kevin/linux
1
Fork 0
Code

selftests/landlock: Add cred_transfer test

Browse Source 
Check that keyctl(KEYCTL_SESSION_TO_PARENT) preserves the parent's
restrictions.

Fixes: e1199815b4 ("selftests/landlock: Add user space tests")
Co-developed-by: Jann Horn <jannh@google.com>
Signed-off-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/r/20240724.Ood5aige9she@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
This commit is contained in:
Mickaël Salaün 2024-07-24 16:54:26 +02:00
parent 39705a6c29
commit cc374782b6
No known key found for this signature in database
GPG Key ID: E5E3D0E88C82F6D2
2 changed files with 75 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
tools/testing/selftests/landlock/base_test.c
View File

@ -9,6 +9,7 @@
#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <linux/keyctl.h>
#include <linux/landlock.h>
#include <string.h>
#include <sys/prctl.h>
@ -326,4 +327,77 @@ TEST(ruleset_fd_transfer)
ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
}
TEST(cred_transfer)
{
struct landlock_ruleset_attr ruleset_attr = {
.handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR,
};
int ruleset_fd, dir_fd;
pid_t child;
int status;
drop_caps(_metadata);
dir_fd = open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
EXPECT_LE(0, dir_fd);
EXPECT_EQ(0, close(dir_fd));
/* Denies opening directories. */
ruleset_fd =
landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
ASSERT_LE(0, ruleset_fd);
EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
ASSERT_EQ(0, landlock_restrict_self(ruleset_fd, 0));
EXPECT_EQ(0, close(ruleset_fd));
/* Checks ruleset enforcement. */
EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
EXPECT_EQ(EACCES, errno);
/* Needed for KEYCTL_SESSION_TO_PARENT permission checks */
EXPECT_NE(-1, syscall(__NR_keyctl, KEYCTL_JOIN_SESSION_KEYRING, NULL, 0,
0, 0))
{
TH_LOG("Failed to join session keyring: %s", strerror(errno));
}
child = fork();
ASSERT_LE(0, child);
if (child == 0) {
/* Checks ruleset enforcement. */
EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
EXPECT_EQ(EACCES, errno);
/*
* KEYCTL_SESSION_TO_PARENT is a no-op unless we have a
* different session keyring in the child, so make that happen.
*/
EXPECT_NE(-1, syscall(__NR_keyctl, KEYCTL_JOIN_SESSION_KEYRING,
NULL, 0, 0, 0));
/*
* KEYCTL_SESSION_TO_PARENT installs credentials on the parent
* that never go through the cred_prepare hook, this path uses
* cred_transfer instead.
*/
EXPECT_EQ(0, syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT, 0,
0, 0, 0));
/* Re-checks ruleset enforcement. */
EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
EXPECT_EQ(EACCES, errno);
_exit(_metadata->exit_code);
return;
}
EXPECT_EQ(child, waitpid(child, &status, 0));
EXPECT_EQ(1, WIFEXITED(status));
EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
/* Re-checks ruleset enforcement. */
EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
EXPECT_EQ(EACCES, errno);
}
TEST_HARNESS_MAIN

1
tools/testing/selftests/landlock/config
View File

@ -2,6 +2,7 @@ CONFIG_CGROUPS=y
CONFIG_CGROUP_SCHED=y
CONFIG_INET=y
CONFIG_IPV6=y
CONFIG_KEYS=y
CONFIG_NET=y
CONFIG_NET_NS=y
CONFIG_OVERLAY_FS=y