[PATCH v1 2/2] selftests/landlock: Add tests to check unhandled rule's access rights
Mickaël Salaün
mic at digikod.net
Thu Nov 30 09:18:07 UTC 2023
On Mon, Nov 27, 2023 at 11:04:02AM +0300, Konstantin Meskhidze (A) wrote:
>
>
> 11/20/2023 10:39 PM, Mickaël Salaün пишет:
> > Add two tests to make sure that we cannot add a rule to a ruleset if the
> > rule's access rights that are not handled by the ruleset:
> > * fs: layout1.rule_with_unhandled_access
> > * net: mini.rule_with_unhandled_access
> >
> > Cc: Günther Noack <gnoack at google.com>
> > Cc: Konstantin Meskhidze <konstantin.meskhidze at huawei.com>
> > Signed-off-by: Mickaël Salaün <mic at digikod.net>
> > ---
> > tools/testing/selftests/landlock/fs_test.c | 35 +++++++++++++++++++++
> > tools/testing/selftests/landlock/net_test.c | 33 +++++++++++++++++++
> > 2 files changed, 68 insertions(+)
> >
> > diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
> > index d77155d75de5..8cabcbe3554e 100644
> > --- a/tools/testing/selftests/landlock/fs_test.c
> > +++ b/tools/testing/selftests/landlock/fs_test.c
> > @@ -596,6 +596,41 @@ TEST_F_FORK(layout1, file_and_dir_access_rights)
> > ASSERT_EQ(0, close(ruleset_fd));
> > }
> > +TEST_F_FORK(layout1, rule_with_unhandled_access)
> > +{
> > + struct landlock_ruleset_attr ruleset_attr = {
> > + /* First bit */
> > + .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE,
> > + };
> > + struct landlock_path_beneath_attr path_beneath = {};
> > + int ruleset_fd;
> > + __u64 access;
> > +
> > + ruleset_fd =
> > + landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
> > + ASSERT_LE(0, ruleset_fd);
> > +
> > + path_beneath.parent_fd = open(file1_s1d2, O_PATH | O_CLOEXEC);
> > + ASSERT_LE(0, path_beneath.parent_fd);
> > +
> > + for (access = 1; access > 0; access <<= 1) {
> > + int err;
> > +
> > + path_beneath.allowed_access = access;
> > + err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
> > + &path_beneath, 0);
> > + if (access == ruleset_attr.handled_access_fs) {
> > + EXPECT_EQ(0, err);
> > + } else {
> > + EXPECT_EQ(-1, err);
> > + EXPECT_EQ(EINVAL, errno);
> > + }
> > + }
> > +
> > + EXPECT_EQ(0, close(path_beneath.parent_fd));
> > + EXPECT_EQ(0, close(ruleset_fd));
> > +}
> > +
> > TEST_F_FORK(layout0, unknown_access_rights)
> > {
> > __u64 access_mask;
> > diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
> > index 9356f5800e31..aec01917abd5 100644
> > --- a/tools/testing/selftests/landlock/net_test.c
> > +++ b/tools/testing/selftests/landlock/net_test.c
> > @@ -1262,6 +1262,39 @@ TEST_F(mini, network_access_rights)
> > EXPECT_EQ(0, close(ruleset_fd));
> > }
> > +TEST_F(mini, rule_with_unhandled_access)
> > +{
> > + struct landlock_ruleset_attr ruleset_attr = {
> > + /* First bit */
> > + .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP,
> > + };
> > + struct landlock_net_port_attr net_port = {
> > + .port = sock_port_start,
> > + };
> > + int ruleset_fd;
> > + __u64 access;
> > +
> > + ruleset_fd =
> > + landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
> > + ASSERT_LE(0, ruleset_fd);
> > +
> > + for (access = 1; access > 0; access <<= 1) {
> > + int err;
> > +
> > + net_port.allowed_access = access;
> > + err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
> > + &net_port, 0);
> > + if (access == ruleset_attr.handled_access_net) {
> > + EXPECT_EQ(0, err);
> > + } else {
> > + EXPECT_EQ(-1, err);
> > + EXPECT_EQ(EINVAL, errno);
> > + }
> > + }
>
> We have such kind of check in TEST_f(mini, inval). Can you please explain
> why we need additional one here?
This doesn't test the same thing. This new test checks that a only known
access rights can be added, which should be a subset of the handled
access rights. This is mostly useful to check consistency with the
synthetic/private access rights Günther is working on.
> > +
> > + EXPECT_EQ(0, close(ruleset_fd));
> > +}
> > +
> > /* Checks invalid attribute, out of landlock network access range. */
> > TEST_F(mini, unknown_access_rights)
> > {
>
More information about the Linux-security-module-archive
mailing list