Loading...
1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 * Landlock test helpers
4 *
5 * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>
6 * Copyright © 2019-2020 ANSSI
7 * Copyright © 2021 Microsoft Corporation
8 */
9
10#include <errno.h>
11#include <linux/landlock.h>
12#include <sys/capability.h>
13#include <sys/socket.h>
14#include <sys/syscall.h>
15#include <sys/types.h>
16#include <sys/wait.h>
17#include <unistd.h>
18
19#include "../kselftest_harness.h"
20
21#ifndef __maybe_unused
22#define __maybe_unused __attribute__((__unused__))
23#endif
24
25/*
26 * TEST_F_FORK() is useful when a test drop privileges but the corresponding
27 * FIXTURE_TEARDOWN() requires them (e.g. to remove files from a directory
28 * where write actions are denied). For convenience, FIXTURE_TEARDOWN() is
29 * also called when the test failed, but not when FIXTURE_SETUP() failed. For
30 * this to be possible, we must not call abort() but instead exit smoothly
31 * (hence the step print).
32 */
33/* clang-format off */
34#define TEST_F_FORK(fixture_name, test_name) \
35 static void fixture_name##_##test_name##_child( \
36 struct __test_metadata *_metadata, \
37 FIXTURE_DATA(fixture_name) *self, \
38 const FIXTURE_VARIANT(fixture_name) *variant); \
39 TEST_F(fixture_name, test_name) \
40 { \
41 int status; \
42 const pid_t child = fork(); \
43 if (child < 0) \
44 abort(); \
45 if (child == 0) { \
46 _metadata->no_print = 1; \
47 fixture_name##_##test_name##_child(_metadata, self, variant); \
48 if (_metadata->skip) \
49 _exit(255); \
50 if (_metadata->passed) \
51 _exit(0); \
52 _exit(_metadata->step); \
53 } \
54 if (child != waitpid(child, &status, 0)) \
55 abort(); \
56 if (WIFSIGNALED(status) || !WIFEXITED(status)) { \
57 _metadata->passed = 0; \
58 _metadata->step = 1; \
59 return; \
60 } \
61 switch (WEXITSTATUS(status)) { \
62 case 0: \
63 _metadata->passed = 1; \
64 break; \
65 case 255: \
66 _metadata->passed = 1; \
67 _metadata->skip = 1; \
68 break; \
69 default: \
70 _metadata->passed = 0; \
71 _metadata->step = WEXITSTATUS(status); \
72 break; \
73 } \
74 } \
75 static void fixture_name##_##test_name##_child( \
76 struct __test_metadata __attribute__((unused)) *_metadata, \
77 FIXTURE_DATA(fixture_name) __attribute__((unused)) *self, \
78 const FIXTURE_VARIANT(fixture_name) \
79 __attribute__((unused)) *variant)
80/* clang-format on */
81
82#ifndef landlock_create_ruleset
83static inline int
84landlock_create_ruleset(const struct landlock_ruleset_attr *const attr,
85 const size_t size, const __u32 flags)
86{
87 return syscall(__NR_landlock_create_ruleset, attr, size, flags);
88}
89#endif
90
91#ifndef landlock_add_rule
92static inline int landlock_add_rule(const int ruleset_fd,
93 const enum landlock_rule_type rule_type,
94 const void *const rule_attr,
95 const __u32 flags)
96{
97 return syscall(__NR_landlock_add_rule, ruleset_fd, rule_type, rule_attr,
98 flags);
99}
100#endif
101
102#ifndef landlock_restrict_self
103static inline int landlock_restrict_self(const int ruleset_fd,
104 const __u32 flags)
105{
106 return syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
107}
108#endif
109
110static void _init_caps(struct __test_metadata *const _metadata, bool drop_all)
111{
112 cap_t cap_p;
113 /* Only these three capabilities are useful for the tests. */
114 const cap_value_t caps[] = {
115 CAP_DAC_OVERRIDE,
116 CAP_MKNOD,
117 CAP_SYS_ADMIN,
118 CAP_SYS_CHROOT,
119 };
120
121 cap_p = cap_get_proc();
122 EXPECT_NE(NULL, cap_p)
123 {
124 TH_LOG("Failed to cap_get_proc: %s", strerror(errno));
125 }
126 EXPECT_NE(-1, cap_clear(cap_p))
127 {
128 TH_LOG("Failed to cap_clear: %s", strerror(errno));
129 }
130 if (!drop_all) {
131 EXPECT_NE(-1, cap_set_flag(cap_p, CAP_PERMITTED,
132 ARRAY_SIZE(caps), caps, CAP_SET))
133 {
134 TH_LOG("Failed to cap_set_flag: %s", strerror(errno));
135 }
136 }
137 EXPECT_NE(-1, cap_set_proc(cap_p))
138 {
139 TH_LOG("Failed to cap_set_proc: %s", strerror(errno));
140 }
141 EXPECT_NE(-1, cap_free(cap_p))
142 {
143 TH_LOG("Failed to cap_free: %s", strerror(errno));
144 }
145}
146
147/* We cannot put such helpers in a library because of kselftest_harness.h . */
148static void __maybe_unused disable_caps(struct __test_metadata *const _metadata)
149{
150 _init_caps(_metadata, false);
151}
152
153static void __maybe_unused drop_caps(struct __test_metadata *const _metadata)
154{
155 _init_caps(_metadata, true);
156}
157
158static void _effective_cap(struct __test_metadata *const _metadata,
159 const cap_value_t caps, const cap_flag_value_t value)
160{
161 cap_t cap_p;
162
163 cap_p = cap_get_proc();
164 EXPECT_NE(NULL, cap_p)
165 {
166 TH_LOG("Failed to cap_get_proc: %s", strerror(errno));
167 }
168 EXPECT_NE(-1, cap_set_flag(cap_p, CAP_EFFECTIVE, 1, &caps, value))
169 {
170 TH_LOG("Failed to cap_set_flag: %s", strerror(errno));
171 }
172 EXPECT_NE(-1, cap_set_proc(cap_p))
173 {
174 TH_LOG("Failed to cap_set_proc: %s", strerror(errno));
175 }
176 EXPECT_NE(-1, cap_free(cap_p))
177 {
178 TH_LOG("Failed to cap_free: %s", strerror(errno));
179 }
180}
181
182static void __maybe_unused set_cap(struct __test_metadata *const _metadata,
183 const cap_value_t caps)
184{
185 _effective_cap(_metadata, caps, CAP_SET);
186}
187
188static void __maybe_unused clear_cap(struct __test_metadata *const _metadata,
189 const cap_value_t caps)
190{
191 _effective_cap(_metadata, caps, CAP_CLEAR);
192}
193
194/* Receives an FD from a UNIX socket. Returns the received FD, or -errno. */
195static int __maybe_unused recv_fd(int usock)
196{
197 int fd_rx;
198 union {
199 /* Aligned ancillary data buffer. */
200 char buf[CMSG_SPACE(sizeof(fd_rx))];
201 struct cmsghdr _align;
202 } cmsg_rx = {};
203 char data = '\0';
204 struct iovec io = {
205 .iov_base = &data,
206 .iov_len = sizeof(data),
207 };
208 struct msghdr msg = {
209 .msg_iov = &io,
210 .msg_iovlen = 1,
211 .msg_control = &cmsg_rx.buf,
212 .msg_controllen = sizeof(cmsg_rx.buf),
213 };
214 struct cmsghdr *cmsg;
215 int res;
216
217 res = recvmsg(usock, &msg, MSG_CMSG_CLOEXEC);
218 if (res < 0)
219 return -errno;
220
221 cmsg = CMSG_FIRSTHDR(&msg);
222 if (cmsg->cmsg_len != CMSG_LEN(sizeof(fd_rx)))
223 return -EIO;
224
225 memcpy(&fd_rx, CMSG_DATA(cmsg), sizeof(fd_rx));
226 return fd_rx;
227}
228
229/* Sends an FD on a UNIX socket. Returns 0 on success or -errno. */
230static int __maybe_unused send_fd(int usock, int fd_tx)
231{
232 union {
233 /* Aligned ancillary data buffer. */
234 char buf[CMSG_SPACE(sizeof(fd_tx))];
235 struct cmsghdr _align;
236 } cmsg_tx = {};
237 char data_tx = '.';
238 struct iovec io = {
239 .iov_base = &data_tx,
240 .iov_len = sizeof(data_tx),
241 };
242 struct msghdr msg = {
243 .msg_iov = &io,
244 .msg_iovlen = 1,
245 .msg_control = &cmsg_tx.buf,
246 .msg_controllen = sizeof(cmsg_tx.buf),
247 };
248 struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg);
249
250 cmsg->cmsg_len = CMSG_LEN(sizeof(fd_tx));
251 cmsg->cmsg_level = SOL_SOCKET;
252 cmsg->cmsg_type = SCM_RIGHTS;
253 memcpy(CMSG_DATA(cmsg), &fd_tx, sizeof(fd_tx));
254
255 if (sendmsg(usock, &msg, 0) < 0)
256 return -errno;
257 return 0;
258}
1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 * Landlock test helpers
4 *
5 * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>
6 * Copyright © 2019-2020 ANSSI
7 * Copyright © 2021 Microsoft Corporation
8 */
9
10#include <arpa/inet.h>
11#include <errno.h>
12#include <linux/landlock.h>
13#include <linux/securebits.h>
14#include <sys/capability.h>
15#include <sys/socket.h>
16#include <sys/syscall.h>
17#include <sys/types.h>
18#include <sys/un.h>
19#include <sys/wait.h>
20#include <unistd.h>
21
22#include "../kselftest_harness.h"
23
24#define TMP_DIR "tmp"
25
26#ifndef __maybe_unused
27#define __maybe_unused __attribute__((__unused__))
28#endif
29
30/* TEST_F_FORK() should not be used for new tests. */
31#define TEST_F_FORK(fixture_name, test_name) TEST_F(fixture_name, test_name)
32
33#ifndef landlock_create_ruleset
34static inline int
35landlock_create_ruleset(const struct landlock_ruleset_attr *const attr,
36 const size_t size, const __u32 flags)
37{
38 return syscall(__NR_landlock_create_ruleset, attr, size, flags);
39}
40#endif
41
42#ifndef landlock_add_rule
43static inline int landlock_add_rule(const int ruleset_fd,
44 const enum landlock_rule_type rule_type,
45 const void *const rule_attr,
46 const __u32 flags)
47{
48 return syscall(__NR_landlock_add_rule, ruleset_fd, rule_type, rule_attr,
49 flags);
50}
51#endif
52
53#ifndef landlock_restrict_self
54static inline int landlock_restrict_self(const int ruleset_fd,
55 const __u32 flags)
56{
57 return syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
58}
59#endif
60
61static void _init_caps(struct __test_metadata *const _metadata, bool drop_all)
62{
63 cap_t cap_p;
64 /* Only these three capabilities are useful for the tests. */
65 const cap_value_t caps[] = {
66 /* clang-format off */
67 CAP_DAC_OVERRIDE,
68 CAP_MKNOD,
69 CAP_NET_ADMIN,
70 CAP_NET_BIND_SERVICE,
71 CAP_SYS_ADMIN,
72 CAP_SYS_CHROOT,
73 /* clang-format on */
74 };
75 const unsigned int noroot = SECBIT_NOROOT | SECBIT_NOROOT_LOCKED;
76
77 if ((cap_get_secbits() & noroot) != noroot)
78 EXPECT_EQ(0, cap_set_secbits(noroot));
79
80 cap_p = cap_get_proc();
81 EXPECT_NE(NULL, cap_p);
82 EXPECT_NE(-1, cap_clear(cap_p));
83 if (!drop_all) {
84 EXPECT_NE(-1, cap_set_flag(cap_p, CAP_PERMITTED,
85 ARRAY_SIZE(caps), caps, CAP_SET));
86 }
87
88 /* Automatically resets ambient capabilities. */
89 EXPECT_NE(-1, cap_set_proc(cap_p))
90 {
91 TH_LOG("Failed to set capabilities: %s", strerror(errno));
92 }
93 EXPECT_NE(-1, cap_free(cap_p));
94
95 /* Quickly checks that ambient capabilities are cleared. */
96 EXPECT_NE(-1, cap_get_ambient(caps[0]));
97}
98
99/* We cannot put such helpers in a library because of kselftest_harness.h . */
100static void __maybe_unused disable_caps(struct __test_metadata *const _metadata)
101{
102 _init_caps(_metadata, false);
103}
104
105static void __maybe_unused drop_caps(struct __test_metadata *const _metadata)
106{
107 _init_caps(_metadata, true);
108}
109
110static void _change_cap(struct __test_metadata *const _metadata,
111 const cap_flag_t flag, const cap_value_t cap,
112 const cap_flag_value_t value)
113{
114 cap_t cap_p;
115
116 cap_p = cap_get_proc();
117 EXPECT_NE(NULL, cap_p);
118 EXPECT_NE(-1, cap_set_flag(cap_p, flag, 1, &cap, value));
119 EXPECT_NE(-1, cap_set_proc(cap_p))
120 {
121 TH_LOG("Failed to set capability %d: %s", cap, strerror(errno));
122 }
123 EXPECT_NE(-1, cap_free(cap_p));
124}
125
126static void __maybe_unused set_cap(struct __test_metadata *const _metadata,
127 const cap_value_t cap)
128{
129 _change_cap(_metadata, CAP_EFFECTIVE, cap, CAP_SET);
130}
131
132static void __maybe_unused clear_cap(struct __test_metadata *const _metadata,
133 const cap_value_t cap)
134{
135 _change_cap(_metadata, CAP_EFFECTIVE, cap, CAP_CLEAR);
136}
137
138static void __maybe_unused
139set_ambient_cap(struct __test_metadata *const _metadata, const cap_value_t cap)
140{
141 _change_cap(_metadata, CAP_INHERITABLE, cap, CAP_SET);
142
143 EXPECT_NE(-1, cap_set_ambient(cap, CAP_SET))
144 {
145 TH_LOG("Failed to set ambient capability %d: %s", cap,
146 strerror(errno));
147 }
148}
149
150static void __maybe_unused clear_ambient_cap(
151 struct __test_metadata *const _metadata, const cap_value_t cap)
152{
153 EXPECT_EQ(1, cap_get_ambient(cap));
154 _change_cap(_metadata, CAP_INHERITABLE, cap, CAP_CLEAR);
155 EXPECT_EQ(0, cap_get_ambient(cap));
156}
157
158/* Receives an FD from a UNIX socket. Returns the received FD, or -errno. */
159static int __maybe_unused recv_fd(int usock)
160{
161 int fd_rx;
162 union {
163 /* Aligned ancillary data buffer. */
164 char buf[CMSG_SPACE(sizeof(fd_rx))];
165 struct cmsghdr _align;
166 } cmsg_rx = {};
167 char data = '\0';
168 struct iovec io = {
169 .iov_base = &data,
170 .iov_len = sizeof(data),
171 };
172 struct msghdr msg = {
173 .msg_iov = &io,
174 .msg_iovlen = 1,
175 .msg_control = &cmsg_rx.buf,
176 .msg_controllen = sizeof(cmsg_rx.buf),
177 };
178 struct cmsghdr *cmsg;
179 int res;
180
181 res = recvmsg(usock, &msg, MSG_CMSG_CLOEXEC);
182 if (res < 0)
183 return -errno;
184
185 cmsg = CMSG_FIRSTHDR(&msg);
186 if (cmsg->cmsg_len != CMSG_LEN(sizeof(fd_rx)))
187 return -EIO;
188
189 memcpy(&fd_rx, CMSG_DATA(cmsg), sizeof(fd_rx));
190 return fd_rx;
191}
192
193/* Sends an FD on a UNIX socket. Returns 0 on success or -errno. */
194static int __maybe_unused send_fd(int usock, int fd_tx)
195{
196 union {
197 /* Aligned ancillary data buffer. */
198 char buf[CMSG_SPACE(sizeof(fd_tx))];
199 struct cmsghdr _align;
200 } cmsg_tx = {};
201 char data_tx = '.';
202 struct iovec io = {
203 .iov_base = &data_tx,
204 .iov_len = sizeof(data_tx),
205 };
206 struct msghdr msg = {
207 .msg_iov = &io,
208 .msg_iovlen = 1,
209 .msg_control = &cmsg_tx.buf,
210 .msg_controllen = sizeof(cmsg_tx.buf),
211 };
212 struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg);
213
214 cmsg->cmsg_len = CMSG_LEN(sizeof(fd_tx));
215 cmsg->cmsg_level = SOL_SOCKET;
216 cmsg->cmsg_type = SCM_RIGHTS;
217 memcpy(CMSG_DATA(cmsg), &fd_tx, sizeof(fd_tx));
218
219 if (sendmsg(usock, &msg, 0) < 0)
220 return -errno;
221 return 0;
222}
223
224static void __maybe_unused
225enforce_ruleset(struct __test_metadata *const _metadata, const int ruleset_fd)
226{
227 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
228 ASSERT_EQ(0, landlock_restrict_self(ruleset_fd, 0))
229 {
230 TH_LOG("Failed to enforce ruleset: %s", strerror(errno));
231 }
232}
233
234struct protocol_variant {
235 int domain;
236 int type;
237 int protocol;
238};
239
240struct service_fixture {
241 struct protocol_variant protocol;
242 /* port is also stored in ipv4_addr.sin_port or ipv6_addr.sin6_port */
243 unsigned short port;
244 union {
245 struct sockaddr_in ipv4_addr;
246 struct sockaddr_in6 ipv6_addr;
247 struct {
248 struct sockaddr_un unix_addr;
249 socklen_t unix_addr_len;
250 };
251 };
252};
253
254static pid_t __maybe_unused sys_gettid(void)
255{
256 return syscall(__NR_gettid);
257}
258
259static void __maybe_unused set_unix_address(struct service_fixture *const srv,
260 const unsigned short index)
261{
262 srv->unix_addr.sun_family = AF_UNIX;
263 sprintf(srv->unix_addr.sun_path,
264 "_selftests-landlock-abstract-unix-tid%d-index%d", sys_gettid(),
265 index);
266 srv->unix_addr_len = SUN_LEN(&srv->unix_addr);
267 srv->unix_addr.sun_path[0] = '\0';
268}