selftests/landlock: Test FD passing from restricted to unrestricted processes

A file descriptor created in a restricted process carries Landlock
restrictions with it which will apply even if the same opened file is
used from an unrestricted process.

This change extracts suitable FD-passing helpers from base_test.c and
moves them to common.h. We use the fixture variants from the ftruncate
fixture to exercise the same scenarios as in the open_and_ftruncate
test, but doing the Landlock restriction and open() in a different
process than the ftruncate() call.

Signed-off-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20221018182216.301684-9-gnoack3000@gmail.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>

diff --git a/tools/testing/selftests/landlock/base_test.c b/tools/testing/selftests/landlock/base_test.c
index 72cdae2..792c3f0 100644 (file)
--- a/tools/testing/selftests/landlock/base_test.c
+++ b/tools/testing/selftests/landlock/base_test.c
@@ -263,23 +263,6 @@ TEST(ruleset_fd_transfer)
                .allowed_access = LANDLOCK_ACCESS_FS_READ_DIR,
        };
        int ruleset_fd_tx, dir_fd;
-       union {
-               /* Aligned ancillary data buffer. */
-               char buf[CMSG_SPACE(sizeof(ruleset_fd_tx))];
-               struct cmsghdr _align;
-       } cmsg_tx = {};
-       char data_tx = '.';
-       struct iovec io = {
-               .iov_base = &data_tx,
-               .iov_len = sizeof(data_tx),
-       };
-       struct msghdr msg = {
-               .msg_iov = &io,
-               .msg_iovlen = 1,
-               .msg_control = &cmsg_tx.buf,
-               .msg_controllen = sizeof(cmsg_tx.buf),
-       };
-       struct cmsghdr *cmsg;
        int socket_fds[2];
        pid_t child;
        int status;
@@ -298,33 +281,20 @@ TEST(ruleset_fd_transfer)
                                    &path_beneath_attr, 0));
        ASSERT_EQ(0, close(path_beneath_attr.parent_fd));
 
-       cmsg = CMSG_FIRSTHDR(&msg);
-       ASSERT_NE(NULL, cmsg);
-       cmsg->cmsg_len = CMSG_LEN(sizeof(ruleset_fd_tx));
-       cmsg->cmsg_level = SOL_SOCKET;
-       cmsg->cmsg_type = SCM_RIGHTS;
-       memcpy(CMSG_DATA(cmsg), &ruleset_fd_tx, sizeof(ruleset_fd_tx));
-
        /* Sends the ruleset FD over a socketpair and then close it. */
        ASSERT_EQ(0, socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0,
                                socket_fds));
-       ASSERT_EQ(sizeof(data_tx), sendmsg(socket_fds[0], &msg, 0));
+       ASSERT_EQ(0, send_fd(socket_fds[0], ruleset_fd_tx));
        ASSERT_EQ(0, close(socket_fds[0]));
        ASSERT_EQ(0, close(ruleset_fd_tx));
 
        child = fork();
        ASSERT_LE(0, child);
        if (child == 0) {
-               int ruleset_fd_rx;
+               const int ruleset_fd_rx = recv_fd(socket_fds[1]);
 
-               *(char *)msg.msg_iov->iov_base = '\0';
-               ASSERT_EQ(sizeof(data_tx),
-                         recvmsg(socket_fds[1], &msg, MSG_CMSG_CLOEXEC));
-               ASSERT_EQ('.', *(char *)msg.msg_iov->iov_base);
+               ASSERT_LE(0, ruleset_fd_rx);
                ASSERT_EQ(0, close(socket_fds[1]));
-               cmsg = CMSG_FIRSTHDR(&msg);
-               ASSERT_EQ(cmsg->cmsg_len, CMSG_LEN(sizeof(ruleset_fd_tx)));
-               memcpy(&ruleset_fd_rx, CMSG_DATA(cmsg), sizeof(ruleset_fd_tx));
 
                /* Enforces the received ruleset on the child. */
                ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));

diff --git a/tools/testing/selftests/landlock/common.h b/tools/testing/selftests/landlock/common.h
index 7d34592..d7987ae 100644 (file)
--- a/tools/testing/selftests/landlock/common.h
+++ b/tools/testing/selftests/landlock/common.h
@@ -10,6 +10,7 @@
 #include <errno.h>
 #include <linux/landlock.h>
 #include <sys/capability.h>
+#include <sys/socket.h>
 #include <sys/syscall.h>
 #include <sys/types.h>
 #include <sys/wait.h>
@@ -189,3 +190,69 @@ static void __maybe_unused clear_cap(struct __test_metadata *const _metadata,
 {
        _effective_cap(_metadata, caps, CAP_CLEAR);
 }
+
+/* Receives an FD from a UNIX socket. Returns the received FD, or -errno. */
+static int __maybe_unused recv_fd(int usock)
+{
+       int fd_rx;
+       union {
+               /* Aligned ancillary data buffer. */
+               char buf[CMSG_SPACE(sizeof(fd_rx))];
+               struct cmsghdr _align;
+       } cmsg_rx = {};
+       char data = '\0';
+       struct iovec io = {
+               .iov_base = &data,
+               .iov_len = sizeof(data),
+       };
+       struct msghdr msg = {
+               .msg_iov = &io,
+               .msg_iovlen = 1,
+               .msg_control = &cmsg_rx.buf,
+               .msg_controllen = sizeof(cmsg_rx.buf),
+       };
+       struct cmsghdr *cmsg;
+       int res;
+
+       res = recvmsg(usock, &msg, MSG_CMSG_CLOEXEC);
+       if (res < 0)
+               return -errno;
+
+       cmsg = CMSG_FIRSTHDR(&msg);
+       if (cmsg->cmsg_len != CMSG_LEN(sizeof(fd_rx)))
+               return -EIO;
+
+       memcpy(&fd_rx, CMSG_DATA(cmsg), sizeof(fd_rx));
+       return fd_rx;
+}
+
+/* Sends an FD on a UNIX socket. Returns 0 on success or -errno. */
+static int __maybe_unused send_fd(int usock, int fd_tx)
+{
+       union {
+               /* Aligned ancillary data buffer. */
+               char buf[CMSG_SPACE(sizeof(fd_tx))];
+               struct cmsghdr _align;
+       } cmsg_tx = {};
+       char data_tx = '.';
+       struct iovec io = {
+               .iov_base = &data_tx,
+               .iov_len = sizeof(data_tx),
+       };
+       struct msghdr msg = {
+               .msg_iov = &io,
+               .msg_iovlen = 1,
+               .msg_control = &cmsg_tx.buf,
+               .msg_controllen = sizeof(cmsg_tx.buf),
+       };
+       struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg);
+
+       cmsg->cmsg_len = CMSG_LEN(sizeof(fd_tx));
+       cmsg->cmsg_level = SOL_SOCKET;
+       cmsg->cmsg_type = SCM_RIGHTS;
+       memcpy(CMSG_DATA(cmsg), &fd_tx, sizeof(fd_tx));
+
+       if (sendmsg(usock, &msg, 0) < 0)
+               return -errno;
+       return 0;
+}

diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
index 308f6f3..f8aae01 100644 (file)
--- a/tools/testing/selftests/landlock/fs_test.c
+++ b/tools/testing/selftests/landlock/fs_test.c
@@ -3541,6 +3541,68 @@ TEST_F_FORK(ftruncate, open_and_ftruncate)
        }
 }
 
+TEST_F_FORK(ftruncate, open_and_ftruncate_in_different_processes)
+{
+       int child, fd, status;
+       int socket_fds[2];
+
+       ASSERT_EQ(0, socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0,
+                               socket_fds));
+
+       child = fork();
+       ASSERT_LE(0, child);
+       if (child == 0) {
+               /*
+                * Enables Landlock in the child process, open a file descriptor
+                * where truncation is forbidden and send it to the
+                * non-landlocked parent process.
+                */
+               const char *const path = file1_s1d1;
+               const struct rule rules[] = {
+                       {
+                               .path = path,
+                               .access = variant->permitted,
+                       },
+                       {},
+               };
+               int fd, ruleset_fd;
+
+               ruleset_fd = create_ruleset(_metadata, variant->handled, rules);
+               ASSERT_LE(0, ruleset_fd);
+               enforce_ruleset(_metadata, ruleset_fd);
+               ASSERT_EQ(0, close(ruleset_fd));
+
+               fd = open(path, O_WRONLY);
+               ASSERT_EQ(variant->expected_open_result, (fd < 0 ? errno : 0));
+
+               if (fd >= 0) {
+                       ASSERT_EQ(0, send_fd(socket_fds[0], fd));
+                       ASSERT_EQ(0, close(fd));
+               }
+
+               ASSERT_EQ(0, close(socket_fds[0]));
+
+               _exit(_metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);
+               return;
+       }
+
+       if (variant->expected_open_result == 0) {
+               fd = recv_fd(socket_fds[1]);
+               ASSERT_LE(0, fd);
+
+               EXPECT_EQ(variant->expected_ftruncate_result,
+                         test_ftruncate(fd));
+               ASSERT_EQ(0, close(fd));
+       }
+
+       ASSERT_EQ(child, waitpid(child, &status, 0));
+       ASSERT_EQ(1, WIFEXITED(status));
+       ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
+
+       ASSERT_EQ(0, close(socket_fds[0]));
+       ASSERT_EQ(0, close(socket_fds[1]));
+}
+
 /* clang-format off */
 FIXTURE(layout1_bind) {};
 /* clang-format on */