[LTP] [PATCH 09/10] Add landlock05 test

[Andrea Cervesato]

On 7/3/24 09:32, Li Wang wrote:
>
>
> On Mon, Jul 1, 2024 at 11:45 PM Andrea Cervesato 
> <andrea.cervesato@suse.de> wrote:
>
>     From: Andrea Cervesato <andrea.cervesato@suse.com>
>
>     This test verifies LANDLOCK_ACCESS_FS_REFER access in the
>     landlock sandbox. The feature is available since kernel 5.19.
>
>     Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
>
>
> Reviewed-by: Li Wang <liwang@redhat.com>
>
>     ---
>      runtest/syscalls                                |   1 +
>      testcases/kernel/syscalls/landlock/.gitignore   |   1 +
>      testcases/kernel/syscalls/landlock/landlock05.c | 113
>     ++++++++++++++++++++++++
>      3 files changed, 115 insertions(+)
>
>     diff --git a/runtest/syscalls b/runtest/syscalls
>     index 9acdaf760..a3ade6dc1 100644
>     --- a/runtest/syscalls
>     +++ b/runtest/syscalls
>     @@ -688,6 +688,7 @@ landlock01 landlock01
>      landlock02 landlock02
>      landlock03 landlock03
>      landlock04 landlock04
>     +landlock05 landlock05
>
>      lchown01 lchown01
>      lchown01_16 lchown01_16
>     diff --git a/testcases/kernel/syscalls/landlock/.gitignore
>     b/testcases/kernel/syscalls/landlock/.gitignore
>     index 4fe8d7cba..a7ea6be2e 100644
>     --- a/testcases/kernel/syscalls/landlock/.gitignore
>     +++ b/testcases/kernel/syscalls/landlock/.gitignore
>     @@ -3,3 +3,4 @@ landlock01
>      landlock02
>      landlock03
>      landlock04
>     +landlock05
>     diff --git a/testcases/kernel/syscalls/landlock/landlock05.c
>     b/testcases/kernel/syscalls/landlock/landlock05.c
>     new file mode 100644
>     index 000000000..57ed67e9f
>     --- /dev/null
>     +++ b/testcases/kernel/syscalls/landlock/landlock05.c
>     @@ -0,0 +1,113 @@
>     +// SPDX-License-Identifier: GPL-2.0-or-later
>     +/*
>     + * Copyright (C) 2024 SUSE LLC Andrea Cervesato
>     <andrea.cervesato@suse.com>
>     + */
>     +
>     +/*\
>     + * [Description]
>     + *
>     + * This test verifies LANDLOCK_ACCESS_FS_REFER access in the
>     + * landlock sandbox.
>     + *
>     + * [Algorithm]
>     + *
>     + * - apply LANDLOCK_ACCESS_FS_REFER in the folder1
>     + * - apply LANDLOCK_ACCESS_FS_REFER in the folder2
>     + * - create folder3
>     + * - verify that file can be moved from folder1 to folder2
>     + * - verify that file can't be moved from folder1 to folder3
>     + */
>     +
>     +#include "landlock_common.h"
>     +
>     +#define MNTPOINT "sandbox"
>     +#define DIR1 MNTPOINT"/folder1"
>     +#define DIR2 MNTPOINT"/folder2"
>     +#define DIR3 MNTPOINT"/folder3"
>     +#define FILENAME1 DIR1"/file"
>     +#define FILENAME2 DIR2"/file"
>     +#define FILENAME3 DIR3"/file"
>     +
>     +static struct landlock_ruleset_attr *ruleset_attr;
>     +static struct landlock_path_beneath_attr *path_beneath_attr;
>     +
>     +static void run(void)
>     +{
>     +       if (!SAFE_FORK()) {
>
>
> Do we really need a fork and test in children here?
>
Yeah, the reason is that sandbox is activated for the entire process. 
That means temporary folder cleanup might be affected when we force 
read-only rule.
>
>     +               TST_EXP_PASS(rename(FILENAME1, FILENAME2));
>     +               if (TST_RET == -1)
>     +                       return;
>     +
>     +               TST_EXP_FAIL(rename(FILENAME2, FILENAME3), EXDEV);
>     +
>     +               _exit(0);
>     +       }
>     +}
>     +
>     +static void setup(void)
>     +{
>     +       int ruleset_fd;
>     +
>     +       verify_landlock_is_enabled();
>     +
>     +       SAFE_MKDIR(DIR1, 0640);
>     +       SAFE_MKDIR(DIR2, 0640);
>     +       SAFE_MKDIR(DIR3, 0640);
>     +       SAFE_TOUCH(FILENAME1, 0640, NULL);
>     +
>     +       tst_res(TINFO, "Applying LANDLOCK_ACCESS_FS_REFER");
>     +
>     +       ruleset_attr->handled_access_fs =
>     +               LANDLOCK_ACCESS_FS_READ_FILE |
>     +               LANDLOCK_ACCESS_FS_WRITE_FILE |
>     +               LANDLOCK_ACCESS_FS_REFER;
>     +
>     +       ruleset_fd = SAFE_LANDLOCK_CREATE_RULESET(
>     +               ruleset_attr, sizeof(struct
>     landlock_ruleset_attr), 0);
>     +
>     +       apply_landlock_rule(
>     +               path_beneath_attr,
>     +               ruleset_fd,
>     +               LANDLOCK_ACCESS_FS_REFER,
>     +               DIR1);
>     +
>     +       apply_landlock_rule(
>     +               path_beneath_attr,
>     +               ruleset_fd,
>     +               LANDLOCK_ACCESS_FS_REFER,
>     +               DIR2);
>     +
>     +       enforce_ruleset(ruleset_fd);
>     +
>     +       SAFE_CLOSE(ruleset_fd);
>     +}
>     +
>     +static struct tst_test test = {
>     +       .test_all = run,
>     +       .setup = setup,
>     +       .min_kver = "5.19",
>     +       .needs_tmpdir = 1,
>     +       .needs_root = 1,
>     +       .forks_child = 1,
>     +       .needs_kconfigs = (const char *[]) {
>     +               "CONFIG_SECURITY_LANDLOCK=y",
>     +               NULL
>     +       },
>     +       .bufs = (struct tst_buffers []) {
>     +               {&ruleset_attr, .size = sizeof(struct
>     landlock_ruleset_attr)},
>     +               {&path_beneath_attr, .size = sizeof(struct
>     landlock_path_beneath_attr)},
>     +               {},
>     +       },
>     +       .caps = (struct tst_cap []) {
>     +               TST_CAP(TST_CAP_REQ, CAP_SYS_ADMIN),
>     +               {}
>     +       },
>     +       .format_device = 1,
>     +       .mount_device = 1,
>     +       .mntpoint = MNTPOINT,
>     +       .all_filesystems = 1,
>     +       .skip_filesystems = (const char *[]) {
>     +               "vfat",
>     +               NULL
>     +       },
>     +};
>
>     -- 
>     2.43.0
>
>
>     -- 
>     Mailing list info: https://lists.linux.it/listinfo/ltp
>
>
>
> -- 
> Regards,
> Li Wang

Andrea