[gentoo-commits] repo/gentoo:master commit in: dev-util/ltrace/

["Marek Szuba" <marecki@gentoo.org>]

commit:     ea8a4b3bcf6a0a57f7cdb8e4d37ff62d099cb6a4
Author:     Marek Szuba <marecki <AT> gentoo <DOT> org>
AuthorDate: Tue Jul 13 10:57:54 2021 +0000
Commit:     Marek Szuba <marecki <AT> gentoo <DOT> org>
CommitDate: Tue Jul 13 11:20:54 2021 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ea8a4b3b

dev-util/ltrace: skip the attach-process test

On modern kernels with the Yama security module enabled the default
ptrace behaviour is that a process must have a predefined relationship
with the inferior it wants to call ``PTRACE_ATTACH`` on, with two
additional modes restricting process tracing even more; for details see
[1]. As a result, unless Yama is explicitly reset to classic ptrace
permissions the ltrace attach-process test fails due to
insufficient permissions - regardless of the sandbox, or even when the
test suite is run manually with no involvement of a Gentoo package
manager.

We could in principle modify the test in question to be compatible with
restricted-ptrace mode, however it would still fail on systems with
Yama in admin-attach and no-attach mode. Between that and requiring the
user to reconfigure Yama prior to running this test being IMHO a Bad
Idea, just don't bother with this test at all.

[1] https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html

Closes: https://bugs.gentoo.org/729046
Signed-off-by: Marek Szuba <marecki <AT> gentoo.org>

 dev-util/ltrace/ltrace-0.7.3.6.1.ebuild   | 4 ++++
 dev-util/ltrace/ltrace-0.7.3_p4-r1.ebuild | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/dev-util/ltrace/ltrace-0.7.3.6.1.ebuild b/dev-util/ltrace/ltrace-0.7.3.6.1.ebuild
index 9fd7b01b854..9bb71a61718 100644
--- a/dev-util/ltrace/ltrace-0.7.3.6.1.ebuild
+++ b/dev-util/ltrace/ltrace-0.7.3.6.1.ebuild
@@ -71,6 +71,10 @@ src_configure() {
 }
 
 src_test() {
+	# On kernels with Yama enabled this will not run, even without sandbox,
+	# unless /proc/sys/kernel/yama/ptrace_scope == 0. Just don't bother.
+	# Note: we only delete it here in order to avoid Makefile.am patching.
+	rm -f testsuite/ltrace.minor/attach-process.exp
 	# sandbox redirects vfork() to fork(): bug # 774054
 	# Let's avoid sandbox entirely.
 	SANDBOX_ON=0 LD_PRELOAD= emake check

diff --git a/dev-util/ltrace/ltrace-0.7.3_p4-r1.ebuild b/dev-util/ltrace/ltrace-0.7.3_p4-r1.ebuild
index beb325aa49c..3b6aafcb34d 100644
--- a/dev-util/ltrace/ltrace-0.7.3_p4-r1.ebuild
+++ b/dev-util/ltrace/ltrace-0.7.3_p4-r1.ebuild
@@ -70,6 +70,10 @@ src_configure() {
 }
 
 src_test() {
+	# On kernels with Yama enabled this will not run, even without sandbox,
+	# unless /proc/sys/kernel/yama/ptrace_scope == 0. Just don't bother.
+	# Note: we only delete it here in order to avoid Makefile.am patching.
+	rm -f testsuite/ltrace.minor/attach-process.exp
 	# sandbox redirects vfork() to fork(): bug # 774054
 	# Let's avoid sandbox entirely.
 	SANDBOX_ON=0 LD_PRELOAD= emake check