From 80b58a4201a50d022574c185b387d54b3d442aae Mon Sep 17 00:00:00 2001 From: Mickaël Salaün Date: Mon, 3 Oct 2022 13:37:43 +0200 Subject: sys/linux/test: add landlock_fs_truncate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This test covers file truncation with path and file descriptor checks handled in security/landlock/fs.c . Signed-off-by: Mickaël Salaün --- sys/linux/test/landlock_fs_truncate | 41 +++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 sys/linux/test/landlock_fs_truncate (limited to 'sys/linux') diff --git a/sys/linux/test/landlock_fs_truncate b/sys/linux/test/landlock_fs_truncate new file mode 100644 index 000000000..1428bc03a --- /dev/null +++ b/sys/linux/test/landlock_fs_truncate @@ -0,0 +1,41 @@ +# Makes regular files. + +mknodat(0xffffffffffffff9c, &AUTO='./file0\x00', 0x81c0, 0x0) +mknodat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x81c0, 0x0) + +# Opens each file in write mode before sandboxing. + +r0 = openat$dir(0xffffffffffffff9c, &AUTO='./file0\x00', 0x1, 0x0) +r1 = openat$dir(0xffffffffffffff9c, &AUTO='./file1\x00', 0x1, 0x0) + +# Creates a ruleset to restrict file truncation: LANDLOCK_ACCESS_FS_TRUNCATE. + +r2 = landlock_create_ruleset(&AUTO={0x4000}, AUTO, 0x0) + +# Allows truncation of file1. + +landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, AUTO, &AUTO={0x4000, r1}, 0x0) + +# No need to close FDs for this test. + +# Enforces the first ruleset. + +prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) +landlock_restrict_self(r2, 0x0) + +# Opens each file in write mode after sandboxing. + +r3 = openat$dir(0xffffffffffffff9c, &AUTO='./file0\x00', 0x1, 0x0) +r4 = openat$dir(0xffffffffffffff9c, &AUTO='./file1\x00', 0x1, 0x0) + +# Denied truncation. + +truncate(&AUTO='./file0\x00', 0x1) # EACCES +ftruncate(r3, 0x1) # EACCES + +# Allowed truncation. + +truncate(&AUTO='./file1\x00', 0x1) +ftruncate(r0, 0x1) +ftruncate(r1, 0x1) +ftruncate(r4, 0x1) -- cgit mrf-deployment