On 17.07.2026 01:25, Mirian Shilakadze wrote:
Add a test for the per-VE permission allowlist. It runs against both interfaces through a fixture variant, ve.proc_permissions and ve.sysfs_permissions, which share the leaf logic in fs/ve_perms.c. Each variant names a few host-only files and a host-only directory, all registered nodes outside a container's default view. Reading the list back is a seq file, so the test adds a read_file_at helper to the shared ve_selftest.h. From the host it grants read on a file, widens to rwx and removes it checking the list each time, confirms an entry granted to one VE is not seen by another, and confirms an unknown path is rejected. It covers the write parser in one test: comment lines skipped, several entries in one write, a later grant replacing an earlier one, a duplicate op keeping the last, remove of an absent entry, and a missing mask rejected, and checks each entry renders at its true depth with a directory getting a trailing slash. Enforcement is checked end to end from inside a VE, split into an allowed and a denied test. A task enters the VE cgroup, unshares CLONE_NEWVE and opens the entry on the inherited host /proc or /sys. Granting r makes each file readable and granting x on the directory lets it be traversed, while an ungranted file stays hidden, a file granted only w cannot be read, and a directory granted only r cannot be traversed. https://virtuozzo.atlassian.net/browse/VSTOR-135286 Signed-off-by: Mirian Shilakadze <[email protected]>
Reviewed-by: Vladimir Riabchun <[email protected]>
--- tools/testing/selftests/ve/.gitignore | 1 + tools/testing/selftests/ve/Makefile | 1 + tools/testing/selftests/ve/ve_perms_test.c | 360 +++++++++++++++++++++ tools/testing/selftests/ve/ve_selftest.h | 26 ++ 4 files changed, 388 insertions(+) create mode 100644 tools/testing/selftests/ve/ve_perms_test.c ...
-- Best regards, Riabchun Vladimir Linux Kernel Developer, Virtuozzo _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
