mirror of
git://git.yoctoproject.org/linux-yocto.git
synced 2025-08-21 16:31:14 +02:00
fefcf0f7cf
Add three tests that examine different scenarios for abstract UNIX socket: 1) scoped_domains: Base tests of the abstract socket scoping mechanism for a landlocked process, same as the ptrace test. 2) scoped_vs_unscoped: Generates three processes with different domains and tests if a process with a non-scoped domain can connect to other processes. 3) outside_socket: Since the socket's creator credentials are used for scoping sockets, this test examines the cases where the socket's credentials are different from the process using it. Move protocol_variant, service_fixture, and sys_gettid() from net_test.c to common.h, and factor out code into a new set_unix_address() helper. Signed-off-by: Tahera Fahimi <fahimitahera@gmail.com> Link: https://lore.kernel.org/r/9321c3d3bcd9212ceb4b50693e29349f8d625e16.1725494372.git.fahimitahera@gmail.com [mic: Fix commit message, remove useless clang-format tags, move drop_caps() calls, move and rename variables, rename variants, use more EXPECT, improve comments, simplify the outside_socket test] Signed-off-by: Mickaël Salaün <mic@digikod.net>
153 lines
3.6 KiB
C
153 lines
3.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Landlock variants for three processes with various domains.
|
|
*
|
|
* Copyright © 2024 Tahera Fahimi <fahimitahera@gmail.com>
|
|
*/
|
|
|
|
enum sandbox_type {
|
|
NO_SANDBOX,
|
|
SCOPE_SANDBOX,
|
|
/* Any other type of sandboxing domain */
|
|
OTHER_SANDBOX,
|
|
};
|
|
|
|
/* clang-format on */
|
|
FIXTURE_VARIANT(scoped_vs_unscoped)
|
|
{
|
|
const int domain_all;
|
|
const int domain_parent;
|
|
const int domain_children;
|
|
const int domain_child;
|
|
const int domain_grand_child;
|
|
};
|
|
|
|
/*
|
|
* .-----------------.
|
|
* | ####### | P3 -> P2 : allow
|
|
* | P1----# P2 # | P3 -> P1 : deny
|
|
* | # | # |
|
|
* | # P3 # |
|
|
* | ####### |
|
|
* '-----------------'
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, deny_scoped) {
|
|
.domain_all = OTHER_SANDBOX,
|
|
.domain_parent = NO_SANDBOX,
|
|
.domain_children = SCOPE_SANDBOX,
|
|
.domain_child = NO_SANDBOX,
|
|
.domain_grand_child = NO_SANDBOX,
|
|
/* clang-format on */
|
|
};
|
|
|
|
/*
|
|
* ###################
|
|
* # ####### # P3 -> P2 : allow
|
|
* # P1----# P2 # # P3 -> P1 : deny
|
|
* # # | # #
|
|
* # # P3 # #
|
|
* # ####### #
|
|
* ###################
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, all_scoped) {
|
|
.domain_all = SCOPE_SANDBOX,
|
|
.domain_parent = NO_SANDBOX,
|
|
.domain_children = SCOPE_SANDBOX,
|
|
.domain_child = NO_SANDBOX,
|
|
.domain_grand_child = NO_SANDBOX,
|
|
/* clang-format on */
|
|
};
|
|
|
|
/*
|
|
* .-----------------.
|
|
* | .-----. | P3 -> P2 : allow
|
|
* | P1----| P2 | | P3 -> P1 : allow
|
|
* | | | |
|
|
* | | P3 | |
|
|
* | '-----' |
|
|
* '-----------------'
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, allow_with_other_domain) {
|
|
.domain_all = OTHER_SANDBOX,
|
|
.domain_parent = NO_SANDBOX,
|
|
.domain_children = OTHER_SANDBOX,
|
|
.domain_child = NO_SANDBOX,
|
|
.domain_grand_child = NO_SANDBOX,
|
|
/* clang-format on */
|
|
};
|
|
|
|
/*
|
|
* .----. ###### P3 -> P2 : allow
|
|
* | P1 |----# P2 # P3 -> P1 : allow
|
|
* '----' ######
|
|
* |
|
|
* P3
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, allow_with_one_domain) {
|
|
.domain_all = NO_SANDBOX,
|
|
.domain_parent = OTHER_SANDBOX,
|
|
.domain_children = NO_SANDBOX,
|
|
.domain_child = SCOPE_SANDBOX,
|
|
.domain_grand_child = NO_SANDBOX,
|
|
/* clang-format on */
|
|
};
|
|
|
|
/*
|
|
* ###### .-----. P3 -> P2 : allow
|
|
* # P1 #----| P2 | P3 -> P1 : allow
|
|
* ###### '-----'
|
|
* |
|
|
* P3
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, allow_with_grand_parent_scoped) {
|
|
.domain_all = NO_SANDBOX,
|
|
.domain_parent = SCOPE_SANDBOX,
|
|
.domain_children = NO_SANDBOX,
|
|
.domain_child = OTHER_SANDBOX,
|
|
.domain_grand_child = NO_SANDBOX,
|
|
/* clang-format on */
|
|
};
|
|
|
|
/*
|
|
* ###### ###### P3 -> P2 : allow
|
|
* # P1 #----# P2 # P3 -> P1 : allow
|
|
* ###### ######
|
|
* |
|
|
* .----.
|
|
* | P3 |
|
|
* '----'
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, allow_with_parents_domain) {
|
|
.domain_all = NO_SANDBOX,
|
|
.domain_parent = SCOPE_SANDBOX,
|
|
.domain_children = NO_SANDBOX,
|
|
.domain_child = SCOPE_SANDBOX,
|
|
.domain_grand_child = NO_SANDBOX,
|
|
/* clang-format on */
|
|
};
|
|
|
|
/*
|
|
* ###### P3 -> P2 : deny
|
|
* # P1 #----P2 P3 -> P1 : deny
|
|
* ###### |
|
|
* |
|
|
* ######
|
|
* # P3 #
|
|
* ######
|
|
*/
|
|
/* clang-format off */
|
|
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, deny_with_self_and_grandparent_domain) {
|
|
.domain_all = NO_SANDBOX,
|
|
.domain_parent = SCOPE_SANDBOX,
|
|
.domain_children = NO_SANDBOX,
|
|
.domain_child = NO_SANDBOX,
|
|
.domain_grand_child = SCOPE_SANDBOX,
|
|
/* clang-format on */
|
|
};
|