diff options
| author | Mickaël Salaün <mic@linux.microsoft.com> | 2021-02-17 19:10:07 +0100 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2021-03-19 16:08:51 +0100 |
| commit | e2081262e70215eeca19da6dfbee917d78b449de (patch) | |
| tree | 02ee4eb9d2e32f76eaa75ddd93b9d1513cafe5bf /sys/linux | |
| parent | bff9ed615c86001f439eb336a86a31e01863fb2f (diff) | |
sys/linux/test: add landlock_fs_forbidden
This test covers mount namespace manipulation forbidden in
security/landlock/fs.c
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Diffstat (limited to 'sys/linux')
| -rw-r--r-- | sys/linux/test/landlock_fs_forbidden | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/sys/linux/test/landlock_fs_forbidden b/sys/linux/test/landlock_fs_forbidden new file mode 100644 index 000000000..29f70e848 --- /dev/null +++ b/sys/linux/test/landlock_fs_forbidden @@ -0,0 +1,39 @@ +# Access denied to whole syscalls, which return EPERM. +# +# Manipuling namespaces requires some privileges: +# requires: -sandbox=setuid + +# Makes a private mount point for MS_MOVE. + +mkdirat(0xffffffffffffff9c, &AUTO='./file0\x00', 0x1c0) +mount$tmpfs(0x0, &AUTO='./file0\x00', &AUTO='tmpfs\x00', 0x0, 0x0) +mount$bind(&AUTO='\x00', &AUTO='./file0\x00', &AUTO='pipefs\x00', 0x40000, 0x0) +mkdirat(0xffffffffffffff9c, &AUTO='./file0/file0\x00', 0x1c0) +mount$tmpfs(0x0, &AUTO='./file0/file0\x00', &AUTO='tmpfs\x00', 0x0, 0x0) +mkdirat(0xffffffffffffff9c, &AUTO='./file0/file1\x00', 0x1c0) + +# Creates a first ruleset to restrict execution. + +r0 = landlock_create_ruleset(&AUTO={0x1}, AUTO, 0x0) +prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) +landlock_restrict_self(r0, 0x0) + +# Checks hook_sb_mount(). + +mount$tmpfs(0x0, &AUTO='./file0/file1\x00', &AUTO='tmpfs\x00', 0x0, 0x0) # EPERM + +# Checks hook_sb_umount(). + +umount2(&AUTO='./file0/file0\x00', 0x0) # EPERM + +# Checks hook_move_mount(). + +move_mount(0xffffffffffffff9c, &AUTO='./file0/file0\x00', 0xffffffffffffff9c, &AUTO='./file0/file0\x00', 0x0) # EPERM + +# Checks hook_sb_remount(). + +mount$bind(&AUTO='\x00', &AUTO='./file0/file0\x00', &AUTO='pipefs\x00', 0x21, 0x0) # EPERM + +# Checks hook_sb_pivotroot(). + +pivot_root(&AUTO='./file0\x00', &AUTO='./file0/file0\x00') # EPERM |