Unverified Commit 960ed6ca authored by Mickaël Salaün's avatar Mickaël Salaün
Browse files

selftests/landlock: Test audit with restrict flags 

Add audit_exec tests to filter Landlock denials according to
cross-execution or muted subdomains.

Add a wait-pipe-sandbox.c test program to sandbox itself and send a
(denied) signals to its parent.

Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/20250320190717.2287696-24-mic@digikod.net


Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
parent 6a500b22

tools/testing/selftests/landlock/.gitignore

+1 −0
Original line number Diff line number Diff line
@@ -2,3 +2,4 @@ 
/sandbox-and-launch

/true

/wait-pipe

/wait-pipe-sandbox

tools/testing/selftests/landlock/Makefile

+5 −1
Original line number Diff line number Diff line
@@ -10,7 +10,11 @@ src_test := $(wildcard *_test.c) 


TEST_GEN_PROGS := $(src_test:.c=)



TEST_GEN_PROGS_EXTENDED := true sandbox-and-launch wait-pipe

TEST_GEN_PROGS_EXTENDED := \

	true \

	sandbox-and-launch \

	wait-pipe \

	wait-pipe-sandbox



# Short targets:

$(TEST_GEN_PROGS): LDLIBS += -lcap -lpthread

tools/testing/selftests/landlock/audit_test.c

+219 −0
Original line number Diff line number Diff line
@@ -7,7 +7,9 @@ 


#define _GNU_SOURCE

#include <errno.h>

#include <limits.h>

#include <linux/landlock.h>

#include <stdlib.h>

#include <sys/mount.h>

#include <sys/prctl.h>

#include <sys/types.h>
@@ -329,4 +331,221 @@ TEST_F(audit_flags, signal) 
	}

}



static int matches_log_fs_read_root(int audit_fd)

{

	return audit_match_record(

		audit_fd, AUDIT_LANDLOCK_ACCESS,

		REGEX_LANDLOCK_PREFIX

		" blockers=fs\\.read_dir path=\"/\" dev=\"[^\"]\\+\" ino=[0-9]\\+$",

		NULL);

}



FIXTURE(audit_exec)

{

	struct audit_filter audit_filter;

	int audit_fd;

};



FIXTURE_VARIANT(audit_exec)

{

	const int restrict_flags;

};



/* clang-format off */

FIXTURE_VARIANT_ADD(audit_exec, default) {

	/* clang-format on */

	.restrict_flags = 0,

};



/* clang-format off */

FIXTURE_VARIANT_ADD(audit_exec, same_exec_off) {

	/* clang-format on */

	.restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF,

};



/* clang-format off */

FIXTURE_VARIANT_ADD(audit_exec, subdomains_off) {

	/* clang-format on */

	.restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF,

};



/* clang-format off */

FIXTURE_VARIANT_ADD(audit_exec, cross_exec_on) {

	/* clang-format on */

	.restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON,

};



/* clang-format off */

FIXTURE_VARIANT_ADD(audit_exec, subdomains_off_and_cross_exec_on) {

	/* clang-format on */

	.restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF |

			  LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON,

};



FIXTURE_SETUP(audit_exec)

{

	disable_caps(_metadata);

	set_cap(_metadata, CAP_AUDIT_CONTROL);



	self->audit_fd = audit_init();

	EXPECT_LE(0, self->audit_fd)

	{

		const char *error_msg;



		/* kill "$(auditctl -s | sed -ne 's/^pid \([0-9]\+\)$/\1/p')" */

		if (self->audit_fd == -EEXIST)

			error_msg = "socket already in use (e.g. auditd)";

		else

			error_msg = strerror(-self->audit_fd);

		TH_LOG("Failed to initialize audit: %s", error_msg);

	}



	/* Applies test filter for the bin_wait_pipe_sandbox program. */

	EXPECT_EQ(0, audit_init_filter_exe(&self->audit_filter,

					   bin_wait_pipe_sandbox));

	EXPECT_EQ(0, audit_filter_exe(self->audit_fd, &self->audit_filter,

				      AUDIT_ADD_RULE));



	clear_cap(_metadata, CAP_AUDIT_CONTROL);

}



FIXTURE_TEARDOWN(audit_exec)

{

	set_cap(_metadata, CAP_AUDIT_CONTROL);

	EXPECT_EQ(0, audit_filter_exe(self->audit_fd, &self->audit_filter,

				      AUDIT_DEL_RULE));

	clear_cap(_metadata, CAP_AUDIT_CONTROL);

	EXPECT_EQ(0, close(self->audit_fd));

}



TEST_F(audit_exec, signal_and_open)

{

	struct audit_records records;

	int pipe_child[2], pipe_parent[2];

	char buf_parent;

	pid_t child;

	int status;



	ASSERT_EQ(0, pipe2(pipe_child, 0));

	ASSERT_EQ(0, pipe2(pipe_parent, 0));



	child = fork();

	ASSERT_LE(0, child);

	if (child == 0) {

		const struct landlock_ruleset_attr layer1 = {

			.scoped = LANDLOCK_SCOPE_SIGNAL,

		};

		char pipe_child_str[12], pipe_parent_str[12];

		char *const argv[] = { (char *)bin_wait_pipe_sandbox,

				       pipe_child_str, pipe_parent_str, NULL };

		int ruleset_fd;



		/* Passes the pipe FDs to the executed binary. */

		EXPECT_EQ(0, close(pipe_child[0]));

		EXPECT_EQ(0, close(pipe_parent[1]));

		snprintf(pipe_child_str, sizeof(pipe_child_str), "%d",

			 pipe_child[1]);

		snprintf(pipe_parent_str, sizeof(pipe_parent_str), "%d",

			 pipe_parent[0]);



		ruleset_fd =

			landlock_create_ruleset(&layer1, sizeof(layer1), 0);

		if (ruleset_fd < 0) {

			perror("Failed to create a ruleset");

			_exit(1);

		}

		prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);

		if (landlock_restrict_self(ruleset_fd,

					   variant->restrict_flags)) {

			perror("Failed to restrict self");

			_exit(1);

		}

		close(ruleset_fd);



		ASSERT_EQ(0, execve(argv[0], argv, NULL))

		{

			TH_LOG("Failed to execute \"%s\": %s", argv[0],

			       strerror(errno));

		};

		_exit(1);

		return;

	}



	EXPECT_EQ(0, close(pipe_child[1]));

	EXPECT_EQ(0, close(pipe_parent[0]));



	/* Waits for the child. */

	EXPECT_EQ(1, read(pipe_child[0], &buf_parent, 1));



	/* Tests that there was no denial until now. */

	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));

	EXPECT_EQ(0, records.access);

	EXPECT_EQ(0, records.domain);



	/*

	 * Wait for the child to do a first denied action by layer1 and

	 * sandbox itself with layer2.

	 */

	EXPECT_EQ(1, write(pipe_parent[1], ".", 1));

	EXPECT_EQ(1, read(pipe_child[0], &buf_parent, 1));



	/* Tests that the audit record only matches the child. */

	if (variant->restrict_flags & LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON) {

		/* Matches the current domain. */

		EXPECT_EQ(0, matches_log_signal(_metadata, self->audit_fd,

						getpid(), NULL));

	}



	/* Checks that we didn't miss anything. */

	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));

	EXPECT_EQ(0, records.access);



	/*

	 * Wait for the child to do a second denied action by layer1 and

	 * layer2, and sandbox itself with layer3.

	 */

	EXPECT_EQ(1, write(pipe_parent[1], ".", 1));

	EXPECT_EQ(1, read(pipe_child[0], &buf_parent, 1));



	/* Tests that the audit record only matches the child. */

	if (variant->restrict_flags & LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON) {

		/* Matches the current domain. */

		EXPECT_EQ(0, matches_log_signal(_metadata, self->audit_fd,

						getpid(), NULL));

	}



	if (!(variant->restrict_flags &

	      LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF)) {

		/* Matches the child domain. */

		EXPECT_EQ(0, matches_log_fs_read_root(self->audit_fd));

	}



	/* Checks that we didn't miss anything. */

	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));

	EXPECT_EQ(0, records.access);



	/* Waits for the child to terminate. */

	EXPECT_EQ(1, write(pipe_parent[1], ".", 1));

	ASSERT_EQ(child, waitpid(child, &status, 0));

	ASSERT_EQ(1, WIFEXITED(status));

	ASSERT_EQ(0, WEXITSTATUS(status));



	/* Tests that the audit record only matches the child. */

	if (!(variant->restrict_flags &

	      LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF)) {

		/*

		 * Matches the child domains, which tests that the

		 * llcred->domain_exec bitmask is correctly updated with a new

		 * domain.

		 */

		EXPECT_EQ(0, matches_log_fs_read_root(self->audit_fd));

		EXPECT_EQ(0, matches_log_signal(_metadata, self->audit_fd,

						getpid(), NULL));

	}



	/* Checks that we didn't miss anything. */

	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));

	EXPECT_EQ(0, records.access);

}



TEST_HARNESS_MAIN

tools/testing/selftests/landlock/common.h

+1 −0
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ 


static const char bin_sandbox_and_launch[] = "./sandbox-and-launch";

static const char bin_wait_pipe[] = "./wait-pipe";

static const char bin_wait_pipe_sandbox[] = "./wait-pipe-sandbox";



static void _init_caps(struct __test_metadata *const _metadata, bool drop_all)

{

tools/testing/selftests/landlock/wait-pipe-sandbox.c

0 → 100644
+131 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/*

 * Write in a pipe, wait, sandbox itself, test sandboxing, and wait again.

 *

 * Used by audit_exec.flags from audit_test.c

 *

 * Copyright © 2024-2025 Microsoft Corporation

 */



#define _GNU_SOURCE

#include <fcntl.h>

#include <linux/landlock.h>

#include <linux/prctl.h>

#include <signal.h>

#include <stdio.h>

#include <stdlib.h>

#include <sys/prctl.h>

#include <unistd.h>



#include "wrappers.h"



static int sync_with(int pipe_child, int pipe_parent)

{

	char buf;



	/* Signals that we are waiting. */

	if (write(pipe_child, ".", 1) != 1) {

		perror("Failed to write to first argument");

		return 1;

	}



	/* Waits for the parent do its test. */

	if (read(pipe_parent, &buf, 1) != 1) {

		perror("Failed to write to the second argument");

		return 1;

	}



	return 0;

}



int main(int argc, char *argv[])

{

	const struct landlock_ruleset_attr layer2 = {

		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR,

	};

	const struct landlock_ruleset_attr layer3 = {

		.scoped = LANDLOCK_SCOPE_SIGNAL,

	};

	int err, pipe_child, pipe_parent, ruleset_fd;



	/* The first argument must be the file descriptor number of a pipe. */

	if (argc != 3) {

		fprintf(stderr, "Wrong number of arguments (not two)\n");

		return 1;

	}



	pipe_child = atoi(argv[1]);

	pipe_parent = atoi(argv[2]);

	/* PR_SET_NO_NEW_PRIVS already set by parent. */



	/* First step to test parent's layer1. */

	err = sync_with(pipe_child, pipe_parent);

	if (err)

		return err;



	/* Tries to send a signal, denied by layer1. */

	if (!kill(getppid(), 0)) {

		fprintf(stderr, "Successfully sent a signal to the parent");

		return 1;

	}



	/* Second step to test parent's layer1 and our layer2. */

	err = sync_with(pipe_child, pipe_parent);

	if (err)

		return err;



	ruleset_fd = landlock_create_ruleset(&layer2, sizeof(layer2), 0);

	if (ruleset_fd < 0) {

		perror("Failed to create the layer2 ruleset");

		return 1;

	}



	if (landlock_restrict_self(ruleset_fd, 0)) {

		perror("Failed to restrict self");

		return 1;

	}

	close(ruleset_fd);



	/* Tries to send a signal, denied by layer1. */

	if (!kill(getppid(), 0)) {

		fprintf(stderr, "Successfully sent a signal to the parent");

		return 1;

	}



	/* Tries to open ., denied by layer2. */

	if (open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC) >= 0) {

		fprintf(stderr, "Successfully opened /");

		return 1;

	}



	/* Third step to test our layer2 and layer3. */

	err = sync_with(pipe_child, pipe_parent);

	if (err)

		return err;



	ruleset_fd = landlock_create_ruleset(&layer3, sizeof(layer3), 0);

	if (ruleset_fd < 0) {

		perror("Failed to create the layer3 ruleset");

		return 1;

	}



	if (landlock_restrict_self(ruleset_fd, 0)) {

		perror("Failed to restrict self");

		return 1;

	}

	close(ruleset_fd);



	/* Tries to open ., denied by layer2. */

	if (open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC) >= 0) {

		fprintf(stderr, "Successfully opened /");

		return 1;

	}



	/* Tries to send a signal, denied by layer3. */

	if (!kill(getppid(), 0)) {

		fprintf(stderr, "Successfully sent a signal to the parent");

		return 1;

	}



	return 0;

}