| Message ID | 20240701-landlock-v1-10-58e9af649a72@suse.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | landlock testing suite | expand |
Nice work on those landlock syscalls test. Reviewed-by: Li Wang <liwang@redhat.com> On Mon, Jul 1, 2024 at 11:45 PM Andrea Cervesato <andrea.cervesato@suse.de> wrote: > From: Andrea Cervesato <andrea.cervesato@suse.com> > > This test verifies LANDLOCK_ACCESS_FS_IOCTL_DEV access in the > landlock sandbox by creating a pipe and testing that ioctl() can > be executed on it. The test is also verifying that some of the I/O > operations can be always executed no matter the sandbox rules. > This feature is available since kernel 6.10. > > Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com> > --- > runtest/syscalls | 1 + > testcases/kernel/syscalls/landlock/.gitignore | 1 + > testcases/kernel/syscalls/landlock/landlock06.c | 110 > ++++++++++++++++++++++++ > 3 files changed, 112 insertions(+) > > diff --git a/runtest/syscalls b/runtest/syscalls > index a3ade6dc1..ebaf8dea4 100644 > --- a/runtest/syscalls > +++ b/runtest/syscalls > @@ -689,6 +689,7 @@ landlock02 landlock02 > landlock03 landlock03 > landlock04 landlock04 > landlock05 landlock05 > +landlock06 landlock06 > > lchown01 lchown01 > lchown01_16 lchown01_16 > diff --git a/testcases/kernel/syscalls/landlock/.gitignore > b/testcases/kernel/syscalls/landlock/.gitignore > index a7ea6be2e..315ac1dca 100644 > --- a/testcases/kernel/syscalls/landlock/.gitignore > +++ b/testcases/kernel/syscalls/landlock/.gitignore > @@ -4,3 +4,4 @@ landlock02 > landlock03 > landlock04 > landlock05 > +landlock06 > diff --git a/testcases/kernel/syscalls/landlock/landlock06.c > b/testcases/kernel/syscalls/landlock/landlock06.c > new file mode 100644 > index 000000000..3281c2d2d > --- /dev/null > +++ b/testcases/kernel/syscalls/landlock/landlock06.c > @@ -0,0 +1,110 @@ > +// SPDX-License-Identifier: GPL-2.0-or-later > +/* > + * Copyright (C) 2024 SUSE LLC Andrea Cervesato < > andrea.cervesato@suse.com> > + */ > + > +/*\ > + * [Description] > + * > + * This test verifies LANDLOCK_ACCESS_FS_IOCTL_DEV access in the > + * landlock sandbox by creating a pipe and testing that ioctl() can be > executed > + * on it. The test is also verifying that some of the I/O operations can > be > + * always executed no matter the sandbox rules. > + */ > + > +#include "landlock_common.h" > +#include <sys/ioctl.h> > + > +#define MNTPOINT "sandbox" > +#define FILENAME MNTPOINT"/fifo" > + > +static struct landlock_ruleset_attr *ruleset_attr; > +static struct landlock_path_beneath_attr *path_beneath_attr; > +static int file_fd; > +static int dev_fd; > + > +static void run(void) > +{ > + if (!SAFE_FORK()) { > + int flag; > + size_t sz = 0; > + > + TST_EXP_PASS(ioctl(file_fd, FIONREAD, &sz)); > + > + /* check unrestrictable commands */ > + TST_EXP_PASS(ioctl(dev_fd, FIOCLEX)); > + TST_EXP_PASS(ioctl(dev_fd, FIONCLEX)); > + TST_EXP_PASS(ioctl(dev_fd, FIONBIO, &flag)); > + TST_EXP_PASS(ioctl(dev_fd, FIOASYNC, &flag)); > + > + _exit(0); > + } > +} > + > +static void setup(void) > +{ > + int ruleset_fd; > + > + verify_landlock_is_enabled(); > + > + SAFE_MKFIFO(FILENAME, 0640); > + > + file_fd = SAFE_OPEN(FILENAME, O_RDONLY | O_NONBLOCK, 0640); > + dev_fd = SAFE_OPEN("/dev/zero", O_RDONLY | O_NONBLOCK, 0640); > + > + tst_res(TINFO, "Applying LANDLOCK_ACCESS_FS_IOCTL_DEV"); > + > + ruleset_attr->handled_access_fs = LANDLOCK_ACCESS_FS_IOCTL_DEV; > + > + ruleset_fd = SAFE_LANDLOCK_CREATE_RULESET( > + ruleset_attr, sizeof(struct landlock_ruleset_attr), 0); > + > + apply_landlock_layer( > + ruleset_attr, > + path_beneath_attr, > + MNTPOINT, > + LANDLOCK_ACCESS_FS_IOCTL_DEV > + ); > + > + SAFE_CLOSE(ruleset_fd); > +} > + > +static void cleanup(void) > +{ > + if (dev_fd != -1) > + SAFE_CLOSE(dev_fd); > + > + if (file_fd != -1) > + SAFE_CLOSE(file_fd); > +} > + > +static struct tst_test test = { > + .test_all = run, > + .setup = setup, > + .cleanup = cleanup, > + .min_kver = "6.10", > + .needs_tmpdir = 1, > + .needs_root = 1, > + .forks_child = 1, > + .needs_kconfigs = (const char *[]) { > + "CONFIG_SECURITY_LANDLOCK=y", > + NULL > + }, > + .bufs = (struct tst_buffers []) { > + {&ruleset_attr, .size = sizeof(struct > landlock_ruleset_attr)}, > + {&path_beneath_attr, .size = sizeof(struct > landlock_path_beneath_attr)}, > + {}, > + }, > + .caps = (struct tst_cap []) { > + TST_CAP(TST_CAP_REQ, CAP_SYS_ADMIN), > + {} > + }, > + .format_device = 1, > + .mount_device = 1, > + .mntpoint = MNTPOINT, > + .all_filesystems = 1, > + .skip_filesystems = (const char *[]) { > + "vfat", > + NULL > + }, > +}; > > -- > 2.43.0 > > > -- > Mailing list info: https://lists.linux.it/listinfo/ltp > >
diff --git a/runtest/syscalls b/runtest/syscalls index a3ade6dc1..ebaf8dea4 100644 --- a/runtest/syscalls +++ b/runtest/syscalls @@ -689,6 +689,7 @@ landlock02 landlock02 landlock03 landlock03 landlock04 landlock04 landlock05 landlock05 +landlock06 landlock06 lchown01 lchown01 lchown01_16 lchown01_16 diff --git a/testcases/kernel/syscalls/landlock/.gitignore b/testcases/kernel/syscalls/landlock/.gitignore index a7ea6be2e..315ac1dca 100644 --- a/testcases/kernel/syscalls/landlock/.gitignore +++ b/testcases/kernel/syscalls/landlock/.gitignore @@ -4,3 +4,4 @@ landlock02 landlock03 landlock04 landlock05 +landlock06 diff --git a/testcases/kernel/syscalls/landlock/landlock06.c b/testcases/kernel/syscalls/landlock/landlock06.c new file mode 100644 index 000000000..3281c2d2d --- /dev/null +++ b/testcases/kernel/syscalls/landlock/landlock06.c @@ -0,0 +1,110 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Copyright (C) 2024 SUSE LLC Andrea Cervesato <andrea.cervesato@suse.com> + */ + +/*\ + * [Description] + * + * This test verifies LANDLOCK_ACCESS_FS_IOCTL_DEV access in the + * landlock sandbox by creating a pipe and testing that ioctl() can be executed + * on it. The test is also verifying that some of the I/O operations can be + * always executed no matter the sandbox rules. + */ + +#include "landlock_common.h" +#include <sys/ioctl.h> + +#define MNTPOINT "sandbox" +#define FILENAME MNTPOINT"/fifo" + +static struct landlock_ruleset_attr *ruleset_attr; +static struct landlock_path_beneath_attr *path_beneath_attr; +static int file_fd; +static int dev_fd; + +static void run(void) +{ + if (!SAFE_FORK()) { + int flag; + size_t sz = 0; + + TST_EXP_PASS(ioctl(file_fd, FIONREAD, &sz)); + + /* check unrestrictable commands */ + TST_EXP_PASS(ioctl(dev_fd, FIOCLEX)); + TST_EXP_PASS(ioctl(dev_fd, FIONCLEX)); + TST_EXP_PASS(ioctl(dev_fd, FIONBIO, &flag)); + TST_EXP_PASS(ioctl(dev_fd, FIOASYNC, &flag)); + + _exit(0); + } +} + +static void setup(void) +{ + int ruleset_fd; + + verify_landlock_is_enabled(); + + SAFE_MKFIFO(FILENAME, 0640); + + file_fd = SAFE_OPEN(FILENAME, O_RDONLY | O_NONBLOCK, 0640); + dev_fd = SAFE_OPEN("/dev/zero", O_RDONLY | O_NONBLOCK, 0640); + + tst_res(TINFO, "Applying LANDLOCK_ACCESS_FS_IOCTL_DEV"); + + ruleset_attr->handled_access_fs = LANDLOCK_ACCESS_FS_IOCTL_DEV; + + ruleset_fd = SAFE_LANDLOCK_CREATE_RULESET( + ruleset_attr, sizeof(struct landlock_ruleset_attr), 0); + + apply_landlock_layer( + ruleset_attr, + path_beneath_attr, + MNTPOINT, + LANDLOCK_ACCESS_FS_IOCTL_DEV + ); + + SAFE_CLOSE(ruleset_fd); +} + +static void cleanup(void) +{ + if (dev_fd != -1) + SAFE_CLOSE(dev_fd); + + if (file_fd != -1) + SAFE_CLOSE(file_fd); +} + +static struct tst_test test = { + .test_all = run, + .setup = setup, + .cleanup = cleanup, + .min_kver = "6.10", + .needs_tmpdir = 1, + .needs_root = 1, + .forks_child = 1, + .needs_kconfigs = (const char *[]) { + "CONFIG_SECURITY_LANDLOCK=y", + NULL + }, + .bufs = (struct tst_buffers []) { + {&ruleset_attr, .size = sizeof(struct landlock_ruleset_attr)}, + {&path_beneath_attr, .size = sizeof(struct landlock_path_beneath_attr)}, + {}, + }, + .caps = (struct tst_cap []) { + TST_CAP(TST_CAP_REQ, CAP_SYS_ADMIN), + {} + }, + .format_device = 1, + .mount_device = 1, + .mntpoint = MNTPOINT, + .all_filesystems = 1, + .skip_filesystems = (const char *[]) { + "vfat", + NULL + }, +};