[LTP] [PATCH] setsockopt08: Handle EPERM from disabled compat xtables in userns

[Avinesh Kumar]

From: Avinesh Kumar <avinesh.kumar@suse.com>

Since kernel commit ec1806a730a1 ("netfilter: x_tables: disable
32bit compat interface in user namespaces"), the compat xtables ABI
returns EPERM when called from inside a non-init user namespace,
regardless of privileges held there. Since the test isolates itself
with tst_setup_netns(), it always hits this path on 32-bit/compat
runs and can no longer reach the CVE-2021-22555 code path

setsockopt08.c:139: TFAIL: setsockopt(3, IPPROTO_IP, IPT_SO_SET_REPLACE, 0xf7f0c800, 1): EPERM (1)

So treat EPERM as TCONF instead of TFAIL.

Signed-off-by: Avinesh Kumar <avinesh.kumar@suse.com>
---
 testcases/kernel/syscalls/setsockopt/setsockopt08.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/testcases/kernel/syscalls/setsockopt/setsockopt08.c b/testcases/kernel/syscalls/setsockopt/setsockopt08.c
index 37051512517a..3d1838f6ed73 100644
--- a/testcases/kernel/syscalls/setsockopt/setsockopt08.c
+++ b/testcases/kernel/syscalls/setsockopt/setsockopt08.c
@@ -82,6 +82,13 @@
  *  * the kernel will insert four bytes of padding
  *    after the match and target entries each.
  *  * sizeof(struct xt_entry_target) = 32
+ *
+ * Since kernel commit ec1806a730a1 ("netfilter: x_tables: disable
+ * 32bit compat interface in user namespaces") in v7.2, the compat
+ * xtables ABI is rejected with EPERM inside a non-init user namespace.
+ * As this test runs isolated via tst_setup_netns(), it can no longer
+ * reach the vulnerable code path on such kernels and reports TCONF
+ * instead.
  */
 
 #include <netinet/in.h>
@@ -135,6 +142,11 @@ void run(void)
 	if (TST_RET == -1 && TST_ERR == ENOPROTOOPT)
 		tst_brk(TCONF | TTERRNO, res_fmt_str, fd, buffer);
 
+	if (TST_RET == -1 && TST_ERR == EPERM  && tst_is_compat_mode()) {
+		tst_res(TINFO, "32bit compat xtables interface is disabled in user namespaces since commit ec1806a730a1");
+		tst_brk(TCONF | TTERRNO, res_fmt_str, fd, buffer);
+	}
+
 	result = (TST_RET == -1 && TST_ERR == EINVAL) ? TPASS : TFAIL;
 	tst_res(result | TTERRNO, res_fmt_str, fd, buffer);
 
@@ -163,6 +175,7 @@ static struct tst_test test = {
 	},
 	.tags = (const struct tst_tag[]) {
 		{"linux-git", "b29c457a6511435960115c0f548c4360d5f4801d"},
+		{"linux-git", "ec1806a730a1c0b3d68a7f9afe81514fb0dd7991"},
 		{"CVE", "2021-22555"},
 		{}
 	}
-- 
2.55.0