1 // SPDX-License-Identifier: GPL-2.0
2 #define _GNU_SOURCE
3 #include <sched.h>
4 #include <stdio.h>
5 #include <errno.h>
6 #include <string.h>
7 #include <sys/types.h>
8 #include <sys/mount.h>
9 #include <sys/wait.h>
10 #include <sys/vfs.h>
11 #include <sys/statvfs.h>
12 #include <stdlib.h>
13 #include <unistd.h>
14 #include <fcntl.h>
15 #include <grp.h>
16 #include <stdbool.h>
17 #include <stdarg.h>
18
19 #ifndef CLONE_NEWNS
20 # define CLONE_NEWNS 0x00020000
21 #endif
22 #ifndef CLONE_NEWUTS
23 # define CLONE_NEWUTS 0x04000000
24 #endif
25 #ifndef CLONE_NEWIPC
26 # define CLONE_NEWIPC 0x08000000
27 #endif
28 #ifndef CLONE_NEWNET
29 # define CLONE_NEWNET 0x40000000
30 #endif
31 #ifndef CLONE_NEWUSER
32 # define CLONE_NEWUSER 0x10000000
33 #endif
34 #ifndef CLONE_NEWPID
35 # define CLONE_NEWPID 0x20000000
36 #endif
37
38 #ifndef MS_REC
39 # define MS_REC 16384
40 #endif
41 #ifndef MS_RELATIME
42 # define MS_RELATIME (1 << 21)
43 #endif
44 #ifndef MS_STRICTATIME
45 # define MS_STRICTATIME (1 << 24)
46 #endif
47
die(char * fmt,...)48 static void die(char *fmt, ...)
49 {
50 va_list ap;
51 va_start(ap, fmt);
52 vfprintf(stderr, fmt, ap);
53 va_end(ap);
54 exit(EXIT_FAILURE);
55 }
56
vmaybe_write_file(bool enoent_ok,char * filename,char * fmt,va_list ap)57 static void vmaybe_write_file(bool enoent_ok, char *filename, char *fmt, va_list ap)
58 {
59 char buf[4096];
60 int fd;
61 ssize_t written;
62 int buf_len;
63
64 buf_len = vsnprintf(buf, sizeof(buf), fmt, ap);
65 if (buf_len < 0) {
66 die("vsnprintf failed: %s\n",
67 strerror(errno));
68 }
69 if (buf_len >= sizeof(buf)) {
70 die("vsnprintf output truncated\n");
71 }
72
73 fd = open(filename, O_WRONLY);
74 if (fd < 0) {
75 if ((errno == ENOENT) && enoent_ok)
76 return;
77 die("open of %s failed: %s\n",
78 filename, strerror(errno));
79 }
80 written = write(fd, buf, buf_len);
81 if (written != buf_len) {
82 if (written >= 0) {
83 die("short write to %s\n", filename);
84 } else {
85 die("write to %s failed: %s\n",
86 filename, strerror(errno));
87 }
88 }
89 if (close(fd) != 0) {
90 die("close of %s failed: %s\n",
91 filename, strerror(errno));
92 }
93 }
94
maybe_write_file(char * filename,char * fmt,...)95 static void maybe_write_file(char *filename, char *fmt, ...)
96 {
97 va_list ap;
98
99 va_start(ap, fmt);
100 vmaybe_write_file(true, filename, fmt, ap);
101 va_end(ap);
102
103 }
104
write_file(char * filename,char * fmt,...)105 static void write_file(char *filename, char *fmt, ...)
106 {
107 va_list ap;
108
109 va_start(ap, fmt);
110 vmaybe_write_file(false, filename, fmt, ap);
111 va_end(ap);
112
113 }
114
read_mnt_flags(const char * path)115 static int read_mnt_flags(const char *path)
116 {
117 int ret;
118 struct statvfs stat;
119 int mnt_flags;
120
121 ret = statvfs(path, &stat);
122 if (ret != 0) {
123 die("statvfs of %s failed: %s\n",
124 path, strerror(errno));
125 }
126 if (stat.f_flag & ~(ST_RDONLY | ST_NOSUID | ST_NODEV | \
127 ST_NOEXEC | ST_NOATIME | ST_NODIRATIME | ST_RELATIME | \
128 ST_SYNCHRONOUS | ST_MANDLOCK)) {
129 die("Unrecognized mount flags\n");
130 }
131 mnt_flags = 0;
132 if (stat.f_flag & ST_RDONLY)
133 mnt_flags |= MS_RDONLY;
134 if (stat.f_flag & ST_NOSUID)
135 mnt_flags |= MS_NOSUID;
136 if (stat.f_flag & ST_NODEV)
137 mnt_flags |= MS_NODEV;
138 if (stat.f_flag & ST_NOEXEC)
139 mnt_flags |= MS_NOEXEC;
140 if (stat.f_flag & ST_NOATIME)
141 mnt_flags |= MS_NOATIME;
142 if (stat.f_flag & ST_NODIRATIME)
143 mnt_flags |= MS_NODIRATIME;
144 if (stat.f_flag & ST_RELATIME)
145 mnt_flags |= MS_RELATIME;
146 if (stat.f_flag & ST_SYNCHRONOUS)
147 mnt_flags |= MS_SYNCHRONOUS;
148 if (stat.f_flag & ST_MANDLOCK)
149 mnt_flags |= ST_MANDLOCK;
150
151 return mnt_flags;
152 }
153
create_and_enter_userns(void)154 static void create_and_enter_userns(void)
155 {
156 uid_t uid;
157 gid_t gid;
158
159 uid = getuid();
160 gid = getgid();
161
162 if (unshare(CLONE_NEWUSER) !=0) {
163 die("unshare(CLONE_NEWUSER) failed: %s\n",
164 strerror(errno));
165 }
166
167 maybe_write_file("/proc/self/setgroups", "deny");
168 write_file("/proc/self/uid_map", "0 %d 1", uid);
169 write_file("/proc/self/gid_map", "0 %d 1", gid);
170
171 if (setgid(0) != 0) {
172 die ("setgid(0) failed %s\n",
173 strerror(errno));
174 }
175 if (setuid(0) != 0) {
176 die("setuid(0) failed %s\n",
177 strerror(errno));
178 }
179 }
180
181 static
test_unpriv_remount(const char * fstype,const char * mount_options,int mount_flags,int remount_flags,int invalid_flags)182 bool test_unpriv_remount(const char *fstype, const char *mount_options,
183 int mount_flags, int remount_flags, int invalid_flags)
184 {
185 pid_t child;
186
187 child = fork();
188 if (child == -1) {
189 die("fork failed: %s\n",
190 strerror(errno));
191 }
192 if (child != 0) { /* parent */
193 pid_t pid;
194 int status;
195 pid = waitpid(child, &status, 0);
196 if (pid == -1) {
197 die("waitpid failed: %s\n",
198 strerror(errno));
199 }
200 if (pid != child) {
201 die("waited for %d got %d\n",
202 child, pid);
203 }
204 if (!WIFEXITED(status)) {
205 die("child did not terminate cleanly\n");
206 }
207 return WEXITSTATUS(status) == EXIT_SUCCESS;
208 }
209
210 create_and_enter_userns();
211 if (unshare(CLONE_NEWNS) != 0) {
212 die("unshare(CLONE_NEWNS) failed: %s\n",
213 strerror(errno));
214 }
215
216 if (mount("testing", "/tmp", fstype, mount_flags, mount_options) != 0) {
217 die("mount of %s with options '%s' on /tmp failed: %s\n",
218 fstype,
219 mount_options? mount_options : "",
220 strerror(errno));
221 }
222
223 create_and_enter_userns();
224
225 if (unshare(CLONE_NEWNS) != 0) {
226 die("unshare(CLONE_NEWNS) failed: %s\n",
227 strerror(errno));
228 }
229
230 if (mount("/tmp", "/tmp", "none",
231 MS_REMOUNT | MS_BIND | remount_flags, NULL) != 0) {
232 /* system("cat /proc/self/mounts"); */
233 die("remount of /tmp failed: %s\n",
234 strerror(errno));
235 }
236
237 if (mount("/tmp", "/tmp", "none",
238 MS_REMOUNT | MS_BIND | invalid_flags, NULL) == 0) {
239 /* system("cat /proc/self/mounts"); */
240 die("remount of /tmp with invalid flags "
241 "succeeded unexpectedly\n");
242 }
243 exit(EXIT_SUCCESS);
244 }
245
test_unpriv_remount_simple(int mount_flags)246 static bool test_unpriv_remount_simple(int mount_flags)
247 {
248 return test_unpriv_remount("ramfs", NULL, mount_flags, mount_flags, 0);
249 }
250
test_unpriv_remount_atime(int mount_flags,int invalid_flags)251 static bool test_unpriv_remount_atime(int mount_flags, int invalid_flags)
252 {
253 return test_unpriv_remount("ramfs", NULL, mount_flags, mount_flags,
254 invalid_flags);
255 }
256
test_priv_mount_unpriv_remount(void)257 static bool test_priv_mount_unpriv_remount(void)
258 {
259 pid_t child;
260 int ret;
261 const char *orig_path = "/dev";
262 const char *dest_path = "/tmp";
263 int orig_mnt_flags, remount_mnt_flags;
264
265 child = fork();
266 if (child == -1) {
267 die("fork failed: %s\n",
268 strerror(errno));
269 }
270 if (child != 0) { /* parent */
271 pid_t pid;
272 int status;
273 pid = waitpid(child, &status, 0);
274 if (pid == -1) {
275 die("waitpid failed: %s\n",
276 strerror(errno));
277 }
278 if (pid != child) {
279 die("waited for %d got %d\n",
280 child, pid);
281 }
282 if (!WIFEXITED(status)) {
283 die("child did not terminate cleanly\n");
284 }
285 return WEXITSTATUS(status) == EXIT_SUCCESS;
286 }
287
288 orig_mnt_flags = read_mnt_flags(orig_path);
289
290 create_and_enter_userns();
291 ret = unshare(CLONE_NEWNS);
292 if (ret != 0) {
293 die("unshare(CLONE_NEWNS) failed: %s\n",
294 strerror(errno));
295 }
296
297 ret = mount(orig_path, dest_path, "bind", MS_BIND | MS_REC, NULL);
298 if (ret != 0) {
299 die("recursive bind mount of %s onto %s failed: %s\n",
300 orig_path, dest_path, strerror(errno));
301 }
302
303 ret = mount(dest_path, dest_path, "none",
304 MS_REMOUNT | MS_BIND | orig_mnt_flags , NULL);
305 if (ret != 0) {
306 /* system("cat /proc/self/mounts"); */
307 die("remount of /tmp failed: %s\n",
308 strerror(errno));
309 }
310
311 remount_mnt_flags = read_mnt_flags(dest_path);
312 if (orig_mnt_flags != remount_mnt_flags) {
313 die("Mount flags unexpectedly changed during remount of %s originally mounted on %s\n",
314 dest_path, orig_path);
315 }
316 exit(EXIT_SUCCESS);
317 }
318
main(int argc,char ** argv)319 int main(int argc, char **argv)
320 {
321 if (!test_unpriv_remount_simple(MS_RDONLY)) {
322 die("MS_RDONLY malfunctions\n");
323 }
324 if (!test_unpriv_remount("devpts", "newinstance", MS_NODEV, MS_NODEV, 0)) {
325 die("MS_NODEV malfunctions\n");
326 }
327 if (!test_unpriv_remount_simple(MS_NOSUID)) {
328 die("MS_NOSUID malfunctions\n");
329 }
330 if (!test_unpriv_remount_simple(MS_NOEXEC)) {
331 die("MS_NOEXEC malfunctions\n");
332 }
333 if (!test_unpriv_remount_atime(MS_RELATIME,
334 MS_NOATIME))
335 {
336 die("MS_RELATIME malfunctions\n");
337 }
338 if (!test_unpriv_remount_atime(MS_STRICTATIME,
339 MS_NOATIME))
340 {
341 die("MS_STRICTATIME malfunctions\n");
342 }
343 if (!test_unpriv_remount_atime(MS_NOATIME,
344 MS_STRICTATIME))
345 {
346 die("MS_NOATIME malfunctions\n");
347 }
348 if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODIRATIME,
349 MS_NOATIME))
350 {
351 die("MS_RELATIME|MS_NODIRATIME malfunctions\n");
352 }
353 if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODIRATIME,
354 MS_NOATIME))
355 {
356 die("MS_STRICTATIME|MS_NODIRATIME malfunctions\n");
357 }
358 if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODIRATIME,
359 MS_STRICTATIME))
360 {
361 die("MS_NOATIME|MS_DIRATIME malfunctions\n");
362 }
363 if (!test_unpriv_remount("ramfs", NULL, MS_STRICTATIME, 0, MS_NOATIME))
364 {
365 die("Default atime malfunctions\n");
366 }
367 if (!test_priv_mount_unpriv_remount()) {
368 die("Mount flags unexpectedly changed after remount\n");
369 }
370 return EXIT_SUCCESS;
371 }
372