projects/linux·blob master · refs

399 lines · 10.2 KiB

1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Landlock tests - Enforcing the same restrictions across multiple threads
4 *
5 * Copyright © 2025 Günther Noack <[email protected]>
6 */
7
8#define _GNU_SOURCE
9#include <linux/landlock.h>
10#include <pthread.h>
11#include <signal.h>
12#include <sys/prctl.h>
13
14#include "common.h"
15
16/* create_ruleset - Create a simple ruleset FD common to all tests */
17static int create_ruleset(struct __test_metadata *const _metadata)
18{
19 struct landlock_ruleset_attr ruleset_attr = {
20 .handled_access_fs = (LANDLOCK_ACCESS_FS_WRITE_FILE |
21 LANDLOCK_ACCESS_FS_TRUNCATE),
22 };
23 const int ruleset_fd =
24 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
25
26 ASSERT_LE(0, ruleset_fd)
27 {
28 TH_LOG("landlock_create_ruleset: %s", strerror(errno));
29 }
30 return ruleset_fd;
31}
32
33TEST(single_threaded_success)
34{
35 const int ruleset_fd = create_ruleset(_metadata);
36
37 disable_caps(_metadata);
38
39 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
40 ASSERT_EQ(0, landlock_restrict_self(ruleset_fd,
41 LANDLOCK_RESTRICT_SELF_TSYNC));
42
43 EXPECT_EQ(0, close(ruleset_fd));
44}
45
46static void store_no_new_privs(void *data)
47{
48 bool *nnp = data;
49
50 if (!nnp)
51 return;
52 *nnp = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
53}
54
55static void *idle(void *data)
56{
57 pthread_cleanup_push(store_no_new_privs, data);
58
59 while (true)
60 sleep(1);
61
62 pthread_cleanup_pop(1);
63}
64
65FIXTURE(multi_threaded)
66{
67 int ruleset_fd;
68};
69
70FIXTURE_VARIANT(multi_threaded)
71{
72 const __u32 restrict_flags;
73 /* Sets no_new_privs with prctl(2) before the enforcement. */
74 const bool prior_no_new_privs;
75 /* Enforces the maximum number of allowed layers beforehand. */
76 const bool max_layers;
77 const int expected_errno;
78 /* Expected no_new_privs state of all threads after the call. */
79 const bool expected_no_new_privs;
80};
81
82/* clang-format off */
83FIXTURE_VARIANT_ADD(multi_threaded, success) {
84 /* clang-format on */
85 .restrict_flags = LANDLOCK_RESTRICT_SELF_TSYNC,
86 .prior_no_new_privs = true,
87 .expected_no_new_privs = true,
88};
89
90/* clang-format off */
91FIXTURE_VARIANT_ADD(multi_threaded, no_new_privs) {
92 /* clang-format on */
93 .restrict_flags = LANDLOCK_RESTRICT_SELF_TSYNC |
94 LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
95 .expected_no_new_privs = true,
96};
97
98/* clang-format off */
99FIXTURE_VARIANT_ADD(multi_threaded, no_new_privs_max_layers) {
100 /* clang-format on */
101 .restrict_flags = LANDLOCK_RESTRICT_SELF_TSYNC |
102 LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
103 .max_layers = true,
104 .expected_errno = E2BIG,
105 .expected_no_new_privs = false,
106};
107
108FIXTURE_SETUP(multi_threaded)
109{
110 self->ruleset_fd = create_ruleset(_metadata);
111
112 if (variant->max_layers) {
113 /* Enforces the maximum number of allowed layers. */
114 for (int i = 0; i < LANDLOCK_MAX_NUM_LAYERS; i++)
115 ASSERT_EQ(0,
116 landlock_restrict_self(self->ruleset_fd, 0));
117 }
118
119 disable_caps(_metadata);
120}
121
122FIXTURE_TEARDOWN(multi_threaded)
123{
124 EXPECT_EQ(0, close(self->ruleset_fd));
125}
126
127TEST_F(multi_threaded, restrict)
128{
129 pthread_t t1, t2;
130 bool no_new_privs1, no_new_privs2;
131
132 ASSERT_EQ(0, pthread_create(&t1, NULL, idle, &no_new_privs1));
133 ASSERT_EQ(0, pthread_create(&t2, NULL, idle, &no_new_privs2));
134
135 if (variant->prior_no_new_privs) {
136 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
137 } else {
138 /* No prior prctl(2) PR_SET_NO_NEW_PRIVS call. */
139 ASSERT_EQ(0, prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0));
140 }
141
142 if (variant->expected_errno) {
143 EXPECT_EQ(-1, landlock_restrict_self(self->ruleset_fd,
144 variant->restrict_flags));
145 EXPECT_EQ(variant->expected_errno, errno);
146 } else {
147 EXPECT_EQ(0, landlock_restrict_self(self->ruleset_fd,
148 variant->restrict_flags));
149 }
150
151 /* Checks the no_new_privs state of the calling thread. */
152 EXPECT_EQ(variant->expected_no_new_privs,
153 prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0));
154
155 ASSERT_EQ(0, pthread_cancel(t1));
156 ASSERT_EQ(0, pthread_cancel(t2));
157 ASSERT_EQ(0, pthread_join(t1, NULL));
158 ASSERT_EQ(0, pthread_join(t2, NULL));
159
160 /* Checks the no_new_privs state of the sibling threads. */
161 EXPECT_EQ(variant->expected_no_new_privs, no_new_privs1);
162 EXPECT_EQ(variant->expected_no_new_privs, no_new_privs2);
163}
164
165TEST(multi_threaded_success_despite_diverging_domains)
166{
167 pthread_t t1, t2;
168 const int ruleset_fd = create_ruleset(_metadata);
169
170 disable_caps(_metadata);
171
172 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
173
174 ASSERT_EQ(0, pthread_create(&t1, NULL, idle, NULL));
175 ASSERT_EQ(0, pthread_create(&t2, NULL, idle, NULL));
176
177 /*
178 * The main thread enforces a ruleset,
179 * thereby bringing the threads' Landlock domains out of sync.
180 */
181 EXPECT_EQ(0, landlock_restrict_self(ruleset_fd, 0));
182
183 /* Still, TSYNC succeeds, bringing the threads in sync again. */
184 EXPECT_EQ(0, landlock_restrict_self(ruleset_fd,
185 LANDLOCK_RESTRICT_SELF_TSYNC));
186
187 ASSERT_EQ(0, pthread_cancel(t1));
188 ASSERT_EQ(0, pthread_cancel(t2));
189 ASSERT_EQ(0, pthread_join(t1, NULL));
190 ASSERT_EQ(0, pthread_join(t2, NULL));
191 EXPECT_EQ(0, close(ruleset_fd));
192}
193
194struct thread_restrict_data {
195 pthread_t t;
196 int ruleset_fd;
197 int result;
198};
199
200static void *thread_restrict(void *data)
201{
202 struct thread_restrict_data *d = data;
203
204 d->result = landlock_restrict_self(d->ruleset_fd,
205 LANDLOCK_RESTRICT_SELF_TSYNC);
206 return NULL;
207}
208
209TEST(competing_enablement)
210{
211 const int ruleset_fd = create_ruleset(_metadata);
212 struct thread_restrict_data d[] = {
213 { .ruleset_fd = ruleset_fd },
214 { .ruleset_fd = ruleset_fd },
215 };
216
217 disable_caps(_metadata);
218
219 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
220 ASSERT_EQ(0, pthread_create(&d[0].t, NULL, thread_restrict, &d[0]));
221 ASSERT_EQ(0, pthread_create(&d[1].t, NULL, thread_restrict, &d[1]));
222
223 /* Wait for threads to finish. */
224 ASSERT_EQ(0, pthread_join(d[0].t, NULL));
225 ASSERT_EQ(0, pthread_join(d[1].t, NULL));
226
227 /* Expect that both succeeded. */
228 EXPECT_EQ(0, d[0].result);
229 EXPECT_EQ(0, d[1].result);
230
231 EXPECT_EQ(0, close(ruleset_fd));
232}
233
234static void signal_nop_handler(int sig)
235{
236}
237
238struct signaler_data {
239 pthread_t target;
240 volatile bool stop;
241};
242
243static void *signaler_thread(void *data)
244{
245 struct signaler_data *sd = data;
246
247 while (!sd->stop)
248 pthread_kill(sd->target, SIGUSR1);
249
250 return NULL;
251}
252
253/*
254 * Number of idle sibling threads. This must be large enough that even on
255 * machines with many cores, the sibling threads cannot all complete their
256 * credential preparation in a single parallel wave, otherwise the signaler
257 * thread has no window to interrupt wait_for_completion_interruptible().
258 * 200 threads on a 64-core machine yields ~3 serialized waves, giving the
259 * tight signal loop enough time to land an interruption.
260 */
261#define NUM_IDLE_THREADS 200
262
263/*
264 * Exercises the tsync interruption and cancellation paths in tsync.c.
265 *
266 * When a signal interrupts the calling thread while it waits for sibling
267 * threads to finish their credential preparation
268 * (wait_for_completion_interruptible in landlock_restrict_sibling_threads),
269 * the kernel sets ERESTARTNOINTR, cancels queued task works that have not
270 * started yet (cancel_tsync_works), then waits for the remaining works to
271 * finish. On the error return, syscalls.c aborts the prepared credentials.
272 * The kernel automatically restarts the syscall, so userspace sees success.
273 */
274TEST(tsync_interrupt)
275{
276 size_t i;
277 pthread_t threads[NUM_IDLE_THREADS];
278 pthread_t signaler;
279 struct signaler_data sd;
280 struct sigaction sa = {};
281 const int ruleset_fd = create_ruleset(_metadata);
282
283 disable_caps(_metadata);
284
285 /* Install a no-op SIGUSR1 handler so the signal does not kill us. */
286 sa.sa_handler = signal_nop_handler;
287 sigemptyset(&sa.sa_mask);
288 ASSERT_EQ(0, sigaction(SIGUSR1, &sa, NULL));
289
290 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
291
292 for (i = 0; i < NUM_IDLE_THREADS; i++)
293 ASSERT_EQ(0, pthread_create(&threads[i], NULL, idle, NULL));
294
295 /*
296 * Start a signaler thread that continuously sends SIGUSR1 to the
297 * calling thread. This maximizes the chance of interrupting
298 * wait_for_completion_interruptible() in the kernel's tsync path.
299 */
300 sd.target = pthread_self();
301 sd.stop = false;
302 ASSERT_EQ(0, pthread_create(&signaler, NULL, signaler_thread, &sd));
303
304 /*
305 * The syscall may be interrupted and transparently restarted by the
306 * kernel (ERESTARTNOINTR). From userspace, it should always succeed.
307 */
308 EXPECT_EQ(0, landlock_restrict_self(ruleset_fd,
309 LANDLOCK_RESTRICT_SELF_TSYNC));
310
311 sd.stop = true;
312 ASSERT_EQ(0, pthread_join(signaler, NULL));
313
314 for (i = 0; i < NUM_IDLE_THREADS; i++) {
315 ASSERT_EQ(0, pthread_cancel(threads[i]));
316 ASSERT_EQ(0, pthread_join(threads[i], NULL));
317 }
318
319 EXPECT_EQ(0, close(ruleset_fd));
320}
321
322/* clang-format off */
323FIXTURE(tsync_without_ruleset) {};
324/* clang-format on */
325
326FIXTURE_VARIANT(tsync_without_ruleset)
327{
328 const __u32 flags;
329 const int expected_errno;
330};
331
332/* clang-format off */
333FIXTURE_VARIANT_ADD(tsync_without_ruleset, tsync_only) {
334 /* clang-format on */
335 .flags = LANDLOCK_RESTRICT_SELF_TSYNC,
336 .expected_errno = EBADF,
337};
338
339/* clang-format off */
340FIXTURE_VARIANT_ADD(tsync_without_ruleset, subdomains_off_same_exec_off) {
341 /* clang-format on */
342 .flags = LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF |
343 LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF |
344 LANDLOCK_RESTRICT_SELF_TSYNC,
345 .expected_errno = EBADF,
346};
347
348/* clang-format off */
349FIXTURE_VARIANT_ADD(tsync_without_ruleset, subdomains_off_new_exec_on) {
350 /* clang-format on */
351 .flags = LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF |
352 LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON |
353 LANDLOCK_RESTRICT_SELF_TSYNC,
354 .expected_errno = EBADF,
355};
356
357/* clang-format off */
358FIXTURE_VARIANT_ADD(tsync_without_ruleset, all_flags) {
359 /* clang-format on */
360 .flags = LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF |
361 LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON |
362 LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF |
363 LANDLOCK_RESTRICT_SELF_TSYNC,
364 .expected_errno = EBADF,
365};
366
367/* clang-format off */
368FIXTURE_VARIANT_ADD(tsync_without_ruleset, subdomains_off) {
369 /* clang-format on */
370 .flags = LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF |
371 LANDLOCK_RESTRICT_SELF_TSYNC,
372 .expected_errno = 0,
373};
374
375FIXTURE_SETUP(tsync_without_ruleset)
376{
377 disable_caps(_metadata);
378}
379
380FIXTURE_TEARDOWN(tsync_without_ruleset)
381{
382}
383
384TEST_F(tsync_without_ruleset, check)
385{
386 int ret;
387
388 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
389
390 ret = landlock_restrict_self(-1, variant->flags);
391 if (variant->expected_errno) {
392 EXPECT_EQ(-1, ret);
393 EXPECT_EQ(variant->expected_errno, errno);
394 } else {
395 EXPECT_EQ(0, ret);
396 }
397}
398
399TEST_HARNESS_MAIN