1 /*
2 * Copyright (C) 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <linux/futex.h>
18 #include <pthread.h>
19 #include <sys/stat.h>
20 #include <unistd.h>
21
22 #include <algorithm>
23 #include <atomic>
24 #include <chrono>
25 #include <string>
26 #include <thread>
27 #include <vector>
28
29 #include <android-base/file.h>
30 #include <android-base/scopeguard.h>
31 #include <gtest/gtest.h>
32 #include <selinux/android.h>
33 #include <selinux/label.h>
34 #include <selinux/selinux.h>
35
36 using namespace std::chrono_literals;
37 using namespace std::string_literals;
38
39 template <typename T, typename F>
WriteFromMultipleThreads(std::vector<std::pair<std::string,T>> & files_and_parameters,F function)40 void WriteFromMultipleThreads(std::vector<std::pair<std::string, T>>& files_and_parameters,
41 F function) {
42 auto num_threads = files_and_parameters.size();
43 pthread_barrier_t barrier;
44 pthread_barrier_init(&barrier, nullptr, num_threads);
45 auto barrier_destroy =
46 android::base::make_scope_guard([&barrier]() { pthread_barrier_destroy(&barrier); });
47
48 auto make_thread_function = [&function, &barrier](const auto& file, const auto& parameter) {
49 return [&]() {
50 function(parameter);
51 pthread_barrier_wait(&barrier);
52 android::base::WriteStringToFile("<empty>", file);
53 };
54 };
55
56 std::vector<std::thread> threads;
57 for (const auto& [file, parameter] : files_and_parameters) {
58 threads.emplace_back(std::thread(make_thread_function(file, parameter)));
59 }
60
61 for (auto& thread : threads) {
62 thread.join();
63 }
64 }
65
TEST(ueventd,setegid_IsPerThread)66 TEST(ueventd, setegid_IsPerThread) {
67 if (getuid() != 0) {
68 GTEST_SKIP() << "Skipping test, must be run as root.";
69 return;
70 }
71
72 TemporaryDir dir;
73
74 gid_t gid = 0;
75 std::vector<std::pair<std::string, gid_t>> files_and_gids;
76 std::generate_n(std::back_inserter(files_and_gids), 100, [&gid, &dir]() {
77 gid++;
78 return std::pair(dir.path + "/gid_"s + std::to_string(gid), gid);
79 });
80
81 WriteFromMultipleThreads(files_and_gids, [](gid_t gid) { EXPECT_EQ(0, setegid(gid)); });
82
83 for (const auto& [file, expected_gid] : files_and_gids) {
84 struct stat info;
85 ASSERT_EQ(0, stat(file.c_str(), &info));
86 EXPECT_EQ(expected_gid, info.st_gid);
87 }
88 }
89
TEST(ueventd,setfscreatecon_IsPerThread)90 TEST(ueventd, setfscreatecon_IsPerThread) {
91 if (getuid() != 0) {
92 GTEST_SKIP() << "Skipping test, must be run as root.";
93 return;
94 }
95 if (!is_selinux_enabled() || security_getenforce() == 1) {
96 GTEST_SKIP() << "Skipping test, SELinux must be enabled and in permissive mode.";
97 return;
98 }
99
100 const char* const contexts[] = {
101 "u:object_r:audio_device:s0",
102 "u:object_r:sensors_device:s0",
103 "u:object_r:video_device:s0",
104 "u:object_r:zero_device:s0",
105 };
106
107 TemporaryDir dir;
108 std::vector<std::pair<std::string, std::string>> files_and_contexts;
109 for (const char* context : contexts) {
110 files_and_contexts.emplace_back(dir.path + "/context_"s + context, context);
111 }
112
113 WriteFromMultipleThreads(files_and_contexts, [](const std::string& context) {
114 EXPECT_EQ(0, setfscreatecon(context.c_str()));
115 });
116
117 for (const auto& [file, expected_context] : files_and_contexts) {
118 char* file_context;
119 ASSERT_GT(getfilecon(file.c_str(), &file_context), 0);
120 EXPECT_EQ(expected_context, file_context);
121 freecon(file_context);
122 }
123 }
124
TEST(ueventd,selabel_lookup_MultiThreaded)125 TEST(ueventd, selabel_lookup_MultiThreaded) {
126 if (getuid() != 0) {
127 GTEST_SKIP() << "Skipping test, must be run as root.";
128 return;
129 }
130
131 // Test parameters
132 constexpr auto num_threads = 10;
133 constexpr auto run_time = 200ms;
134
135 std::unique_ptr<selabel_handle, decltype(&selabel_close)> sehandle(
136 selinux_android_file_context_handle(), &selabel_close);
137
138 ASSERT_TRUE(sehandle);
139
140 struct {
141 const char* file;
142 int mode;
143 std::string expected_context;
144 } files_and_modes[] = {
145 {"/dev/zero", 020666, ""},
146 {"/dev/null", 020666, ""},
147 {"/dev/random", 020666, ""},
148 {"/dev/urandom", 020666, ""},
149 };
150
151 // Precondition, ensure that we can lookup all of these from a single thread, and store the
152 // expected context for each.
153 for (size_t i = 0; i < arraysize(files_and_modes); ++i) {
154 char* secontext;
155 ASSERT_EQ(0, selabel_lookup(sehandle.get(), &secontext, files_and_modes[i].file,
156 files_and_modes[i].mode));
157 files_and_modes[i].expected_context = secontext;
158 freecon(secontext);
159 }
160
161 // Now that we know we can access them, and what their context should be, run in parallel.
162 std::atomic_bool stopped = false;
163 std::atomic_uint num_api_failures = 0;
164 std::atomic_uint num_context_check_failures = 0;
165 std::atomic_uint num_successes = 0;
166
167 auto thread_function = [&]() {
168 while (!stopped) {
169 for (size_t i = 0; i < arraysize(files_and_modes); ++i) {
170 char* secontext;
171 int result = selabel_lookup(sehandle.get(), &secontext, files_and_modes[i].file,
172 files_and_modes[i].mode);
173 if (result != 0) {
174 num_api_failures++;
175 } else {
176 if (files_and_modes[i].expected_context != secontext) {
177 num_context_check_failures++;
178 } else {
179 num_successes++;
180 }
181 freecon(secontext);
182 }
183 }
184 }
185 };
186
187 std::vector<std::thread> threads;
188 std::generate_n(back_inserter(threads), num_threads,
189 [&]() { return std::thread(thread_function); });
190
191 std::this_thread::sleep_for(run_time);
192 stopped = true;
193 for (auto& thread : threads) {
194 thread.join();
195 }
196
197 EXPECT_EQ(0U, num_api_failures);
198 EXPECT_EQ(0U, num_context_check_failures);
199 EXPECT_GT(num_successes, 0U);
200 }
201