_root the limits does not apply. It's strange that they apply in your case. Which kernel is this?
Hi Cyril, Xiao Yang, > Hi! > > If the value of max_user_namespaces is set to 10 but more than > > 10 user namspaces are currently used on system. In this case, > > these tests fail with ENOSPC. for example: > > # lsns -t user -n | wc -l > > 17 > > # ./fanotify17 > > ... > > fanotify17.c:174: TINFO: Test #0: Global groups limit in init user ns > > fanotify17.c:130: TPASS: Created 128 groups - below groups limit (128) > > fanotify17.c:174: TINFO: Test #1: Global groups limit in privileged user ns > > fanotify17.c:154: TFAIL: unshare(CLONE_NEWUSER) failed: ENOSPC (28) > > tst_test.c:452: TBROK: Invalid child (6958) exit value 1 > That's strange the test seems to work for me even if it's over the > limit. > $ lsns -t user -n | wc -l > 14 I'm able to reproduce as well on VM. I get problems with 9 for fanotify17 ... # for i in {0..7}; do unshare -U & done # lsns -t user -n | wc -l 9 # ./fanotify17 ... fanotify17.c:154: TFAIL: unshare(CLONE_NEWUSER) failed: ENOSPC (28) tst_test.c:452: TBROK: Invalid child (1916) exit value 1 and with 10 for getxattr05: # unshare -U & # lsns -t user -n | wc -l 10 # ./getxattr05 getxattr05.c:88: TPASS: Got same data when acquiring the value of system.posix_acl_access twice getxattr05.c:88: TPASS: Got same data when acquiring the value of system.posix_acl_access twice getxattr05.c:88: TPASS: Got same data when acquiring the value of system.posix_acl_access twice > I suppose that since the test is executed as a root since it has > .require_root the limits does not apply. It's strange that they apply in > your case. Which kernel is this? Testing on 6.12.0-rc4-1.gf83465d-default and 6.11.5-1-default (both openSUSE Tumbleweed) and 6.9.9-amd64 (Debian). Yes, root access is required for rw to /proc/sys/user/max_user_namespaces: getxattr05.c:159: TBROK: Failed to open FILE '/proc/sys/user/max_user_namespaces' for writing: EACCES (13) getxattr05.c:167: TWARN: Failed to open FILE '/proc/sys/user/max_user_namespaces' for writing: EACCES (13) Kind regards, Petr
Hi Cyril, Xiao Yang, Reviewed-by: Petr Vorel <pvorel@suse.cz> > BTW, it may be better to get the number of user namespaces in use and then add 10. Although I thing this suggestion from Xiao Yang would be better. Kind regards, Petr
diff --git a/testcases/kernel/syscalls/fanotify/fanotify17.c b/testcases/kernel/syscalls/fanotify/fanotify17.c index 3ecb31b6e..a6206d953 100644 --- a/testcases/kernel/syscalls/fanotify/fanotify17.c +++ b/testcases/kernel/syscalls/fanotify/fanotify17.c @@ -224,7 +224,7 @@ static void setup(void) user_ns_supported = 0; } else if (!access(MAX_USERNS, F_OK)) { SAFE_FILE_SCANF(MAX_USERNS, "%d", &orig_max_userns); - SAFE_FILE_PRINTF(MAX_USERNS, "%d", 10); + SAFE_FILE_PRINTF(MAX_USERNS, "%d", orig_max_userns + 10); } /* diff --git a/testcases/kernel/syscalls/getxattr/getxattr05.c b/testcases/kernel/syscalls/getxattr/getxattr05.c index d9717a695..f1c8e8391 100644 --- a/testcases/kernel/syscalls/getxattr/getxattr05.c +++ b/testcases/kernel/syscalls/getxattr/getxattr05.c @@ -156,7 +156,7 @@ static void setup(void) user_ns_supported = 0; } else if (!access(MAX_USERNS, F_OK)) { SAFE_FILE_SCANF(MAX_USERNS, "%d", &orig_max_userns); - SAFE_FILE_PRINTF(MAX_USERNS, "%d", 10); + SAFE_FILE_PRINTF(MAX_USERNS, "%d", orig_max_userns + 10); } }
If the value of max_user_namespaces is set to 10 but more than 10 user namspaces are currently used on system. In this case, these tests fail with ENOSPC. for example: # lsns -t user -n | wc -l 17 # ./fanotify17 ... fanotify17.c:174: TINFO: Test #0: Global groups limit in init user ns fanotify17.c:130: TPASS: Created 128 groups - below groups limit (128) fanotify17.c:174: TINFO: Test #1: Global groups limit in privileged user ns fanotify17.c:154: TFAIL: unshare(CLONE_NEWUSER) failed: ENOSPC (28) tst_test.c:452: TBROK: Invalid child (6958) exit value 1 Try to fix the issue by increasing the default value of max_user_namespaces by 10. Signed-off-by: Xiao Yang <ice_yangxiao@163.com> --- testcases/kernel/syscalls/fanotify/fanotify17.c | 2 +- testcases/kernel/syscalls/getxattr/getxattr05.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)