| Author | Tokens | Token Proportion | Commits | Commit Proportion |
|---|---|---|---|---|
| Konstantin Meskhidze | 8038 | 51.57% | 2 | 8.70% |
| Matthieu Buffet | 5607 | 35.97% | 6 | 26.09% |
| Mickaël Salaün | 1278 | 8.20% | 9 | 39.13% |
| Ivanov Mikhail | 401 | 2.57% | 2 | 8.70% |
| Tingmao Wang | 237 | 1.52% | 1 | 4.35% |
| Günther Noack | 23 | 0.15% | 1 | 4.35% |
| Hu Yadi | 3 | 0.02% | 1 | 4.35% |
| Tahera Fahimi | 1 | 0.01% | 1 | 4.35% |
| Total | 15588 | 23 |
// SPDX-License-Identifier: GPL-2.0-only /* * Landlock tests - Network * * Copyright © 2022-2023 Huawei Tech. Co., Ltd. * Copyright © 2023 Microsoft Corporation */ #define _GNU_SOURCE #include <arpa/inet.h> #include <errno.h> #include <fcntl.h> #include <linux/landlock.h> #include <linux/in.h> #include <sched.h> #include <stdint.h> #include <string.h> #include <sys/prctl.h> #include <sys/socket.h> #include <sys/syscall.h> #include <sys/un.h> #include "audit.h" #include "common.h" const short sock_port_start = (1 << 10); static const char loopback_ipv4[] = "127.0.0.1"; static const char loopback_ipv6[] = "::1"; /* Number pending connections queue to be hold. */ const short backlog = 10; enum sandbox_type { NO_SANDBOX, /* This may be used to test rules that allow *and* deny accesses. */ TCP_SANDBOX, UDP_SANDBOX, }; static int set_service(struct service_fixture *const srv, const struct protocol_variant prot, const unsigned short index) { memset(srv, 0, sizeof(*srv)); /* * Copies all protocol properties in case of the variant only contains * a subset of them. */ srv->protocol = prot; /* Checks for port overflow. */ if (index > 2) return 1; srv->port = sock_port_start << (2 * index); switch (prot.domain) { case AF_UNSPEC: case AF_INET: srv->ipv4_addr.sin_family = prot.domain; srv->ipv4_addr.sin_port = htons(srv->port); srv->ipv4_addr.sin_addr.s_addr = inet_addr(loopback_ipv4); return 0; case AF_INET6: srv->ipv6_addr.sin6_family = prot.domain; srv->ipv6_addr.sin6_port = htons(srv->port); inet_pton(AF_INET6, loopback_ipv6, &srv->ipv6_addr.sin6_addr); return 0; case AF_UNIX: set_unix_address(srv, index); return 0; } return 1; } static void setup_loopback(struct __test_metadata *const _metadata) { set_cap(_metadata, CAP_SYS_ADMIN); ASSERT_EQ(0, unshare(CLONE_NEWNET)); clear_cap(_metadata, CAP_SYS_ADMIN); set_ambient_cap(_metadata, CAP_NET_ADMIN); ASSERT_EQ(0, system("ip link set dev lo up")); clear_ambient_cap(_metadata, CAP_NET_ADMIN); } static bool prot_is_tcp(const struct protocol_variant *const prot) { return (prot->domain == AF_INET || prot->domain == AF_INET6) && prot->type == SOCK_STREAM && (prot->protocol == IPPROTO_TCP || prot->protocol == IPPROTO_IP); } static bool prot_is_udp(const struct protocol_variant *const prot) { return (prot->domain == AF_INET || prot->domain == AF_INET6) && prot->type == SOCK_DGRAM && (prot->protocol == IPPROTO_UDP || prot->protocol == IPPROTO_IP); } static bool is_restricted(const struct protocol_variant *const prot, const enum sandbox_type sandbox) { if (sandbox == TCP_SANDBOX) return prot_is_tcp(prot); else if (sandbox == UDP_SANDBOX) return prot_is_udp(prot); return false; } static int socket_variant(const struct service_fixture *const srv) { /* Arbitrary value just to not block other tests indefinitely. */ const struct timeval timeout = { .tv_sec = 0, .tv_usec = 100000, }; int sockfd; int ret; sockfd = socket(srv->protocol.domain, srv->protocol.type | SOCK_CLOEXEC, srv->protocol.protocol); if (sockfd < 0) return -errno; ret = setsockopt(sockfd, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)); if (ret != 0) { ret = -errno; close(sockfd); return ret; } ret = setsockopt(sockfd, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout)); if (ret != 0) { ret = -errno; close(sockfd); return ret; } return sockfd; } #ifndef SIN6_LEN_RFC2133 #define SIN6_LEN_RFC2133 24 #endif static socklen_t get_addrlen(const struct service_fixture *const srv, const bool minimal) { switch (srv->protocol.domain) { case AF_UNSPEC: if (minimal) return sizeof(sa_family_t); return sizeof(struct sockaddr_storage); case AF_INET: return sizeof(srv->ipv4_addr); case AF_INET6: if (minimal) return SIN6_LEN_RFC2133; return sizeof(srv->ipv6_addr); case AF_UNIX: if (minimal) return sizeof(srv->unix_addr) - sizeof(srv->unix_addr.sun_path); return srv->unix_addr_len; default: return 0; } } static void set_port(struct service_fixture *const srv, uint16_t port) { switch (srv->protocol.domain) { case AF_UNSPEC: case AF_INET: srv->ipv4_addr.sin_port = htons(port); return; case AF_INET6: srv->ipv6_addr.sin6_port = htons(port); return; default: return; } } static uint16_t get_binded_port(int socket_fd, const struct protocol_variant *const prot) { struct sockaddr_in ipv4_addr; struct sockaddr_in6 ipv6_addr; socklen_t ipv4_addr_len, ipv6_addr_len; /* Gets binded port. */ switch (prot->domain) { case AF_UNSPEC: case AF_INET: ipv4_addr_len = sizeof(ipv4_addr); getsockname(socket_fd, &ipv4_addr, &ipv4_addr_len); return ntohs(ipv4_addr.sin_port); case AF_INET6: ipv6_addr_len = sizeof(ipv6_addr); getsockname(socket_fd, &ipv6_addr, &ipv6_addr_len); return ntohs(ipv6_addr.sin6_port); default: return 0; } } static int bind_variant_addrlen(const int sock_fd, const struct service_fixture *const srv, const socklen_t addrlen) { int ret; switch (srv->protocol.domain) { case AF_UNSPEC: case AF_INET: ret = bind(sock_fd, &srv->ipv4_addr, addrlen); break; case AF_INET6: ret = bind(sock_fd, &srv->ipv6_addr, addrlen); break; case AF_UNIX: ret = bind(sock_fd, &srv->unix_addr, addrlen); break; default: errno = EAFNOSUPPORT; return -errno; } if (ret < 0) return -errno; return ret; } static int bind_variant(const int sock_fd, const struct service_fixture *const srv) { return bind_variant_addrlen(sock_fd, srv, get_addrlen(srv, false)); } static int connect_variant_addrlen(const int sock_fd, const struct service_fixture *const srv, const socklen_t addrlen) { int ret; switch (srv->protocol.domain) { case AF_UNSPEC: case AF_INET: ret = connect(sock_fd, &srv->ipv4_addr, addrlen); break; case AF_INET6: ret = connect(sock_fd, &srv->ipv6_addr, addrlen); break; case AF_UNIX: ret = connect(sock_fd, &srv->unix_addr, addrlen); break; default: errno = -EAFNOSUPPORT; return -errno; } if (ret < 0) return -errno; return ret; } static int connect_variant(const int sock_fd, const struct service_fixture *const srv) { return connect_variant_addrlen(sock_fd, srv, get_addrlen(srv, false)); } static int sendto_variant_addrlen(const int sock_fd, const struct service_fixture *const srv, const socklen_t addrlen, void *buf, size_t len, size_t flags) { const struct sockaddr *dst = NULL; ssize_t ret; /* * We never want our processes to be killed by SIGPIPE: we check return * codes and errno, so that we have actual error messages. */ flags |= MSG_NOSIGNAL; if (srv != NULL) { switch (srv->protocol.domain) { case AF_UNSPEC: case AF_INET: dst = (const struct sockaddr *)&srv->ipv4_addr; break; case AF_INET6: dst = (const struct sockaddr *)&srv->ipv6_addr; break; case AF_UNIX: dst = (const struct sockaddr *)&srv->unix_addr; break; default: errno = EAFNOSUPPORT; return -errno; } } ret = sendto(sock_fd, buf, len, flags, dst, addrlen); if (ret < 0) return -errno; /* errno is not set in cases of partial writes. */ if (ret != len) return -EINTR; return 0; } static int sendto_variant(const int sock_fd, const struct service_fixture *const srv, void *buf, size_t len, size_t flags) { socklen_t addrlen = 0; if (srv != NULL) addrlen = get_addrlen(srv, false); return sendto_variant_addrlen(sock_fd, srv, addrlen, buf, len, flags); } static int test_sendmsg(struct __test_metadata *const _metadata, const struct protocol_variant *prot, int client_fd, int server_fd, const struct service_fixture *srv, bool bind_denied, bool send_denied) { int ret; socklen_t opt_len; int sock_type; int addr_family; struct sockaddr_storage peer_addr = { 0 }; bool has_remote_port; bool needs_autobind; char read_buf[1] = { 0 }; /* * Prepare the test by inspecting the socket type and whether it has a * local/remote address set (all of which determine the expected * outcomes). */ opt_len = sizeof(sock_type); ASSERT_EQ(0, getsockopt(client_fd, SOL_SOCKET, SO_TYPE, &sock_type, &opt_len)); opt_len = sizeof(addr_family); ASSERT_EQ(0, getsockopt(client_fd, SOL_SOCKET, SO_DOMAIN, &addr_family, &opt_len)); opt_len = sizeof(peer_addr); has_remote_port = (getpeername(client_fd, (struct sockaddr *)&peer_addr, &opt_len) == 0); needs_autobind = (addr_family == AF_INET || addr_family == AF_INET6) && get_binded_port(client_fd, prot) == 0; /* First, check error code with truncated explicit address. */ if (srv != NULL) { ret = sendto_variant_addrlen( client_fd, srv, get_addrlen(srv, true) - 1, "A", 1, 0); if (sock_type == SOCK_STREAM && !has_remote_port) { EXPECT_EQ(-EPIPE, ret) { return -1; } } else if (bind_denied && needs_autobind) { EXPECT_EQ(-EACCES, ret) { return -1; } } else { EXPECT_EQ(-EINVAL, ret) { return -1; } } } /* With or without explicit destination address (srv can be NULL). */ ret = sendto_variant(client_fd, srv, "B", 1, 0); if (sock_type == SOCK_STREAM && !has_remote_port) { EXPECT_EQ(-EPIPE, ret) { return -1; } } else if ((send_denied && srv != NULL) || (bind_denied && needs_autobind)) { ASSERT_EQ(-EACCES, ret) { return -1; } } else if (srv == NULL && !has_remote_port) { if (addr_family == AF_UNIX) { ASSERT_EQ(-ENOTCONN, ret) { return -1; } } else if (sock_type == SOCK_STREAM) { ASSERT_EQ(-EPIPE, ret) { return -1; } } else { ASSERT_EQ(-EDESTADDRREQ, ret) { return -1; } } } else { ASSERT_EQ(0, ret); ASSERT_EQ(1, recv(server_fd, read_buf, 1, 0)); ASSERT_EQ(read_buf[0], 'B') { return -1; } } return 0; } FIXTURE(protocol) { struct service_fixture srv0, srv1, srv2; struct service_fixture unspec_any0, unspec_srv0, unspec_srv1; }; FIXTURE_VARIANT(protocol) { const enum sandbox_type sandbox; const struct protocol_variant prot; }; FIXTURE_SETUP(protocol) { struct protocol_variant prot_unspec = variant->prot; prot_unspec.domain = AF_UNSPEC; disable_caps(_metadata); ASSERT_EQ(0, set_service(&self->srv0, variant->prot, 0)); ASSERT_EQ(0, set_service(&self->srv1, variant->prot, 1)); ASSERT_EQ(0, set_service(&self->srv2, variant->prot, 2)); ASSERT_EQ(0, set_service(&self->unspec_srv0, prot_unspec, 0)); ASSERT_EQ(0, set_service(&self->unspec_srv1, prot_unspec, 1)); ASSERT_EQ(0, set_service(&self->unspec_any0, prot_unspec, 0)); self->unspec_any0.ipv4_addr.sin_addr.s_addr = htonl(INADDR_ANY); setup_loopback(_metadata); }; FIXTURE_TEARDOWN(protocol) { } /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv4_tcp1) { /* clang-format on */ .sandbox = NO_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_STREAM, /* IPPROTO_IP == 0 */ .protocol = IPPROTO_IP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv4_tcp2) { /* clang-format on */ .sandbox = NO_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_STREAM, .protocol = IPPROTO_TCP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv4_mptcp) { /* clang-format on */ .sandbox = NO_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_STREAM, .protocol = IPPROTO_MPTCP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv6_tcp1) { /* clang-format on */ .sandbox = NO_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_STREAM, /* IPPROTO_IP == 0 */ .protocol = IPPROTO_IP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv6_tcp2) { /* clang-format on */ .sandbox = NO_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_STREAM, .protocol = IPPROTO_TCP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv6_mptcp) { /* clang-format on */ .sandbox = NO_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_STREAM, .protocol = IPPROTO_MPTCP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv4_udp) { /* clang-format on */ .sandbox = NO_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_DGRAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_ipv6_udp) { /* clang-format on */ .sandbox = NO_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_DGRAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_unix_stream) { /* clang-format on */ .sandbox = NO_SANDBOX, .prot = { .domain = AF_UNIX, .type = SOCK_STREAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, no_sandbox_with_unix_datagram) { /* clang-format on */ .sandbox = NO_SANDBOX, .prot = { .domain = AF_UNIX, .type = SOCK_DGRAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv4_tcp1) { /* clang-format on */ .sandbox = TCP_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_STREAM, /* IPPROTO_IP == 0 */ .protocol = IPPROTO_IP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv4_tcp2) { /* clang-format on */ .sandbox = TCP_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_STREAM, .protocol = IPPROTO_TCP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv4_mptcp) { /* clang-format on */ .sandbox = TCP_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_STREAM, .protocol = IPPROTO_MPTCP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv6_tcp1) { /* clang-format on */ .sandbox = TCP_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_STREAM, /* IPPROTO_IP == 0 */ .protocol = IPPROTO_IP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv6_tcp2) { /* clang-format on */ .sandbox = TCP_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_STREAM, .protocol = IPPROTO_TCP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv6_mptcp) { /* clang-format on */ .sandbox = TCP_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_STREAM, .protocol = IPPROTO_MPTCP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv4_udp) { /* clang-format on */ .sandbox = TCP_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_DGRAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_ipv6_udp) { /* clang-format on */ .sandbox = TCP_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_DGRAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_unix_stream) { /* clang-format on */ .sandbox = TCP_SANDBOX, .prot = { .domain = AF_UNIX, .type = SOCK_STREAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, tcp_sandbox_with_unix_datagram) { /* clang-format on */ .sandbox = TCP_SANDBOX, .prot = { .domain = AF_UNIX, .type = SOCK_DGRAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_ipv4_udp1) { /* clang-format on */ .sandbox = UDP_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_DGRAM, .protocol = IPPROTO_UDP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_ipv4_udp2) { /* clang-format on */ .sandbox = UDP_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_DGRAM, /* IPPROTO_IP == 0 */ .protocol = IPPROTO_IP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_ipv6_udp1) { /* clang-format on */ .sandbox = UDP_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_DGRAM, .protocol = IPPROTO_UDP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_ipv6_udp2) { /* clang-format on */ .sandbox = UDP_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_DGRAM, /* IPPROTO_IP == 0 */ .protocol = IPPROTO_IP, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_ipv4_tcp) { /* clang-format on */ .sandbox = UDP_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_STREAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_ipv6_tcp) { /* clang-format on */ .sandbox = UDP_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_STREAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_unix_stream) { /* clang-format on */ .sandbox = UDP_SANDBOX, .prot = { .domain = AF_UNIX, .type = SOCK_STREAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(protocol, udp_sandbox_with_unix_datagram) { /* clang-format on */ .sandbox = UDP_SANDBOX, .prot = { .domain = AF_UNIX, .type = SOCK_DGRAM, }, }; static void test_bind_and_connect(struct __test_metadata *const _metadata, const struct service_fixture *const srv, const bool deny_bind, const bool deny_connect) { char buf = '\0'; int inval_fd, bind_fd, client_fd, status, ret; pid_t child; /* Starts invalid addrlen tests with bind. */ inval_fd = socket_variant(srv); ASSERT_LE(0, inval_fd) { TH_LOG("Failed to create socket: %s", strerror(errno)); } /* Tries to bind with zero as addrlen. */ EXPECT_EQ(-EINVAL, bind_variant_addrlen(inval_fd, srv, 0)); /* Tries to bind with too small addrlen. */ EXPECT_EQ(-EINVAL, bind_variant_addrlen(inval_fd, srv, get_addrlen(srv, true) - 1)); /* Tries to bind with minimal addrlen. */ ret = bind_variant_addrlen(inval_fd, srv, get_addrlen(srv, true)); if (deny_bind) { EXPECT_EQ(-EACCES, ret); } else { EXPECT_EQ(0, ret) { TH_LOG("Failed to bind to socket: %s", strerror(errno)); } } EXPECT_EQ(0, close(inval_fd)); /* Starts invalid addrlen tests with connect. */ inval_fd = socket_variant(srv); ASSERT_LE(0, inval_fd); /* Tries to connect with zero as addrlen. */ EXPECT_EQ(-EINVAL, connect_variant_addrlen(inval_fd, srv, 0)); /* Tries to connect with too small addrlen. */ EXPECT_EQ(-EINVAL, connect_variant_addrlen(inval_fd, srv, get_addrlen(srv, true) - 1)); /* Tries to connect with minimal addrlen. */ ret = connect_variant_addrlen(inval_fd, srv, get_addrlen(srv, true)); if (srv->protocol.domain == AF_UNIX) { EXPECT_EQ(-EINVAL, ret); } else if (deny_connect) { EXPECT_EQ(-EACCES, ret); } else if (srv->protocol.type == SOCK_STREAM) { /* No listening server, whatever the value of deny_bind. */ EXPECT_EQ(-ECONNREFUSED, ret); } else { EXPECT_EQ(0, ret) { TH_LOG("Failed to connect to socket: %s", strerror(errno)); } } EXPECT_EQ(0, close(inval_fd)); /* Starts connection tests. */ bind_fd = socket_variant(srv); ASSERT_LE(0, bind_fd); ret = bind_variant(bind_fd, srv); if (deny_bind) { EXPECT_EQ(-EACCES, ret); } else { EXPECT_EQ(0, ret); /* Creates a listening socket. */ if (srv->protocol.type == SOCK_STREAM) EXPECT_EQ(0, listen(bind_fd, backlog)); } child = fork(); ASSERT_LE(0, child); if (child == 0) { int connect_fd, ret; /* Closes listening socket for the child. */ EXPECT_EQ(0, close(bind_fd)); /* Starts connection tests. */ connect_fd = socket_variant(srv); ASSERT_LE(0, connect_fd); ret = connect_variant(connect_fd, srv); if (deny_connect) { EXPECT_EQ(-EACCES, ret); } else if (deny_bind && srv->protocol.type == SOCK_STREAM) { /* No listening server. */ EXPECT_EQ(-ECONNREFUSED, ret); } else { EXPECT_EQ(0, ret); EXPECT_EQ(1, write(connect_fd, ".", 1)); } EXPECT_EQ(0, close(connect_fd)); _exit(_metadata->exit_code); return; } /* Accepts connection from the child. */ client_fd = bind_fd; if (!deny_bind && !deny_connect) { if (srv->protocol.type == SOCK_STREAM) { client_fd = accept(bind_fd, NULL, 0); ASSERT_LE(0, client_fd); } EXPECT_EQ(1, read(client_fd, &buf, 1)); EXPECT_EQ('.', buf); } EXPECT_EQ(child, waitpid(child, &status, 0)); EXPECT_EQ(1, WIFEXITED(status)); EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); /* Closes connection, if any. */ if (client_fd != bind_fd) EXPECT_LE(0, close(client_fd)); /* Closes listening socket. */ EXPECT_EQ(0, close(bind_fd)); } TEST_F(protocol, bind) { if (variant->sandbox == TCP_SANDBOX || variant->sandbox == UDP_SANDBOX) { const __u64 bind_access = (variant->sandbox == TCP_SANDBOX ? LANDLOCK_ACCESS_NET_BIND_TCP : LANDLOCK_ACCESS_NET_BIND_UDP); const __u64 conn_access = (variant->sandbox == TCP_SANDBOX ? LANDLOCK_ACCESS_NET_CONNECT_TCP : LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = bind_access | conn_access, }; const struct landlock_net_port_attr bind_connect_p0 = { .allowed_access = bind_access | conn_access, .port = self->srv0.port, }; const struct landlock_net_port_attr connect_p1 = { .allowed_access = conn_access, .port = self->srv1.port, }; int ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); /* Allows connect and bind for the first port. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &bind_connect_p0, 0)); /* Allows connect and denies bind for the second port. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &connect_p1, 0)); /* * For UDP sockets, allows binding to ephemeral ports (required * to connect or send a first datagram) */ if (variant->sandbox == UDP_SANDBOX) { const struct landlock_net_port_attr bind_ephemeral = { .allowed_access = bind_access, .port = 0, }; ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &bind_ephemeral, 0)); } enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } /* Binds a socket to the first port. */ test_bind_and_connect(_metadata, &self->srv0, false, false); /* Binds a socket to the second port. */ test_bind_and_connect(_metadata, &self->srv1, is_restricted(&variant->prot, variant->sandbox), false); /* Binds a socket to the third port. */ test_bind_and_connect(_metadata, &self->srv2, is_restricted(&variant->prot, variant->sandbox), is_restricted(&variant->prot, variant->sandbox)); } TEST_F(protocol, connect) { if (variant->sandbox == TCP_SANDBOX || variant->sandbox == UDP_SANDBOX) { const __u64 bind_access = (variant->sandbox == TCP_SANDBOX ? LANDLOCK_ACCESS_NET_BIND_TCP : LANDLOCK_ACCESS_NET_BIND_UDP); const __u64 conn_access = (variant->sandbox == TCP_SANDBOX ? LANDLOCK_ACCESS_NET_CONNECT_TCP : LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = bind_access | conn_access, }; const struct landlock_net_port_attr bind_connect_p0 = { .allowed_access = bind_access | conn_access, .port = self->srv0.port, }; const struct landlock_net_port_attr bind_p1 = { .allowed_access = bind_access, .port = self->srv1.port, }; int ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); /* Allows connect and bind for the first port. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &bind_connect_p0, 0)); /* Allows bind and denies connect for the second port. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &bind_p1, 0)); /* * For UDP sockets, allows binding to ephemeral ports (required * to connect or send a first datagram) */ if (variant->sandbox == UDP_SANDBOX) { const struct landlock_net_port_attr bind_ephemeral = { .allowed_access = bind_access, .port = 0, }; ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &bind_ephemeral, 0)); } enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } test_bind_and_connect(_metadata, &self->srv0, false, false); test_bind_and_connect(_metadata, &self->srv1, false, is_restricted(&variant->prot, variant->sandbox)); test_bind_and_connect(_metadata, &self->srv2, is_restricted(&variant->prot, variant->sandbox), is_restricted(&variant->prot, variant->sandbox)); } TEST_F(protocol, bind_unspec) { const __u64 bind_access = (variant->sandbox == TCP_SANDBOX ? LANDLOCK_ACCESS_NET_BIND_TCP : LANDLOCK_ACCESS_NET_BIND_UDP); const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = bind_access, }; const struct landlock_net_port_attr rule_bind = { .allowed_access = bind_access, .port = self->srv0.port, }; int bind_fd, ret; if (variant->sandbox == TCP_SANDBOX || variant->sandbox == UDP_SANDBOX) { const int ruleset_fd = landlock_create_ruleset( &ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); /* Allows bind. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &rule_bind, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } bind_fd = socket_variant(&self->srv0); ASSERT_LE(0, bind_fd); /* Tries to bind with too small addrlen. */ EXPECT_EQ(-EINVAL, bind_variant_addrlen( bind_fd, &self->unspec_any0, get_addrlen(&self->unspec_any0, true) - 1)); /* Allowed bind on AF_UNSPEC/INADDR_ANY. */ ret = bind_variant(bind_fd, &self->unspec_any0); if (variant->prot.domain == AF_INET) { EXPECT_EQ(0, ret) { TH_LOG("Failed to bind to unspec/any socket: %s", strerror(errno)); } } else if (variant->prot.domain == AF_INET6) { EXPECT_EQ(-EAFNOSUPPORT, ret); } else { EXPECT_EQ(-EINVAL, ret); } EXPECT_EQ(0, close(bind_fd)); if (variant->sandbox == TCP_SANDBOX || variant->sandbox == UDP_SANDBOX) { const int ruleset_fd = landlock_create_ruleset( &ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); /* Denies bind. */ enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } bind_fd = socket_variant(&self->srv0); ASSERT_LE(0, bind_fd); /* Denied bind on AF_UNSPEC/INADDR_ANY. */ ret = bind_variant(bind_fd, &self->unspec_any0); if (variant->prot.domain == AF_INET) { if (is_restricted(&variant->prot, variant->sandbox)) { EXPECT_EQ(-EACCES, ret); } else { EXPECT_EQ(0, ret); } } else if (variant->prot.domain == AF_INET6) { EXPECT_EQ(-EAFNOSUPPORT, ret); } else { EXPECT_EQ(-EINVAL, ret); } EXPECT_EQ(0, close(bind_fd)); /* Checks bind with AF_UNSPEC and the loopback address. */ bind_fd = socket_variant(&self->srv0); ASSERT_LE(0, bind_fd); ret = bind_variant(bind_fd, &self->unspec_srv0); if (variant->prot.domain == AF_INET || variant->prot.domain == AF_INET6) { EXPECT_EQ(-EAFNOSUPPORT, ret); } else { EXPECT_EQ(-EINVAL, ret) { TH_LOG("Wrong bind error: %s", strerror(errno)); } } EXPECT_EQ(0, close(bind_fd)); } TEST_F(protocol, connect_unspec) { const __u64 connect_right = (variant->sandbox == TCP_SANDBOX ? LANDLOCK_ACCESS_NET_CONNECT_TCP : LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); const __u64 bind_right = (variant->sandbox == TCP_SANDBOX ? LANDLOCK_ACCESS_NET_BIND_TCP : LANDLOCK_ACCESS_NET_BIND_UDP); const struct landlock_ruleset_attr ruleset_conn = { .handled_access_net = connect_right, }; const struct landlock_ruleset_attr ruleset_conn_bind = { .handled_access_net = connect_right | bind_right, }; const struct landlock_net_port_attr rule_connect = { .allowed_access = connect_right, .port = self->srv0.port, }; int bind_fd, client_fd, status; pid_t child; /* Specific connection tests. */ bind_fd = socket_variant(&self->srv0); ASSERT_LE(0, bind_fd); EXPECT_EQ(0, bind_variant(bind_fd, &self->srv0)); if (self->srv0.protocol.type == SOCK_STREAM) EXPECT_EQ(0, listen(bind_fd, backlog)); child = fork(); ASSERT_LE(0, child); if (child == 0) { int connect_fd, ret; /* Closes listening socket for the child. */ EXPECT_EQ(0, close(bind_fd)); connect_fd = socket_variant(&self->srv0); ASSERT_LE(0, connect_fd); EXPECT_EQ(0, connect_variant(connect_fd, &self->srv0)); /* Tries to connect again, or set peer. */ ret = connect_variant(connect_fd, &self->srv0); if (self->srv0.protocol.type == SOCK_STREAM) { EXPECT_EQ(-EISCONN, ret); } else { EXPECT_EQ(0, ret); } if (variant->sandbox == TCP_SANDBOX || variant->sandbox == UDP_SANDBOX) { const int ruleset_fd = landlock_create_ruleset( &ruleset_conn, sizeof(ruleset_conn), 0); ASSERT_LE(0, ruleset_fd); /* Allows connect. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &rule_connect, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } /* Disconnects already connected socket, or set peer. */ ret = connect_variant(connect_fd, &self->unspec_any0); if (self->srv0.protocol.domain == AF_UNIX && self->srv0.protocol.type == SOCK_STREAM) { EXPECT_EQ(-EINVAL, ret); } else { EXPECT_EQ(0, ret); } /* Tries to reconnect, or set peer. */ ret = connect_variant(connect_fd, &self->srv0); if (self->srv0.protocol.domain == AF_UNIX && self->srv0.protocol.type == SOCK_STREAM) { EXPECT_EQ(-EISCONN, ret); } else { EXPECT_EQ(0, ret); } if (variant->sandbox == TCP_SANDBOX || variant->sandbox == UDP_SANDBOX) { const int ruleset_fd = landlock_create_ruleset( &ruleset_conn_bind, sizeof(ruleset_conn_bind), 0); ASSERT_LE(0, ruleset_fd); /* Denies connect and bind. */ enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } /* Try to re-disconnect with a truncated address struct. */ EXPECT_EQ(-EINVAL, connect_variant_addrlen( connect_fd, &self->unspec_any0, get_addrlen(&self->unspec_any0, true) - 1)); /* * Re-disconnect, with a minimal sockaddr struct (just a * bare af_family=AF_UNSPEC field). */ ret = connect_variant_addrlen(connect_fd, &self->unspec_any0, get_addrlen(&self->unspec_any0, true)); if (self->srv0.protocol.domain == AF_UNIX && self->srv0.protocol.type == SOCK_STREAM) { EXPECT_EQ(-EINVAL, ret); } else { /* Always allowed to disconnect. */ EXPECT_EQ(0, ret); } EXPECT_EQ(0, close(connect_fd)); _exit(_metadata->exit_code); return; } client_fd = bind_fd; if (self->srv0.protocol.type == SOCK_STREAM) { client_fd = accept(bind_fd, NULL, 0); ASSERT_LE(0, client_fd); } EXPECT_EQ(child, waitpid(child, &status, 0)); EXPECT_EQ(1, WIFEXITED(status)); EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); /* Closes connection, if any. */ if (client_fd != bind_fd) EXPECT_LE(0, close(client_fd)); /* Closes listening socket. */ EXPECT_EQ(0, close(bind_fd)); } TEST_F(protocol, tcp_fastopen) { const bool restricted = variant->sandbox == TCP_SANDBOX && variant->prot.type == SOCK_STREAM && (variant->prot.protocol == IPPROTO_TCP || variant->prot.protocol == IPPROTO_IP) && (variant->prot.domain == AF_INET || variant->prot.domain == AF_INET6); const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_CONNECT_TCP, }; int bind_fd, client_fd, status; char buf; pid_t child; bind_fd = socket_variant(&self->srv0); ASSERT_LE(0, bind_fd); EXPECT_EQ(0, bind_variant(bind_fd, &self->srv0)); if (self->srv0.protocol.type == SOCK_STREAM) EXPECT_EQ(0, listen(bind_fd, backlog)); child = fork(); ASSERT_LE(0, child); if (child == 0) { int connect_fd, ret; /* Closes listening socket for the child. */ EXPECT_EQ(0, close(bind_fd)); connect_fd = socket_variant(&self->srv0); ASSERT_LE(0, connect_fd); if (variant->sandbox == TCP_SANDBOX) { const int ruleset_fd = landlock_create_ruleset( &ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } /* Fast Open with no address. */ ret = sendto_variant(connect_fd, NULL, NULL, 0, MSG_FASTOPEN); if (self->srv0.protocol.domain == AF_UNIX) { EXPECT_EQ(-ENOTCONN, ret); } else if (self->srv0.protocol.type == SOCK_DGRAM) { EXPECT_EQ(-EDESTADDRREQ, ret); } else { EXPECT_EQ(-EINVAL, ret); } /* Fast Open to a denied address. */ ret = sendto_variant(connect_fd, &self->srv0, "A", 1, MSG_FASTOPEN); if (restricted) { EXPECT_EQ(-EACCES, ret); } else if (self->srv0.protocol.domain == AF_UNIX && self->srv0.protocol.type == SOCK_STREAM) { EXPECT_EQ(-EOPNOTSUPP, ret); } else { EXPECT_EQ(0, ret); } EXPECT_EQ(0, close(connect_fd)); _exit(_metadata->exit_code); return; } client_fd = bind_fd; if (!restricted && self->srv0.protocol.type == SOCK_STREAM && self->srv0.protocol.domain != AF_UNIX) { client_fd = accept(bind_fd, NULL, 0); ASSERT_LE(0, client_fd); } if (restricted) { EXPECT_EQ(-1, read(client_fd, &buf, 1)); EXPECT_EQ(ENOTCONN, errno); } else if (self->srv0.protocol.domain == AF_UNIX && self->srv0.protocol.type == SOCK_STREAM) { EXPECT_EQ(-1, read(client_fd, &buf, 1)); EXPECT_EQ(EINVAL, errno); } else { EXPECT_EQ(1, read(client_fd, &buf, 1)); EXPECT_EQ('A', buf); } EXPECT_EQ(child, waitpid(child, &status, 0)); EXPECT_EQ(1, WIFEXITED(status)); EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); if (client_fd != bind_fd) EXPECT_LE(0, close(client_fd)); EXPECT_EQ(0, close(bind_fd)); } TEST_F(protocol, sendmsg_stream) { int srv0_fd, tmp_fd, client_fd, res; char read_buf[1] = { 0 }; /* * Simple test for stream sockets: just deny all connect()/ * send(explicit addr)/bind(), and make sure we don't interfere with any * operation. */ if (variant->prot.type != SOCK_STREAM) return; if (variant->sandbox == UDP_SANDBOX) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, }; const int ruleset_fd = landlock_create_ruleset( &ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } ASSERT_LE(0, client_fd = socket_variant(&self->srv0)); ASSERT_LE(0, srv0_fd = socket_variant(&self->srv0)); ASSERT_EQ(0, bind_variant(srv0_fd, &self->srv0)); ASSERT_EQ(0, listen(srv0_fd, backlog)); /* Send on a non-connected socket. */ res = sendto_variant(client_fd, NULL, "A", 1, 0); if (variant->prot.domain == AF_UNIX) { EXPECT_EQ(-ENOTCONN, res); } else { EXPECT_EQ(-EPIPE, res); } /* Send to a truncated (invalid) address on a non-connected socket. */ res = sendto_variant_addrlen(client_fd, &self->srv0, get_addrlen(&self->srv0, true) - 1, "B", 1, 0); if (variant->prot.domain == AF_UNIX) { EXPECT_EQ(-EOPNOTSUPP, res); } else { EXPECT_EQ(-EPIPE, res); } /* Connect. */ ASSERT_EQ(0, connect_variant(client_fd, &self->srv0)); tmp_fd = accept(srv0_fd, NULL, 0); ASSERT_LE(0, tmp_fd); EXPECT_EQ(0, close(srv0_fd)); srv0_fd = tmp_fd; /* Send without an explicit address. */ EXPECT_EQ(0, sendto_variant(client_fd, NULL, "C", 1, 0)); EXPECT_EQ(1, recv(srv0_fd, read_buf, 1, 0)) { TH_LOG("recv() failed: %s", strerror(errno)); } EXPECT_EQ(read_buf[0], 'C'); /* Send to a truncated (invalid) address. */ res = sendto_variant_addrlen(client_fd, &self->srv0, get_addrlen(&self->srv0, true) - 1, "D", 1, 0); if (variant->prot.domain == AF_UNIX) { EXPECT_EQ(-EISCONN, res); } else { ASSERT_EQ(0, res); EXPECT_EQ(1, recv(srv0_fd, read_buf, 1, 0)) { TH_LOG("recv() failed: %s", strerror(errno)); } EXPECT_EQ(read_buf[0], 'D'); } /* Send to a valid but different address. */ res = sendto_variant(client_fd, &self->srv1, "E", 1, 0); if (variant->prot.domain == AF_UNIX) { EXPECT_EQ(-EISCONN, res); } else { ASSERT_EQ(0, res); EXPECT_EQ(1, recv(srv0_fd, read_buf, 1, 0)) { TH_LOG("recv() failed: %s", strerror(errno)); } EXPECT_EQ(read_buf[0], 'E'); } EXPECT_EQ(0, close(client_fd)); } TEST_F(protocol, sendmsg_dgram) { const bool restricted = is_restricted(&variant->prot, variant->sandbox); int srv0_fd, srv1_fd, client_fd, child, status, res; if (variant->prot.type != SOCK_DGRAM) return; /* Prepare server on port #0 to be allowed. */ ASSERT_LE(0, srv0_fd = socket_variant(&self->srv0)); ASSERT_EQ(0, bind_variant(srv0_fd, &self->srv0)); /* And another server on port #1 to be denied. */ ASSERT_LE(0, srv1_fd = socket_variant(&self->srv1)); ASSERT_EQ(0, bind_variant(srv1_fd, &self->srv1)); /* * Check that sockets connected before restrictions are not impacted in * any way. */ child = fork(); ASSERT_LE(0, child); if (child == 0) { ASSERT_LE(0, client_fd = socket_variant(&self->srv0)); ASSERT_EQ(0, connect_variant(client_fd, &self->srv0)); if (variant->sandbox == UDP_SANDBOX) { /* Deny all connect()/send(explicit addr)/bind(). */ const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, }; const int ruleset_fd = landlock_create_ruleset( &ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd, srv0_fd, NULL, restricted, restricted)); EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd, srv0_fd, &self->srv0, restricted, restricted)); EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd, srv1_fd, &self->srv1, restricted, restricted)); EXPECT_EQ(0, close(client_fd)); _exit(_metadata->exit_code); } EXPECT_EQ(child, waitpid(child, &status, 0)); EXPECT_EQ(1, WIFEXITED(status)); EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); /* * Restrict connect/send, but not bind(). Then try sending with no * destination (and no remote peer set), an allowed destination, then a * denied destination. */ child = fork(); ASSERT_LE(0, child); if (child == 0) { if (variant->sandbox == UDP_SANDBOX) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, }; const struct landlock_net_port_attr send_p0 = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, .port = self->srv0.port, }; const int ruleset_fd = landlock_create_ruleset( &ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &send_p0, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } ASSERT_LE(0, client_fd = socket_variant(&self->srv0)); EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd, -1, NULL, false, false)); EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd, srv0_fd, &self->srv0, false, false)); EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd, srv1_fd, &self->srv1, false, restricted)); EXPECT_EQ(0, close(client_fd)); _exit(_metadata->exit_code); return; } EXPECT_EQ(child, waitpid(child, &status, 0)); EXPECT_EQ(1, WIFEXITED(status)); EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); /* * Rest of this test is just for autobind enforcement, which only exists * in IP sockets. */ if (variant->prot.domain != AF_INET && variant->prot.domain != AF_INET6) return; /* Restrict bind() to explicit calls with an arbitrary (non-0) port. */ child = fork(); ASSERT_LE(0, child); if (child == 0) { const uint16_t allowed_src_port = 42424; struct service_fixture allowed_src; allowed_src = self->srv0; set_port(&allowed_src, allowed_src_port); if (variant->sandbox == UDP_SANDBOX) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_BIND_UDP, }; const struct landlock_net_port_attr rule = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_UDP, .port = allowed_src_port, }; const int ruleset_fd = landlock_create_ruleset( &ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &rule, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } ASSERT_LE(0, client_fd = socket_variant(&self->srv0)); /* Check that implicit bind(0) in sendmsg() is denied. */ EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd, srv0_fd, &self->srv0, restricted, false)); /* Same thing for autobind in connect(). */ res = connect_variant(client_fd, &self->srv0); if (restricted) { EXPECT_EQ(-EACCES, res); } else { EXPECT_EQ(0, res); } EXPECT_EQ(0, close(client_fd)); /* Make sendmsg() work by explicitly binding to the only allowed port. */ ASSERT_LE(0, client_fd = socket_variant(&self->srv0)); EXPECT_EQ(0, bind_variant(client_fd, &allowed_src)); EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd, srv0_fd, &self->srv0, restricted, false)); EXPECT_EQ(0, close(client_fd)); /* Make connect() work by explicitly binding to the only allowed port. */ ASSERT_LE(0, client_fd = socket_variant(&self->srv0)); EXPECT_EQ(0, bind_variant(client_fd, &allowed_src)); EXPECT_EQ(0, connect_variant(client_fd, &self->srv0)); EXPECT_EQ(0, close(client_fd)); _exit(_metadata->exit_code); return; } EXPECT_EQ(child, waitpid(child, &status, 0)); EXPECT_EQ(1, WIFEXITED(status)); EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); /* * Check that %LANDLOCK_ACCESS_NET_BIND_UDP on port 0 allows implicit * autobinds. */ child = fork(); ASSERT_LE(0, child); if (child == 0) { if (variant->sandbox == UDP_SANDBOX) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_BIND_UDP, }; const struct landlock_net_port_attr rule = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_UDP, .port = 0, }; const int ruleset_fd = landlock_create_ruleset( &ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &rule, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } ASSERT_LE(0, client_fd = socket_variant(&self->srv0)); EXPECT_EQ(0, test_sendmsg(_metadata, &variant->prot, client_fd, srv0_fd, &self->srv0, false, false)); EXPECT_EQ(0, close(client_fd)); _exit(_metadata->exit_code); } EXPECT_EQ(child, waitpid(child, &status, 0)); EXPECT_EQ(1, WIFEXITED(status)); EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); } TEST_F(protocol, sendmsg_unspec) { const bool restricted = is_restricted(&variant->prot, variant->sandbox); int client_fd, srv0_fd, srv1_fd, res; char read_buf[1] = { 0 }; /* * We already test for the absence of influence on sendmsg for other * socket types and other address families, there's no point in adapting * this test for stream sockets too. */ if (variant->prot.type != SOCK_DGRAM) return; /* Prepare client of the right family. */ ASSERT_LE(0, client_fd = socket_variant(&self->srv0)); /* Prepare server on port #0 to be allowed. */ ASSERT_LE(0, srv0_fd = socket_variant(&self->srv0)); ASSERT_EQ(0, bind_variant(srv0_fd, &self->srv0)); /* And another server on port #1 to be denied. */ ASSERT_LE(0, srv1_fd = socket_variant(&self->srv1)); ASSERT_EQ(0, bind_variant(srv1_fd, &self->srv1)); if (variant->sandbox == UDP_SANDBOX) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, }; const struct landlock_net_port_attr rule = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, .port = self->srv0.port, }; const int ruleset_fd = landlock_create_ruleset( &ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &rule, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } /* Explicit AF_UNSPEC address but truncated. */ EXPECT_EQ(-EINVAL, sendto_variant_addrlen( client_fd, &self->unspec_srv0, get_addrlen(&self->unspec_srv0, true) - 1, "A", 1, 0)); /* * Explicit AF_UNSPEC address, should be treated as AF_INET by IPv4 * sockets (and thus map to srv0, allowed), but be denied by IPv6 * sockets. */ res = sendto_variant(client_fd, &self->unspec_srv0, "B", 1, 0); if (variant->prot.domain == AF_INET6) { if (restricted) { /* Always denied on IPv6 socket. */ EXPECT_EQ(-EACCES, res); } else { /* IPv6 sockets treat AF_UNSPEC as a NULL address. */ EXPECT_EQ(-EDESTADDRREQ, res); } } else if (variant->prot.domain == AF_INET) { ASSERT_EQ(0, res); EXPECT_EQ(1, read(srv0_fd, read_buf, 1)) { TH_LOG("read() failed: %s", strerror(errno)); } EXPECT_EQ(read_buf[0], 'B'); } else { /* Unix sockets don't accept AF_UNSPEC. */ EXPECT_EQ(-EINVAL, res); } /* * Explicit AF_UNSPEC address, should be treated as AF_INET on IPv4 * sockets (and thus map to srv1, denied), and be denied on IPv6 sockets * as always. */ res = sendto_variant(client_fd, &self->unspec_srv1, "C", 1, 0); if (variant->prot.domain == AF_INET6) { if (restricted) { /* Always denied on IPv6 socket. */ EXPECT_EQ(-EACCES, res); } else { /* IPv6 sockets treat AF_UNSPEC as a NULL address. */ EXPECT_EQ(-EDESTADDRREQ, res); } } else if (variant->prot.domain == AF_INET) { if (restricted) { /* Sending to srv1 is not allowed, only srv0. */ EXPECT_EQ(-EACCES, res); } else { ASSERT_EQ(0, res); EXPECT_EQ(1, read(srv1_fd, read_buf, 1)) { TH_LOG("read() failed: %s", strerror(errno)); } EXPECT_EQ(read_buf[0], 'C'); } } else { /* Unix sockets don't accept AF_UNSPEC. */ EXPECT_EQ(-EINVAL, res); } ASSERT_EQ(0, connect_variant(client_fd, &self->srv0)); /* Minimal explicit AF_UNSPEC address (just the sa_family_t field) */ res = sendto_variant_addrlen(client_fd, &self->unspec_srv0, get_addrlen(&self->unspec_srv0, true), "D", 1, 0); if (variant->prot.domain == AF_INET6) { if (restricted) { /* AF_UNSPEC is always denied in IPv6. */ EXPECT_EQ(-EACCES, res); } else { /* * IPv6 sockets treat AF_UNSPEC as a NULL address, * falling back to the connected address. */ ASSERT_EQ(0, res); EXPECT_EQ(1, read(srv0_fd, read_buf, 1)); EXPECT_EQ(read_buf[0], 'D'); } } else { /* * IPv4 socket will expect a struct sockaddr_in, our address is * considered truncated. And Unix sockets don't accept * AF_UNSPEC at all. */ EXPECT_EQ(-EINVAL, res); } } FIXTURE(ipv4) { struct service_fixture srv0, srv1; }; FIXTURE_VARIANT(ipv4) { const enum sandbox_type sandbox; const int type; }; /* clang-format off */ FIXTURE_VARIANT_ADD(ipv4, no_sandbox_with_tcp) { /* clang-format on */ .sandbox = NO_SANDBOX, .type = SOCK_STREAM, }; /* clang-format off */ FIXTURE_VARIANT_ADD(ipv4, tcp_sandbox_with_tcp) { /* clang-format on */ .sandbox = TCP_SANDBOX, .type = SOCK_STREAM, }; /* clang-format off */ FIXTURE_VARIANT_ADD(ipv4, udp_sandbox_with_tcp) { /* clang-format on */ .sandbox = UDP_SANDBOX, .type = SOCK_STREAM, }; /* clang-format off */ FIXTURE_VARIANT_ADD(ipv4, no_sandbox_with_udp) { /* clang-format on */ .sandbox = NO_SANDBOX, .type = SOCK_DGRAM, }; /* clang-format off */ FIXTURE_VARIANT_ADD(ipv4, tcp_sandbox_with_udp) { /* clang-format on */ .sandbox = TCP_SANDBOX, .type = SOCK_DGRAM, }; /* clang-format off */ FIXTURE_VARIANT_ADD(ipv4, udp_sandbox_with_udp) { /* clang-format on */ .sandbox = UDP_SANDBOX, .type = SOCK_DGRAM, }; FIXTURE_SETUP(ipv4) { const struct protocol_variant prot = { .domain = AF_INET, .type = variant->type, }; disable_caps(_metadata); set_service(&self->srv0, prot, 0); set_service(&self->srv1, prot, 1); setup_loopback(_metadata); }; FIXTURE_TEARDOWN(ipv4) { } TEST_F(ipv4, from_unix_to_inet) { int unix_stream_fd, unix_dgram_fd; if (variant->sandbox == TCP_SANDBOX || variant->sandbox == UDP_SANDBOX) { const __u64 access_rights = (variant->sandbox == TCP_SANDBOX ? LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP : LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = access_rights, }; const struct landlock_net_port_attr tcp_bind_connect_p0 = { .allowed_access = access_rights, .port = self->srv0.port, }; int ruleset_fd; /* Denies connect and bind to check errno value. */ ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); /* Allows connect and bind for srv0. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_bind_connect_p0, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } unix_stream_fd = socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0); ASSERT_LE(0, unix_stream_fd); unix_dgram_fd = socket(AF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, 0); ASSERT_LE(0, unix_dgram_fd); /* Checks unix stream bind and connect for srv0. */ EXPECT_EQ(-EINVAL, bind_variant(unix_stream_fd, &self->srv0)); EXPECT_EQ(-EINVAL, connect_variant(unix_stream_fd, &self->srv0)); /* Checks unix stream bind and connect for srv1. */ EXPECT_EQ(-EINVAL, bind_variant(unix_stream_fd, &self->srv1)) { TH_LOG("Wrong bind error: %s", strerror(errno)); } EXPECT_EQ(-EINVAL, connect_variant(unix_stream_fd, &self->srv1)); /* Checks unix datagram bind and connect for srv0. */ EXPECT_EQ(-EINVAL, bind_variant(unix_dgram_fd, &self->srv0)); EXPECT_EQ(-EINVAL, connect_variant(unix_dgram_fd, &self->srv0)); /* Checks unix datagram bind and connect for srv1. */ EXPECT_EQ(-EINVAL, bind_variant(unix_dgram_fd, &self->srv1)); EXPECT_EQ(-EINVAL, connect_variant(unix_dgram_fd, &self->srv1)); } FIXTURE(tcp_layers) { struct service_fixture srv0, srv1; }; FIXTURE_VARIANT(tcp_layers) { const size_t num_layers; const int domain; }; FIXTURE_SETUP(tcp_layers) { const struct protocol_variant prot = { .domain = variant->domain, .type = SOCK_STREAM, }; disable_caps(_metadata); ASSERT_EQ(0, set_service(&self->srv0, prot, 0)); ASSERT_EQ(0, set_service(&self->srv1, prot, 1)); setup_loopback(_metadata); }; FIXTURE_TEARDOWN(tcp_layers) { } /* clang-format off */ FIXTURE_VARIANT_ADD(tcp_layers, no_sandbox_with_ipv4) { /* clang-format on */ .domain = AF_INET, .num_layers = 0, }; /* clang-format off */ FIXTURE_VARIANT_ADD(tcp_layers, one_sandbox_with_ipv4) { /* clang-format on */ .domain = AF_INET, .num_layers = 1, }; /* clang-format off */ FIXTURE_VARIANT_ADD(tcp_layers, two_sandboxes_with_ipv4) { /* clang-format on */ .domain = AF_INET, .num_layers = 2, }; /* clang-format off */ FIXTURE_VARIANT_ADD(tcp_layers, three_sandboxes_with_ipv4) { /* clang-format on */ .domain = AF_INET, .num_layers = 3, }; /* clang-format off */ FIXTURE_VARIANT_ADD(tcp_layers, no_sandbox_with_ipv6) { /* clang-format on */ .domain = AF_INET6, .num_layers = 0, }; /* clang-format off */ FIXTURE_VARIANT_ADD(tcp_layers, one_sandbox_with_ipv6) { /* clang-format on */ .domain = AF_INET6, .num_layers = 1, }; /* clang-format off */ FIXTURE_VARIANT_ADD(tcp_layers, two_sandboxes_with_ipv6) { /* clang-format on */ .domain = AF_INET6, .num_layers = 2, }; /* clang-format off */ FIXTURE_VARIANT_ADD(tcp_layers, three_sandboxes_with_ipv6) { /* clang-format on */ .domain = AF_INET6, .num_layers = 3, }; TEST_F(tcp_layers, ruleset_overlap) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, }; const struct landlock_net_port_attr tcp_bind = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP, .port = self->srv0.port, }; const struct landlock_net_port_attr tcp_bind_connect = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, .port = self->srv0.port, }; if (variant->num_layers >= 1) { int ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); /* Allows bind. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_bind, 0)); /* Also allows bind, but allows connect too. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_bind_connect, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } if (variant->num_layers >= 2) { int ruleset_fd; /* Creates another ruleset layer. */ ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); /* Only allows bind. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_bind, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } if (variant->num_layers >= 3) { int ruleset_fd; /* Creates another ruleset layer. */ ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); /* Try to allow bind and connect. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_bind_connect, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } /* * Forbids to connect to the socket because only one ruleset layer * allows connect. */ test_bind_and_connect(_metadata, &self->srv0, false, variant->num_layers >= 2); } TEST_F(tcp_layers, ruleset_expand) { if (variant->num_layers >= 1) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP, }; /* Allows bind for srv0. */ const struct landlock_net_port_attr bind_srv0 = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP, .port = self->srv0.port, }; int ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &bind_srv0, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } if (variant->num_layers >= 2) { /* Expands network mask with connect action. */ const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, }; /* Allows bind for srv0 and connect to srv0. */ const struct landlock_net_port_attr tcp_bind_connect_p0 = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, .port = self->srv0.port, }; /* Try to allow bind for srv1. */ const struct landlock_net_port_attr tcp_bind_p1 = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP, .port = self->srv1.port, }; int ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_bind_connect_p0, 0)); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_bind_p1, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } if (variant->num_layers >= 3) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, }; /* Allows connect to srv0, without bind rule. */ const struct landlock_net_port_attr tcp_bind_p0 = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP, .port = self->srv0.port, }; int ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_bind_p0, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } test_bind_and_connect(_metadata, &self->srv0, false, variant->num_layers >= 3); test_bind_and_connect(_metadata, &self->srv1, variant->num_layers >= 1, variant->num_layers >= 2); } /* clang-format off */ FIXTURE(mini) {}; /* clang-format on */ FIXTURE_SETUP(mini) { disable_caps(_metadata); setup_loopback(_metadata); }; FIXTURE_TEARDOWN(mini) { } /* clang-format off */ #define ACCESS_LAST LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP #define ACCESS_ALL ( \ LANDLOCK_ACCESS_NET_BIND_TCP | \ LANDLOCK_ACCESS_NET_CONNECT_TCP | \ LANDLOCK_ACCESS_NET_BIND_UDP | \ LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP) /* clang-format on */ TEST_F(mini, network_access_rights) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = ACCESS_ALL, }; struct landlock_net_port_attr net_port = { .port = sock_port_start, }; int ruleset_fd; __u64 access; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); for (access = 1; access <= ACCESS_LAST; access <<= 1) { net_port.allowed_access = access; EXPECT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &net_port, 0)) { TH_LOG("Failed to add rule with access 0x%llx: %s", (unsigned long long)access, strerror(errno)); } } EXPECT_EQ(0, close(ruleset_fd)); } /* Checks invalid attribute, out of landlock network access range. */ TEST_F(mini, ruleset_with_unknown_access) { __u64 access_mask; for (access_mask = 1ULL << 63; access_mask != ACCESS_LAST; access_mask >>= 1) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = access_mask, }; EXPECT_EQ(-1, landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0)); EXPECT_EQ(EINVAL, errno); } } TEST_F(mini, rule_with_unknown_access) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = ACCESS_ALL, }; struct landlock_net_port_attr net_port = { .port = sock_port_start, }; int ruleset_fd; __u64 access; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); for (access = 1ULL << 63; access != ACCESS_LAST; access >>= 1) { net_port.allowed_access = access; EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &net_port, 0)); EXPECT_EQ(EINVAL, errno); } EXPECT_EQ(0, close(ruleset_fd)); } TEST_F(mini, rule_with_unhandled_access) { struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP, }; struct landlock_net_port_attr net_port = { .port = sock_port_start, }; int ruleset_fd; __u64 access; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); for (access = 1; access > 0; access <<= 1) { int err; net_port.allowed_access = access; err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &net_port, 0); if (access == ruleset_attr.handled_access_net) { EXPECT_EQ(0, err); } else { EXPECT_EQ(-1, err); EXPECT_EQ(EINVAL, errno); } } EXPECT_EQ(0, close(ruleset_fd)); } TEST_F(mini, inval) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP }; const struct landlock_net_port_attr tcp_bind_connect = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, .port = sock_port_start, }; const struct landlock_net_port_attr tcp_denied = { .allowed_access = 0, .port = sock_port_start, }; const struct landlock_net_port_attr tcp_bind = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP, .port = sock_port_start, }; int ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); /* Checks unhandled allowed_access. */ EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_bind_connect, 0)); EXPECT_EQ(EINVAL, errno); /* Checks zero access value. */ EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_denied, 0)); EXPECT_EQ(ENOMSG, errno); /* Adds with legitimate values. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_bind, 0)); } TEST_F(mini, tcp_port_overflow) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, }; const struct landlock_net_port_attr port_max_bind = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP, .port = UINT16_MAX, }; const struct landlock_net_port_attr port_max_connect = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP, .port = UINT16_MAX, }; const struct landlock_net_port_attr port_overflow1 = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP, .port = UINT16_MAX + 1, }; const struct landlock_net_port_attr port_overflow2 = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP, .port = UINT16_MAX + 2, }; const struct landlock_net_port_attr port_overflow3 = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP, .port = UINT32_MAX + 1UL, }; const struct landlock_net_port_attr port_overflow4 = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP, .port = UINT32_MAX + 2UL, }; const struct protocol_variant ipv4_tcp = { .domain = AF_INET, .type = SOCK_STREAM, }; struct service_fixture srv_denied, srv_max_allowed; int ruleset_fd; ASSERT_EQ(0, set_service(&srv_denied, ipv4_tcp, 0)); /* Be careful to avoid port inconsistencies. */ srv_max_allowed = srv_denied; srv_max_allowed.port = port_max_bind.port; srv_max_allowed.ipv4_addr.sin_port = htons(port_max_bind.port); ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &port_max_bind, 0)); EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &port_overflow1, 0)); EXPECT_EQ(EINVAL, errno); EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &port_overflow2, 0)); EXPECT_EQ(EINVAL, errno); EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &port_overflow3, 0)); EXPECT_EQ(EINVAL, errno); /* Interleaves with invalid rule additions. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &port_max_connect, 0)); EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &port_overflow4, 0)); EXPECT_EQ(EINVAL, errno); enforce_ruleset(_metadata, ruleset_fd); test_bind_and_connect(_metadata, &srv_denied, true, true); test_bind_and_connect(_metadata, &srv_max_allowed, false, false); } FIXTURE(ipv4_tcp) { struct service_fixture srv0, srv1; }; FIXTURE_SETUP(ipv4_tcp) { const struct protocol_variant ipv4_tcp = { .domain = AF_INET, .type = SOCK_STREAM, }; disable_caps(_metadata); ASSERT_EQ(0, set_service(&self->srv0, ipv4_tcp, 0)); ASSERT_EQ(0, set_service(&self->srv1, ipv4_tcp, 1)); setup_loopback(_metadata); }; FIXTURE_TEARDOWN(ipv4_tcp) { } TEST_F(ipv4_tcp, port_endianness) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, }; const struct landlock_net_port_attr bind_host_endian_p0 = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP, /* Host port format. */ .port = self->srv0.port, }; const struct landlock_net_port_attr connect_big_endian_p0 = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP, /* Big endian port format. */ .port = htons(self->srv0.port), }; const struct landlock_net_port_attr bind_connect_host_endian_p1 = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, /* Host port format. */ .port = self->srv1.port, }; const unsigned int one = 1; const char little_endian = *(const char *)&one; int ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &bind_host_endian_p0, 0)); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &connect_big_endian_p0, 0)); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &bind_connect_host_endian_p1, 0)); enforce_ruleset(_metadata, ruleset_fd); /* No restriction for big endinan CPU. */ test_bind_and_connect(_metadata, &self->srv0, false, little_endian); /* No restriction for any CPU. */ test_bind_and_connect(_metadata, &self->srv1, false, false); } TEST_F(ipv4_tcp, with_fs) { const struct landlock_ruleset_attr ruleset_attr_fs_net = { .handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR, .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP, }; struct landlock_path_beneath_attr path_beneath = { .allowed_access = LANDLOCK_ACCESS_FS_READ_DIR, .parent_fd = -1, }; struct landlock_net_port_attr tcp_bind = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP, .port = self->srv0.port, }; int ruleset_fd, bind_fd, dir_fd; /* Creates ruleset both for filesystem and network access. */ ruleset_fd = landlock_create_ruleset(&ruleset_attr_fs_net, sizeof(ruleset_attr_fs_net), 0); ASSERT_LE(0, ruleset_fd); /* Adds a filesystem rule. */ path_beneath.parent_fd = open("/dev", O_PATH | O_DIRECTORY | O_CLOEXEC); ASSERT_LE(0, path_beneath.parent_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0)); EXPECT_EQ(0, close(path_beneath.parent_fd)); /* Adds a network rule. */ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_bind, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); /* Tests file access. */ dir_fd = open("/dev", O_RDONLY); EXPECT_LE(0, dir_fd); EXPECT_EQ(0, close(dir_fd)); dir_fd = open("/", O_RDONLY); EXPECT_EQ(-1, dir_fd); EXPECT_EQ(EACCES, errno); /* Tests port binding. */ bind_fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0); ASSERT_LE(0, bind_fd); EXPECT_EQ(0, bind_variant(bind_fd, &self->srv0)); EXPECT_EQ(0, close(bind_fd)); bind_fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0); ASSERT_LE(0, bind_fd); EXPECT_EQ(-EACCES, bind_variant(bind_fd, &self->srv1)); } FIXTURE(port_specific) { struct service_fixture srv0; struct service_fixture cli1; }; FIXTURE_VARIANT(port_specific) { const enum sandbox_type sandbox; const struct protocol_variant prot; }; /* clang-format off */ FIXTURE_VARIANT_ADD(port_specific, no_sandbox_with_ipv4) { /* clang-format on */ .sandbox = NO_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_STREAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(port_specific, tcp_sandbox_with_ipv4) { /* clang-format on */ .sandbox = TCP_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_STREAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(port_specific, udp_sandbox_with_ipv4) { /* clang-format on */ .sandbox = UDP_SANDBOX, .prot = { .domain = AF_INET, .type = SOCK_DGRAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(port_specific, no_sandbox_with_ipv6) { /* clang-format on */ .sandbox = NO_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_STREAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(port_specific, tcp_sandbox_with_ipv6) { /* clang-format on */ .sandbox = TCP_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_STREAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(port_specific, udp_sandbox_with_ipv6) { /* clang-format on */ .sandbox = UDP_SANDBOX, .prot = { .domain = AF_INET6, .type = SOCK_DGRAM, }, }; FIXTURE_SETUP(port_specific) { disable_caps(_metadata); ASSERT_EQ(0, set_service(&self->srv0, variant->prot, 0)); ASSERT_EQ(0, set_service(&self->cli1, variant->prot, 1)); setup_loopback(_metadata); }; FIXTURE_TEARDOWN(port_specific) { } TEST_F(port_specific, bind_connect_zero) { int bind_fd, connect_fd, ret; uint16_t port; /* Adds a rule layer with bind and connect actions. */ if (variant->sandbox == TCP_SANDBOX || variant->sandbox == UDP_SANDBOX) { const __u64 access_rights = (variant->sandbox == TCP_SANDBOX ? LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP : LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = access_rights, }; const struct landlock_net_port_attr bind_connect_zero = { .allowed_access = access_rights, .port = 0, }; int ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); /* Checks zero port value on bind and connect actions. */ EXPECT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &bind_connect_zero, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } bind_fd = socket_variant(&self->srv0); ASSERT_LE(0, bind_fd); connect_fd = socket_variant(&self->srv0); ASSERT_LE(0, connect_fd); /* Sets address port to 0 for both protocol families. */ set_port(&self->srv0, 0); /* * Binds on port 0, which selects a random port within * ip_local_port_range. */ ret = bind_variant(bind_fd, &self->srv0); EXPECT_EQ(0, ret); if (variant->prot.type == SOCK_STREAM) EXPECT_EQ(0, listen(bind_fd, backlog)); /* Connects on port 0. */ ret = connect_variant(connect_fd, &self->srv0); if (variant->prot.type == SOCK_STREAM) { EXPECT_EQ(-ECONNREFUSED, ret); } else { EXPECT_EQ(0, ret); } /* Sets binded port for both protocol families. */ port = get_binded_port(bind_fd, &variant->prot); EXPECT_NE(0, port); set_port(&self->srv0, port); /* Connects on the binded port. */ ret = connect_variant(connect_fd, &self->srv0); if (is_restricted(&variant->prot, variant->sandbox)) { /* Denied by Landlock. */ EXPECT_EQ(-EACCES, ret); } else { EXPECT_EQ(0, ret); } EXPECT_EQ(0, close(connect_fd)); EXPECT_EQ(0, close(bind_fd)); } TEST_F(port_specific, bind_connect_1023) { int bind_fd, connect_fd, ret; /* Adds a rule layer with bind and connect actions. */ if (variant->sandbox == TCP_SANDBOX || variant->sandbox == UDP_SANDBOX) { const __u64 bind_right = (variant->sandbox == TCP_SANDBOX ? LANDLOCK_ACCESS_NET_BIND_TCP : LANDLOCK_ACCESS_NET_BIND_UDP); const __u64 access_rights = (variant->sandbox == TCP_SANDBOX ? (LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP) : (LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP)); const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = access_rights, }; /* A rule with port value less than 1024. */ const struct landlock_net_port_attr bind_connect_low_range = { .allowed_access = access_rights, .port = 1023, }; /* A rule with 1024 port. */ const struct landlock_net_port_attr bind_connect = { .allowed_access = access_rights, .port = 1024, }; /* A rule with cli1's port, to use as source port. */ const struct landlock_net_port_attr srcport = { .allowed_access = bind_right, .port = self->cli1.port, }; int ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &bind_connect_low_range, 0)); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &bind_connect, 0)); if (variant->sandbox == UDP_SANDBOX) { ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &srcport, 0)); } enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); } bind_fd = socket_variant(&self->srv0); ASSERT_LE(0, bind_fd); /* Sets address port to 1023 for both protocol families. */ set_port(&self->srv0, 1023); /* Binds on port 1023. */ ret = bind_variant(bind_fd, &self->srv0); /* Denied by the system. */ EXPECT_EQ(-EACCES, ret); /* Binds on port 1023. */ set_cap(_metadata, CAP_NET_BIND_SERVICE); ret = bind_variant(bind_fd, &self->srv0); clear_cap(_metadata, CAP_NET_BIND_SERVICE); EXPECT_EQ(0, ret); if (variant->prot.type == SOCK_STREAM) EXPECT_EQ(0, listen(bind_fd, backlog)); connect_fd = socket_variant(&self->srv0); ASSERT_LE(0, connect_fd); if (variant->prot.type == SOCK_DGRAM) { /* * We are about to connect(), but bind() is restricted, so for * UDP sockets we need to use cli1's port as source port (the * only one we are allowed to use). */ EXPECT_EQ(0, bind_variant(connect_fd, &self->cli1)); } /* Connects on the binded port 1023. */ ret = connect_variant(connect_fd, &self->srv0); EXPECT_EQ(0, ret); EXPECT_EQ(0, close(connect_fd)); EXPECT_EQ(0, close(bind_fd)); bind_fd = socket_variant(&self->srv0); ASSERT_LE(0, bind_fd); connect_fd = socket_variant(&self->srv0); ASSERT_LE(0, connect_fd); /* Sets address port to 1024 for both protocol families. */ set_port(&self->srv0, 1024); /* Binds on port 1024. */ ret = bind_variant(bind_fd, &self->srv0); EXPECT_EQ(0, ret); if (variant->prot.type == SOCK_STREAM) EXPECT_EQ(0, listen(bind_fd, backlog)); if (variant->prot.type == SOCK_DGRAM) EXPECT_EQ(0, bind_variant(connect_fd, &self->cli1)); /* Connects on the binded port 1024. */ ret = connect_variant(connect_fd, &self->srv0); EXPECT_EQ(0, ret); EXPECT_EQ(0, close(connect_fd)); EXPECT_EQ(0, close(bind_fd)); } /** * matches_auditlog - Check audit log for a network access denial * * @audit_fd: Audit file descriptor. * @blockers: A regex-escaped blocker string, e.g., "net\.bind_tcp". * @dir_addr: Either "saddr" or "daddr", ignored if addr is NULL. * @addr: A regex-escaped IP address string, or NULL. * @dir_port: Either "src" or "dest", ignored if addr is NULL. * @port: A port number, ignored if addr is NULL. */ static int matches_auditlog(const int audit_fd, const char *const blockers, const char *const dir_addr, const char *const addr, const char *const dir_port, const __u16 port) { static const char log_with_addrport_tmpl[] = REGEX_LANDLOCK_PREFIX " blockers=%s %s=%s %s=%u$"; static const char log_without_addrport_tmpl[] = REGEX_LANDLOCK_PREFIX " blockers=%s"; /* * Max strlen(blockers): 16 * Max strlen(dir_addr): 5 * Max strlen(addr): 12 * Max strlen(dir_port): 4 * Max strlen(%u port): 5 */ char log_match[sizeof(log_with_addrport_tmpl) + 42]; int log_match_len; if (addr == NULL) log_match_len = snprintf(log_match, sizeof(log_match), log_without_addrport_tmpl, blockers); else log_match_len = snprintf(log_match, sizeof(log_match), log_with_addrport_tmpl, blockers, dir_addr, addr, dir_port, port); if (log_match_len > sizeof(log_match)) return -E2BIG; return audit_match_record(audit_fd, AUDIT_LANDLOCK_ACCESS, log_match, NULL); } FIXTURE(audit) { struct service_fixture srv0; struct service_fixture srv1; /* srv2 has a rule with no access but quiet bit set. */ struct service_fixture srv2; struct service_fixture unspec_srv0; struct audit_filter audit_filter; int audit_fd; }; FIXTURE_VARIANT(audit) { const char *const addr; const struct protocol_variant prot; }; /* clang-format off */ FIXTURE_VARIANT_ADD(audit, ipv4_tcp) { /* clang-format on */ .addr = "127\\.0\\.0\\.1", .prot = { .domain = AF_INET, .type = SOCK_STREAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(audit, ipv4_udp) { /* clang-format on */ .addr = "127\\.0\\.0\\.1", .prot = { .domain = AF_INET, .type = SOCK_DGRAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(audit, ipv6_tcp) { /* clang-format on */ .addr = "::1", .prot = { .domain = AF_INET6, .type = SOCK_STREAM, }, }; /* clang-format off */ FIXTURE_VARIANT_ADD(audit, ipv6_udp) { /* clang-format on */ .addr = "::1", .prot = { .domain = AF_INET6, .type = SOCK_DGRAM, }, }; FIXTURE_SETUP(audit) { struct protocol_variant prot_unspec = variant->prot; prot_unspec.domain = AF_UNSPEC; ASSERT_EQ(0, set_service(&self->srv0, variant->prot, 0)); ASSERT_EQ(0, set_service(&self->srv1, variant->prot, 1)); ASSERT_EQ(0, set_service(&self->srv2, variant->prot, 2)); ASSERT_EQ(0, set_service(&self->unspec_srv0, prot_unspec, 0)); setup_loopback(_metadata); set_cap(_metadata, CAP_AUDIT_CONTROL); self->audit_fd = audit_init_with_exe_filter(&self->audit_filter); EXPECT_LE(0, self->audit_fd); disable_caps(_metadata); }; FIXTURE_TEARDOWN(audit) { set_cap(_metadata, CAP_AUDIT_CONTROL); EXPECT_EQ(0, audit_cleanup(self->audit_fd, &self->audit_filter)); clear_cap(_metadata, CAP_AUDIT_CONTROL); } TEST_F(audit, bind) { const char *audit_evt = (variant->prot.type == SOCK_STREAM ? "net\\.bind_tcp" : "net\\.bind_udp"); const __u64 access_rights = (variant->prot.type == SOCK_STREAM ? LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP : LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = access_rights, .quiet_access_net = access_rights, }; const struct landlock_net_port_attr quiet_rule = { .allowed_access = 0, .port = self->srv2.port, }; struct audit_records records; int ruleset_fd, sock_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &quiet_rule, LANDLOCK_ADD_RULE_QUIET)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); sock_fd = socket_variant(&self->srv0); ASSERT_LE(0, sock_fd); EXPECT_EQ(-EACCES, bind_variant(sock_fd, &self->srv0)); EXPECT_EQ(0, matches_auditlog(self->audit_fd, audit_evt, "saddr", variant->addr, "src", self->srv0.port)); EXPECT_EQ(0, audit_count_records(self->audit_fd, &records)); EXPECT_EQ(0, records.access); EXPECT_EQ(1, records.domain); EXPECT_EQ(0, close(sock_fd)); /* Bind to srv2 (with quiet rule): no new audit logs. */ sock_fd = socket_variant(&self->srv2); ASSERT_LE(0, sock_fd); EXPECT_EQ(-EACCES, bind_variant(sock_fd, &self->srv2)); EXPECT_EQ(0, audit_count_records(self->audit_fd, &records)); EXPECT_EQ(0, records.access); EXPECT_EQ(0, records.domain); EXPECT_EQ(0, close(sock_fd)); } TEST_F(audit, connect) { const char *audit_evt = (variant->prot.type == SOCK_STREAM ? "net\\.connect_tcp" : "net\\.connect_send_udp"); const __u64 bind_right = (variant->prot.type == SOCK_STREAM ? LANDLOCK_ACCESS_NET_BIND_TCP : LANDLOCK_ACCESS_NET_BIND_UDP); const __u64 conn_right = (variant->prot.type == SOCK_STREAM ? LANDLOCK_ACCESS_NET_CONNECT_TCP : LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); const __u64 access_rights = bind_right | conn_right; const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = access_rights, .quiet_access_net = access_rights, }; const struct landlock_net_port_attr rule_connect_p1 = { .allowed_access = conn_right, .port = self->srv1.port, }; const struct landlock_net_port_attr quiet_rule = { .allowed_access = 0, .port = self->srv2.port, }; struct audit_records records; int ruleset_fd, sock_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &rule_connect_p1, 0)); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &quiet_rule, LANDLOCK_ADD_RULE_QUIET)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); sock_fd = socket_variant(&self->srv0); ASSERT_LE(0, sock_fd); EXPECT_EQ(-EACCES, connect_variant(sock_fd, &self->srv0)); EXPECT_EQ(0, matches_auditlog(self->audit_fd, audit_evt, "daddr", variant->addr, "dest", self->srv0.port)); EXPECT_EQ(0, audit_count_records(self->audit_fd, &records)); EXPECT_EQ(0, records.access); EXPECT_EQ(1, records.domain); if (variant->prot.type == SOCK_DGRAM) { /* Check that autobind generates a denied bind event. */ EXPECT_EQ(-EACCES, connect_variant(sock_fd, &self->srv1)); EXPECT_EQ(0, matches_auditlog(self->audit_fd, "net\\.bind_udp", NULL, NULL, NULL, 0)); EXPECT_EQ(0, audit_count_records(self->audit_fd, &records)); EXPECT_EQ(0, records.access); EXPECT_EQ(0, records.domain); } EXPECT_EQ(0, close(sock_fd)); /* Connect to srv2 (with quiet rule): no new audit logs. */ sock_fd = socket_variant(&self->srv2); ASSERT_LE(0, sock_fd); EXPECT_EQ(-EACCES, connect_variant(sock_fd, &self->srv2)); EXPECT_EQ(0, audit_count_records(self->audit_fd, &records)); EXPECT_EQ(0, records.access); EXPECT_EQ(0, records.domain); EXPECT_EQ(0, close(sock_fd)); } /* Quieting bind access has no effect on connect. */ TEST_F(audit, connect_quiet_bind) { const char *audit_evt = (variant->prot.type == SOCK_STREAM ? "net\\.connect_tcp" : "net\\.connect_send_udp"); const int bind_right = (variant->prot.type == SOCK_STREAM ? LANDLOCK_ACCESS_NET_BIND_TCP : LANDLOCK_ACCESS_NET_BIND_UDP); const int conn_right = (variant->prot.type == SOCK_STREAM ? LANDLOCK_ACCESS_NET_CONNECT_TCP : LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); const int access_rights = bind_right | conn_right; const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = access_rights, .quiet_access_net = bind_right, }; const struct landlock_ruleset_attr ruleset_attr_2 = { .handled_access_net = access_rights, .quiet_access_net = conn_right, }; const struct landlock_net_port_attr quiet_rule = { .allowed_access = 0, .port = self->srv2.port, }; struct audit_records records; int ruleset_fd, sock_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &quiet_rule, LANDLOCK_ADD_RULE_QUIET)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); sock_fd = socket_variant(&self->srv2); ASSERT_LE(0, sock_fd); EXPECT_EQ(-EACCES, connect_variant(sock_fd, &self->srv2)); EXPECT_EQ(0, matches_auditlog(self->audit_fd, audit_evt, "daddr", variant->addr, "dest", self->srv2.port)); EXPECT_EQ(0, audit_count_records(self->audit_fd, &records)); EXPECT_EQ(0, records.access); EXPECT_EQ(0, close(sock_fd)); /* New layer that also denies connect but has the correct quiet bit. */ ruleset_fd = landlock_create_ruleset(&ruleset_attr_2, sizeof(ruleset_attr_2), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &quiet_rule, LANDLOCK_ADD_RULE_QUIET)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); sock_fd = socket_variant(&self->srv2); ASSERT_LE(0, sock_fd); EXPECT_EQ(-EACCES, connect_variant(sock_fd, &self->srv2)); /* Quieted - no logs expected. */ EXPECT_EQ(0, audit_count_records(self->audit_fd, &records)); EXPECT_EQ(0, records.access); EXPECT_EQ(0, close(sock_fd)); } static int matches_log_connect_bound(int audit_fd, const char *const blockers, const char *const addr, __u16 lport, __u16 dport) { static const char log_template[] = REGEX_LANDLOCK_PREFIX " blockers=%s laddr=%s lport=%u daddr=%s dest=%u$"; /* Slack for the blockers, two addresses and two port numbers. */ char log_match[sizeof(log_template) + 60]; int log_match_len; log_match_len = snprintf(log_match, sizeof(log_match), log_template, blockers, addr, lport, addr, dport); if (log_match_len > sizeof(log_match)) return -E2BIG; return audit_match_record(audit_fd, AUDIT_LANDLOCK_ACCESS, log_match, NULL); } /* * After a bind() to an allowed port, a denied connect must report laddr/lport * from the bound socket (made available through audit_net.sk) in addition to * the connect sockaddr's daddr/dest. */ TEST_F(audit, connect_bound) { const __u64 bind_right = (variant->prot.type == SOCK_STREAM ? LANDLOCK_ACCESS_NET_BIND_TCP : LANDLOCK_ACCESS_NET_BIND_UDP); const __u64 conn_right = (variant->prot.type == SOCK_STREAM ? LANDLOCK_ACCESS_NET_CONNECT_TCP : LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); const char *const audit_evt = (variant->prot.type == SOCK_STREAM ? "net\\.connect_tcp" : "net\\.connect_send_udp"); const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = bind_right | conn_right, }; const struct landlock_net_port_attr rule_bind = { .allowed_access = bind_right, .port = self->srv0.port, }; struct service_fixture srv_remote; struct audit_records records; int ruleset_fd, sock_fd; /* Uses a second port as the denied connect target. */ ASSERT_EQ(0, set_service(&srv_remote, variant->prot, 1)); ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &rule_bind, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); sock_fd = socket_variant(&self->srv0); ASSERT_LE(0, sock_fd); EXPECT_EQ(0, bind_variant(sock_fd, &self->srv0)); EXPECT_EQ(-EACCES, connect_variant(sock_fd, &srv_remote)); EXPECT_EQ(0, matches_log_connect_bound(self->audit_fd, audit_evt, variant->addr, self->srv0.port, srv_remote.port)); EXPECT_EQ(0, audit_count_records(self->audit_fd, &records)); EXPECT_EQ(0, records.access); EXPECT_EQ(1, records.domain); EXPECT_EQ(0, close(sock_fd)); } TEST_F(audit, sendmsg) { const struct landlock_ruleset_attr ruleset_attr = { .handled_access_net = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP | LANDLOCK_ACCESS_NET_BIND_UDP, }; const struct landlock_net_port_attr rule = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, .port = self->srv1.port, }; struct audit_records records; int ruleset_fd; int sock_fd; /* Sendmsg on stream sockets is never denied. */ if (variant->prot.type != SOCK_DGRAM) return; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); ASSERT_LE(0, ruleset_fd); ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &rule, 0)); enforce_ruleset(_metadata, ruleset_fd); EXPECT_EQ(0, close(ruleset_fd)); sock_fd = socket_variant(&self->srv0); ASSERT_LE(0, sock_fd); EXPECT_EQ(-EACCES, sendto_variant(sock_fd, &self->srv0, "A", 1, 0)); EXPECT_EQ(0, matches_auditlog(self->audit_fd, "net\\.connect_send_udp", "daddr", variant->addr, "dest", self->srv0.port)); EXPECT_EQ(0, audit_count_records(self->audit_fd, &records)); EXPECT_EQ(0, records.access); EXPECT_EQ(1, records.domain); /* Check that autobind generates a denied bind event. */ EXPECT_EQ(-EACCES, sendto_variant(sock_fd, &self->srv1, "A", 1, 0)); EXPECT_EQ(0, matches_auditlog(self->audit_fd, "net\\.bind_udp", NULL, NULL, NULL, 0)); EXPECT_EQ(0, audit_count_records(self->audit_fd, &records)); EXPECT_EQ(0, records.access); EXPECT_EQ(0, records.domain); EXPECT_EQ(-EACCES, sendto_variant(sock_fd, &self->unspec_srv0, "B", 1, 0)); EXPECT_EQ(0, matches_auditlog(self->audit_fd, "net\\.connect_send_udp", "daddr", NULL, "dest", 0)); EXPECT_EQ(0, audit_count_records(self->audit_fd, &records)); EXPECT_EQ(0, records.access); EXPECT_EQ(0, records.domain); EXPECT_EQ(0, close(sock_fd)); } TEST_HARNESS_MAIN
Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.
Created with Cregit http://github.com/cregit/cregit
Version 2.0-RC1