1e1199815SMickaël Salaün // SPDX-License-Identifier: GPL-2.0 2e1199815SMickaël Salaün /* 3e1199815SMickaël Salaün * Landlock tests - Common user space base 4e1199815SMickaël Salaün * 5e1199815SMickaël Salaün * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> 6e1199815SMickaël Salaün * Copyright © 2019-2020 ANSSI 7e1199815SMickaël Salaün */ 8e1199815SMickaël Salaün 9e1199815SMickaël Salaün #define _GNU_SOURCE 10e1199815SMickaël Salaün #include <errno.h> 11e1199815SMickaël Salaün #include <fcntl.h> 12e1199815SMickaël Salaün #include <linux/landlock.h> 13e1199815SMickaël Salaün #include <string.h> 14e1199815SMickaël Salaün #include <sys/prctl.h> 15e1199815SMickaël Salaün #include <sys/socket.h> 16e1199815SMickaël Salaün #include <sys/types.h> 17e1199815SMickaël Salaün 18e1199815SMickaël Salaün #include "common.h" 19e1199815SMickaël Salaün 20e1199815SMickaël Salaün #ifndef O_PATH 21e1199815SMickaël Salaün #define O_PATH 010000000 22e1199815SMickaël Salaün #endif 23e1199815SMickaël Salaün 24e1199815SMickaël Salaün TEST(inconsistent_attr) { 25e1199815SMickaël Salaün const long page_size = sysconf(_SC_PAGESIZE); 26e1199815SMickaël Salaün char *const buf = malloc(page_size + 1); 27e1199815SMickaël Salaün struct landlock_ruleset_attr *const ruleset_attr = (void *)buf; 28e1199815SMickaël Salaün 29e1199815SMickaël Salaün ASSERT_NE(NULL, buf); 30e1199815SMickaël Salaün 31e1199815SMickaël Salaün /* Checks copy_from_user(). */ 32e1199815SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 0, 0)); 33e1199815SMickaël Salaün /* The size if less than sizeof(struct landlock_attr_enforce). */ 34e1199815SMickaël Salaün ASSERT_EQ(EINVAL, errno); 35e1199815SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 1, 0)); 36e1199815SMickaël Salaün ASSERT_EQ(EINVAL, errno); 37e1199815SMickaël Salaün 38e1199815SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(NULL, 1, 0)); 39e1199815SMickaël Salaün /* The size if less than sizeof(struct landlock_attr_enforce). */ 40e1199815SMickaël Salaün ASSERT_EQ(EFAULT, errno); 41e1199815SMickaël Salaün 42e1199815SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(NULL, 43e1199815SMickaël Salaün sizeof(struct landlock_ruleset_attr), 0)); 44e1199815SMickaël Salaün ASSERT_EQ(EFAULT, errno); 45e1199815SMickaël Salaün 46e1199815SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size + 1, 0)); 47e1199815SMickaël Salaün ASSERT_EQ(E2BIG, errno); 48e1199815SMickaël Salaün 49e1199815SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 50e1199815SMickaël Salaün sizeof(struct landlock_ruleset_attr), 0)); 51e1199815SMickaël Salaün ASSERT_EQ(ENOMSG, errno); 52e1199815SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size, 0)); 53e1199815SMickaël Salaün ASSERT_EQ(ENOMSG, errno); 54e1199815SMickaël Salaün 55e1199815SMickaël Salaün /* Checks non-zero value. */ 56e1199815SMickaël Salaün buf[page_size - 2] = '.'; 57e1199815SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size, 0)); 58e1199815SMickaël Salaün ASSERT_EQ(E2BIG, errno); 59e1199815SMickaël Salaün 60e1199815SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size + 1, 0)); 61e1199815SMickaël Salaün ASSERT_EQ(E2BIG, errno); 62e1199815SMickaël Salaün 63e1199815SMickaël Salaün free(buf); 64e1199815SMickaël Salaün } 65e1199815SMickaël Salaün 66*3532b0b4SMickaël Salaün TEST(abi_version) { 67*3532b0b4SMickaël Salaün const struct landlock_ruleset_attr ruleset_attr = { 68*3532b0b4SMickaël Salaün .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE, 69*3532b0b4SMickaël Salaün }; 70*3532b0b4SMickaël Salaün ASSERT_EQ(1, landlock_create_ruleset(NULL, 0, 71*3532b0b4SMickaël Salaün LANDLOCK_CREATE_RULESET_VERSION)); 72*3532b0b4SMickaël Salaün 73*3532b0b4SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0, 74*3532b0b4SMickaël Salaün LANDLOCK_CREATE_RULESET_VERSION)); 75*3532b0b4SMickaël Salaün ASSERT_EQ(EINVAL, errno); 76*3532b0b4SMickaël Salaün 77*3532b0b4SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(NULL, sizeof(ruleset_attr), 78*3532b0b4SMickaël Salaün LANDLOCK_CREATE_RULESET_VERSION)); 79*3532b0b4SMickaël Salaün ASSERT_EQ(EINVAL, errno); 80*3532b0b4SMickaël Salaün 81*3532b0b4SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 82*3532b0b4SMickaël Salaün sizeof(ruleset_attr), 83*3532b0b4SMickaël Salaün LANDLOCK_CREATE_RULESET_VERSION)); 84*3532b0b4SMickaël Salaün ASSERT_EQ(EINVAL, errno); 85*3532b0b4SMickaël Salaün 86*3532b0b4SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0, 87*3532b0b4SMickaël Salaün LANDLOCK_CREATE_RULESET_VERSION | 1 << 31)); 88*3532b0b4SMickaël Salaün ASSERT_EQ(EINVAL, errno); 89*3532b0b4SMickaël Salaün } 90*3532b0b4SMickaël Salaün 91*3532b0b4SMickaël Salaün TEST(inval_create_ruleset_flags) { 92*3532b0b4SMickaël Salaün const int last_flag = LANDLOCK_CREATE_RULESET_VERSION; 93*3532b0b4SMickaël Salaün const int invalid_flag = last_flag << 1; 94*3532b0b4SMickaël Salaün const struct landlock_ruleset_attr ruleset_attr = { 95*3532b0b4SMickaël Salaün .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE, 96*3532b0b4SMickaël Salaün }; 97*3532b0b4SMickaël Salaün 98*3532b0b4SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0, invalid_flag)); 99*3532b0b4SMickaël Salaün ASSERT_EQ(EINVAL, errno); 100*3532b0b4SMickaël Salaün 101*3532b0b4SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0, invalid_flag)); 102*3532b0b4SMickaël Salaün ASSERT_EQ(EINVAL, errno); 103*3532b0b4SMickaël Salaün 104*3532b0b4SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(NULL, sizeof(ruleset_attr), 105*3532b0b4SMickaël Salaün invalid_flag)); 106*3532b0b4SMickaël Salaün ASSERT_EQ(EINVAL, errno); 107*3532b0b4SMickaël Salaün 108*3532b0b4SMickaël Salaün ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 109*3532b0b4SMickaël Salaün sizeof(ruleset_attr), invalid_flag)); 110*3532b0b4SMickaël Salaün ASSERT_EQ(EINVAL, errno); 111*3532b0b4SMickaël Salaün } 112*3532b0b4SMickaël Salaün 113e1199815SMickaël Salaün TEST(empty_path_beneath_attr) { 114e1199815SMickaël Salaün const struct landlock_ruleset_attr ruleset_attr = { 115e1199815SMickaël Salaün .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE, 116e1199815SMickaël Salaün }; 117e1199815SMickaël Salaün const int ruleset_fd = landlock_create_ruleset(&ruleset_attr, 118e1199815SMickaël Salaün sizeof(ruleset_attr), 0); 119e1199815SMickaël Salaün 120e1199815SMickaël Salaün ASSERT_LE(0, ruleset_fd); 121e1199815SMickaël Salaün 122e1199815SMickaël Salaün /* Similar to struct landlock_path_beneath_attr.parent_fd = 0 */ 123e1199815SMickaël Salaün ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, 124e1199815SMickaël Salaün NULL, 0)); 125e1199815SMickaël Salaün ASSERT_EQ(EFAULT, errno); 126e1199815SMickaël Salaün ASSERT_EQ(0, close(ruleset_fd)); 127e1199815SMickaël Salaün } 128e1199815SMickaël Salaün 129e1199815SMickaël Salaün TEST(inval_fd_enforce) { 130e1199815SMickaël Salaün ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); 131e1199815SMickaël Salaün 132e1199815SMickaël Salaün ASSERT_EQ(-1, landlock_restrict_self(-1, 0)); 133e1199815SMickaël Salaün ASSERT_EQ(EBADF, errno); 134e1199815SMickaël Salaün } 135e1199815SMickaël Salaün 136e1199815SMickaël Salaün TEST(unpriv_enforce_without_no_new_privs) { 137e1199815SMickaël Salaün int err; 138e1199815SMickaël Salaün 139e1199815SMickaël Salaün drop_caps(_metadata); 140e1199815SMickaël Salaün err = landlock_restrict_self(-1, 0); 141e1199815SMickaël Salaün ASSERT_EQ(EPERM, errno); 142e1199815SMickaël Salaün ASSERT_EQ(err, -1); 143e1199815SMickaël Salaün } 144e1199815SMickaël Salaün 145e1199815SMickaël Salaün TEST(ruleset_fd_io) 146e1199815SMickaël Salaün { 147e1199815SMickaël Salaün struct landlock_ruleset_attr ruleset_attr = { 148e1199815SMickaël Salaün .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE, 149e1199815SMickaël Salaün }; 150e1199815SMickaël Salaün int ruleset_fd; 151e1199815SMickaël Salaün char buf; 152e1199815SMickaël Salaün 153e1199815SMickaël Salaün drop_caps(_metadata); 154e1199815SMickaël Salaün ruleset_fd = landlock_create_ruleset(&ruleset_attr, 155e1199815SMickaël Salaün sizeof(ruleset_attr), 0); 156e1199815SMickaël Salaün ASSERT_LE(0, ruleset_fd); 157e1199815SMickaël Salaün 158e1199815SMickaël Salaün ASSERT_EQ(-1, write(ruleset_fd, ".", 1)); 159e1199815SMickaël Salaün ASSERT_EQ(EINVAL, errno); 160e1199815SMickaël Salaün ASSERT_EQ(-1, read(ruleset_fd, &buf, 1)); 161e1199815SMickaël Salaün ASSERT_EQ(EINVAL, errno); 162e1199815SMickaël Salaün 163e1199815SMickaël Salaün ASSERT_EQ(0, close(ruleset_fd)); 164e1199815SMickaël Salaün } 165e1199815SMickaël Salaün 166e1199815SMickaël Salaün /* Tests enforcement of a ruleset FD transferred through a UNIX socket. */ 167e1199815SMickaël Salaün TEST(ruleset_fd_transfer) 168e1199815SMickaël Salaün { 169e1199815SMickaël Salaün struct landlock_ruleset_attr ruleset_attr = { 170e1199815SMickaël Salaün .handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR, 171e1199815SMickaël Salaün }; 172e1199815SMickaël Salaün struct landlock_path_beneath_attr path_beneath_attr = { 173e1199815SMickaël Salaün .allowed_access = LANDLOCK_ACCESS_FS_READ_DIR, 174e1199815SMickaël Salaün }; 175e1199815SMickaël Salaün int ruleset_fd_tx, dir_fd; 176e1199815SMickaël Salaün union { 177e1199815SMickaël Salaün /* Aligned ancillary data buffer. */ 178e1199815SMickaël Salaün char buf[CMSG_SPACE(sizeof(ruleset_fd_tx))]; 179e1199815SMickaël Salaün struct cmsghdr _align; 180e1199815SMickaël Salaün } cmsg_tx = {}; 181e1199815SMickaël Salaün char data_tx = '.'; 182e1199815SMickaël Salaün struct iovec io = { 183e1199815SMickaël Salaün .iov_base = &data_tx, 184e1199815SMickaël Salaün .iov_len = sizeof(data_tx), 185e1199815SMickaël Salaün }; 186e1199815SMickaël Salaün struct msghdr msg = { 187e1199815SMickaël Salaün .msg_iov = &io, 188e1199815SMickaël Salaün .msg_iovlen = 1, 189e1199815SMickaël Salaün .msg_control = &cmsg_tx.buf, 190e1199815SMickaël Salaün .msg_controllen = sizeof(cmsg_tx.buf), 191e1199815SMickaël Salaün }; 192e1199815SMickaël Salaün struct cmsghdr *cmsg; 193e1199815SMickaël Salaün int socket_fds[2]; 194e1199815SMickaël Salaün pid_t child; 195e1199815SMickaël Salaün int status; 196e1199815SMickaël Salaün 197e1199815SMickaël Salaün drop_caps(_metadata); 198e1199815SMickaël Salaün 199e1199815SMickaël Salaün /* Creates a test ruleset with a simple rule. */ 200e1199815SMickaël Salaün ruleset_fd_tx = landlock_create_ruleset(&ruleset_attr, 201e1199815SMickaël Salaün sizeof(ruleset_attr), 0); 202e1199815SMickaël Salaün ASSERT_LE(0, ruleset_fd_tx); 203e1199815SMickaël Salaün path_beneath_attr.parent_fd = open("/tmp", O_PATH | O_NOFOLLOW | 204e1199815SMickaël Salaün O_DIRECTORY | O_CLOEXEC); 205e1199815SMickaël Salaün ASSERT_LE(0, path_beneath_attr.parent_fd); 206e1199815SMickaël Salaün ASSERT_EQ(0, landlock_add_rule(ruleset_fd_tx, LANDLOCK_RULE_PATH_BENEATH, 207e1199815SMickaël Salaün &path_beneath_attr, 0)); 208e1199815SMickaël Salaün ASSERT_EQ(0, close(path_beneath_attr.parent_fd)); 209e1199815SMickaël Salaün 210e1199815SMickaël Salaün cmsg = CMSG_FIRSTHDR(&msg); 211e1199815SMickaël Salaün ASSERT_NE(NULL, cmsg); 212e1199815SMickaël Salaün cmsg->cmsg_len = CMSG_LEN(sizeof(ruleset_fd_tx)); 213e1199815SMickaël Salaün cmsg->cmsg_level = SOL_SOCKET; 214e1199815SMickaël Salaün cmsg->cmsg_type = SCM_RIGHTS; 215e1199815SMickaël Salaün memcpy(CMSG_DATA(cmsg), &ruleset_fd_tx, sizeof(ruleset_fd_tx)); 216e1199815SMickaël Salaün 217e1199815SMickaël Salaün /* Sends the ruleset FD over a socketpair and then close it. */ 218e1199815SMickaël Salaün ASSERT_EQ(0, socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0, socket_fds)); 219e1199815SMickaël Salaün ASSERT_EQ(sizeof(data_tx), sendmsg(socket_fds[0], &msg, 0)); 220e1199815SMickaël Salaün ASSERT_EQ(0, close(socket_fds[0])); 221e1199815SMickaël Salaün ASSERT_EQ(0, close(ruleset_fd_tx)); 222e1199815SMickaël Salaün 223e1199815SMickaël Salaün child = fork(); 224e1199815SMickaël Salaün ASSERT_LE(0, child); 225e1199815SMickaël Salaün if (child == 0) { 226e1199815SMickaël Salaün int ruleset_fd_rx; 227e1199815SMickaël Salaün 228e1199815SMickaël Salaün *(char *)msg.msg_iov->iov_base = '\0'; 229e1199815SMickaël Salaün ASSERT_EQ(sizeof(data_tx), recvmsg(socket_fds[1], &msg, MSG_CMSG_CLOEXEC)); 230e1199815SMickaël Salaün ASSERT_EQ('.', *(char *)msg.msg_iov->iov_base); 231e1199815SMickaël Salaün ASSERT_EQ(0, close(socket_fds[1])); 232e1199815SMickaël Salaün cmsg = CMSG_FIRSTHDR(&msg); 233e1199815SMickaël Salaün ASSERT_EQ(cmsg->cmsg_len, CMSG_LEN(sizeof(ruleset_fd_tx))); 234e1199815SMickaël Salaün memcpy(&ruleset_fd_rx, CMSG_DATA(cmsg), sizeof(ruleset_fd_tx)); 235e1199815SMickaël Salaün 236e1199815SMickaël Salaün /* Enforces the received ruleset on the child. */ 237e1199815SMickaël Salaün ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); 238e1199815SMickaël Salaün ASSERT_EQ(0, landlock_restrict_self(ruleset_fd_rx, 0)); 239e1199815SMickaël Salaün ASSERT_EQ(0, close(ruleset_fd_rx)); 240e1199815SMickaël Salaün 241e1199815SMickaël Salaün /* Checks that the ruleset enforcement. */ 242e1199815SMickaël Salaün ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)); 243e1199815SMickaël Salaün ASSERT_EQ(EACCES, errno); 244e1199815SMickaël Salaün dir_fd = open("/tmp", O_RDONLY | O_DIRECTORY | O_CLOEXEC); 245e1199815SMickaël Salaün ASSERT_LE(0, dir_fd); 246e1199815SMickaël Salaün ASSERT_EQ(0, close(dir_fd)); 247e1199815SMickaël Salaün _exit(_metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE); 248e1199815SMickaël Salaün return; 249e1199815SMickaël Salaün } 250e1199815SMickaël Salaün 251e1199815SMickaël Salaün ASSERT_EQ(0, close(socket_fds[1])); 252e1199815SMickaël Salaün 253e1199815SMickaël Salaün /* Checks that the parent is unrestricted. */ 254e1199815SMickaël Salaün dir_fd = open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC); 255e1199815SMickaël Salaün ASSERT_LE(0, dir_fd); 256e1199815SMickaël Salaün ASSERT_EQ(0, close(dir_fd)); 257e1199815SMickaël Salaün dir_fd = open("/tmp", O_RDONLY | O_DIRECTORY | O_CLOEXEC); 258e1199815SMickaël Salaün ASSERT_LE(0, dir_fd); 259e1199815SMickaël Salaün ASSERT_EQ(0, close(dir_fd)); 260e1199815SMickaël Salaün 261e1199815SMickaël Salaün ASSERT_EQ(child, waitpid(child, &status, 0)); 262e1199815SMickaël Salaün ASSERT_EQ(1, WIFEXITED(status)); 263e1199815SMickaël Salaün ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); 264e1199815SMickaël Salaün } 265e1199815SMickaël Salaün 266e1199815SMickaël Salaün TEST_HARNESS_MAIN 267