May 2025 - dev

Re: [PATCH] fedora: Separately restore context for /run/user in %posttrans selinux
by Stefano Brivio 23 May '25

23 May '25

On Thu, 22 May 2025 22:19:11 -0600 Max Chernoff <git(a)maxchernoff.ca> wrote: > Hi Stefano, > > On Thu, 2025-05-22 at 23:13 +0200, Stefano Brivio wrote: > > The previous change introduces specific file contexts for > > /run/user/%{USERID}/netns and > > /run/user/%{USERID}/containers/networks/rootless-netns, but > > %selinux_relabel_post can't handle that, see comments for more > > details. > > > > Add a separate restorecon(8) call for /run/user in the > > post-transaction scriptlet for the SELinux subpackage. > > I've tested this out and can confirm that it works, thanks. Thanks for testing! I'll apply both patches soon and make a new release within a few days, then we'll finally have the intended SELinux setup for pasta as well. I'm quite relieved about it. :) > Aside: what is the correct way to build passt rpms? "make pkgs" doesn't > build the SELinux package, Right, 'make pkgs' is just a quick hack to make static builds (which doesn't need a proper rpm / rpmbuild setup) and I build RPMs for releases and release testing via Koji / Copr, which source git snapshots anyway. For one-off builds: > but I was eventually able to get the following to work: > > $ git archive --prefix=passt-$(git rev-parse @)/ @ > ./passt-$(git rev-parse @).tar > $ xz passt-*.tar > $ mv *.tar.xz contrib/fedora/ > $ cd contrib/fedora/ > $ rpkg local --outdir $(realpath .) I actually do something like this, but uglier. I didn't think of using git-archive: $ mkdir passt-679cb68455a9ae40cc72233abf218c20527500a6/ $ cp -Rpd *.c *.h Makefile seccomp.sh passt.1 passt-repair.1 qrap.1 README.md doc/ contrib/ LICENSES/ passt-679cb68455a9ae40cc72233abf218c20527500a6/ $ tar Jcvf /home/sbrivio/rpmbuild/SOURCES/passt-679cb68455a9ae40cc72233abf218c20527500a6.tar.xz passt-679cb68455a9ae40cc72233abf218c20527500a6/ $ cd contrib/fedora $ rpkg spec /tmp/rpkg/passt-1-djdq6cud/passt.spec $ rpmbuild -ba /tmp/rpkg/passt-1-djdq6cud/passt.spec > Is there a way to do this without needing to manually create the .tar.xz > archive first? We would need to replace %prep with a simple copy from the current directory. I didn't really think this through, but perhaps we could make it conditional, like this: diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index 745cf01..f1973ee 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -47,7 +47,13 @@ Requires(preun): policycoreutils This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1). %prep +%if "%(ls passt.c)" == "passt.c" +# Hack for local build from source tree +cp -a %(pwd)/* . +%else +# The usual process with an upstream tarball %setup -q -n passt-%{git_hash} +%endif %build %set_build_flags ? Maybe there's a more common or idiomatic way though... -- Stefano

1 0

[PATCH] fedora: Separately restore context for /run/user in %posttrans selinux
by Stefano Brivio 22 May '25

22 May '25

The previous change introduces specific file contexts for /run/user/%{USERID}/netns and /run/user/%{USERID}/containers/networks/rootless-netns, but %selinux_relabel_post can't handle that, see comments for more details. Add a separate restorecon(8) call for /run/user in the post-transaction scriptlet for the SELinux subpackage. Reported-by: Max Chernoff <git(a)maxchernoff.ca> Link: https://bugs.passt.top/show_bug.cgi?id=81 Link: https://github.com/containers/podman/discussions/26100#discussioncomment-13… Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- This should be applied on top of Max's: [PATCH v3 1/1] selinux: Transition to pasta_t in containers contrib/fedora/passt.spec | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index 745cf01..5aaf7ac 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -102,6 +102,12 @@ fi %posttrans selinux %selinux_relabel_post -s %{selinuxtype} +# %selinux_relabel_post calls fixfiles(8) with the previous file_contexts file +# (see selabel_file(5)) in order to restore only the file contexts which +# actually changed. However, as file_contexts doesn't support %{USERID} +# substitutions, this will not work for specific file contexts that pasta needs +# to have under /run/user. Restore those explicitly. +restorecon -R /run/user %files %license LICENSES/{GPL-2.0-or-later.txt,BSD-3-Clause.txt} -- 2.43.0

1 0

vhost-kernel net on pasta: from 26 to 37Gbit/s
by Eugenio Perez Martin 21 May '25

21 May '25

Hi! Some updates on the integration. The main culprit was to allow pasta to keep reading packets using the regular read() on the tap device. I thought that part was completely disabled, but I guess the kernel is able to omit the notification on tap as long as the userspace does not read it. My scenario: in different CPUs, all in the same NUMA. I run iperf server on CPU 11 with "iperf3 -A 11 -s". All odds CPUs are isolated with isolcpus=1,3,... nohz=on nohz_full=1,3,... With vanilla pasta isolated to CPUs 1,3 with taskset, and just --config-net option, and running iperf with "iperf3 -A 5 -c 10.6.68.254 -w 8M": - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 30.7 GBytes 26.4 Gbits/sec 0 sender [ 5] 0.00-10.04 sec 30.7 GBytes 26.3 Gbits/sec receiver Now trying with the vhost patches we get a slightly worse performance: - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 25.5 GBytes 21.9 Gbits/sec 0 sender [ 5] 0.00-10.04 sec 25.5 GBytes 21.8 Gbits/sec receiver Now vhost patch still lacks optimizations like disabling notifications or batch more rx available buffer notifications. At the moment it refills the rx buffers in each iteration, and does not set the no_notify bit which makes the kernel skip the used buffer notifications if pasta is actively checking the queue, which is not optimal. Now if I isolate the vhost kernel thread [1] I get way more performance as expected: - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 43.1 GBytes 37.1 Gbits/sec 0 sender [ 5] 0.00-10.04 sec 43.1 GBytes 36.9 Gbits/sec receiver After analyzing perf output, rep_movs_alternative is the most called function in the three iperf3 (~20%Self), passt.avx2 (~15%Self) and vhost (~15%Self), But I don't see any of them consuming 100% of CPU in top: pasta consumes ~85% %CPU, both iperf3 client and server consumes 60%, and vhost consumes ~53%. So... I have mixed feelings about this :). By "default" it seems to have less performance, but my test is maybe too synthetic. There is room for improvement with the mentioned optimizations so I'd continue applying them, continuing with UDP and TCP zerocopy, and developing zerocopy vhost rx. With these numbers I think the series should not be merged at the moment. I could send it as RFC if you want but I've not applied the comments the first one received, POC style :). Thanks! [1] Notes to reproduce it, I'm able to see it with top -H and then set with taskset. Either the latest changes on the module or the way pasta behaves does not allow me to see in classical ps output.

3 4

[PATCH 0/1] selinux: Transition to pasta_t in containers
by Max Chernoff 20 May '25

20 May '25

Hi, Currently, pasta runs in the container_runtime_exec_t context when running in a container. This commit updates the SELinux policy so that pasta instead runs in the pasta_t context. I'm more familiar with CIL, so I initially developed the modified policy in CIL, and then later ported it to the kernel policy language. My original CIL source is available here: https://github.com/gucci-on-fleek/maxchernoff.ca/blob/master/etc/selinux/lo… I've tested this on Fedora 42 with rootless Podman, with both unconfined (unconfined_u) and confined (user_u) users, and with both TCP and UDP. I've never actually used the email workflow for Git before, so please let me know if I've done something wrong. Thanks, -- Max Max Chernoff (1): selinux: Transition to pasta_t in containers contrib/selinux/pasta.fc | 10 ++++++---- contrib/selinux/pasta.te | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 4 deletions(-) -- 2.49.0

3 16

[PATCH] Correct various function comment headers
by Laurent Vivier 19 May '25

19 May '25

This commit refines function comment headers for improved accuracy and consistency. Key changes include: - Corrected parameter/return descriptions (e.g., `logtime`, `__daemon`). - Added missing and removed incorrect parameter documentation (e.g., `tcp_vu_sock_recv`, `ndp`). - Standardized comments to the `/** ... */` style for functions like `udp_flow_close` and `ns_enter`. - Ensured function names in comments consistently use `()`. - Addressed minor typos and updated comments for renamed functions. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- conf.c | 2 +- flow.c | 4 +++- log.c | 3 ++- ndp.c | 1 - netlink.c | 1 - pasta.c | 4 +--- pcap.c | 7 ++----- tcp.c | 10 ++++++---- tcp_buf.c | 4 ++-- tcp_vu.c | 4 +++- udp.c | 4 ++-- udp_flow.c | 5 +++-- util.c | 11 +++++++---- 13 files changed, 32 insertions(+), 28 deletions(-) diff --git a/conf.c b/conf.c index a6d7e22a860c..f4c8ca25c87e 100644 --- a/conf.c +++ b/conf.c @@ -1358,7 +1358,7 @@ static void conf_open_files(struct ctx *c) } /** - * parse_mac - Parse a MAC address from a string + * parse_mac() - Parse a MAC address from a string * @mac: Binary MAC address, initialised on success * @str: String to parse * diff --git a/flow.c b/flow.c index 6a5c8aa439c2..cc050339c9c4 100644 --- a/flow.c +++ b/flow.c @@ -480,7 +480,9 @@ struct flowside *flow_target(const struct ctx *c, union flow *flow, /** * flow_set_type() - Set type and move to TYPED * @flow: Flow to change state - * @pif: pif of the initiating side + * @type: New flow type to assign + * + * Return: pointer to the modified flow structure. */ union flow *flow_set_type(union flow *flow, enum flow_type type) { diff --git a/log.c b/log.c index 5d7d76f68b2e..33b89fc14574 100644 --- a/log.c +++ b/log.c @@ -54,7 +54,8 @@ bool log_stderr = true; /* Not daemonised, no shell spawned */ * logtime() - Get the current time for logging purposes * @ts: Buffer into which to store the timestamp * - * Return: pointer to @now, or NULL if there was an error retrieving the time + * Return: pointer to @ts on success, or NULL if there was + * an error retrieving the time */ static const struct timespec *logtime(struct timespec *ts) { diff --git a/ndp.c b/ndp.c index b664034b00b1..3e1549456839 100644 --- a/ndp.c +++ b/ndp.c @@ -335,7 +335,6 @@ static void ndp_ra(const struct ctx *c, const struct in6_addr *dst) /** * ndp() - Check for NDP solicitations, reply as needed * @c: Execution context - * @ih: ICMPv6 header * @saddr: Source IPv6 address * @p: Packet pool * diff --git a/netlink.c b/netlink.c index a0525047e898..ee9325a054a2 100644 --- a/netlink.c +++ b/netlink.c @@ -1024,7 +1024,6 @@ int nl_link_get_mac(int s, unsigned int ifi, void *mac) /** * nl_link_set_mac() - Set link MAC address * @s: Netlink socket - * @ns: Use netlink socket in namespace * @ifi: Interface index * @mac: MAC address to set * diff --git a/pasta.c b/pasta.c index 017fa3224c65..c20769211d9e 100644 --- a/pasta.c +++ b/pasta.c @@ -57,15 +57,13 @@ int pasta_child_pid; /** * pasta_child_handler() - Exit once shell exits (if we started it), reap clones - * @signal: Unused, handler deals with SIGCHLD only + * @signal: Signal number; this handler deals with SIGCHLD only */ void pasta_child_handler(int signal) { int errno_save = errno; siginfo_t infop; - (void)signal; - if (signal != SIGCHLD) return; diff --git a/pcap.c b/pcap.c index e95aa6fe29a6..46d11a2a6daa 100644 --- a/pcap.c +++ b/pcap.c @@ -52,8 +52,6 @@ struct pcap_pkthdr { * @iovcnt: Number of buffers (@iov entries) in frame * @offset: Byte offset of the L2 headers within @iov * @now: Timestamp - * - * Returns: 0 on success, -errno on error writing to the file */ static void pcap_frame(const struct iovec *iov, size_t iovcnt, size_t offset, const struct timespec *now) @@ -113,10 +111,9 @@ void pcap_multiple(const struct iovec *iov, size_t frame_parts, unsigned int n, pcap_frame(iov + i * frame_parts, frame_parts, offset, &now); } -/* - * pcap_iov - Write packet data described by an I/O vector +/** + * pcap_iov() - Write packet data described by an I/O vector * to a pcap file descriptor. - * * @iov: Pointer to the array of struct iovec describing the I/O vector * containing packet data to write, including L2 header * @iovcnt: Number of buffers (@iov entries) diff --git a/tcp.c b/tcp.c index 0ac298a74125..f43c1e27c112 100644 --- a/tcp.c +++ b/tcp.c @@ -456,7 +456,7 @@ int tcp_set_peek_offset(const struct tcp_tap_conn *conn, int offset) /** * tcp_conn_epoll_events() - epoll events mask for given connection state * @events: Current connection events - * @conn_flags Connection flags + * @conn_flags: Connection flags * * Return: epoll events mask corresponding to implied connection state */ @@ -1079,7 +1079,7 @@ out: * tcp_update_seqack_from_tap() - ACK number from tap and related flags/counters * @c: Execution context * @conn: Connection pointer - * @seq Current ACK sequence, host order + * @seq: Current ACK sequence, host order */ static void tcp_update_seqack_from_tap(const struct ctx *c, struct tcp_tap_conn *conn, uint32_t seq) @@ -1103,7 +1103,7 @@ static void tcp_update_seqack_from_tap(const struct ctx *c, * @conn: Connection pointer * @flags: TCP flags: if not set, send segment only if ACK is due * @th: TCP header to update - * @data: buffer to store TCP option + * @opts: TCP option buffer (output parameter) * @optlen: size of the TCP option buffer (output parameter) * * Return: < 0 error code on connection reset, @@ -1238,7 +1238,7 @@ static void tcp_get_tap_ws(struct tcp_tap_conn *conn, /** * tcp_tap_window_update() - Process an updated window from tap side * @conn: Connection pointer - * @window: Window value, host order, unscaled + * @wnd: Window value, host order, unscaled */ static void tcp_tap_window_update(struct tcp_tap_conn *conn, unsigned wnd) { @@ -1261,6 +1261,8 @@ static void tcp_tap_window_update(struct tcp_tap_conn *conn, unsigned wnd) * tcp_init_seq() - Calculate initial sequence number according to RFC 6528 * @hash: Hash of connection details * @now: Current timestamp + * + * Return: the calculated 32-bit initial sequence number. */ static uint32_t tcp_init_seq(uint64_t hash, const struct timespec *now) { diff --git a/tcp_buf.c b/tcp_buf.c index 05305636b503..d1fca676c9a7 100644 --- a/tcp_buf.c +++ b/tcp_buf.c @@ -104,7 +104,7 @@ void tcp_sock_iov_init(const struct ctx *c) /** * tcp_revert_seq() - Revert affected conn->seq_to_tap after failed transmission - * @ctx: Execution context + * @c: Execution context * @conns: Array of connection pointers corresponding to queued frames * @frames: Two-dimensional array containing queued frames with sub-iovs * @num_frames: Number of entries in the two arrays to be compared @@ -148,7 +148,7 @@ void tcp_payload_flush(const struct ctx *c) } /** - * tcp_buf_fill_headers() - Fill 802.3, IP, TCP headers in pre-cooked buffers + * tcp_l2_buf_fill_headers() - Fill 802.3, IP, TCP headers in pre-cooked buffers * @conn: Connection pointer * @iov: Pointer to an array of iovec of TCP pre-cooked buffers * @check: Checksum, if already known diff --git a/tcp_vu.c b/tcp_vu.c index 57587cc73a63..f3914c7c2195 100644 --- a/tcp_vu.c +++ b/tcp_vu.c @@ -176,8 +176,10 @@ int tcp_vu_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags) * @already_sent: Number of bytes already sent * @fillsize: Maximum bytes to fill in guest-side receiving window * @iov_cnt: number of iov (output) + * @head_cnt: Pointer to store the count of head iov entries (output) * - * Return: Number of iov entries used to store the data or negative error code + * Return: number of bytes received from the socket, or a negative error code + * on failure. */ static ssize_t tcp_vu_sock_recv(const struct ctx *c, const struct tcp_tap_conn *conn, bool v6, diff --git a/udp.c b/udp.c index ca28b37c142d..65a52e0755c0 100644 --- a/udp.c +++ b/udp.c @@ -473,7 +473,7 @@ static void udp_send_tap_icmp6(const struct ctx *c, /** * udp_pktinfo() - Retrieve packet destination address from cmsg * @msg: msghdr into which message has been received - * @dst: (Local) destination address of message in @mh (output) + * @dst: (Local) destination address of message in @msg (output) * * Return: 0 on success, -1 if the information was missing (@dst is set to * inany_any6). @@ -736,7 +736,7 @@ static int udp_peek_addr(int s, union sockaddr_inany *src, * udp_sock_recv() - Receive datagrams from a socket * @c: Execution context * @s: Socket to receive from - * @mmh mmsghdr array to receive into + * @mmh: mmsghdr array to receive into * @n: Maximum number of datagrams to receive * * Return: Number of datagrams received diff --git a/udp_flow.c b/udp_flow.c index 4c6b3c2ca8da..cef3fb588bbe 100644 --- a/udp_flow.c +++ b/udp_flow.c @@ -36,7 +36,7 @@ struct udp_flow *udp_at_sidx(flow_sidx_t sidx) return &flow->udp; } -/* +/** * udp_flow_close() - Close and clean up UDP flow * @c: Execution context * @uflow: UDP flow @@ -126,7 +126,8 @@ static int udp_flow_sock(const struct ctx *c, * @flow: Initiated flow * @now: Timestamp * - * Return: UDP specific flow, if successful, NULL on failure + * Return: sidx for the target side of the new UDP flow, or FLOW_SIDX_NONE + * on failure. * * #syscalls getsockname */ diff --git a/util.c b/util.c index f5497d4634dc..7b245ccc01f9 100644 --- a/util.c +++ b/util.c @@ -364,7 +364,7 @@ void bitmap_or(uint8_t *dst, size_t size, const uint8_t *a, const uint8_t *b) dst[i] = a[i] | b[i]; } -/* +/** * ns_enter() - Enter configured user (unless already joined) and network ns * @c: Execution context * @@ -499,7 +499,8 @@ int output_file_open(const char *path, int flags) * @pidfile_fd: Open PID file descriptor * @devnull_fd: Open file descriptor for /dev/null * - * Return: child PID on success, won't return on failure + * Return: 0 in the child process on success. The parent process exits. + * Does not return in either process on failure (calls _exit). */ int __daemon(int pidfile_fd, int devnull_fd) { @@ -607,7 +608,8 @@ int do_clone(int (*fn)(void *), char *stack_area, size_t stack_size, int flags, #endif } -/* write_all_buf() - write all of a buffer to an fd +/** + * write_all_buf() - write all of a buffer to an fd * @fd: File descriptor * @buf: Pointer to base of buffer * @len: Length of buffer @@ -637,7 +639,8 @@ int write_all_buf(int fd, const void *buf, size_t len) return 0; } -/* write_remainder() - write the tail of an IO vector to an fd +/** + * write_remainder() - write the tail of an IO vector to an fd * @fd: File descriptor * @iov: IO vector * @iovcnt: Number of entries in @iov -- 2.49.0

1 0

[PATCH] tap: Avoid bogus missingReturn cppcheck warning in tap_l2_max_len()
by Stefano Brivio 19 May '25

19 May '25

Cppcheck 2.14.2 on Alpine Linux (musl) says that: tap.c:111:19: error: Found an exit path from function with non-void return type that has missing return statement [missingReturn] switch (c->mode) { ^ This exit path is not reachable because we ASSERT(0) after the switch, but for some reason cppcheck doesn't see this with musl headers. Hide the warning with a redundant return statement. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- tap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tap.c b/tap.c index d630f6d..6db5d88 100644 --- a/tap.c +++ b/tap.c @@ -118,6 +118,8 @@ unsigned long tap_l2_max_len(const struct ctx *c) } /* NOLINTEND(bugprone-branch-clone) */ ASSERT(0); + + return 0; /* Unreachable, for cppcheck's sake */ } /** -- 2.43.0

2 4

[PATCH 0/3] Standardize and correct function comment headers
by Laurent Vivier 16 May '25

16 May '25

This series cleans up function comment headers in iov, virtio, and vhost_user modules for improved consistency and accuracy. The following changes are included: iov: Standardize function comment headers (Ensures /** and func_name() syntax for uniformity) virtio: Correct and align comment headers (Addresses format, typos, tags, param names in .c/.h) vhost_user: Correct and align function comment headers (Corrects params, func names in comments, & docs in .c) Full details can be found in the individual patch descriptions. Laurent Vivier (3): vhost_user: Correct and align function comment headers virtio: Correct and align comment headers iov: Standardize function comment headers iov.c | 15 ++-- vhost_user.c | 221 +++++++++++++++++++++++++-------------------------- vhost_user.h | 2 +- virtio.c | 29 ++++--- virtio.h | 4 +- 5 files changed, 137 insertions(+), 134 deletions(-) -- 2.49.0

2 4

[PATCH] codespell: Correct typos in comments and error message
by Laurent Vivier 16 May '25

16 May '25

This commit addresses several spelling errors identified by the `codespell` tool. The corrections apply to: - Code comments in `fwd.c`, `ip.h`, `isolation.c`, and `log.c`. - An error message string in `vhost_user.c`. Specifically, the following misspellings were corrected: - "adddress" to "address" - "capabilites" to "capabilities" - "Musn't" to "Mustn't" - "calculatd" to "calculated" - "Invalide" to "Invalid" Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- fwd.c | 2 +- ip.h | 2 +- isolation.c | 8 ++++---- log.c | 2 +- vhost_user.c | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/fwd.c b/fwd.c index 49aabc34aa18..250cf5640b85 100644 --- a/fwd.c +++ b/fwd.c @@ -418,7 +418,7 @@ uint8_t fwd_nat_from_splice(const struct ctx *c, uint8_t proto, else tgt->eaddr = inany_loopback6; - /* Preserve the specific loopback adddress used, but let the kernel pick + /* Preserve the specific loopback address used, but let the kernel pick * a source port on the target side */ tgt->oaddr = ini->eaddr; diff --git a/ip.h b/ip.h index 471c57ee4c71..24509d9c11cd 100644 --- a/ip.h +++ b/ip.h @@ -118,7 +118,7 @@ static inline uint32_t ip6_get_flow_lbl(const struct ipv6hdr *ip6h) char *ipv6_l4hdr(const struct pool *p, int idx, size_t offset, uint8_t *proto, size_t *dlen); -/* IPv6 link-local all-nodes multicast adddress, ff02::1 */ +/* IPv6 link-local all-nodes multicast address, ff02::1 */ static const struct in6_addr in6addr_ll_all_nodes = { .s6_addr = { 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, diff --git a/isolation.c b/isolation.c index c944fb35c3a4..bbcd23b72271 100644 --- a/isolation.c +++ b/isolation.c @@ -129,7 +129,7 @@ static void drop_caps_ep_except(uint64_t keep) * additional layer of protection. Executing this requires * CAP_SETPCAP, which we will have within our userns. * - * Note that dropping capabilites from the bounding set limits + * Note that dropping capabilities from the bounding set limits * exec()ed processes, but does not remove them from the effective or * permitted sets, so it doesn't reduce our own capabilities. */ @@ -174,8 +174,8 @@ static void clamp_caps(void) * Should: * - drop unneeded capabilities * - close all open files except for standard streams and the one from --fd - * Musn't: - * - remove filesytem access (we need to access files during setup) + * Mustn't: + * - remove filesystem access (we need to access files during setup) */ void isolate_initial(int argc, char **argv) { @@ -194,7 +194,7 @@ void isolate_initial(int argc, char **argv) * * It's debatable whether it's useful to drop caps when we * retain SETUID and SYS_ADMIN, but we might as well. We drop - * further capabilites in isolate_user() and + * further capabilities in isolate_user() and * isolate_prefork(). */ keep = BIT(CAP_NET_BIND_SERVICE) | BIT(CAP_SETUID) | BIT(CAP_SETGID) | diff --git a/log.c b/log.c index d40d7ae2a92c..5d7d76f68b2e 100644 --- a/log.c +++ b/log.c @@ -402,7 +402,7 @@ void __setlogmask(int mask) * logfile_init() - Open log file and write header with PID, version, path * @name: Identifier for header: passt or pasta * @path: Path to log file - * @size: Maximum size of log file: log_cut_size is calculatd here + * @size: Maximum size of log file: log_cut_size is calculated here */ void logfile_init(const char *name, const char *path, size_t size) { diff --git a/vhost_user.c b/vhost_user.c index 105f77a5df2b..ca36763cabaf 100644 --- a/vhost_user.c +++ b/vhost_user.c @@ -1021,7 +1021,7 @@ static bool vu_set_device_state_fd_exec(struct vu_dev *vdev, if (direction != VHOST_USER_TRANSFER_STATE_DIRECTION_SAVE && direction != VHOST_USER_TRANSFER_STATE_DIRECTION_LOAD) - die("Invalide device_state_fd direction: %d", direction); + die("Invalid device_state_fd direction: %d", direction); migrate_request(vdev->context, msg->fds[0], direction == VHOST_USER_TRANSFER_STATE_DIRECTION_LOAD); -- 2.49.0

2 1

[PATCH v3] test: Display count of skipped tests in status and summary
by Laurent Vivier 16 May '25

16 May '25

This commit enhances test reporting by tracking and displaying the number of skipped tests. The skipped test count is now visible in the tmux status bar during execution and included in the final test summary log. This provides a more complete overview of test suite results. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- Notes: v3: correcly generate exit code v2: add missing comma before SKIPPED in report log test/lib/term | 7 +++++-- test/run | 6 +++--- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/test/lib/term b/test/lib/term index ed690de82c20..089364c67f85 100755 --- a/test/lib/term +++ b/test/lib/term @@ -19,6 +19,7 @@ STATUS_FILE_INDEX=0 STATUS_COLS= STATUS_PASS=0 STATUS_FAIL=0 +STATUS_SKIPPED=0 PR_RED='\033[1;31m' PR_GREEN='\033[1;32m' @@ -439,19 +440,21 @@ info_layout() { # status_test_ok() - Update counter of passed tests, log and display message status_test_ok() { STATUS_PASS=$((STATUS_PASS + 1)) - tmux set status-right "PASS: ${STATUS_PASS} | FAIL: ${STATUS_FAIL} | #(TZ="UTC" date -Iseconds)" + tmux set status-right "PASS: ${STATUS_PASS} | FAIL: ${STATUS_FAIL} | SKIPPED: ${STATUS_SKIPPED} | #(TZ="UTC" date -Iseconds)" info_passed } # status_test_fail() - Update counter of failed tests, log and display message status_test_fail() { STATUS_FAIL=$((STATUS_FAIL + 1)) - tmux set status-right "PASS: ${STATUS_PASS} | FAIL: ${STATUS_FAIL} | #(TZ="UTC" date -Iseconds)" + tmux set status-right "PASS: ${STATUS_PASS} | FAIL: ${STATUS_FAIL} | SKIPPED: ${STATUS_SKIPPED} | #(TZ="UTC" date -Iseconds)" info_failed } # status_test_fail() - Update counter of failed tests, log and display message status_test_skip() { + STATUS_SKIPPED=$((STATUS_SKIPPED + 1)) + tmux set status-right "PASS: ${STATUS_PASS} | FAIL: ${STATUS_FAIL} | SKIPPED: ${STATUS_SKIPPED} | #(TZ="UTC" date -Iseconds)" info_skipped } diff --git a/test/run b/test/run index 4e86f30fb750..f73c31196558 100755 --- a/test/run +++ b/test/run @@ -202,7 +202,7 @@ skip_distro() { perf_finish [ ${CI} -eq 1 ] && video_stop - log "PASS: ${STATUS_PASS}, FAIL: ${STATUS_FAIL}" + log "PASS: ${STATUS_PASS}, FAIL: ${STATUS_FAIL}, SKIPPED: ${STATUS_SKIPPED}" pause_continue \ "Press any key to keep test session open" \ @@ -236,7 +236,7 @@ run_selected() { done teardown "${__setup}" - log "PASS: ${STATUS_PASS}, FAIL: ${STATUS_FAIL}" + log "PASS: ${STATUS_PASS}, FAIL: ${STATUS_FAIL}, SKIPPED: ${STATUS_SKIPPED}" pause_continue \ "Press any key to keep test session open" \ @@ -307,4 +307,4 @@ fi tail -n1 ${LOGFILE} echo "Log at ${LOGFILE}" -exit $(tail -n1 ${LOGFILE} | sed -n 's/.*FAIL: $.*$$/\1/p') +exit $(tail -n1 ${LOGFILE} | sed -n 's/.*FAIL: $.*$,.*$/\1/p') -- 2.49.0

2 1

[PATCH 0/4] Fedora 42: Static Analysis and Compiler Warning Fixes
by Laurent Vivier 14 May '25

14 May '25

This patch series addresses a collection of warnings and errors flagged by GCC and Clang's static analyzer across various modules. The fixes primarily involve clarifying code intent where warnings were false positives or applying specific attributes to suppress warnings for intentionally designed code constructs. The series consists of the following patches (in order of application): 1. **dhcpv6: fix GCC error (unterminated-string-initialization)** Silences GCC error for an intentionally non-NUL-terminated string. 2. **virtio: Fix Clang warning (bugprone-sizeof-expression, cert-arr39-c)** Justifies intentional `sizeof` usage in pointer arithmetic against Clang warnings. 3. **ndp: Fix Clang analyzer warning (clang-analyzer-security.PointerSub)** Clarifies pointer subtraction as a valid C idiom for struct offset calculation. 4. **flow: fix clang error (clang-analyzer-security.PointerSub)** Confirms pointers in `flow_idx()` reference the same array, validating subtraction. Laurent Vivier (4): dhcpv6: fix GCC error (unterminated-string-initialization) virtio: Fix Clang warning (bugprone-sizeof-expression, cert-arr39-c) ndp: Fix Clang analyzer warning (clang-analyzer-security.PointerSub) flow: Fix clang error (clang-analyzer-security.PointerSub) dhcpv6.c | 4 +++- flow_table.h | 1 + ndp.c | 1 + virtio.c | 1 + 4 files changed, 6 insertions(+), 1 deletion(-) -- 2.49.0

2 5