mirror of
https://github.com/nxp-imx/linux-imx.git
synced 2025-07-11 11:55:28 +02:00
selftests/landlock: Add cred_transfer test
commitcc374782b6
upstream. Check that keyctl(KEYCTL_SESSION_TO_PARENT) preserves the parent's restrictions. Fixes:e1199815b4
("selftests/landlock: Add user space tests") Co-developed-by: Jann Horn <jannh@google.com> Signed-off-by: Jann Horn <jannh@google.com> Link: https://lore.kernel.org/r/20240724.Ood5aige9she@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
6a74f52aab
commit
27be7ff9ff
|
@ -9,6 +9,7 @@
|
||||||
#define _GNU_SOURCE
|
#define _GNU_SOURCE
|
||||||
#include <errno.h>
|
#include <errno.h>
|
||||||
#include <fcntl.h>
|
#include <fcntl.h>
|
||||||
|
#include <linux/keyctl.h>
|
||||||
#include <linux/landlock.h>
|
#include <linux/landlock.h>
|
||||||
#include <string.h>
|
#include <string.h>
|
||||||
#include <sys/prctl.h>
|
#include <sys/prctl.h>
|
||||||
|
@ -326,4 +327,77 @@ TEST(ruleset_fd_transfer)
|
||||||
ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
|
ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
TEST(cred_transfer)
|
||||||
|
{
|
||||||
|
struct landlock_ruleset_attr ruleset_attr = {
|
||||||
|
.handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR,
|
||||||
|
};
|
||||||
|
int ruleset_fd, dir_fd;
|
||||||
|
pid_t child;
|
||||||
|
int status;
|
||||||
|
|
||||||
|
drop_caps(_metadata);
|
||||||
|
|
||||||
|
dir_fd = open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
|
||||||
|
EXPECT_LE(0, dir_fd);
|
||||||
|
EXPECT_EQ(0, close(dir_fd));
|
||||||
|
|
||||||
|
/* Denies opening directories. */
|
||||||
|
ruleset_fd =
|
||||||
|
landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
|
||||||
|
ASSERT_LE(0, ruleset_fd);
|
||||||
|
EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
|
||||||
|
ASSERT_EQ(0, landlock_restrict_self(ruleset_fd, 0));
|
||||||
|
EXPECT_EQ(0, close(ruleset_fd));
|
||||||
|
|
||||||
|
/* Checks ruleset enforcement. */
|
||||||
|
EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
|
||||||
|
EXPECT_EQ(EACCES, errno);
|
||||||
|
|
||||||
|
/* Needed for KEYCTL_SESSION_TO_PARENT permission checks */
|
||||||
|
EXPECT_NE(-1, syscall(__NR_keyctl, KEYCTL_JOIN_SESSION_KEYRING, NULL, 0,
|
||||||
|
0, 0))
|
||||||
|
{
|
||||||
|
TH_LOG("Failed to join session keyring: %s", strerror(errno));
|
||||||
|
}
|
||||||
|
|
||||||
|
child = fork();
|
||||||
|
ASSERT_LE(0, child);
|
||||||
|
if (child == 0) {
|
||||||
|
/* Checks ruleset enforcement. */
|
||||||
|
EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
|
||||||
|
EXPECT_EQ(EACCES, errno);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* KEYCTL_SESSION_TO_PARENT is a no-op unless we have a
|
||||||
|
* different session keyring in the child, so make that happen.
|
||||||
|
*/
|
||||||
|
EXPECT_NE(-1, syscall(__NR_keyctl, KEYCTL_JOIN_SESSION_KEYRING,
|
||||||
|
NULL, 0, 0, 0));
|
||||||
|
|
||||||
|
/*
|
||||||
|
* KEYCTL_SESSION_TO_PARENT installs credentials on the parent
|
||||||
|
* that never go through the cred_prepare hook, this path uses
|
||||||
|
* cred_transfer instead.
|
||||||
|
*/
|
||||||
|
EXPECT_EQ(0, syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT, 0,
|
||||||
|
0, 0, 0));
|
||||||
|
|
||||||
|
/* Re-checks ruleset enforcement. */
|
||||||
|
EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
|
||||||
|
EXPECT_EQ(EACCES, errno);
|
||||||
|
|
||||||
|
_exit(_metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
EXPECT_EQ(child, waitpid(child, &status, 0));
|
||||||
|
EXPECT_EQ(1, WIFEXITED(status));
|
||||||
|
EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
|
||||||
|
|
||||||
|
/* Re-checks ruleset enforcement. */
|
||||||
|
EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
|
||||||
|
EXPECT_EQ(EACCES, errno);
|
||||||
|
}
|
||||||
|
|
||||||
TEST_HARNESS_MAIN
|
TEST_HARNESS_MAIN
|
||||||
|
|
|
@ -1,5 +1,6 @@
|
||||||
CONFIG_CGROUPS=y
|
CONFIG_CGROUPS=y
|
||||||
CONFIG_CGROUP_SCHED=y
|
CONFIG_CGROUP_SCHED=y
|
||||||
|
CONFIG_KEYS=y
|
||||||
CONFIG_OVERLAY_FS=y
|
CONFIG_OVERLAY_FS=y
|
||||||
CONFIG_PROC_FS=y
|
CONFIG_PROC_FS=y
|
||||||
CONFIG_SECURITY=y
|
CONFIG_SECURITY=y
|
||||||
|
|
Loading…
Reference in New Issue
Block a user