diff options
| author | Christian Brauner <brauner@kernel.org> | 2026-08-03 14:15:01 +0200 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-08-03 23:36:18 +0200 |
| commit | f2b69ea2d1a017f0c8e848ff875f4cf2492d2bd0 (patch) | |
| tree | 29bf4dd83ae5d3fa58f7187d05497543f27b76ed /tools/testing/selftests/exec/Makefile | |
| parent | b604897764047229c6a931e1980cac1b2197d9d2 (diff) | |
| download | linux-next-f2b69ea2d1a017f0c8e848ff875f4cf2492d2bd0.tar.gz linux-next-f2b69ea2d1a017f0c8e848ff875f4cf2492d2bd0.zip | |
selftests/exec: test the pre-opened interpreter limit
- an interpreter opened at registration is charged
- an interpreter a 'B' entry binds is charged too
- an entry that opens none is not
- removing an entry gives the charge back
- a nested user namespace cannot buy itself budget by raising its own limit
Skips where the sysctl or binfmt_misc is missing. The 'B' case lives in
binfmt_misc_bpf.c because binding needs a handler. It binds from a child
in a user namespace of its own, through the fd the child inherited, so
the charge lands on the child while the interpreter is still opened with
the entry file's credentials, and nothing outside the child sees a
changed limit.
Link: https://patch.msgid.link/20260803-work-binfmt_misc-interplimit-v1-2-4a2435500bd9@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Diffstat (limited to 'tools/testing/selftests/exec/Makefile')
| -rw-r--r-- | tools/testing/selftests/exec/Makefile | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/tools/testing/selftests/exec/Makefile b/tools/testing/selftests/exec/Makefile index 410c93606a0c..b640af8f02b5 100644 --- a/tools/testing/selftests/exec/Makefile +++ b/tools/testing/selftests/exec/Makefile @@ -25,6 +25,10 @@ TEST_GEN_PROGS += check-exec # or an 'F' entry can pin the instance that owns it. Unprivileged, no bpf. TEST_GEN_PROGS += binfmt_misc_selfpin +# The interpreters an 'F' or 'B' entry pre-opens are charged against +# UCOUNT_BINFMT_MISC_INTERPRETERS. Unprivileged, no bpf. +TEST_GEN_PROGS += binfmt_misc_interplimit + # 'D' (register disabled) binfmt_misc test: an entry that exists but does # not dispatch until it is enabled. Static magic entry, no bpf toolchain. TEST_GEN_PROGS += binfmt_misc_disabled @@ -104,6 +108,8 @@ $(OUTPUT)/script-noexec.inc: $(CHECK_EXEC_SAMPLES)/script-noexec.inc # CFLAGS for every program in this directory. $(OUTPUT)/binfmt_misc_selfpin: CFLAGS += $(TOOLS_INCLUDES) $(OUTPUT)/binfmt_misc_selfpin: ../filesystems/utils.c +$(OUTPUT)/binfmt_misc_interplimit: CFLAGS += $(TOOLS_INCLUDES) +$(OUTPUT)/binfmt_misc_interplimit: ../filesystems/utils.c # --- binfmt_misc bpf ('B') handler test --------------------------------- # The struct_ops bpf objects are compiled against the running kernel's BTF. |