1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Landlock tests - Common user space base
4  *
5  * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>
6  * Copyright © 2019-2020 ANSSI
7  */
8 
9 #define _GNU_SOURCE
10 #include <errno.h>
11 #include <fcntl.h>
12 #include <linux/landlock.h>
13 #include <string.h>
14 #include <sys/prctl.h>
15 #include <sys/socket.h>
16 #include <sys/types.h>
17 
18 #include "common.h"
19 
20 #ifndef O_PATH
21 #define O_PATH 010000000
22 #endif
23 
24 TEST(inconsistent_attr)
25 {
26 	const long page_size = sysconf(_SC_PAGESIZE);
27 	char *const buf = malloc(page_size + 1);
28 	struct landlock_ruleset_attr *const ruleset_attr = (void *)buf;
29 
30 	ASSERT_NE(NULL, buf);
31 
32 	/* Checks copy_from_user(). */
33 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 0, 0));
34 	/* The size if less than sizeof(struct landlock_attr_enforce). */
35 	ASSERT_EQ(EINVAL, errno);
36 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 1, 0));
37 	ASSERT_EQ(EINVAL, errno);
38 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 7, 0));
39 	ASSERT_EQ(EINVAL, errno);
40 
41 	ASSERT_EQ(-1, landlock_create_ruleset(NULL, 1, 0));
42 	/* The size if less than sizeof(struct landlock_attr_enforce). */
43 	ASSERT_EQ(EFAULT, errno);
44 
45 	ASSERT_EQ(-1, landlock_create_ruleset(
46 			      NULL, sizeof(struct landlock_ruleset_attr), 0));
47 	ASSERT_EQ(EFAULT, errno);
48 
49 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size + 1, 0));
50 	ASSERT_EQ(E2BIG, errno);
51 
52 	/* Checks minimal valid attribute size. */
53 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 8, 0));
54 	ASSERT_EQ(ENOMSG, errno);
55 	ASSERT_EQ(-1, landlock_create_ruleset(
56 			      ruleset_attr,
57 			      sizeof(struct landlock_ruleset_attr), 0));
58 	ASSERT_EQ(ENOMSG, errno);
59 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size, 0));
60 	ASSERT_EQ(ENOMSG, errno);
61 
62 	/* Checks non-zero value. */
63 	buf[page_size - 2] = '.';
64 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size, 0));
65 	ASSERT_EQ(E2BIG, errno);
66 
67 	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size + 1, 0));
68 	ASSERT_EQ(E2BIG, errno);
69 
70 	free(buf);
71 }
72 
73 TEST(abi_version)
74 {
75 	const struct landlock_ruleset_attr ruleset_attr = {
76 		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE,
77 	};
78 	ASSERT_EQ(3, landlock_create_ruleset(NULL, 0,
79 					     LANDLOCK_CREATE_RULESET_VERSION));
80 
81 	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0,
82 					      LANDLOCK_CREATE_RULESET_VERSION));
83 	ASSERT_EQ(EINVAL, errno);
84 
85 	ASSERT_EQ(-1, landlock_create_ruleset(NULL, sizeof(ruleset_attr),
86 					      LANDLOCK_CREATE_RULESET_VERSION));
87 	ASSERT_EQ(EINVAL, errno);
88 
89 	ASSERT_EQ(-1,
90 		  landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr),
91 					  LANDLOCK_CREATE_RULESET_VERSION));
92 	ASSERT_EQ(EINVAL, errno);
93 
94 	ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0,
95 					      LANDLOCK_CREATE_RULESET_VERSION |
96 						      1 << 31));
97 	ASSERT_EQ(EINVAL, errno);
98 }
99 
100 /* Tests ordering of syscall argument checks. */
101 TEST(create_ruleset_checks_ordering)
102 {
103 	const int last_flag = LANDLOCK_CREATE_RULESET_VERSION;
104 	const int invalid_flag = last_flag << 1;
105 	int ruleset_fd;
106 	const struct landlock_ruleset_attr ruleset_attr = {
107 		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE,
108 	};
109 
110 	/* Checks priority for invalid flags. */
111 	ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0, invalid_flag));
112 	ASSERT_EQ(EINVAL, errno);
113 
114 	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0, invalid_flag));
115 	ASSERT_EQ(EINVAL, errno);
116 
117 	ASSERT_EQ(-1, landlock_create_ruleset(NULL, sizeof(ruleset_attr),
118 					      invalid_flag));
119 	ASSERT_EQ(EINVAL, errno);
120 
121 	ASSERT_EQ(-1,
122 		  landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr),
123 					  invalid_flag));
124 	ASSERT_EQ(EINVAL, errno);
125 
126 	/* Checks too big ruleset_attr size. */
127 	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, -1, 0));
128 	ASSERT_EQ(E2BIG, errno);
129 
130 	/* Checks too small ruleset_attr size. */
131 	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0, 0));
132 	ASSERT_EQ(EINVAL, errno);
133 	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 1, 0));
134 	ASSERT_EQ(EINVAL, errno);
135 
136 	/* Checks valid call. */
137 	ruleset_fd =
138 		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
139 	ASSERT_LE(0, ruleset_fd);
140 	ASSERT_EQ(0, close(ruleset_fd));
141 }
142 
143 /* Tests ordering of syscall argument checks. */
144 TEST(add_rule_checks_ordering)
145 {
146 	const struct landlock_ruleset_attr ruleset_attr = {
147 		.handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE,
148 	};
149 	struct landlock_path_beneath_attr path_beneath_attr = {
150 		.allowed_access = LANDLOCK_ACCESS_FS_EXECUTE,
151 		.parent_fd = -1,
152 	};
153 	const int ruleset_fd =
154 		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
155 
156 	ASSERT_LE(0, ruleset_fd);
157 
158 	/* Checks invalid flags. */
159 	ASSERT_EQ(-1, landlock_add_rule(-1, 0, NULL, 1));
160 	ASSERT_EQ(EINVAL, errno);
161 
162 	/* Checks invalid ruleset FD. */
163 	ASSERT_EQ(-1, landlock_add_rule(-1, 0, NULL, 0));
164 	ASSERT_EQ(EBADF, errno);
165 
166 	/* Checks invalid rule type. */
167 	ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, 0, NULL, 0));
168 	ASSERT_EQ(EINVAL, errno);
169 
170 	/* Checks invalid rule attr. */
171 	ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
172 					NULL, 0));
173 	ASSERT_EQ(EFAULT, errno);
174 
175 	/* Checks invalid path_beneath.parent_fd. */
176 	ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
177 					&path_beneath_attr, 0));
178 	ASSERT_EQ(EBADF, errno);
179 
180 	/* Checks valid call. */
181 	path_beneath_attr.parent_fd =
182 		open("/tmp", O_PATH | O_NOFOLLOW | O_DIRECTORY | O_CLOEXEC);
183 	ASSERT_LE(0, path_beneath_attr.parent_fd);
184 	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
185 				       &path_beneath_attr, 0));
186 	ASSERT_EQ(0, close(path_beneath_attr.parent_fd));
187 	ASSERT_EQ(0, close(ruleset_fd));
188 }
189 
190 /* Tests ordering of syscall argument and permission checks. */
191 TEST(restrict_self_checks_ordering)
192 {
193 	const struct landlock_ruleset_attr ruleset_attr = {
194 		.handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE,
195 	};
196 	struct landlock_path_beneath_attr path_beneath_attr = {
197 		.allowed_access = LANDLOCK_ACCESS_FS_EXECUTE,
198 		.parent_fd = -1,
199 	};
200 	const int ruleset_fd =
201 		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
202 
203 	ASSERT_LE(0, ruleset_fd);
204 	path_beneath_attr.parent_fd =
205 		open("/tmp", O_PATH | O_NOFOLLOW | O_DIRECTORY | O_CLOEXEC);
206 	ASSERT_LE(0, path_beneath_attr.parent_fd);
207 	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
208 				       &path_beneath_attr, 0));
209 	ASSERT_EQ(0, close(path_beneath_attr.parent_fd));
210 
211 	/* Checks unprivileged enforcement without no_new_privs. */
212 	drop_caps(_metadata);
213 	ASSERT_EQ(-1, landlock_restrict_self(-1, -1));
214 	ASSERT_EQ(EPERM, errno);
215 	ASSERT_EQ(-1, landlock_restrict_self(-1, 0));
216 	ASSERT_EQ(EPERM, errno);
217 	ASSERT_EQ(-1, landlock_restrict_self(ruleset_fd, 0));
218 	ASSERT_EQ(EPERM, errno);
219 
220 	ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
221 
222 	/* Checks invalid flags. */
223 	ASSERT_EQ(-1, landlock_restrict_self(-1, -1));
224 	ASSERT_EQ(EINVAL, errno);
225 
226 	/* Checks invalid ruleset FD. */
227 	ASSERT_EQ(-1, landlock_restrict_self(-1, 0));
228 	ASSERT_EQ(EBADF, errno);
229 
230 	/* Checks valid call. */
231 	ASSERT_EQ(0, landlock_restrict_self(ruleset_fd, 0));
232 	ASSERT_EQ(0, close(ruleset_fd));
233 }
234 
235 TEST(ruleset_fd_io)
236 {
237 	struct landlock_ruleset_attr ruleset_attr = {
238 		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE,
239 	};
240 	int ruleset_fd;
241 	char buf;
242 
243 	drop_caps(_metadata);
244 	ruleset_fd =
245 		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
246 	ASSERT_LE(0, ruleset_fd);
247 
248 	ASSERT_EQ(-1, write(ruleset_fd, ".", 1));
249 	ASSERT_EQ(EINVAL, errno);
250 	ASSERT_EQ(-1, read(ruleset_fd, &buf, 1));
251 	ASSERT_EQ(EINVAL, errno);
252 
253 	ASSERT_EQ(0, close(ruleset_fd));
254 }
255 
256 /* Tests enforcement of a ruleset FD transferred through a UNIX socket. */
257 TEST(ruleset_fd_transfer)
258 {
259 	struct landlock_ruleset_attr ruleset_attr = {
260 		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR,
261 	};
262 	struct landlock_path_beneath_attr path_beneath_attr = {
263 		.allowed_access = LANDLOCK_ACCESS_FS_READ_DIR,
264 	};
265 	int ruleset_fd_tx, dir_fd;
266 	int socket_fds[2];
267 	pid_t child;
268 	int status;
269 
270 	drop_caps(_metadata);
271 
272 	/* Creates a test ruleset with a simple rule. */
273 	ruleset_fd_tx =
274 		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
275 	ASSERT_LE(0, ruleset_fd_tx);
276 	path_beneath_attr.parent_fd =
277 		open("/tmp", O_PATH | O_NOFOLLOW | O_DIRECTORY | O_CLOEXEC);
278 	ASSERT_LE(0, path_beneath_attr.parent_fd);
279 	ASSERT_EQ(0,
280 		  landlock_add_rule(ruleset_fd_tx, LANDLOCK_RULE_PATH_BENEATH,
281 				    &path_beneath_attr, 0));
282 	ASSERT_EQ(0, close(path_beneath_attr.parent_fd));
283 
284 	/* Sends the ruleset FD over a socketpair and then close it. */
285 	ASSERT_EQ(0, socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0,
286 				socket_fds));
287 	ASSERT_EQ(0, send_fd(socket_fds[0], ruleset_fd_tx));
288 	ASSERT_EQ(0, close(socket_fds[0]));
289 	ASSERT_EQ(0, close(ruleset_fd_tx));
290 
291 	child = fork();
292 	ASSERT_LE(0, child);
293 	if (child == 0) {
294 		const int ruleset_fd_rx = recv_fd(socket_fds[1]);
295 
296 		ASSERT_LE(0, ruleset_fd_rx);
297 		ASSERT_EQ(0, close(socket_fds[1]));
298 
299 		/* Enforces the received ruleset on the child. */
300 		ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
301 		ASSERT_EQ(0, landlock_restrict_self(ruleset_fd_rx, 0));
302 		ASSERT_EQ(0, close(ruleset_fd_rx));
303 
304 		/* Checks that the ruleset enforcement. */
305 		ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
306 		ASSERT_EQ(EACCES, errno);
307 		dir_fd = open("/tmp", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
308 		ASSERT_LE(0, dir_fd);
309 		ASSERT_EQ(0, close(dir_fd));
310 		_exit(_metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);
311 		return;
312 	}
313 
314 	ASSERT_EQ(0, close(socket_fds[1]));
315 
316 	/* Checks that the parent is unrestricted. */
317 	dir_fd = open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
318 	ASSERT_LE(0, dir_fd);
319 	ASSERT_EQ(0, close(dir_fd));
320 	dir_fd = open("/tmp", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
321 	ASSERT_LE(0, dir_fd);
322 	ASSERT_EQ(0, close(dir_fd));
323 
324 	ASSERT_EQ(child, waitpid(child, &status, 0));
325 	ASSERT_EQ(1, WIFEXITED(status));
326 	ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
327 }
328 
329 TEST_HARNESS_MAIN
330