Unverified Commit a1a202a5 authored by Günther Noack's avatar Günther Noack Committed by Mickaël Salaün
Browse files

selftests/landlock: Test FD passing from restricted to unrestricted processes 



A file descriptor created in a restricted process carries Landlock
restrictions with it which will apply even if the same opened file is
used from an unrestricted process.

This change extracts suitable FD-passing helpers from base_test.c and
moves them to common.h. We use the fixture variants from the ftruncate
fixture to exercise the same scenarios as in the open_and_ftruncate
test, but doing the Landlock restriction and open() in a different
process than the ftruncate() call.

Signed-off-by: default avatarGünther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20221018182216.301684-9-gnoack3000@gmail.com


Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
parent 97b30f9e

tools/testing/selftests/landlock/base_test.c

+3 −33
Original line number Diff line number Diff line
@@ -263,23 +263,6 @@ TEST(ruleset_fd_transfer) 
		.allowed_access = LANDLOCK_ACCESS_FS_READ_DIR,

	};

	int ruleset_fd_tx, dir_fd;

	union {

		/* Aligned ancillary data buffer. */

		char buf[CMSG_SPACE(sizeof(ruleset_fd_tx))];

		struct cmsghdr _align;

	} cmsg_tx = {};

	char data_tx = '.';

	struct iovec io = {

		.iov_base = &data_tx,

		.iov_len = sizeof(data_tx),

	};

	struct msghdr msg = {

		.msg_iov = &io,

		.msg_iovlen = 1,

		.msg_control = &cmsg_tx.buf,

		.msg_controllen = sizeof(cmsg_tx.buf),

	};

	struct cmsghdr *cmsg;

	int socket_fds[2];

	pid_t child;

	int status;
@@ -298,33 +281,20 @@ TEST(ruleset_fd_transfer) 
				    &path_beneath_attr, 0));

	ASSERT_EQ(0, close(path_beneath_attr.parent_fd));



	cmsg = CMSG_FIRSTHDR(&msg);

	ASSERT_NE(NULL, cmsg);

	cmsg->cmsg_len = CMSG_LEN(sizeof(ruleset_fd_tx));

	cmsg->cmsg_level = SOL_SOCKET;

	cmsg->cmsg_type = SCM_RIGHTS;

	memcpy(CMSG_DATA(cmsg), &ruleset_fd_tx, sizeof(ruleset_fd_tx));



	/* Sends the ruleset FD over a socketpair and then close it. */

	ASSERT_EQ(0, socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0,

				socket_fds));

	ASSERT_EQ(sizeof(data_tx), sendmsg(socket_fds[0], &msg, 0));

	ASSERT_EQ(0, send_fd(socket_fds[0], ruleset_fd_tx));

	ASSERT_EQ(0, close(socket_fds[0]));

	ASSERT_EQ(0, close(ruleset_fd_tx));



	child = fork();

	ASSERT_LE(0, child);

	if (child == 0) {

		int ruleset_fd_rx;

		const int ruleset_fd_rx = recv_fd(socket_fds[1]);



		*(char *)msg.msg_iov->iov_base = '\0';

		ASSERT_EQ(sizeof(data_tx),

			  recvmsg(socket_fds[1], &msg, MSG_CMSG_CLOEXEC));

		ASSERT_EQ('.', *(char *)msg.msg_iov->iov_base);

		ASSERT_LE(0, ruleset_fd_rx);

		ASSERT_EQ(0, close(socket_fds[1]));

		cmsg = CMSG_FIRSTHDR(&msg);

		ASSERT_EQ(cmsg->cmsg_len, CMSG_LEN(sizeof(ruleset_fd_tx)));

		memcpy(&ruleset_fd_rx, CMSG_DATA(cmsg), sizeof(ruleset_fd_tx));



		/* Enforces the received ruleset on the child. */

		ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));

tools/testing/selftests/landlock/common.h

+67 −0
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ 
#include <errno.h>

#include <linux/landlock.h>

#include <sys/capability.h>

#include <sys/socket.h>

#include <sys/syscall.h>

#include <sys/types.h>

#include <sys/wait.h>
@@ -189,3 +190,69 @@ static void __maybe_unused clear_cap(struct __test_metadata *const _metadata, 
{

	_effective_cap(_metadata, caps, CAP_CLEAR);

}



/* Receives an FD from a UNIX socket. Returns the received FD, or -errno. */

static int __maybe_unused recv_fd(int usock)

{

	int fd_rx;

	union {

		/* Aligned ancillary data buffer. */

		char buf[CMSG_SPACE(sizeof(fd_rx))];

		struct cmsghdr _align;

	} cmsg_rx = {};

	char data = '\0';

	struct iovec io = {

		.iov_base = &data,

		.iov_len = sizeof(data),

	};

	struct msghdr msg = {

		.msg_iov = &io,

		.msg_iovlen = 1,

		.msg_control = &cmsg_rx.buf,

		.msg_controllen = sizeof(cmsg_rx.buf),

	};

	struct cmsghdr *cmsg;

	int res;



	res = recvmsg(usock, &msg, MSG_CMSG_CLOEXEC);

	if (res < 0)

		return -errno;



	cmsg = CMSG_FIRSTHDR(&msg);

	if (cmsg->cmsg_len != CMSG_LEN(sizeof(fd_rx)))

		return -EIO;



	memcpy(&fd_rx, CMSG_DATA(cmsg), sizeof(fd_rx));

	return fd_rx;

}



/* Sends an FD on a UNIX socket. Returns 0 on success or -errno. */

static int __maybe_unused send_fd(int usock, int fd_tx)

{

	union {

		/* Aligned ancillary data buffer. */

		char buf[CMSG_SPACE(sizeof(fd_tx))];

		struct cmsghdr _align;

	} cmsg_tx = {};

	char data_tx = '.';

	struct iovec io = {

		.iov_base = &data_tx,

		.iov_len = sizeof(data_tx),

	};

	struct msghdr msg = {

		.msg_iov = &io,

		.msg_iovlen = 1,

		.msg_control = &cmsg_tx.buf,

		.msg_controllen = sizeof(cmsg_tx.buf),

	};

	struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg);



	cmsg->cmsg_len = CMSG_LEN(sizeof(fd_tx));

	cmsg->cmsg_level = SOL_SOCKET;

	cmsg->cmsg_type = SCM_RIGHTS;

	memcpy(CMSG_DATA(cmsg), &fd_tx, sizeof(fd_tx));



	if (sendmsg(usock, &msg, 0) < 0)

		return -errno;

	return 0;

}

tools/testing/selftests/landlock/fs_test.c

+62 −0
Original line number Diff line number Diff line
@@ -3541,6 +3541,68 @@ TEST_F_FORK(ftruncate, open_and_ftruncate) 
	}

}



TEST_F_FORK(ftruncate, open_and_ftruncate_in_different_processes)

{

	int child, fd, status;

	int socket_fds[2];



	ASSERT_EQ(0, socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0,

				socket_fds));



	child = fork();

	ASSERT_LE(0, child);

	if (child == 0) {

		/*

		 * Enables Landlock in the child process, open a file descriptor

		 * where truncation is forbidden and send it to the

		 * non-landlocked parent process.

		 */

		const char *const path = file1_s1d1;

		const struct rule rules[] = {

			{

				.path = path,

				.access = variant->permitted,

			},

			{},

		};

		int fd, ruleset_fd;



		ruleset_fd = create_ruleset(_metadata, variant->handled, rules);

		ASSERT_LE(0, ruleset_fd);

		enforce_ruleset(_metadata, ruleset_fd);

		ASSERT_EQ(0, close(ruleset_fd));



		fd = open(path, O_WRONLY);

		ASSERT_EQ(variant->expected_open_result, (fd < 0 ? errno : 0));



		if (fd >= 0) {

			ASSERT_EQ(0, send_fd(socket_fds[0], fd));

			ASSERT_EQ(0, close(fd));

		}



		ASSERT_EQ(0, close(socket_fds[0]));



		_exit(_metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);

		return;

	}



	if (variant->expected_open_result == 0) {

		fd = recv_fd(socket_fds[1]);

		ASSERT_LE(0, fd);



		EXPECT_EQ(variant->expected_ftruncate_result,

			  test_ftruncate(fd));

		ASSERT_EQ(0, close(fd));

	}



	ASSERT_EQ(child, waitpid(child, &status, 0));

	ASSERT_EQ(1, WIFEXITED(status));

	ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));



	ASSERT_EQ(0, close(socket_fds[0]));

	ASSERT_EQ(0, close(socket_fds[1]));

}



/* clang-format off */

FIXTURE(layout1_bind) {};

/* clang-format on */