1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Landlock tests - Common user space base
4 *
5 * Copyright �� 2017-2020 Micka��l Sala��n <mic@digikod.net>
6 * Copyright �� 2019-2020 ANSSI
7 */
8
9#define _GNU_SOURCE
10#include <errno.h>
11#include <fcntl.h>
12#include <linux/landlock.h>
13#include <string.h>
14#include <sys/prctl.h>
15#include <sys/socket.h>
16#include <sys/types.h>
17
18#include "common.h"
19
20#ifndef O_PATH
21#define O_PATH 010000000
22#endif
23
24TEST(inconsistent_attr)
25{
26	const long page_size = sysconf(_SC_PAGESIZE);
27	char *const buf = malloc(page_size + 1);
28	struct landlock_ruleset_attr *const ruleset_attr = (void *)buf;
29
30	ASSERT_NE(NULL, buf);
31
32	/* Checks copy_from_user(). */
33	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 0, 0));
34	/* The size if less than sizeof(struct landlock_attr_enforce). */
35	ASSERT_EQ(EINVAL, errno);
36	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 1, 0));
37	ASSERT_EQ(EINVAL, errno);
38	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 7, 0));
39	ASSERT_EQ(EINVAL, errno);
40
41	ASSERT_EQ(-1, landlock_create_ruleset(NULL, 1, 0));
42	/* The size if less than sizeof(struct landlock_attr_enforce). */
43	ASSERT_EQ(EFAULT, errno);
44
45	ASSERT_EQ(-1, landlock_create_ruleset(
46			      NULL, sizeof(struct landlock_ruleset_attr), 0));
47	ASSERT_EQ(EFAULT, errno);
48
49	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size + 1, 0));
50	ASSERT_EQ(E2BIG, errno);
51
52	/* Checks minimal valid attribute size. */
53	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, 8, 0));
54	ASSERT_EQ(ENOMSG, errno);
55	ASSERT_EQ(-1, landlock_create_ruleset(
56			      ruleset_attr,
57			      sizeof(struct landlock_ruleset_attr), 0));
58	ASSERT_EQ(ENOMSG, errno);
59	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size, 0));
60	ASSERT_EQ(ENOMSG, errno);
61
62	/* Checks non-zero value. */
63	buf[page_size - 2] = '.';
64	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size, 0));
65	ASSERT_EQ(E2BIG, errno);
66
67	ASSERT_EQ(-1, landlock_create_ruleset(ruleset_attr, page_size + 1, 0));
68	ASSERT_EQ(E2BIG, errno);
69
70	free(buf);
71}
72
73TEST(abi_version)
74{
75	const struct landlock_ruleset_attr ruleset_attr = {
76		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE,
77	};
78	ASSERT_EQ(4, landlock_create_ruleset(NULL, 0,
79					     LANDLOCK_CREATE_RULESET_VERSION));
80
81	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0,
82					      LANDLOCK_CREATE_RULESET_VERSION));
83	ASSERT_EQ(EINVAL, errno);
84
85	ASSERT_EQ(-1, landlock_create_ruleset(NULL, sizeof(ruleset_attr),
86					      LANDLOCK_CREATE_RULESET_VERSION));
87	ASSERT_EQ(EINVAL, errno);
88
89	ASSERT_EQ(-1,
90		  landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr),
91					  LANDLOCK_CREATE_RULESET_VERSION));
92	ASSERT_EQ(EINVAL, errno);
93
94	ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0,
95					      LANDLOCK_CREATE_RULESET_VERSION |
96						      1 << 31));
97	ASSERT_EQ(EINVAL, errno);
98}
99
100/* Tests ordering of syscall argument checks. */
101TEST(create_ruleset_checks_ordering)
102{
103	const int last_flag = LANDLOCK_CREATE_RULESET_VERSION;
104	const int invalid_flag = last_flag << 1;
105	int ruleset_fd;
106	const struct landlock_ruleset_attr ruleset_attr = {
107		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE,
108	};
109
110	/* Checks priority for invalid flags. */
111	ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0, invalid_flag));
112	ASSERT_EQ(EINVAL, errno);
113
114	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0, invalid_flag));
115	ASSERT_EQ(EINVAL, errno);
116
117	ASSERT_EQ(-1, landlock_create_ruleset(NULL, sizeof(ruleset_attr),
118					      invalid_flag));
119	ASSERT_EQ(EINVAL, errno);
120
121	ASSERT_EQ(-1,
122		  landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr),
123					  invalid_flag));
124	ASSERT_EQ(EINVAL, errno);
125
126	/* Checks too big ruleset_attr size. */
127	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, -1, 0));
128	ASSERT_EQ(E2BIG, errno);
129
130	/* Checks too small ruleset_attr size. */
131	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0, 0));
132	ASSERT_EQ(EINVAL, errno);
133	ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 1, 0));
134	ASSERT_EQ(EINVAL, errno);
135
136	/* Checks valid call. */
137	ruleset_fd =
138		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
139	ASSERT_LE(0, ruleset_fd);
140	ASSERT_EQ(0, close(ruleset_fd));
141}
142
143/* Tests ordering of syscall argument checks. */
144TEST(add_rule_checks_ordering)
145{
146	const struct landlock_ruleset_attr ruleset_attr = {
147		.handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE,
148	};
149	struct landlock_path_beneath_attr path_beneath_attr = {
150		.allowed_access = LANDLOCK_ACCESS_FS_EXECUTE,
151		.parent_fd = -1,
152	};
153	const int ruleset_fd =
154		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
155
156	ASSERT_LE(0, ruleset_fd);
157
158	/* Checks invalid flags. */
159	ASSERT_EQ(-1, landlock_add_rule(-1, 0, NULL, 1));
160	ASSERT_EQ(EINVAL, errno);
161
162	/* Checks invalid ruleset FD. */
163	ASSERT_EQ(-1, landlock_add_rule(-1, 0, NULL, 0));
164	ASSERT_EQ(EBADF, errno);
165
166	/* Checks invalid rule type. */
167	ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, 0, NULL, 0));
168	ASSERT_EQ(EINVAL, errno);
169
170	/* Checks invalid rule attr. */
171	ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
172					NULL, 0));
173	ASSERT_EQ(EFAULT, errno);
174
175	/* Checks invalid path_beneath.parent_fd. */
176	ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
177					&path_beneath_attr, 0));
178	ASSERT_EQ(EBADF, errno);
179
180	/* Checks valid call. */
181	path_beneath_attr.parent_fd =
182		open("/tmp", O_PATH | O_NOFOLLOW | O_DIRECTORY | O_CLOEXEC);
183	ASSERT_LE(0, path_beneath_attr.parent_fd);
184	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
185				       &path_beneath_attr, 0));
186	ASSERT_EQ(0, close(path_beneath_attr.parent_fd));
187	ASSERT_EQ(0, close(ruleset_fd));
188}
189
190/* Tests ordering of syscall argument and permission checks. */
191TEST(restrict_self_checks_ordering)
192{
193	const struct landlock_ruleset_attr ruleset_attr = {
194		.handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE,
195	};
196	struct landlock_path_beneath_attr path_beneath_attr = {
197		.allowed_access = LANDLOCK_ACCESS_FS_EXECUTE,
198		.parent_fd = -1,
199	};
200	const int ruleset_fd =
201		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
202
203	ASSERT_LE(0, ruleset_fd);
204	path_beneath_attr.parent_fd =
205		open("/tmp", O_PATH | O_NOFOLLOW | O_DIRECTORY | O_CLOEXEC);
206	ASSERT_LE(0, path_beneath_attr.parent_fd);
207	ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
208				       &path_beneath_attr, 0));
209	ASSERT_EQ(0, close(path_beneath_attr.parent_fd));
210
211	/* Checks unprivileged enforcement without no_new_privs. */
212	drop_caps(_metadata);
213	ASSERT_EQ(-1, landlock_restrict_self(-1, -1));
214	ASSERT_EQ(EPERM, errno);
215	ASSERT_EQ(-1, landlock_restrict_self(-1, 0));
216	ASSERT_EQ(EPERM, errno);
217	ASSERT_EQ(-1, landlock_restrict_self(ruleset_fd, 0));
218	ASSERT_EQ(EPERM, errno);
219
220	ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
221
222	/* Checks invalid flags. */
223	ASSERT_EQ(-1, landlock_restrict_self(-1, -1));
224	ASSERT_EQ(EINVAL, errno);
225
226	/* Checks invalid ruleset FD. */
227	ASSERT_EQ(-1, landlock_restrict_self(-1, 0));
228	ASSERT_EQ(EBADF, errno);
229
230	/* Checks valid call. */
231	ASSERT_EQ(0, landlock_restrict_self(ruleset_fd, 0));
232	ASSERT_EQ(0, close(ruleset_fd));
233}
234
235TEST(ruleset_fd_io)
236{
237	struct landlock_ruleset_attr ruleset_attr = {
238		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE,
239	};
240	int ruleset_fd;
241	char buf;
242
243	drop_caps(_metadata);
244	ruleset_fd =
245		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
246	ASSERT_LE(0, ruleset_fd);
247
248	ASSERT_EQ(-1, write(ruleset_fd, ".", 1));
249	ASSERT_EQ(EINVAL, errno);
250	ASSERT_EQ(-1, read(ruleset_fd, &buf, 1));
251	ASSERT_EQ(EINVAL, errno);
252
253	ASSERT_EQ(0, close(ruleset_fd));
254}
255
256/* Tests enforcement of a ruleset FD transferred through a UNIX socket. */
257TEST(ruleset_fd_transfer)
258{
259	struct landlock_ruleset_attr ruleset_attr = {
260		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR,
261	};
262	struct landlock_path_beneath_attr path_beneath_attr = {
263		.allowed_access = LANDLOCK_ACCESS_FS_READ_DIR,
264	};
265	int ruleset_fd_tx, dir_fd;
266	int socket_fds[2];
267	pid_t child;
268	int status;
269
270	drop_caps(_metadata);
271
272	/* Creates a test ruleset with a simple rule. */
273	ruleset_fd_tx =
274		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
275	ASSERT_LE(0, ruleset_fd_tx);
276	path_beneath_attr.parent_fd =
277		open("/tmp", O_PATH | O_NOFOLLOW | O_DIRECTORY | O_CLOEXEC);
278	ASSERT_LE(0, path_beneath_attr.parent_fd);
279	ASSERT_EQ(0,
280		  landlock_add_rule(ruleset_fd_tx, LANDLOCK_RULE_PATH_BENEATH,
281				    &path_beneath_attr, 0));
282	ASSERT_EQ(0, close(path_beneath_attr.parent_fd));
283
284	/* Sends the ruleset FD over a socketpair and then close it. */
285	ASSERT_EQ(0, socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0,
286				socket_fds));
287	ASSERT_EQ(0, send_fd(socket_fds[0], ruleset_fd_tx));
288	ASSERT_EQ(0, close(socket_fds[0]));
289	ASSERT_EQ(0, close(ruleset_fd_tx));
290
291	child = fork();
292	ASSERT_LE(0, child);
293	if (child == 0) {
294		const int ruleset_fd_rx = recv_fd(socket_fds[1]);
295
296		ASSERT_LE(0, ruleset_fd_rx);
297		ASSERT_EQ(0, close(socket_fds[1]));
298
299		/* Enforces the received ruleset on the child. */
300		ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
301		ASSERT_EQ(0, landlock_restrict_self(ruleset_fd_rx, 0));
302		ASSERT_EQ(0, close(ruleset_fd_rx));
303
304		/* Checks that the ruleset enforcement. */
305		ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
306		ASSERT_EQ(EACCES, errno);
307		dir_fd = open("/tmp", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
308		ASSERT_LE(0, dir_fd);
309		ASSERT_EQ(0, close(dir_fd));
310		_exit(_metadata->exit_code);
311		return;
312	}
313
314	ASSERT_EQ(0, close(socket_fds[1]));
315
316	/* Checks that the parent is unrestricted. */
317	dir_fd = open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
318	ASSERT_LE(0, dir_fd);
319	ASSERT_EQ(0, close(dir_fd));
320	dir_fd = open("/tmp", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
321	ASSERT_LE(0, dir_fd);
322	ASSERT_EQ(0, close(dir_fd));
323
324	ASSERT_EQ(child, waitpid(child, &status, 0));
325	ASSERT_EQ(1, WIFEXITED(status));
326	ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
327}
328
329TEST_HARNESS_MAIN
330