mirror of
git://git.yoctoproject.org/linux-yocto.git
synced 2025-08-21 16:31:14 +02:00
fefcf0f7cf
Add three tests that examine different scenarios for abstract UNIX socket: 1) scoped_domains: Base tests of the abstract socket scoping mechanism for a landlocked process, same as the ptrace test. 2) scoped_vs_unscoped: Generates three processes with different domains and tests if a process with a non-scoped domain can connect to other processes. 3) outside_socket: Since the socket's creator credentials are used for scoping sockets, this test examines the cases where the socket's credentials are different from the process using it. Move protocol_variant, service_fixture, and sys_gettid() from net_test.c to common.h, and factor out code into a new set_unix_address() helper. Signed-off-by: Tahera Fahimi <fahimitahera@gmail.com> Link: https://lore.kernel.org/r/9321c3d3bcd9212ceb4b50693e29349f8d625e16.1725494372.git.fahimitahera@gmail.com [mic: Fix commit message, remove useless clang-format tags, move drop_caps() calls, move and rename variables, rename variants, use more EXPECT, improve comments, simplify the outside_socket test] Signed-off-by: Mickaël Salaün <mic@digikod.net>
157 lines
3.4 KiB
C
157 lines
3.4 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Landlock scoped_domains variants
|
|
*
|
|
* See the hierarchy variants from ptrace_test.c
|
|
*
|
|
* Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>
|
|
* Copyright © 2019-2020 ANSSI
|
|
* Copyright © 2024 Tahera Fahimi <fahimitahera@gmail.com>
|
|
*/
|
|
|
|
/* clang-format on */
|
|
FIXTURE_VARIANT(scoped_domains)
|
|
{
|
|
bool domain_both;
|
|
bool domain_parent;
|
|
bool domain_child;
|
|
};
|
|
|
|
/*
|
|
* No domain
|
|
*
|
|
* P1-. P1 -> P2 : allow
|
|
* \ P2 -> P1 : allow
|
|
* 'P2
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_domains, without_domain) {
|
|
/* clang-format on */
|
|
.domain_both = false,
|
|
.domain_parent = false,
|
|
.domain_child = false,
|
|
};
|
|
|
|
/*
|
|
* Child domain
|
|
*
|
|
* P1--. P1 -> P2 : allow
|
|
* \ P2 -> P1 : deny
|
|
* .'-----.
|
|
* | P2 |
|
|
* '------'
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_domains, child_domain) {
|
|
/* clang-format on */
|
|
.domain_both = false,
|
|
.domain_parent = false,
|
|
.domain_child = true,
|
|
};
|
|
|
|
/*
|
|
* Parent domain
|
|
* .------.
|
|
* | P1 --. P1 -> P2 : deny
|
|
* '------' \ P2 -> P1 : allow
|
|
* '
|
|
* P2
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_domains, parent_domain) {
|
|
/* clang-format on */
|
|
.domain_both = false,
|
|
.domain_parent = true,
|
|
.domain_child = false,
|
|
};
|
|
|
|
/*
|
|
* Parent + child domain (siblings)
|
|
* .------.
|
|
* | P1 ---. P1 -> P2 : deny
|
|
* '------' \ P2 -> P1 : deny
|
|
* .---'--.
|
|
* | P2 |
|
|
* '------'
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_domains, sibling_domain) {
|
|
/* clang-format on */
|
|
.domain_both = false,
|
|
.domain_parent = true,
|
|
.domain_child = true,
|
|
};
|
|
|
|
/*
|
|
* Same domain (inherited)
|
|
* .-------------.
|
|
* | P1----. | P1 -> P2 : allow
|
|
* | \ | P2 -> P1 : allow
|
|
* | ' |
|
|
* | P2 |
|
|
* '-------------'
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_domains, inherited_domain) {
|
|
/* clang-format on */
|
|
.domain_both = true,
|
|
.domain_parent = false,
|
|
.domain_child = false,
|
|
};
|
|
|
|
/*
|
|
* Inherited + child domain
|
|
* .-----------------.
|
|
* | P1----. | P1 -> P2 : allow
|
|
* | \ | P2 -> P1 : deny
|
|
* | .-'----. |
|
|
* | | P2 | |
|
|
* | '------' |
|
|
* '-----------------'
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_domains, nested_domain) {
|
|
/* clang-format on */
|
|
.domain_both = true,
|
|
.domain_parent = false,
|
|
.domain_child = true,
|
|
};
|
|
|
|
/*
|
|
* Inherited + parent domain
|
|
* .-----------------.
|
|
* |.------. | P1 -> P2 : deny
|
|
* || P1 ----. | P2 -> P1 : allow
|
|
* |'------' \ |
|
|
* | ' |
|
|
* | P2 |
|
|
* '-----------------'
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_domains, nested_and_parent_domain) {
|
|
/* clang-format on */
|
|
.domain_both = true,
|
|
.domain_parent = true,
|
|
.domain_child = false,
|
|
};
|
|
|
|
/*
|
|
* Inherited + parent and child domain (siblings)
|
|
* .-----------------.
|
|
* | .------. | P1 -> P2 : deny
|
|
* | | P1 . | P2 -> P1 : deny
|
|
* | '------'\ |
|
|
* | \ |
|
|
* | .--'---. |
|
|
* | | P2 | |
|
|
* | '------' |
|
|
* '-----------------'
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_domains, forked_domains) {
|
|
/* clang-format on */
|
|
.domain_both = true,
|
|
.domain_parent = true,
|
|
.domain_child = true,
|
|
};
|