gramineproject / graphene

Graphene / Graphene-SGX - a library OS for Linux multi-process applications, with Intel SGX support
https://grapheneproject.io
GNU Lesser General Public License v3.0
769 stars 260 forks source link

Test fails in unlinking of writable directory and breaks without reporting results #2547

Open anjalirai-intel opened 3 years ago

anjalirai-intel commented 3 years ago

Description of the problem

Unlinking of a writable directory fails and test fails with "TBROK: Test 0 haven't reported results!"

Steps to reproduce

Execute attached files unlink08_setup in linux environment and unlink08_run with graphene-direct $ ./unlink08_setup $ graphene-direct ./unlink08_run

Expected results

TINFO: Timeout per run is 0h 05m 00s
TPASS: unlink(<unwritable directory>) failed as expected: EACCES (13)
TPASS: unlink(<unsearchable directory>) failed as expected: EACCES (13)
TPASS: unlink(<directory>) failed as expected: EISDIR (21)
TPASS: unlink(<directory>) failed as expected: EISDIR (21)

Summary:
passed   4
failed   0
skipped  0
warnings 0

Actual results

TINFO: Timeout per run is 0h 05m 00s
TFAIL: unlink(<unwritable directory>) succeeded unexpectedly
/root/Graphene_Master/LibOS/shim/test/ltp/ltp_src/lib/tst_test.c:1082: TBROK: Test 0 haven't reported results!

Summary:
passed   0
failed   0
skipped  0
warnings 0

Label

bug unlink08.zip

dimakuv commented 3 years ago

The actual problem is that this LTP test does setuid(<some-other-uid>) -- and this syscall is a mockup (doesn't do anything and returns success) in Graphene. So the LTP test thinks that it changed the user (which is not the owner of the directory), and tries to unlink(directory-of-another-user). This should fail but it doesn't, as can be seen in the log.

mkow commented 3 years ago

So, can we close it then?

dimakuv commented 3 years ago

We need to discuss the Big Problem of setuid, chown and so on. Graphene doesn't have the concept of Users, Groups, Ownership, Permissions for files. And Graphene just does absolutely random things: some syscalls return with ENOSYS, some syscalls return with success but do nothing, some syscalls return hard-coded values (???). This is a complete mess, and we at least need a uniform policy on this.