1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Landlock tests - Common user space base
4  *
5  * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>
6  * Copyright © 2019-2020 ANSSI
7  */
8 
9 #define _GNU_SOURCE
10 #include <errno.h>
11 #include <fcntl.h>
12 #include <linux/landlock.h>
13 #include <string.h>
14 #include <sys/prctl.h>
15 #include <sys/socket.h>
16 #include <sys/types.h>
17 
18 #include "common.h"
19 
20 #ifndef O_PATH
21 #define O_PATH		010000000
22 #endif
23 
24 TEST(inconsistent_attr) {
25 	const long page_size = sysconf(_SC_PAGESIZE);
26 	char *const buf = malloc(page_size + 1);
27 	struct landlock_ruleset_attr *const ruleset_attr = (void *)buf;
28 
29 	ASSERT_NE(NULL, buf);
30 
31 	/* Checks copy_from_user(). */
32 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 0, 0));
33 	/* The size if less than sizeof(struct landlock_attr_enforce). */
34 	ASSERT_EQ(EINVAL, errno);
35 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 1, 0));
36 	ASSERT_EQ(EINVAL, errno);
37 
38 	ASSERT_EQ(-1, landlock_create_ruleset(NULL, 1, 0));
39 	/* The size if less than sizeof(struct landlock_attr_enforce). */
40 	ASSERT_EQ(EFAULT, errno);
41 
42 	ASSERT_EQ(-1, landlock_create_ruleset(NULL,
43 				sizeof(struct landlock_ruleset_attr), 0));
44 	ASSERT_EQ(EFAULT, errno);
45 
46 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size + 1, 0));
47 	ASSERT_EQ(E2BIG, errno);
48 
49 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr,
50 				sizeof(struct landlock_ruleset_attr), 0));
51 	ASSERT_EQ(ENOMSG, errno);
52 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size, 0));
53 	ASSERT_EQ(ENOMSG, errno);
54 
55 	/* Checks non-zero value. */
56 	buf[page_size - 2] = '.';
57 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size, 0));
58 	ASSERT_EQ(E2BIG, errno);
59 
60 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size + 1, 0));
61 	ASSERT_EQ(E2BIG, errno);
62 
63 	free(buf);
64 }
65 
66 TEST(abi_version) {
67 	const struct landlock_ruleset_attr ruleset_attr = {
68 		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE,
69 	};
70 	ASSERT_EQ(1, landlock_create_ruleset(NULL, 0,
71 				LANDLOCK_CREATE_RULESET_VERSION));
72 
73 	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0,
74 				LANDLOCK_CREATE_RULESET_VERSION));
75 	ASSERT_EQ(EINVAL, errno);
76 
77 	ASSERT_EQ(-1, landlock_create_ruleset(NULL, sizeof(ruleset_attr),
78 				LANDLOCK_CREATE_RULESET_VERSION));
79 	ASSERT_EQ(EINVAL, errno);
80 
81 	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr,
82 				sizeof(ruleset_attr),
83 				LANDLOCK_CREATE_RULESET_VERSION));
84 	ASSERT_EQ(EINVAL, errno);
85 
86 	ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0,
87 				LANDLOCK_CREATE_RULESET_VERSION | 1 << 31));
88 	ASSERT_EQ(EINVAL, errno);
89 }
90 
91 TEST(inval_create_ruleset_flags) {
92 	const int last_flag = LANDLOCK_CREATE_RULESET_VERSION;
93 	const int invalid_flag = last_flag << 1;
94 	const struct landlock_ruleset_attr ruleset_attr = {
95 		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE,
96 	};
97 
98 	ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0, invalid_flag));
99 	ASSERT_EQ(EINVAL, errno);
100 
101 	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0, invalid_flag));
102 	ASSERT_EQ(EINVAL, errno);
103 
104 	ASSERT_EQ(-1, landlock_create_ruleset(NULL, sizeof(ruleset_attr),
105 				invalid_flag));
106 	ASSERT_EQ(EINVAL, errno);
107 
108 	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr,
109 				sizeof(ruleset_attr), invalid_flag));
110 	ASSERT_EQ(EINVAL, errno);
111 }
112 
113 TEST(empty_path_beneath_attr) {
114 	const struct landlock_ruleset_attr ruleset_attr = {
115 		.handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE,
116 	};
117 	const int ruleset_fd = landlock_create_ruleset(&ruleset_attr,
118 			sizeof(ruleset_attr), 0);
119 
120 	ASSERT_LE(0, ruleset_fd);
121 
122 	/* Similar to struct landlock_path_beneath_attr.parent_fd = 0 */
123 	ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
124 				NULL, 0));
125 	ASSERT_EQ(EFAULT, errno);
126 	ASSERT_EQ(0, close(ruleset_fd));
127 }
128 
129 TEST(inval_fd_enforce) {
130 	ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
131 
132 	ASSERT_EQ(-1, landlock_restrict_self(-1, 0));
133 	ASSERT_EQ(EBADF, errno);
134 }
135 
136 TEST(unpriv_enforce_without_no_new_privs) {
137 	int err;
138 
139 	drop_caps(_metadata);
140 	err = landlock_restrict_self(-1, 0);
141 	ASSERT_EQ(EPERM, errno);
142 	ASSERT_EQ(err, -1);
143 }
144 
145 TEST(ruleset_fd_io)
146 {
147 	struct landlock_ruleset_attr ruleset_attr = {
148 		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE,
149 	};
150 	int ruleset_fd;
151 	char buf;
152 
153 	drop_caps(_metadata);
154 	ruleset_fd = landlock_create_ruleset(&ruleset_attr,
155 			sizeof(ruleset_attr), 0);
156 	ASSERT_LE(0, ruleset_fd);
157 
158 	ASSERT_EQ(-1, write(ruleset_fd, ".", 1));
159 	ASSERT_EQ(EINVAL, errno);
160 	ASSERT_EQ(-1, read(ruleset_fd, &buf, 1));
161 	ASSERT_EQ(EINVAL, errno);
162 
163 	ASSERT_EQ(0, close(ruleset_fd));
164 }
165 
166 /* Tests enforcement of a ruleset FD transferred through a UNIX socket. */
167 TEST(ruleset_fd_transfer)
168 {
169 	struct landlock_ruleset_attr ruleset_attr = {
170 		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR,
171 	};
172 	struct landlock_path_beneath_attr path_beneath_attr = {
173 		.allowed_access = LANDLOCK_ACCESS_FS_READ_DIR,
174 	};
175 	int ruleset_fd_tx, dir_fd;
176 	union {
177 		/* Aligned ancillary data buffer. */
178 		char buf[CMSG_SPACE(sizeof(ruleset_fd_tx))];
179 		struct cmsghdr _align;
180 	} cmsg_tx = {};
181 	char data_tx = '.';
182 	struct iovec io = {
183 		.iov_base = &data_tx,
184 		.iov_len = sizeof(data_tx),
185 	};
186 	struct msghdr msg = {
187 		.msg_iov = &io,
188 		.msg_iovlen = 1,
189 		.msg_control = &cmsg_tx.buf,
190 		.msg_controllen = sizeof(cmsg_tx.buf),
191 	};
192 	struct cmsghdr *cmsg;
193 	int socket_fds[2];
194 	pid_t child;
195 	int status;
196 
197 	drop_caps(_metadata);
198 
199 	/* Creates a test ruleset with a simple rule. */
200 	ruleset_fd_tx = landlock_create_ruleset(&ruleset_attr,
201 			sizeof(ruleset_attr), 0);
202 	ASSERT_LE(0, ruleset_fd_tx);
203 	path_beneath_attr.parent_fd = open("/tmp", O_PATH | O_NOFOLLOW |
204 			O_DIRECTORY | O_CLOEXEC);
205 	ASSERT_LE(0, path_beneath_attr.parent_fd);
206 	ASSERT_EQ(0, landlock_add_rule(ruleset_fd_tx, LANDLOCK_RULE_PATH_BENEATH,
207 				&path_beneath_attr, 0));
208 	ASSERT_EQ(0, close(path_beneath_attr.parent_fd));
209 
210 	cmsg = CMSG_FIRSTHDR(&msg);
211 	ASSERT_NE(NULL, cmsg);
212 	cmsg->cmsg_len = CMSG_LEN(sizeof(ruleset_fd_tx));
213 	cmsg->cmsg_level = SOL_SOCKET;
214 	cmsg->cmsg_type = SCM_RIGHTS;
215 	memcpy(CMSG_DATA(cmsg), &ruleset_fd_tx, sizeof(ruleset_fd_tx));
216 
217 	/* Sends the ruleset FD over a socketpair and then close it. */
218 	ASSERT_EQ(0, socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0, socket_fds));
219 	ASSERT_EQ(sizeof(data_tx), sendmsg(socket_fds[0], &msg, 0));
220 	ASSERT_EQ(0, close(socket_fds[0]));
221 	ASSERT_EQ(0, close(ruleset_fd_tx));
222 
223 	child = fork();
224 	ASSERT_LE(0, child);
225 	if (child == 0) {
226 		int ruleset_fd_rx;
227 
228 		*(char *)msg.msg_iov->iov_base = '\0';
229 		ASSERT_EQ(sizeof(data_tx), recvmsg(socket_fds[1], &msg, MSG_CMSG_CLOEXEC));
230 		ASSERT_EQ('.', *(char *)msg.msg_iov->iov_base);
231 		ASSERT_EQ(0, close(socket_fds[1]));
232 		cmsg = CMSG_FIRSTHDR(&msg);
233 		ASSERT_EQ(cmsg->cmsg_len, CMSG_LEN(sizeof(ruleset_fd_tx)));
234 		memcpy(&ruleset_fd_rx, CMSG_DATA(cmsg), sizeof(ruleset_fd_tx));
235 
236 		/* Enforces the received ruleset on the child. */
237 		ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
238 		ASSERT_EQ(0, landlock_restrict_self(ruleset_fd_rx, 0));
239 		ASSERT_EQ(0, close(ruleset_fd_rx));
240 
241 		/* Checks that the ruleset enforcement. */
242 		ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
243 		ASSERT_EQ(EACCES, errno);
244 		dir_fd = open("/tmp", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
245 		ASSERT_LE(0, dir_fd);
246 		ASSERT_EQ(0, close(dir_fd));
247 		_exit(_metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);
248 		return;
249 	}
250 
251 	ASSERT_EQ(0, close(socket_fds[1]));
252 
253 	/* Checks that the parent is unrestricted. */
254 	dir_fd = open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
255 	ASSERT_LE(0, dir_fd);
256 	ASSERT_EQ(0, close(dir_fd));
257 	dir_fd = open("/tmp", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
258 	ASSERT_LE(0, dir_fd);
259 	ASSERT_EQ(0, close(dir_fd));
260 
261 	ASSERT_EQ(child, waitpid(child, &status, 0));
262 	ASSERT_EQ(1, WIFEXITED(status));
263 	ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
264 }
265 
266 TEST_HARNESS_MAIN
267