Unverified Commit f12f8f84 authored by Mickaël Salaün's avatar Mickaël Salaün
Browse files

selftests/landlock: Add tests for FS topology changes with network rules 

Add 2 tests to the layout1 fixture:
* topology_changes_with_net_only: Checks that FS topology
  changes are not denied by network-only restrictions.
* topology_changes_with_net_and_fs: Make sure that FS topology
  changes are still denied with FS and network restrictions.

This specifically test commit d7220364 ("landlock: Allow FS topology
changes for domains without such rule type").

Cc: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Link: https://lore.kernel.org/r/20231027154615.815134-1-mic@digikod.net


Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
parent 51442e8d

tools/testing/selftests/landlock/fs_test.c

+59 −0
Original line number Diff line number Diff line
@@ -1625,6 +1625,65 @@ TEST_F_FORK(layout1, move_mount) 
	clear_cap(_metadata, CAP_SYS_ADMIN);

}



TEST_F_FORK(layout1, topology_changes_with_net_only)

{

	const struct landlock_ruleset_attr ruleset_net = {

		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |

				      LANDLOCK_ACCESS_NET_CONNECT_TCP,

	};

	int ruleset_fd;



	/* Add network restrictions. */

	ruleset_fd =

		landlock_create_ruleset(&ruleset_net, sizeof(ruleset_net), 0);

	ASSERT_LE(0, ruleset_fd);

	enforce_ruleset(_metadata, ruleset_fd);

	ASSERT_EQ(0, close(ruleset_fd));



	/* Mount, remount, move_mount, umount, and pivot_root checks. */

	set_cap(_metadata, CAP_SYS_ADMIN);

	ASSERT_EQ(0, mount_opt(&mnt_tmp, dir_s1d2));

	ASSERT_EQ(0, mount(NULL, dir_s1d2, NULL, MS_PRIVATE | MS_REC, NULL));

	ASSERT_EQ(0, syscall(__NR_move_mount, AT_FDCWD, dir_s1d2, AT_FDCWD,

			     dir_s2d2, 0));

	ASSERT_EQ(0, umount(dir_s2d2));

	ASSERT_EQ(0, syscall(__NR_pivot_root, dir_s3d2, dir_s3d3));

	ASSERT_EQ(0, chdir("/"));

	clear_cap(_metadata, CAP_SYS_ADMIN);

}



TEST_F_FORK(layout1, topology_changes_with_net_and_fs)

{

	const struct landlock_ruleset_attr ruleset_net_fs = {

		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |

				      LANDLOCK_ACCESS_NET_CONNECT_TCP,

		.handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE,

	};

	int ruleset_fd;



	/* Add network and filesystem restrictions. */

	ruleset_fd = landlock_create_ruleset(&ruleset_net_fs,

					     sizeof(ruleset_net_fs), 0);

	ASSERT_LE(0, ruleset_fd);

	enforce_ruleset(_metadata, ruleset_fd);

	ASSERT_EQ(0, close(ruleset_fd));



	/* Mount, remount, move_mount, umount, and pivot_root checks. */

	set_cap(_metadata, CAP_SYS_ADMIN);

	ASSERT_EQ(-1, mount_opt(&mnt_tmp, dir_s1d2));

	ASSERT_EQ(EPERM, errno);

	ASSERT_EQ(-1, mount(NULL, dir_s3d2, NULL, MS_PRIVATE | MS_REC, NULL));

	ASSERT_EQ(EPERM, errno);

	ASSERT_EQ(-1, syscall(__NR_move_mount, AT_FDCWD, dir_s3d2, AT_FDCWD,

			      dir_s2d2, 0));

	ASSERT_EQ(EPERM, errno);

	ASSERT_EQ(-1, umount(dir_s3d2));

	ASSERT_EQ(EPERM, errno);

	ASSERT_EQ(-1, syscall(__NR_pivot_root, dir_s3d2, dir_s3d3));

	ASSERT_EQ(EPERM, errno);

	clear_cap(_metadata, CAP_SYS_ADMIN);

}



TEST_F_FORK(layout1, release_inodes)

{

	const struct rule rules[] = {