1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Landlock tests - Common user space base 4 * 5 * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> 6 * Copyright © 2019-2020 ANSSI 7 */ 8 9 #define _GNU_SOURCE 10 #include <errno.h> 11 #include <fcntl.h> 12 #include <linux/landlock.h> 13 #include <string.h> 14 #include <sys/prctl.h> 15 #include <sys/socket.h> 16 #include <sys/types.h> 17 18 #include "common.h" 19 20 #ifndef O_PATH 21 #define O_PATH 010000000 22 #endif 23 24 TEST(inconsistent_attr) 25 { 26 const long page_size = sysconf(_SC_PAGESIZE); 27 char *const buf = malloc(page_size + 1); 28 struct landlock_ruleset_attr *const ruleset_attr = (void *)buf; 29 30 ASSERT_NE(NULL, buf); 31 32 /* Checks copy_from_user(). */ 33 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 0, 0)); 34 /* The size if less than sizeof(struct landlock_attr_enforce). */ 35 ASSERT_EQ(EINVAL, errno); 36 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 1, 0)); 37 ASSERT_EQ(EINVAL, errno); 38 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 7, 0)); 39 ASSERT_EQ(EINVAL, errno); 40 41 ASSERT_EQ(-1, landlock_create_ruleset(NULL, 1, 0)); 42 /* The size if less than sizeof(struct landlock_attr_enforce). */ 43 ASSERT_EQ(EFAULT, errno); 44 45 ASSERT_EQ(-1, landlock_create_ruleset( 46 NULL, sizeof(struct landlock_ruleset_attr), 0)); 47 ASSERT_EQ(EFAULT, errno); 48 49 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size + 1, 0)); 50 ASSERT_EQ(E2BIG, errno); 51 52 /* Checks minimal valid attribute size. */ 53 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 8, 0)); 54 ASSERT_EQ(ENOMSG, errno); 55 ASSERT_EQ(-1, landlock_create_ruleset( 56 ruleset_attr, 57 sizeof(struct landlock_ruleset_attr), 0)); 58 ASSERT_EQ(ENOMSG, errno); 59 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size, 0)); 60 ASSERT_EQ(ENOMSG, errno); 61 62 /* Checks non-zero value. */ 63 buf[page_size - 2] = '.'; 64 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size, 0)); 65 ASSERT_EQ(E2BIG, errno); 66 67 ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size + 1, 0)); 68 ASSERT_EQ(E2BIG, errno); 69 70 free(buf); 71 } 72 73 TEST(abi_version) 74 { 75 const struct landlock_ruleset_attr ruleset_attr = { 76 .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE, 77 }; 78 ASSERT_EQ(1, landlock_create_ruleset(NULL, 0, 79 LANDLOCK_CREATE_RULESET_VERSION)); 80 81 ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0, 82 LANDLOCK_CREATE_RULESET_VERSION)); 83 ASSERT_EQ(EINVAL, errno); 84 85 ASSERT_EQ(-1, landlock_create_ruleset(NULL, sizeof(ruleset_attr), 86 LANDLOCK_CREATE_RULESET_VERSION)); 87 ASSERT_EQ(EINVAL, errno); 88 89 ASSERT_EQ(-1, 90 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 91 LANDLOCK_CREATE_RULESET_VERSION)); 92 ASSERT_EQ(EINVAL, errno); 93 94 ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0, 95 LANDLOCK_CREATE_RULESET_VERSION | 96 1 << 31)); 97 ASSERT_EQ(EINVAL, errno); 98 } 99 100 TEST(inval_create_ruleset_flags) 101 { 102 const int last_flag = LANDLOCK_CREATE_RULESET_VERSION; 103 const int invalid_flag = last_flag << 1; 104 const struct landlock_ruleset_attr ruleset_attr = { 105 .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE, 106 }; 107 108 ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0, invalid_flag)); 109 ASSERT_EQ(EINVAL, errno); 110 111 ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0, invalid_flag)); 112 ASSERT_EQ(EINVAL, errno); 113 114 ASSERT_EQ(-1, landlock_create_ruleset(NULL, sizeof(ruleset_attr), 115 invalid_flag)); 116 ASSERT_EQ(EINVAL, errno); 117 118 ASSERT_EQ(-1, 119 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 120 invalid_flag)); 121 ASSERT_EQ(EINVAL, errno); 122 } 123 124 /* Tests ordering of syscall argument checks. */ 125 TEST(add_rule_checks_ordering) 126 { 127 const struct landlock_ruleset_attr ruleset_attr = { 128 .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE, 129 }; 130 struct landlock_path_beneath_attr path_beneath_attr = { 131 .allowed_access = LANDLOCK_ACCESS_FS_EXECUTE, 132 .parent_fd = -1, 133 }; 134 const int ruleset_fd = 135 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); 136 137 ASSERT_LE(0, ruleset_fd); 138 139 /* Checks invalid flags. */ 140 ASSERT_EQ(-1, landlock_add_rule(-1, 0, NULL, 1)); 141 ASSERT_EQ(EINVAL, errno); 142 143 /* Checks invalid ruleset FD. */ 144 ASSERT_EQ(-1, landlock_add_rule(-1, 0, NULL, 0)); 145 ASSERT_EQ(EBADF, errno); 146 147 /* Checks invalid rule type. */ 148 ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, 0, NULL, 0)); 149 ASSERT_EQ(EINVAL, errno); 150 151 /* Checks invalid rule attr. */ 152 ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, 153 NULL, 0)); 154 ASSERT_EQ(EFAULT, errno); 155 156 /* Checks invalid path_beneath.parent_fd. */ 157 ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, 158 &path_beneath_attr, 0)); 159 ASSERT_EQ(EBADF, errno); 160 161 /* Checks valid call. */ 162 path_beneath_attr.parent_fd = 163 open("/tmp", O_PATH | O_NOFOLLOW | O_DIRECTORY | O_CLOEXEC); 164 ASSERT_LE(0, path_beneath_attr.parent_fd); 165 ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, 166 &path_beneath_attr, 0)); 167 ASSERT_EQ(0, close(path_beneath_attr.parent_fd)); 168 ASSERT_EQ(0, close(ruleset_fd)); 169 } 170 171 /* Tests ordering of syscall argument and permission checks. */ 172 TEST(restrict_self_checks_ordering) 173 { 174 const struct landlock_ruleset_attr ruleset_attr = { 175 .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE, 176 }; 177 struct landlock_path_beneath_attr path_beneath_attr = { 178 .allowed_access = LANDLOCK_ACCESS_FS_EXECUTE, 179 .parent_fd = -1, 180 }; 181 const int ruleset_fd = 182 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); 183 184 ASSERT_LE(0, ruleset_fd); 185 path_beneath_attr.parent_fd = 186 open("/tmp", O_PATH | O_NOFOLLOW | O_DIRECTORY | O_CLOEXEC); 187 ASSERT_LE(0, path_beneath_attr.parent_fd); 188 ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, 189 &path_beneath_attr, 0)); 190 ASSERT_EQ(0, close(path_beneath_attr.parent_fd)); 191 192 /* Checks unprivileged enforcement without no_new_privs. */ 193 drop_caps(_metadata); 194 ASSERT_EQ(-1, landlock_restrict_self(-1, -1)); 195 ASSERT_EQ(EPERM, errno); 196 ASSERT_EQ(-1, landlock_restrict_self(-1, 0)); 197 ASSERT_EQ(EPERM, errno); 198 ASSERT_EQ(-1, landlock_restrict_self(ruleset_fd, 0)); 199 ASSERT_EQ(EPERM, errno); 200 201 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); 202 203 /* Checks invalid flags. */ 204 ASSERT_EQ(-1, landlock_restrict_self(-1, -1)); 205 ASSERT_EQ(EINVAL, errno); 206 207 /* Checks invalid ruleset FD. */ 208 ASSERT_EQ(-1, landlock_restrict_self(-1, 0)); 209 ASSERT_EQ(EBADF, errno); 210 211 /* Checks valid call. */ 212 ASSERT_EQ(0, landlock_restrict_self(ruleset_fd, 0)); 213 ASSERT_EQ(0, close(ruleset_fd)); 214 } 215 216 TEST(ruleset_fd_io) 217 { 218 struct landlock_ruleset_attr ruleset_attr = { 219 .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE, 220 }; 221 int ruleset_fd; 222 char buf; 223 224 drop_caps(_metadata); 225 ruleset_fd = 226 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); 227 ASSERT_LE(0, ruleset_fd); 228 229 ASSERT_EQ(-1, write(ruleset_fd, ".", 1)); 230 ASSERT_EQ(EINVAL, errno); 231 ASSERT_EQ(-1, read(ruleset_fd, &buf, 1)); 232 ASSERT_EQ(EINVAL, errno); 233 234 ASSERT_EQ(0, close(ruleset_fd)); 235 } 236 237 /* Tests enforcement of a ruleset FD transferred through a UNIX socket. */ 238 TEST(ruleset_fd_transfer) 239 { 240 struct landlock_ruleset_attr ruleset_attr = { 241 .handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR, 242 }; 243 struct landlock_path_beneath_attr path_beneath_attr = { 244 .allowed_access = LANDLOCK_ACCESS_FS_READ_DIR, 245 }; 246 int ruleset_fd_tx, dir_fd; 247 union { 248 /* Aligned ancillary data buffer. */ 249 char buf[CMSG_SPACE(sizeof(ruleset_fd_tx))]; 250 struct cmsghdr _align; 251 } cmsg_tx = {}; 252 char data_tx = '.'; 253 struct iovec io = { 254 .iov_base = &data_tx, 255 .iov_len = sizeof(data_tx), 256 }; 257 struct msghdr msg = { 258 .msg_iov = &io, 259 .msg_iovlen = 1, 260 .msg_control = &cmsg_tx.buf, 261 .msg_controllen = sizeof(cmsg_tx.buf), 262 }; 263 struct cmsghdr *cmsg; 264 int socket_fds[2]; 265 pid_t child; 266 int status; 267 268 drop_caps(_metadata); 269 270 /* Creates a test ruleset with a simple rule. */ 271 ruleset_fd_tx = 272 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); 273 ASSERT_LE(0, ruleset_fd_tx); 274 path_beneath_attr.parent_fd = 275 open("/tmp", O_PATH | O_NOFOLLOW | O_DIRECTORY | O_CLOEXEC); 276 ASSERT_LE(0, path_beneath_attr.parent_fd); 277 ASSERT_EQ(0, 278 landlock_add_rule(ruleset_fd_tx, LANDLOCK_RULE_PATH_BENEATH, 279 &path_beneath_attr, 0)); 280 ASSERT_EQ(0, close(path_beneath_attr.parent_fd)); 281 282 cmsg = CMSG_FIRSTHDR(&msg); 283 ASSERT_NE(NULL, cmsg); 284 cmsg->cmsg_len = CMSG_LEN(sizeof(ruleset_fd_tx)); 285 cmsg->cmsg_level = SOL_SOCKET; 286 cmsg->cmsg_type = SCM_RIGHTS; 287 memcpy(CMSG_DATA(cmsg), &ruleset_fd_tx, sizeof(ruleset_fd_tx)); 288 289 /* Sends the ruleset FD over a socketpair and then close it. */ 290 ASSERT_EQ(0, socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0, 291 socket_fds)); 292 ASSERT_EQ(sizeof(data_tx), sendmsg(socket_fds[0], &msg, 0)); 293 ASSERT_EQ(0, close(socket_fds[0])); 294 ASSERT_EQ(0, close(ruleset_fd_tx)); 295 296 child = fork(); 297 ASSERT_LE(0, child); 298 if (child == 0) { 299 int ruleset_fd_rx; 300 301 *(char *)msg.msg_iov->iov_base = '\0'; 302 ASSERT_EQ(sizeof(data_tx), 303 recvmsg(socket_fds[1], &msg, MSG_CMSG_CLOEXEC)); 304 ASSERT_EQ('.', *(char *)msg.msg_iov->iov_base); 305 ASSERT_EQ(0, close(socket_fds[1])); 306 cmsg = CMSG_FIRSTHDR(&msg); 307 ASSERT_EQ(cmsg->cmsg_len, CMSG_LEN(sizeof(ruleset_fd_tx))); 308 memcpy(&ruleset_fd_rx, CMSG_DATA(cmsg), sizeof(ruleset_fd_tx)); 309 310 /* Enforces the received ruleset on the child. */ 311 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); 312 ASSERT_EQ(0, landlock_restrict_self(ruleset_fd_rx, 0)); 313 ASSERT_EQ(0, close(ruleset_fd_rx)); 314 315 /* Checks that the ruleset enforcement. */ 316 ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)); 317 ASSERT_EQ(EACCES, errno); 318 dir_fd = open("/tmp", O_RDONLY | O_DIRECTORY | O_CLOEXEC); 319 ASSERT_LE(0, dir_fd); 320 ASSERT_EQ(0, close(dir_fd)); 321 _exit(_metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE); 322 return; 323 } 324 325 ASSERT_EQ(0, close(socket_fds[1])); 326 327 /* Checks that the parent is unrestricted. */ 328 dir_fd = open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC); 329 ASSERT_LE(0, dir_fd); 330 ASSERT_EQ(0, close(dir_fd)); 331 dir_fd = open("/tmp", O_RDONLY | O_DIRECTORY | O_CLOEXEC); 332 ASSERT_LE(0, dir_fd); 333 ASSERT_EQ(0, close(dir_fd)); 334 335 ASSERT_EQ(child, waitpid(child, &status, 0)); 336 ASSERT_EQ(1, WIFEXITED(status)); 337 ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); 338 } 339 340 TEST_HARNESS_MAIN 341