1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Landlock tests - Common user space base 4 * 5 * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> 6 * Copyright © 2019-2020 ANSSI 7 */ 8 9 #define _GNU_SOURCE 10 #include <errno.h> 11 #include <fcntl.h> 12 #include <linux/landlock.h> 13 #include <string.h> 14 #include <sys/prctl.h> 15 #include <sys/socket.h> 16 #include <sys/types.h> 17 18 #include "common.h" 19 20 #ifndef O_PATH 21 #define O_PATH 010000000 22 #endif 23 24 TEST(inconsistent_attr) 25 { 26 const long page_size = sysconf(_SC_PAGESIZE); 27 char *const buf = malloc(page_size + 1); 28 struct landlock_ruleset_attr *const ruleset_attr = (void *)buf; 29 30 ASSERT_NE(NULL, buf); 31 32 /* Checks copy_from_user(). */ 33 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 0, 0)); 34 /* The size if less than sizeof(struct landlock_attr_enforce). */ 35 ASSERT_EQ(EINVAL, errno); 36 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 1, 0)); 37 ASSERT_EQ(EINVAL, errno); 38 39 ASSERT_EQ(-1, landlock_create_ruleset(NULL, 1, 0)); 40 /* The size if less than sizeof(struct landlock_attr_enforce). */ 41 ASSERT_EQ(EFAULT, errno); 42 43 ASSERT_EQ(-1, landlock_create_ruleset( 44 NULL, sizeof(struct landlock_ruleset_attr), 0)); 45 ASSERT_EQ(EFAULT, errno); 46 47 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size + 1, 0)); 48 ASSERT_EQ(E2BIG, errno); 49 50 ASSERT_EQ(-1, landlock_create_ruleset( 51 ruleset_attr, 52 sizeof(struct landlock_ruleset_attr), 0)); 53 ASSERT_EQ(ENOMSG, errno); 54 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size, 0)); 55 ASSERT_EQ(ENOMSG, errno); 56 57 /* Checks non-zero value. */ 58 buf[page_size - 2] = '.'; 59 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size, 0)); 60 ASSERT_EQ(E2BIG, errno); 61 62 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size + 1, 0)); 63 ASSERT_EQ(E2BIG, errno); 64 65 free(buf); 66 } 67 68 TEST(abi_version) 69 { 70 const struct landlock_ruleset_attr ruleset_attr = { 71 .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE, 72 }; 73 ASSERT_EQ(1, landlock_create_ruleset(NULL, 0, 74 LANDLOCK_CREATE_RULESET_VERSION)); 75 76 ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0, 77 LANDLOCK_CREATE_RULESET_VERSION)); 78 ASSERT_EQ(EINVAL, errno); 79 80 ASSERT_EQ(-1, landlock_create_ruleset(NULL, sizeof(ruleset_attr), 81 LANDLOCK_CREATE_RULESET_VERSION)); 82 ASSERT_EQ(EINVAL, errno); 83 84 ASSERT_EQ(-1, 85 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 86 LANDLOCK_CREATE_RULESET_VERSION)); 87 ASSERT_EQ(EINVAL, errno); 88 89 ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0, 90 LANDLOCK_CREATE_RULESET_VERSION | 91 1 << 31)); 92 ASSERT_EQ(EINVAL, errno); 93 } 94 95 TEST(inval_create_ruleset_flags) 96 { 97 const int last_flag = LANDLOCK_CREATE_RULESET_VERSION; 98 const int invalid_flag = last_flag << 1; 99 const struct landlock_ruleset_attr ruleset_attr = { 100 .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE, 101 }; 102 103 ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0, invalid_flag)); 104 ASSERT_EQ(EINVAL, errno); 105 106 ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0, invalid_flag)); 107 ASSERT_EQ(EINVAL, errno); 108 109 ASSERT_EQ(-1, landlock_create_ruleset(NULL, sizeof(ruleset_attr), 110 invalid_flag)); 111 ASSERT_EQ(EINVAL, errno); 112 113 ASSERT_EQ(-1, 114 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 115 invalid_flag)); 116 ASSERT_EQ(EINVAL, errno); 117 } 118 119 TEST(empty_path_beneath_attr) 120 { 121 const struct landlock_ruleset_attr ruleset_attr = { 122 .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE, 123 }; 124 const int ruleset_fd = 125 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); 126 127 ASSERT_LE(0, ruleset_fd); 128 129 /* Similar to struct landlock_path_beneath_attr.parent_fd = 0 */ 130 ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, 131 NULL, 0)); 132 ASSERT_EQ(EFAULT, errno); 133 ASSERT_EQ(0, close(ruleset_fd)); 134 } 135 136 TEST(inval_fd_enforce) 137 { 138 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); 139 140 ASSERT_EQ(-1, landlock_restrict_self(-1, 0)); 141 ASSERT_EQ(EBADF, errno); 142 } 143 144 TEST(unpriv_enforce_without_no_new_privs) 145 { 146 int err; 147 148 drop_caps(_metadata); 149 err = landlock_restrict_self(-1, 0); 150 ASSERT_EQ(EPERM, errno); 151 ASSERT_EQ(err, -1); 152 } 153 154 TEST(ruleset_fd_io) 155 { 156 struct landlock_ruleset_attr ruleset_attr = { 157 .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE, 158 }; 159 int ruleset_fd; 160 char buf; 161 162 drop_caps(_metadata); 163 ruleset_fd = 164 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); 165 ASSERT_LE(0, ruleset_fd); 166 167 ASSERT_EQ(-1, write(ruleset_fd, ".", 1)); 168 ASSERT_EQ(EINVAL, errno); 169 ASSERT_EQ(-1, read(ruleset_fd, &buf, 1)); 170 ASSERT_EQ(EINVAL, errno); 171 172 ASSERT_EQ(0, close(ruleset_fd)); 173 } 174 175 /* Tests enforcement of a ruleset FD transferred through a UNIX socket. */ 176 TEST(ruleset_fd_transfer) 177 { 178 struct landlock_ruleset_attr ruleset_attr = { 179 .handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR, 180 }; 181 struct landlock_path_beneath_attr path_beneath_attr = { 182 .allowed_access = LANDLOCK_ACCESS_FS_READ_DIR, 183 }; 184 int ruleset_fd_tx, dir_fd; 185 union { 186 /* Aligned ancillary data buffer. */ 187 char buf[CMSG_SPACE(sizeof(ruleset_fd_tx))]; 188 struct cmsghdr _align; 189 } cmsg_tx = {}; 190 char data_tx = '.'; 191 struct iovec io = { 192 .iov_base = &data_tx, 193 .iov_len = sizeof(data_tx), 194 }; 195 struct msghdr msg = { 196 .msg_iov = &io, 197 .msg_iovlen = 1, 198 .msg_control = &cmsg_tx.buf, 199 .msg_controllen = sizeof(cmsg_tx.buf), 200 }; 201 struct cmsghdr *cmsg; 202 int socket_fds[2]; 203 pid_t child; 204 int status; 205 206 drop_caps(_metadata); 207 208 /* Creates a test ruleset with a simple rule. */ 209 ruleset_fd_tx = 210 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); 211 ASSERT_LE(0, ruleset_fd_tx); 212 path_beneath_attr.parent_fd = 213 open("/tmp", O_PATH | O_NOFOLLOW | O_DIRECTORY | O_CLOEXEC); 214 ASSERT_LE(0, path_beneath_attr.parent_fd); 215 ASSERT_EQ(0, 216 landlock_add_rule(ruleset_fd_tx, LANDLOCK_RULE_PATH_BENEATH, 217 &path_beneath_attr, 0)); 218 ASSERT_EQ(0, close(path_beneath_attr.parent_fd)); 219 220 cmsg = CMSG_FIRSTHDR(&msg); 221 ASSERT_NE(NULL, cmsg); 222 cmsg->cmsg_len = CMSG_LEN(sizeof(ruleset_fd_tx)); 223 cmsg->cmsg_level = SOL_SOCKET; 224 cmsg->cmsg_type = SCM_RIGHTS; 225 memcpy(CMSG_DATA(cmsg), &ruleset_fd_tx, sizeof(ruleset_fd_tx)); 226 227 /* Sends the ruleset FD over a socketpair and then close it. */ 228 ASSERT_EQ(0, socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0, 229 socket_fds)); 230 ASSERT_EQ(sizeof(data_tx), sendmsg(socket_fds[0], &msg, 0)); 231 ASSERT_EQ(0, close(socket_fds[0])); 232 ASSERT_EQ(0, close(ruleset_fd_tx)); 233 234 child = fork(); 235 ASSERT_LE(0, child); 236 if (child == 0) { 237 int ruleset_fd_rx; 238 239 *(char *)msg.msg_iov->iov_base = '\0'; 240 ASSERT_EQ(sizeof(data_tx), 241 recvmsg(socket_fds[1], &msg, MSG_CMSG_CLOEXEC)); 242 ASSERT_EQ('.', *(char *)msg.msg_iov->iov_base); 243 ASSERT_EQ(0, close(socket_fds[1])); 244 cmsg = CMSG_FIRSTHDR(&msg); 245 ASSERT_EQ(cmsg->cmsg_len, CMSG_LEN(sizeof(ruleset_fd_tx))); 246 memcpy(&ruleset_fd_rx, CMSG_DATA(cmsg), sizeof(ruleset_fd_tx)); 247 248 /* Enforces the received ruleset on the child. */ 249 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); 250 ASSERT_EQ(0, landlock_restrict_self(ruleset_fd_rx, 0)); 251 ASSERT_EQ(0, close(ruleset_fd_rx)); 252 253 /* Checks that the ruleset enforcement. */ 254 ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)); 255 ASSERT_EQ(EACCES, errno); 256 dir_fd = open("/tmp", O_RDONLY | O_DIRECTORY | O_CLOEXEC); 257 ASSERT_LE(0, dir_fd); 258 ASSERT_EQ(0, close(dir_fd)); 259 _exit(_metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE); 260 return; 261 } 262 263 ASSERT_EQ(0, close(socket_fds[1])); 264 265 /* Checks that the parent is unrestricted. */ 266 dir_fd = open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC); 267 ASSERT_LE(0, dir_fd); 268 ASSERT_EQ(0, close(dir_fd)); 269 dir_fd = open("/tmp", O_RDONLY | O_DIRECTORY | O_CLOEXEC); 270 ASSERT_LE(0, dir_fd); 271 ASSERT_EQ(0, close(dir_fd)); 272 273 ASSERT_EQ(child, waitpid(child, &status, 0)); 274 ASSERT_EQ(1, WIFEXITED(status)); 275 ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); 276 } 277 278 TEST_HARNESS_MAIN 279