1 /* SPDX-License-Identifier: GPL-2.0 */
2 /*
3 * Landlock test helpers
4 *
5 * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>
6 * Copyright © 2019-2020 ANSSI
7 * Copyright © 2021 Microsoft Corporation
8 */
9
10 #include <arpa/inet.h>
11 #include <errno.h>
12 #include <linux/landlock.h>
13 #include <linux/securebits.h>
14 #include <sys/capability.h>
15 #include <sys/socket.h>
16 #include <sys/syscall.h>
17 #include <sys/types.h>
18 #include <sys/un.h>
19 #include <sys/wait.h>
20 #include <unistd.h>
21
22 #include "../kselftest_harness.h"
23
24 #define TMP_DIR "tmp"
25
26 #ifndef __maybe_unused
27 #define __maybe_unused __attribute__((__unused__))
28 #endif
29
30 /* TEST_F_FORK() should not be used for new tests. */
31 #define TEST_F_FORK(fixture_name, test_name) TEST_F(fixture_name, test_name)
32
33 #ifndef landlock_create_ruleset
34 static inline int
landlock_create_ruleset(const struct landlock_ruleset_attr * const attr,const size_t size,const __u32 flags)35 landlock_create_ruleset(const struct landlock_ruleset_attr *const attr,
36 const size_t size, const __u32 flags)
37 {
38 return syscall(__NR_landlock_create_ruleset, attr, size, flags);
39 }
40 #endif
41
42 #ifndef landlock_add_rule
landlock_add_rule(const int ruleset_fd,const enum landlock_rule_type rule_type,const void * const rule_attr,const __u32 flags)43 static inline int landlock_add_rule(const int ruleset_fd,
44 const enum landlock_rule_type rule_type,
45 const void *const rule_attr,
46 const __u32 flags)
47 {
48 return syscall(__NR_landlock_add_rule, ruleset_fd, rule_type, rule_attr,
49 flags);
50 }
51 #endif
52
53 #ifndef landlock_restrict_self
landlock_restrict_self(const int ruleset_fd,const __u32 flags)54 static inline int landlock_restrict_self(const int ruleset_fd,
55 const __u32 flags)
56 {
57 return syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
58 }
59 #endif
60
_init_caps(struct __test_metadata * const _metadata,bool drop_all)61 static void _init_caps(struct __test_metadata *const _metadata, bool drop_all)
62 {
63 cap_t cap_p;
64 /* Only these three capabilities are useful for the tests. */
65 const cap_value_t caps[] = {
66 /* clang-format off */
67 CAP_DAC_OVERRIDE,
68 CAP_MKNOD,
69 CAP_NET_ADMIN,
70 CAP_NET_BIND_SERVICE,
71 CAP_SETUID,
72 CAP_SYS_ADMIN,
73 CAP_SYS_CHROOT,
74 /* clang-format on */
75 };
76 const unsigned int noroot = SECBIT_NOROOT | SECBIT_NOROOT_LOCKED;
77
78 if ((cap_get_secbits() & noroot) != noroot)
79 EXPECT_EQ(0, cap_set_secbits(noroot));
80
81 cap_p = cap_get_proc();
82 EXPECT_NE(NULL, cap_p);
83 EXPECT_NE(-1, cap_clear(cap_p));
84 if (!drop_all) {
85 EXPECT_NE(-1, cap_set_flag(cap_p, CAP_PERMITTED,
86 ARRAY_SIZE(caps), caps, CAP_SET));
87 }
88
89 /* Automatically resets ambient capabilities. */
90 EXPECT_NE(-1, cap_set_proc(cap_p))
91 {
92 TH_LOG("Failed to set capabilities: %s", strerror(errno));
93 }
94 EXPECT_NE(-1, cap_free(cap_p));
95
96 /* Quickly checks that ambient capabilities are cleared. */
97 EXPECT_NE(-1, cap_get_ambient(caps[0]));
98 }
99
100 /* We cannot put such helpers in a library because of kselftest_harness.h . */
disable_caps(struct __test_metadata * const _metadata)101 static void __maybe_unused disable_caps(struct __test_metadata *const _metadata)
102 {
103 _init_caps(_metadata, false);
104 }
105
drop_caps(struct __test_metadata * const _metadata)106 static void __maybe_unused drop_caps(struct __test_metadata *const _metadata)
107 {
108 _init_caps(_metadata, true);
109 }
110
_change_cap(struct __test_metadata * const _metadata,const cap_flag_t flag,const cap_value_t cap,const cap_flag_value_t value)111 static void _change_cap(struct __test_metadata *const _metadata,
112 const cap_flag_t flag, const cap_value_t cap,
113 const cap_flag_value_t value)
114 {
115 cap_t cap_p;
116
117 cap_p = cap_get_proc();
118 EXPECT_NE(NULL, cap_p);
119 EXPECT_NE(-1, cap_set_flag(cap_p, flag, 1, &cap, value));
120 EXPECT_NE(-1, cap_set_proc(cap_p))
121 {
122 TH_LOG("Failed to set capability %d: %s", cap, strerror(errno));
123 }
124 EXPECT_NE(-1, cap_free(cap_p));
125 }
126
set_cap(struct __test_metadata * const _metadata,const cap_value_t cap)127 static void __maybe_unused set_cap(struct __test_metadata *const _metadata,
128 const cap_value_t cap)
129 {
130 _change_cap(_metadata, CAP_EFFECTIVE, cap, CAP_SET);
131 }
132
clear_cap(struct __test_metadata * const _metadata,const cap_value_t cap)133 static void __maybe_unused clear_cap(struct __test_metadata *const _metadata,
134 const cap_value_t cap)
135 {
136 _change_cap(_metadata, CAP_EFFECTIVE, cap, CAP_CLEAR);
137 }
138
139 static void __maybe_unused
set_ambient_cap(struct __test_metadata * const _metadata,const cap_value_t cap)140 set_ambient_cap(struct __test_metadata *const _metadata, const cap_value_t cap)
141 {
142 _change_cap(_metadata, CAP_INHERITABLE, cap, CAP_SET);
143
144 EXPECT_NE(-1, cap_set_ambient(cap, CAP_SET))
145 {
146 TH_LOG("Failed to set ambient capability %d: %s", cap,
147 strerror(errno));
148 }
149 }
150
clear_ambient_cap(struct __test_metadata * const _metadata,const cap_value_t cap)151 static void __maybe_unused clear_ambient_cap(
152 struct __test_metadata *const _metadata, const cap_value_t cap)
153 {
154 EXPECT_EQ(1, cap_get_ambient(cap));
155 _change_cap(_metadata, CAP_INHERITABLE, cap, CAP_CLEAR);
156 EXPECT_EQ(0, cap_get_ambient(cap));
157 }
158
159 /* Receives an FD from a UNIX socket. Returns the received FD, or -errno. */
recv_fd(int usock)160 static int __maybe_unused recv_fd(int usock)
161 {
162 int fd_rx;
163 union {
164 /* Aligned ancillary data buffer. */
165 char buf[CMSG_SPACE(sizeof(fd_rx))];
166 struct cmsghdr _align;
167 } cmsg_rx = {};
168 char data = '\0';
169 struct iovec io = {
170 .iov_base = &data,
171 .iov_len = sizeof(data),
172 };
173 struct msghdr msg = {
174 .msg_iov = &io,
175 .msg_iovlen = 1,
176 .msg_control = &cmsg_rx.buf,
177 .msg_controllen = sizeof(cmsg_rx.buf),
178 };
179 struct cmsghdr *cmsg;
180 int res;
181
182 res = recvmsg(usock, &msg, MSG_CMSG_CLOEXEC);
183 if (res < 0)
184 return -errno;
185
186 cmsg = CMSG_FIRSTHDR(&msg);
187 if (cmsg->cmsg_len != CMSG_LEN(sizeof(fd_rx)))
188 return -EIO;
189
190 memcpy(&fd_rx, CMSG_DATA(cmsg), sizeof(fd_rx));
191 return fd_rx;
192 }
193
194 /* Sends an FD on a UNIX socket. Returns 0 on success or -errno. */
send_fd(int usock,int fd_tx)195 static int __maybe_unused send_fd(int usock, int fd_tx)
196 {
197 union {
198 /* Aligned ancillary data buffer. */
199 char buf[CMSG_SPACE(sizeof(fd_tx))];
200 struct cmsghdr _align;
201 } cmsg_tx = {};
202 char data_tx = '.';
203 struct iovec io = {
204 .iov_base = &data_tx,
205 .iov_len = sizeof(data_tx),
206 };
207 struct msghdr msg = {
208 .msg_iov = &io,
209 .msg_iovlen = 1,
210 .msg_control = &cmsg_tx.buf,
211 .msg_controllen = sizeof(cmsg_tx.buf),
212 };
213 struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg);
214
215 cmsg->cmsg_len = CMSG_LEN(sizeof(fd_tx));
216 cmsg->cmsg_level = SOL_SOCKET;
217 cmsg->cmsg_type = SCM_RIGHTS;
218 memcpy(CMSG_DATA(cmsg), &fd_tx, sizeof(fd_tx));
219
220 if (sendmsg(usock, &msg, 0) < 0)
221 return -errno;
222 return 0;
223 }
224
225 static void __maybe_unused
enforce_ruleset(struct __test_metadata * const _metadata,const int ruleset_fd)226 enforce_ruleset(struct __test_metadata *const _metadata, const int ruleset_fd)
227 {
228 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
229 ASSERT_EQ(0, landlock_restrict_self(ruleset_fd, 0))
230 {
231 TH_LOG("Failed to enforce ruleset: %s", strerror(errno));
232 }
233 }
234
235 struct protocol_variant {
236 int domain;
237 int type;
238 int protocol;
239 };
240
241 struct service_fixture {
242 struct protocol_variant protocol;
243 /* port is also stored in ipv4_addr.sin_port or ipv6_addr.sin6_port */
244 unsigned short port;
245 union {
246 struct sockaddr_in ipv4_addr;
247 struct sockaddr_in6 ipv6_addr;
248 struct {
249 struct sockaddr_un unix_addr;
250 socklen_t unix_addr_len;
251 };
252 };
253 };
254
sys_gettid(void)255 static pid_t __maybe_unused sys_gettid(void)
256 {
257 return syscall(__NR_gettid);
258 }
259
set_unix_address(struct service_fixture * const srv,const unsigned short index)260 static void __maybe_unused set_unix_address(struct service_fixture *const srv,
261 const unsigned short index)
262 {
263 srv->unix_addr.sun_family = AF_UNIX;
264 sprintf(srv->unix_addr.sun_path,
265 "_selftests-landlock-abstract-unix-tid%d-index%d", sys_gettid(),
266 index);
267 srv->unix_addr_len = SUN_LEN(&srv->unix_addr);
268 srv->unix_addr.sun_path[0] = '\0';
269 }
270