WIP: tests: Add cap2_userns checkpoint_restore test

[bachradsusi]

Create a child process in new pid and user namespaces and drop CAP_SYS_ADMIN to enforce using CAP_CHECKPOINT_RESTORE capability which is required for writing to /proc/sys/kernel/ns_last_pid

[WOnder93]

Actually, you can avoid using capsh and messing with CAP_SYS_ADMIN, etc. by running the runcon inside the namespace:

diff --git a/policy/test_cap_userns.te b/policy/test_cap_userns.te
index 11febae..402675b 100644
--- a/policy/test_cap_userns.te
+++ b/policy/test_cap_userns.te
@@ -27,21 +27,13 @@ allow capusernsdomain self:capability setfcap;
 # Domain for process that is allowed to use cap_checkpoint_restore
 type test_cap2_userns_t;
 testsuite_domain_type(test_cap2_userns_t)
-typeattribute test_cap2_userns_t capusernsdomain;
 typeattribute test_cap2_userns_t cap2usernsdomain;
 allow test_cap2_userns_t self:cap2_userns checkpoint_restore;
 
 # Domain for process that is not to use cap_checkpoint_restore
 type test_no_cap2_userns_t;
 testsuite_domain_type(test_no_cap2_userns_t)
-typeattribute test_no_cap2_userns_t capusernsdomain;
 typeattribute test_no_cap2_userns_t cap2usernsdomain;
 
 # Rules common to both domains.
-allow_userns_create(cap2usernsdomain)
-# linux >= v5.12 needs setfcap to map UID 0
-allow cap2usernsdomain self:capability setfcap;
-
-allow cap2usernsdomain self:cap_userns setpcap;
-allow cap2usernsdomain self:cap_userns sys_admin;
 kernel_rw_kernel_ns_lastpid_sysctl(cap2usernsdomain)
diff --git a/tests/cap_userns/test b/tests/cap_userns/test
index f976889..9cee33d 100755
--- a/tests/cap_userns/test
+++ b/tests/cap_userns/test
@@ -35,14 +35,14 @@ ok($result);
 # Verify that test_cap2_userns_t can use cap_checkpoint_restore
 
 $result = system(
-"runcon -t test_cap2_userns_t -- $basedir/userns_child_exec -p -U -M '0 0 1' -G '0 0 1' -- capsh --drop=cap_sys_admin -+ -c 'echo 1000 > /proc/sys/kernel/ns_last_pid' 2>&1"
+"$basedir/userns_child_exec -p -U -M '0 0 1' -G '0 0 1' -- runcon -t test_cap2_userns_t -- sysctl -w kernel.ns_last_pid=1000 2>&1"
 );
 ok( $result eq 0 );
 
 # Verify that test_no_cap_userns_t cannot use cap_checkpoint_restore
 
 $result = system(
-"runcon -t test_no_cap2_userns_t -- $basedir/userns_child_exec -p -U -M '0 0 1' -G '0 0 1' -- capsh --drop=cap_sys_admin -+ -c 'echo 1000 > /proc/sys/kernel/ns_last_pid' 2>&1"
+"$basedir/userns_child_exec -p -U -M '0 0 1' -G '0 0 1' -- runcon -t test_no_cap2_userns_t -- sysctl -w kernel.ns_last_pid=1000 2>&1"
 );
 ok($result);
 

[bachradsusi]

Updated based on your comment

[bachradsusi]

https://lore.kernel.org/selinux/20250605133414.939461-1-lautrbach@redhat.com/T/#m150fe6bc7fe7eee788c1114b6f9e6a80e7db7e59