Merge patch series "selftests: openat2: migrate to kselftest harness"

Aleksa Sarai <aleksa@amutable.com> says: These tests were written in the early days of selftests' TAP support, the more modern kselftest harness is much easier to follow and maintain. The actual contents of the tests are unchanged by this change. * patches from https://patch.msgid.link/20260401-openat2-selftests-kunit-v2-0-ad153a07da0c@amutable.com: selftests: openat2: migrate to kselftest harness selftests: openat2: switch from custom ARRAY_LEN to ARRAY_SIZE selftests: openat2: move helpers to header selftests: move openat2 tests to selftests/filesystems/

Christian Brauner committed 7 months ago

Commit 3e0be8c2 parents 254f496 215be769 files · +631 −669Browse files

Unified · Split

9 files

tools/testing/selftests/filesystems/openat2/.gitignore +0 −0
tools/testing/selftests/filesystems/openat2/Makefile +2 −3
tools/testing/selftests/filesystems/openat2/helpers.h +168 −0
tools/testing/selftests/filesystems/openat2/openat2_test.c +99 −124
tools/testing/selftests/filesystems/openat2/rename_attack_test.c +159 −0
tools/testing/selftests/filesystems/openat2/resolve_test.c +203 −165
tools/testing/selftests/openat2/helpers.c +0 −109
tools/testing/selftests/openat2/helpers.h +0 −108
tools/testing/selftests/openat2/rename_attack_test.c +0 −160

tools/testing/selftests/filesystems/openat2/.gitignorerenamed from tools/testing/selftests/openat2/.gitignore+0−0

File renamed without changes.

tools/testing/selftests/filesystems/openat2/Makefilerenamed from tools/testing/selftests/openat2/Makefile+2−3

@@ -1,5 +1,6 @@
1	1	# SPDX-License-Identifier: GPL-2.0-or-later
2	2
	3	+CFLAGS += $(KHDR_INCLUDES)
3	4	CFLAGS += -Wall -O2 -g -fsanitize=address -fsanitize=undefined
4	5	TEST_GEN_PROGS := openat2_test resolve_test rename_attack_test
5	6
@@ -13,6 +14,4 @@ endif · 7 unmodified lines
13	14
14	15	LOCAL_HDRS += helpers.h
15	16
16		−include ../lib.mk
17		−
18		−$(TEST_GEN_PROGS): helpers.c
	17	+include ../../lib.mk

tools/testing/selftests/filesystems/openat2/helpers.h+168−0

@@ -0,0 +1,168 @@
	1	+// SPDX-License-Identifier: GPL-2.0-or-later
	2	+/*
	3	+ * Author: Aleksa Sarai <cyphar@cyphar.com>
	4	+ * Copyright (C) 2018-2019 SUSE LLC.
	5	+ * Copyright (C) 2026 Amutable GmbH
	6	+ */
	7	+
	8	+#ifndef __RESOLVEAT_H__
	9	+#define __RESOLVEAT_H__
	10	+
	11	+#define _GNU_SOURCE
	12	+#include <stdint.h>
	13	+#include <stdbool.h>
	14	+#include <errno.h>
	15	+#include <limits.h>
	16	+#include <linux/types.h>
	17	+#include <linux/unistd.h>
	18	+#include "kselftest_harness.h"
	19	+
	20	+#define BUILD_BUG_ON(e) ((void)(sizeof(struct { int:(-!!(e)); })))
	21	+
	22	+/*
	23	+ * Arguments for how openat2(2) should open the target path. If @resolve is
	24	+ * zero, then openat2(2) operates very similarly to openat(2).
	25	+ *
	26	+ * However, unlike openat(2), unknown bits in @flags result in -EINVAL rather
	27	+ * than being silently ignored. @mode must be zero unless one of {O_CREAT,
	28	+ * O_TMPFILE} are set.
	29	+ *
	30	+ * @flags: O_* flags.
	31	+ * @mode: O_CREAT/O_TMPFILE file mode.
	32	+ * @resolve: RESOLVE_* flags.
	33	+ */
	34	+struct open_how {
	35	+ __u64 flags;
	36	+ __u64 mode;
	37	+ __u64 resolve;
	38	+};
	39	+
	40	+#define OPEN_HOW_SIZE_VER0 24 /* sizeof first published struct */
	41	+#define OPEN_HOW_SIZE_LATEST OPEN_HOW_SIZE_VER0
	42	+
	43	+#ifndef RESOLVE_IN_ROOT
	44	+/* how->resolve flags for openat2(2). */
	45	+#define RESOLVE_NO_XDEV 0x01 /* Block mount-point crossings
	46	+ (includes bind-mounts). */
	47	+#define RESOLVE_NO_MAGICLINKS 0x02 /* Block traversal through procfs-style
	48	+ "magic-links". */
	49	+#define RESOLVE_NO_SYMLINKS 0x04 /* Block traversal through all symlinks
	50	+ (implies OEXT_NO_MAGICLINKS) */
	51	+#define RESOLVE_BENEATH 0x08 /* Block "lexical" trickery like
	52	+ "..", symlinks, and absolute
	53	+ paths which escape the dirfd. */
	54	+#define RESOLVE_IN_ROOT 0x10 /* Make all jumps to "/" and ".."
	55	+ be scoped inside the dirfd
	56	+ (similar to chroot(2)). */
	57	+#endif /* RESOLVE_IN_ROOT */
	58	+
	59	+__maybe_unused
	60	+static bool needs_openat2(const struct open_how *how)
	61	+{
	62	+ return how->resolve != 0;
	63	+}
	64	+
	65	+__maybe_unused
	66	+static int raw_openat2(int dfd, const char path, void how, size_t size)
	67	+{
	68	+ int ret = syscall(__NR_openat2, dfd, path, how, size);
	69	+
	70	+ return ret >= 0 ? ret : -errno;
	71	+}
	72	+
	73	+__maybe_unused
	74	+static int sys_openat2(int dfd, const char path, struct open_how how)
	75	+{
	76	+ return raw_openat2(dfd, path, how, sizeof(*how));
	77	+}
	78	+
	79	+__maybe_unused
	80	+static int sys_openat(int dfd, const char path, struct open_how how)
	81	+{
	82	+ int ret = openat(dfd, path, how->flags, how->mode);
	83	+
	84	+ return ret >= 0 ? ret : -errno;
	85	+}
	86	+
	87	+__maybe_unused
	88	+static int sys_renameat2(int olddirfd, const char *oldpath,
	89	+ int newdirfd, const char *newpath, unsigned int flags)
	90	+{
	91	+ int ret = syscall(__NR_renameat2, olddirfd, oldpath,
	92	+ newdirfd, newpath, flags);
	93	+
	94	+ return ret >= 0 ? ret : -errno;
	95	+}
	96	+
	97	+__maybe_unused
	98	+static int touchat(int dfd, const char *path)
	99	+{
	100	+ int fd = openat(dfd, path, O_CREAT, 0700);
	101	+
	102	+ if (fd >= 0)
	103	+ close(fd);
	104	+ return fd;
	105	+}
	106	+
	107	+__maybe_unused
	108	+static char fdreadlink(struct __test_metadata _metadata, int fd)
	109	+{
	110	+ char target, tmp;
	111	+
	112	+ ASSERT_GT(asprintf(&tmp, "/proc/self/fd/%d", fd), 0);
	113	+
	114	+ target = malloc(PATH_MAX);
	115	+ ASSERT_NE(target, NULL);
	116	+ memset(target, 0, PATH_MAX);
	117	+
	118	+ ASSERT_GT(readlink(tmp, target, PATH_MAX), 0);
	119	+
	120	+ free(tmp);
	121	+ return target;
	122	+}
	123	+
	124	+__maybe_unused
	125	+static bool fdequal(struct __test_metadata *_metadata, int fd,
	126	+ int dfd, const char *path)
	127	+{
	128	+ char fdpath, dfdpath, *other;
	129	+ bool cmp;
	130	+
	131	+ fdpath = fdreadlink(_metadata, fd);
	132	+ dfdpath = fdreadlink(_metadata, dfd);
	133	+
	134	+ if (!path) {
	135	+ ASSERT_GT(asprintf(&other, "%s", dfdpath), 0);
	136	+ } else if (*path == '/') {
	137	+ ASSERT_GT(asprintf(&other, "%s", path), 0);
	138	+ } else {
	139	+ ASSERT_GT(asprintf(&other, "%s/%s", dfdpath, path), 0);
	140	+ }
	141	+
	142	+ cmp = !strcmp(fdpath, other);
	143	+
	144	+ free(fdpath);
	145	+ free(dfdpath);
	146	+ free(other);
	147	+ return cmp;
	148	+}
	149	+
	150	+static bool openat2_supported = false;
	151	+
	152	+__attribute__((constructor))
	153	+static void __detect_openat2_supported(void)
	154	+{
	155	+ struct open_how how = {};
	156	+ int fd;
	157	+
	158	+ BUILD_BUG_ON(sizeof(struct open_how) != OPEN_HOW_SIZE_VER0);
	159	+
	160	+ /* Check openat2(2) support. */
	161	+ fd = sys_openat2(AT_FDCWD, ".", &how);
	162	+ openat2_supported = (fd >= 0);
	163	+
	164	+ if (fd >= 0)
	165	+ close(fd);
	166	+}
	167	+
	168	+#endif /* __RESOLVEAT_H__ */

tools/testing/selftests/filesystems/openat2/openat2_test.crenamed from tools/testing/selftests/openat2/openat2_test.c+99−124

@@ -15,8 +15,8 @@ · 14 unmodified lines
15	15	#include <stdbool.h>
16	16	#include <string.h>
17	17
18		−#include "kselftest.h"
19	18	#include "helpers.h"
	19	+#include "kselftest_harness.h"
20	20
21	21	/*
22	22	* O_LARGEFILE is set to 0 by glibc.
@@ -45,13 +45,29 @@ struct struct_test { · 22 unmodified lines
45	45	int err;
46	46	};
47	47
48		−#define NUM_OPENAT2_STRUCT_TESTS 7
49		−#define NUM_OPENAT2_STRUCT_VARIATIONS 13
	48	+struct flag_test {
	49	+ const char *name;
	50	+ struct open_how how;
	51	+ int err;
	52	+};
	53	+
	54	+FIXTURE(openat2) {};
50	55
51		−void test_openat2_struct(void)
	56	+FIXTURE_SETUP(openat2)
52	57	{
53		− int misalignments[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 17, 87 };
	58	+ if (!openat2_supported)
	59	+ SKIP(return, "openat2(2) not supported");
	60	+}
	61	+
	62	+FIXTURE_TEARDOWN(openat2) {}
54	63
	64	+/*
	65	+ * Verify that the struct size and misalignment handling for openat2(2) is
	66	+ * correct, including that is_zeroed_user() works.
	67	+ */
	68	+TEST_F(openat2, struct_argument_sizes)
	69	+{
	70	+ int misalignments[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 17, 87 };
55	71	struct struct_test tests[] = {
56	72	/* Normal struct. */
57	73	{ .name = "normal struct",
@@ -83,26 +99,14 @@ void test_openat2_struct(void) · 25 unmodified lines
83	99	.size = sizeof(struct open_how_ext), .err = -E2BIG },
84	100	};
85	101
86		− BUILD_BUG_ON(ARRAY_LEN(misalignments) != NUM_OPENAT2_STRUCT_VARIATIONS);
87		− BUILD_BUG_ON(ARRAY_LEN(tests) != NUM_OPENAT2_STRUCT_TESTS);
88		−
89		− for (int i = 0; i < ARRAY_LEN(tests); i++) {
	102	+ for (int i = 0; i < ARRAY_SIZE(tests); i++) {
90	103	struct struct_test *test = &tests[i];
91	104	struct open_how_ext how_ext = test->arg;
92	105
93		− for (int j = 0; j < ARRAY_LEN(misalignments); j++) {
	106	+ for (int j = 0; j < ARRAY_SIZE(misalignments); j++) {
94	107	int fd, misalign = misalignments[j];
95		− char *fdpath = NULL;
96		− bool failed;
97		− void (resultfn)(const char msg, ...) = ksft_test_result_pass;
98		−
99	108	void copy = NULL, how_copy = &how_ext;
100		−
101		− if (!openat2_supported) {
102		− ksft_print_msg("openat2(2) unsupported\n");
103		− resultfn = ksft_test_result_skip;
104		− goto skip;
105		− }
	109	+ char *fdpath = NULL;
106	110
107	111	if (misalign) {
108	112	/*
@@ -119,50 +123,42 @@ void test_openat2_struct(void) · 10 unmodified lines
119	123	}
120	124
121	125	fd = raw_openat2(AT_FDCWD, ".", how_copy, test->size);
122		− if (test->err >= 0)
123		− failed = (fd < 0);
124		− else
125		− failed = (fd != test->err);
126	126	if (fd >= 0) {
127		− fdpath = fdreadlink(fd);
	127	+ fdpath = fdreadlink(_metadata, fd);
128	128	close(fd);
129	129	}
130	130
131		− if (failed) {
132		− resultfn = ksft_test_result_fail;
133		−
134		− ksft_print_msg("openat2 unexpectedly returned ");
135		− if (fdpath)
136		− ksft_print_msg("%d['%s']\n", fd, fdpath);
137		− else
138		− ksft_print_msg("%d (%s)\n", fd, strerror(-fd));
	131	+ if (test->err >= 0) {
	132	+ EXPECT_GE(fd, 0) {
	133	+ TH_LOG("openat2 with %s [misalign=%d] should succeed, got %d (%s)",
	134	+ test->name, misalign,
	135	+ fd, strerror(-fd));
	136	+ }
	137	+ } else {
	138	+ EXPECT_EQ(test->err, fd) {
	139	+ if (fdpath)
	140	+ TH_LOG("openat2 with %s [misalign=%d] should fail with %d (%s), got %d['%s']",
	141	+ test->name, misalign,
	142	+ test->err,
	143	+ strerror(-test->err),
	144	+ fd, fdpath);
	145	+ else
	146	+ TH_LOG("openat2 with %s [misalign=%d] should fail with %d (%s), got %d (%s)",
	147	+ test->name, misalign,
	148	+ test->err,
	149	+ strerror(-test->err),
	150	+ fd, strerror(-fd));
	151	+ }
139	152	}
140	153
141		−skip:
142		− if (test->err >= 0)
143		− resultfn("openat2 with %s argument [misalign=%d] succeeds\n",
144		− test->name, misalign);
145		− else
146		− resultfn("openat2 with %s argument [misalign=%d] fails with %d (%s)\n",
147		− test->name, misalign, test->err,
148		− strerror(-test->err));
149		−
150	154	free(copy);
151	155	free(fdpath);
152		− fflush(stdout);
153	156	}
154	157	}
155	158	}
156	159
157		−struct flag_test {
158		− const char *name;
159		− struct open_how how;
160		− int err;
161		−};
162		−
163		−#define NUM_OPENAT2_FLAG_TESTS 25
164		−
165		−void test_openat2_flags(void)
	160	+/* Verify openat2(2) flag and mode validation. */
	161	+TEST_F(openat2, flag_validation)
166	162	{
167	163	struct flag_test tests[] = {
168	164	/* O_TMPFILE is incompatible with O_PATH and O_CREAT. */
@@ -241,20 +237,10 @@ void test_openat2_flags(void) · 72 unmodified lines
241	237	.how.resolve = 0, .err = -EINVAL },
242	238	};
243	239
244		− BUILD_BUG_ON(ARRAY_LEN(tests) != NUM_OPENAT2_FLAG_TESTS);
245		−
246		− for (int i = 0; i < ARRAY_LEN(tests); i++) {
	240	+ for (int i = 0; i < ARRAY_SIZE(tests); i++) {
247	241	int fd, fdflags = -1;
248	242	char path, fdpath = NULL;
249		− bool failed = false;
250	243	struct flag_test *test = &tests[i];
251		− void (resultfn)(const char msg, ...) = ksft_test_result_pass;
252		−
253		− if (!openat2_supported) {
254		− ksft_print_msg("openat2(2) unsupported\n");
255		− resultfn = ksft_test_result_skip;
256		− goto skip;
257		− }
258	244
259	245	path = (test->how.flags & O_CREAT) ? "/tmp/ksft.openat2_tmpfile" : ".";
260	246	unlink(path);
@@ -265,74 +251,63 @@ void test_openat2_flags(void) · 4 unmodified lines
265	251	* Skip the testcase if it failed because not supported
266	252	* by FS. (e.g. a valid O_TMPFILE combination on NFS)
267	253	*/
268		− ksft_test_result_skip("openat2 with %s fails with %d (%s)\n",
269		− test->name, fd, strerror(-fd));
270		− goto next;
	254	+ TH_LOG("openat2 with %s not supported by FS -- skipping",
	255	+ test->name);
	256	+ continue;
271	257	}
272	258
273		− if (test->err >= 0)
274		− failed = (fd < 0);
275		− else
276		− failed = (fd != test->err);
277		− if (fd >= 0) {
278		− int otherflags;
279		−
280		− fdpath = fdreadlink(fd);
281		− fdflags = fcntl(fd, F_GETFL);
282		− otherflags = fcntl(fd, F_GETFD);
283		− close(fd);
284		−
285		− E_assert(fdflags >= 0, "fcntl F_GETFL of new fd");
286		− E_assert(otherflags >= 0, "fcntl F_GETFD of new fd");
287		−
288		− /* O_CLOEXEC isn't shown in F_GETFL. */
289		− if (otherflags & FD_CLOEXEC)
290		− fdflags \|= O_CLOEXEC;
291		− /* O_CREAT is hidden from F_GETFL. */
292		− if (test->how.flags & O_CREAT)
293		− fdflags \|= O_CREAT;
294		− if (!(test->how.flags & O_LARGEFILE))
295		− fdflags &= ~O_LARGEFILE;
296		− failed \|= (fdflags != test->how.flags);
297		− }
	259	+ if (test->err >= 0) {
	260	+ EXPECT_GE(fd, 0) {
	261	+ TH_LOG("openat2 with %s should succeed, got %d (%s)",
	262	+ test->name, fd, strerror(-fd));
	263	+ }
	264	+ if (fd >= 0) {
	265	+ int otherflags;
298	266
299		− if (failed) {
300		− resultfn = ksft_test_result_fail;
	267	+ fdpath = fdreadlink(_metadata, fd);
	268	+ fdflags = fcntl(fd, F_GETFL);
	269	+ otherflags = fcntl(fd, F_GETFD);
	270	+ close(fd);
301	271
302		− ksft_print_msg("openat2 unexpectedly returned ");
303		− if (fdpath)
304		− ksft_print_msg("%d['%s'] with %X (!= %llX)\n",
305		− fd, fdpath, fdflags,
306		− test->how.flags);
307		− else
308		− ksft_print_msg("%d (%s)\n", fd, strerror(-fd));
	272	+ ASSERT_GE(fdflags, 0);
	273	+ ASSERT_GE(otherflags, 0);
	274	+
	275	+ /* O_CLOEXEC isn't shown in F_GETFL. */
	276	+ if (otherflags & FD_CLOEXEC)
	277	+ fdflags \|= O_CLOEXEC;
	278	+ /* O_CREAT is hidden from F_GETFL. */
	279	+ if (test->how.flags & O_CREAT)
	280	+ fdflags \|= O_CREAT;
	281	+ if (!(test->how.flags & O_LARGEFILE))
	282	+ fdflags &= ~O_LARGEFILE;
	283	+
	284	+ EXPECT_EQ(fdflags, (int)test->how.flags) {
	285	+ TH_LOG("openat2 with %s: flags mismatch %X != %llX",
	286	+ test->name, fdflags,
	287	+ (unsigned long long)test->how.flags);
	288	+ }
	289	+ }
	290	+ } else {
	291	+ EXPECT_EQ(test->err, fd) {
	292	+ if (fd >= 0) {
	293	+ fdpath = fdreadlink(_metadata, fd);
	294	+ TH_LOG("openat2 with %s should fail with %d (%s), got %d['%s']",
	295	+ test->name, test->err,
	296	+ strerror(-test->err),
	297	+ fd, fdpath);
	298	+ } else {
	299	+ TH_LOG("openat2 with %s should fail with %d (%s), got %d (%s)",
	300	+ test->name, test->err,
	301	+ strerror(-test->err),
	302	+ fd, strerror(-fd));
	303	+ }
	304	+ }
	305	+ if (fd >= 0)
	306	+ close(fd);
309	307	}
310	308
311		−skip:
312		− if (test->err >= 0)
313		− resultfn("openat2 with %s succeeds\n", test->name);
314		− else
315		− resultfn("openat2 with %s fails with %d (%s)\n",
316		− test->name, test->err, strerror(-test->err));
317		−next:
318	309	free(fdpath);
319		− fflush(stdout);
320	310	}
321	311	}
322	312
323		−#define NUM_TESTS (NUM_OPENAT2_STRUCT_VARIATIONS * NUM_OPENAT2_STRUCT_TESTS + \
324		− NUM_OPENAT2_FLAG_TESTS)
325		−
326		−int main(int argc, char **argv)
327		−{
328		− ksft_print_header();
329		− ksft_set_plan(NUM_TESTS);
330		−
331		− test_openat2_struct();
332		− test_openat2_flags();
333		−
334		− if (ksft_get_fail_cnt() + ksft_get_error_cnt() > 0)
335		− ksft_exit_fail();
336		− else
337		− ksft_exit_pass();
338		−}
	313	+TEST_HARNESS_MAIN

tools/testing/selftests/filesystems/openat2/rename_attack_test.c+159−0

@@ -0,0 +1,159 @@
	1	+// SPDX-License-Identifier: GPL-2.0-or-later
	2	+/*
	3	+ * Author: Aleksa Sarai <cyphar@cyphar.com>
	4	+ * Copyright (C) 2018-2019 SUSE LLC.
	5	+ */
	6	+
	7	+#define _GNU_SOURCE
	8	+#include <errno.h>
	9	+#include <fcntl.h>
	10	+#include <sched.h>
	11	+#include <sys/stat.h>
	12	+#include <sys/types.h>
	13	+#include <sys/mount.h>
	14	+#include <sys/mman.h>
	15	+#include <sys/prctl.h>
	16	+#include <signal.h>
	17	+#include <stdio.h>
	18	+#include <stdlib.h>
	19	+#include <stdbool.h>
	20	+#include <string.h>
	21	+#include <syscall.h>
	22	+#include <limits.h>
	23	+#include <unistd.h>
	24	+
	25	+#include "helpers.h"
	26	+#include "kselftest_harness.h"
	27	+
	28	+#define ROUNDS 400000
	29	+
	30	+/* Swap @dirfd/@a and @dirfd/@b constantly. Parent must kill this process. */
	31	+pid_t spawn_attack(struct __test_metadata *_metadata,
	32	+ int dirfd, char a, char b)
	33	+{
	34	+ pid_t child = fork();
	35	+ if (child != 0)
	36	+ return child;
	37	+
	38	+ /* If the parent (the test process) dies, kill ourselves too. */
	39	+ ASSERT_EQ(prctl(PR_SET_PDEATHSIG, SIGKILL), 0);
	40	+
	41	+ /* Swap @a and @b. */
	42	+ for (;;)
	43	+ renameat2(dirfd, a, dirfd, b, RENAME_EXCHANGE);
	44	+ exit(1);
	45	+}
	46	+
	47	+/*
	48	+ * Construct a test directory with the following structure:
	49	+ *
	50	+ * root/
	51	+ * \|-- a/
	52	+ * \| `-- c/
	53	+ * `-- b/
	54	+ */
	55	+FIXTURE(rename_attack) {
	56	+ int dfd;
	57	+ int afd;
	58	+ pid_t child;
	59	+};
	60	+
	61	+FIXTURE_SETUP(rename_attack)
	62	+{
	63	+ char dirname[] = "/tmp/ksft-openat2-rename-attack.XXXXXX";
	64	+
	65	+ self->dfd = -1;
	66	+ self->afd = -1;
	67	+ self->child = 0;
	68	+
	69	+ /* Make the top-level directory. */
	70	+ ASSERT_NE(mkdtemp(dirname), NULL);
	71	+ self->dfd = open(dirname, O_PATH \| O_DIRECTORY);
	72	+ ASSERT_GE(self->dfd, 0);
	73	+
	74	+ ASSERT_EQ(mkdirat(self->dfd, "a", 0755), 0);
	75	+ ASSERT_EQ(mkdirat(self->dfd, "b", 0755), 0);
	76	+ ASSERT_EQ(mkdirat(self->dfd, "a/c", 0755), 0);
	77	+
	78	+ self->afd = openat(self->dfd, "a", O_PATH);
	79	+ ASSERT_GE(self->afd, 0);
	80	+
	81	+ self->child = spawn_attack(_metadata, self->dfd, "a/c", "b");
	82	+ ASSERT_GT(self->child, 0);
	83	+}
	84	+
	85	+FIXTURE_TEARDOWN(rename_attack)
	86	+{
	87	+ if (self->child > 0)
	88	+ kill(self->child, SIGKILL);
	89	+ if (self->afd >= 0)
	90	+ close(self->afd);
	91	+ if (self->dfd >= 0)
	92	+ close(self->dfd);
	93	+}
	94	+
	95	+FIXTURE_VARIANT(rename_attack) {
	96	+ int resolve;
	97	+ const char *name;
	98	+};
	99	+
	100	+FIXTURE_VARIANT_ADD(rename_attack, resolve_beneath) {
	101	+ .resolve = RESOLVE_BENEATH,
	102	+ .name = "RESOLVE_BENEATH",
	103	+};
	104	+
	105	+FIXTURE_VARIANT_ADD(rename_attack, resolve_in_root) {
	106	+ .resolve = RESOLVE_IN_ROOT,
	107	+ .name = "RESOLVE_IN_ROOT",
	108	+};
	109	+
	110	+TEST_F_TIMEOUT(rename_attack, test, 120)
	111	+{
	112	+ int escapes = 0, successes = 0, other_errs = 0, exdevs = 0, eagains = 0;
	113	+ char *victim_path = "c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../..";
	114	+ struct open_how how = {
	115	+ .flags = O_PATH,
	116	+ .resolve = variant->resolve,
	117	+ };
	118	+
	119	+ if (!openat2_supported) {
	120	+ how.resolve = 0;
	121	+ TH_LOG("openat2(2) unsupported -- using openat(2) instead");
	122	+ }
	123	+
	124	+ for (int i = 0; i < ROUNDS; i++) {
	125	+ int fd;
	126	+
	127	+ if (openat2_supported)
	128	+ fd = sys_openat2(self->afd, victim_path, &how);
	129	+ else
	130	+ fd = sys_openat(self->afd, victim_path, &how);
	131	+
	132	+ if (fd < 0) {
	133	+ if (fd == -EAGAIN)
	134	+ eagains++;
	135	+ else if (fd == -EXDEV)
	136	+ exdevs++;
	137	+ else if (fd == -ENOENT)
	138	+ escapes++; /* escaped outside and got ENOENT... */
	139	+ else
	140	+ other_errs++; /* unexpected error */
	141	+ } else {
	142	+ if (fdequal(_metadata, fd, self->afd, NULL))
	143	+ successes++;
	144	+ else
	145	+ escapes++; /* we got an unexpected fd */
	146	+ }
	147	+ if (fd >= 0)
	148	+ close(fd);
	149	+ }
	150	+
	151	+ TH_LOG("non-escapes: EAGAIN=%d EXDEV=%d E<other>=%d success=%d",
	152	+ eagains, exdevs, other_errs, successes);
	153	+ ASSERT_EQ(escapes, 0) {
	154	+ TH_LOG("rename attack with %s (%d runs, got %d escapes)",
	155	+ variant->name, ROUNDS, escapes);
	156	+ }
	157	+}
	158	+
	159	+TEST_HARNESS_MAIN

tools/testing/selftests/filesystems/openat2/resolve_test.crenamed from tools/testing/selftests/openat2/resolve_test.c+203−165

@@ -14,8 +14,81 @@ · 13 unmodified lines
14	14	#include <stdbool.h>
15	15	#include <string.h>
16	16
17		−#include "kselftest.h"
18	17	#include "helpers.h"
	18	+#include "kselftest_harness.h"
	19	+
	20	+struct resolve_test {
	21	+ const char *name;
	22	+ const char *dir;
	23	+ const char *path;
	24	+ struct open_how how;
	25	+ bool pass;
	26	+ union {
	27	+ int err;
	28	+ const char *path;
	29	+ } out;
	30	+};
	31	+
	32	+/*
	33	+ * Verify a single resolve test case. This must be called from within a TEST_F
	34	+ * function with _metadata in scope.
	35	+ */
	36	+static void verify_resolve_test(struct __test_metadata *_metadata,
	37	+ int rootfd, int hardcoded_fd,
	38	+ const struct resolve_test *test)
	39	+{
	40	+ struct open_how how = test->how;
	41	+ int dfd, fd;
	42	+ char *fdpath = NULL;
	43	+
	44	+ /* Auto-set O_PATH. */
	45	+ if (!(how.flags & O_CREAT))
	46	+ how.flags \|= O_PATH;
	47	+
	48	+ if (test->dir)
	49	+ dfd = openat(rootfd, test->dir, O_PATH \| O_DIRECTORY);
	50	+ else
	51	+ dfd = dup(rootfd);
	52	+ ASSERT_GE(dfd, 0) TH_LOG("failed to open dir '%s': %m", test->dir ?: ".");
	53	+ ASSERT_EQ(dup2(dfd, hardcoded_fd), hardcoded_fd);
	54	+
	55	+ fd = sys_openat2(dfd, test->path, &how);
	56	+
	57	+ if (test->pass) {
	58	+ EXPECT_GE(fd, 0) {
	59	+ TH_LOG("%s: expected success, got %d (%s)",
	60	+ test->name, fd, strerror(-fd));
	61	+ }
	62	+ if (fd >= 0) {
	63	+ EXPECT_TRUE(fdequal(_metadata, fd, rootfd, test->out.path)) {
	64	+ fdpath = fdreadlink(_metadata, fd);
	65	+ TH_LOG("%s: wrong path '%s', expected '%s'",
	66	+ test->name, fdpath,
	67	+ test->out.path ?: ".");
	68	+ free(fdpath);
	69	+ }
	70	+ }
	71	+ } else {
	72	+ EXPECT_EQ(test->out.err, fd) {
	73	+ if (fd >= 0) {
	74	+ fdpath = fdreadlink(_metadata, fd);
	75	+ TH_LOG("%s: expected %d (%s), got %d['%s']",
	76	+ test->name, test->out.err,
	77	+ strerror(-test->out.err), fd, fdpath);
	78	+ free(fdpath);
	79	+ } else {
	80	+ TH_LOG("%s: expected %d (%s), got %d (%s)",
	81	+ test->name, test->out.err,
	82	+ strerror(-test->out.err),
	83	+ fd, strerror(-fd));
	84	+ }
	85	+ }
	86	+ }
	87	+
	88	+ if (fd >= 0)
	89	+ close(fd);
	90	+ close(dfd);
	91	+}
19	92
20	93	/*
21	94	* Construct a test directory with the following structure:
@@ -39,101 +112,110 @@ · 17 unmodified lines
39	112	* \|-- absself -> /
40	113	* \|-- self -> ../../root/
41	114	* \|-- garbageself -> /../../root/
42		− * \|-- passwd -> ../cheeky/../cheeky/../etc/../etc/passwd
43		− * \|-- abspasswd -> /../cheeky/../cheeky/../etc/../etc/passwd
	115	+ * \|-- passwd -> ../cheeky/../etc/../etc/passwd
	116	+ * \|-- abspasswd -> /../cheeky/../etc/../etc/passwd
44	117	* \|-- dotdotlink -> ../../../../../../../../../../../../../../etc/passwd
45	118	* `-- garbagelink -> /../../../../../../../../../../../../../../etc/passwd
46	119	*/
47		−int setup_testdir(void)
	120	+FIXTURE(openat2_resolve) {
	121	+ int rootfd;
	122	+ int hardcoded_fd;
	123	+ char *hardcoded_fdpath;
	124	+ char *procselfexe;
	125	+};
	126	+
	127	+FIXTURE_SETUP(openat2_resolve)
48	128	{
49		− int dfd, tmpfd;
50	129	char dirname[] = "/tmp/ksft-openat2-testdir.XXXXXX";
	130	+ int dfd, tmpfd;
	131	+
	132	+ self->rootfd = -1;
	133	+ self->hardcoded_fd = -1;
	134	+ self->hardcoded_fdpath = NULL;
	135	+ self->procselfexe = NULL;
	136	+
	137	+ /* NOTE: We should be checking for CAP_SYS_ADMIN here... */
	138	+ if (geteuid() != 0)
	139	+ SKIP(return, "all tests require euid == 0");
	140	+ if (!openat2_supported)
	141	+ SKIP(return, "openat2(2) not supported");
51	142
52	143	/* Unshare and make /tmp a new directory. */
53		− E_unshare(CLONE_NEWNS);
54		− E_mount("", "/tmp", "", MS_PRIVATE, "");
	144	+ ASSERT_EQ(unshare(CLONE_NEWNS), 0);
	145	+ ASSERT_EQ(mount("", "/tmp", "", MS_PRIVATE, ""), 0);
55	146
56	147	/* Make the top-level directory. */
57		− if (!mkdtemp(dirname))
58		− ksft_exit_fail_msg("setup_testdir: failed to create tmpdir\n");
	148	+ ASSERT_NE(mkdtemp(dirname), NULL);
59	149	dfd = open(dirname, O_PATH \| O_DIRECTORY);
60		− if (dfd < 0)
61		− ksft_exit_fail_msg("setup_testdir: failed to open tmpdir\n");
	150	+ ASSERT_GE(dfd, 0);
62	151
63	152	/* A sub-directory which is actually used for tests. */
64		− E_mkdirat(dfd, "root", 0755);
	153	+ ASSERT_EQ(mkdirat(dfd, "root", 0755), 0);
65	154	tmpfd = openat(dfd, "root", O_PATH \| O_DIRECTORY);
66		− if (tmpfd < 0)
67		− ksft_exit_fail_msg("setup_testdir: failed to open tmpdir\n");
	155	+ ASSERT_GE(tmpfd, 0);
68	156	close(dfd);
69	157	dfd = tmpfd;
70	158
71		− E_symlinkat("/proc/self/exe", dfd, "procexe");
72		− E_symlinkat("/proc/self/root", dfd, "procroot");
73		− E_mkdirat(dfd, "root", 0755);
	159	+ ASSERT_EQ(symlinkat("/proc/self/exe", dfd, "procexe"), 0);
	160	+ ASSERT_EQ(symlinkat("/proc/self/root", dfd, "procroot"), 0);
	161	+ ASSERT_EQ(mkdirat(dfd, "root", 0755), 0);
74	162
75	163	/* There is no mountat(2), so use chdir. */
76		− E_mkdirat(dfd, "mnt", 0755);
77		− E_fchdir(dfd);
78		− E_mount("tmpfs", "./mnt", "tmpfs", MS_NOSUID \| MS_NODEV, "");
79		− E_symlinkat("../mnt/", dfd, "mnt/self");
80		− E_symlinkat("/mnt/", dfd, "mnt/absself");
81		−
82		− E_mkdirat(dfd, "etc", 0755);
83		− E_touchat(dfd, "etc/passwd");
84		−
85		− E_symlinkat("/newfile3", dfd, "creatlink");
86		− E_symlinkat("etc/", dfd, "reletc");
87		− E_symlinkat("etc/passwd", dfd, "relsym");
88		− E_symlinkat("/etc/", dfd, "absetc");
89		− E_symlinkat("/etc/passwd", dfd, "abssym");
90		− E_symlinkat("/cheeky", dfd, "abscheeky");
91		−
92		− E_mkdirat(dfd, "cheeky", 0755);
93		−
94		− E_symlinkat("/", dfd, "cheeky/absself");
95		− E_symlinkat("../../root/", dfd, "cheeky/self");
96		− E_symlinkat("/../../root/", dfd, "cheeky/garbageself");
97		−
98		− E_symlinkat("../cheeky/../etc/../etc/passwd", dfd, "cheeky/passwd");
99		− E_symlinkat("/../cheeky/../etc/../etc/passwd", dfd, "cheeky/abspasswd");
100		−
101		− E_symlinkat("../../../../../../../../../../../../../../etc/passwd",
102		− dfd, "cheeky/dotdotlink");
103		− E_symlinkat("/../../../../../../../../../../../../../../etc/passwd",
104		− dfd, "cheeky/garbagelink");
105		−
106		− return dfd;
	164	+ ASSERT_EQ(mkdirat(dfd, "mnt", 0755), 0);
	165	+ ASSERT_EQ(fchdir(dfd), 0);
	166	+ ASSERT_EQ(mount("tmpfs", "./mnt", "tmpfs", MS_NOSUID \| MS_NODEV, ""), 0);
	167	+ ASSERT_EQ(symlinkat("../mnt/", dfd, "mnt/self"), 0);
	168	+ ASSERT_EQ(symlinkat("/mnt/", dfd, "mnt/absself"), 0);
	169	+
	170	+ ASSERT_EQ(mkdirat(dfd, "etc", 0755), 0);
	171	+ ASSERT_GE(touchat(dfd, "etc/passwd"), 0);
	172	+
	173	+ ASSERT_EQ(symlinkat("/newfile3", dfd, "creatlink"), 0);
	174	+ ASSERT_EQ(symlinkat("etc/", dfd, "reletc"), 0);
	175	+ ASSERT_EQ(symlinkat("etc/passwd", dfd, "relsym"), 0);
	176	+ ASSERT_EQ(symlinkat("/etc/", dfd, "absetc"), 0);
	177	+ ASSERT_EQ(symlinkat("/etc/passwd", dfd, "abssym"), 0);
	178	+ ASSERT_EQ(symlinkat("/cheeky", dfd, "abscheeky"), 0);
	179	+
	180	+ ASSERT_EQ(mkdirat(dfd, "cheeky", 0755), 0);
	181	+
	182	+ ASSERT_EQ(symlinkat("/", dfd, "cheeky/absself"), 0);
	183	+ ASSERT_EQ(symlinkat("../../root/", dfd, "cheeky/self"), 0);
	184	+ ASSERT_EQ(symlinkat("/../../root/", dfd, "cheeky/garbageself"), 0);
	185	+
	186	+ ASSERT_EQ(symlinkat("../cheeky/../etc/../etc/passwd",
	187	+ dfd, "cheeky/passwd"), 0);
	188	+ ASSERT_EQ(symlinkat("/../cheeky/../etc/../etc/passwd",
	189	+ dfd, "cheeky/abspasswd"), 0);
	190	+
	191	+ ASSERT_EQ(symlinkat("../../../../../../../../../../../../../../etc/passwd",
	192	+ dfd, "cheeky/dotdotlink"), 0);
	193	+ ASSERT_EQ(symlinkat("/../../../../../../../../../../../../../../etc/passwd",
	194	+ dfd, "cheeky/garbagelink"), 0);
	195	+
	196	+ self->rootfd = dfd;
	197	+
	198	+ self->hardcoded_fd = open("/dev/null", O_RDONLY);
	199	+ ASSERT_GE(self->hardcoded_fd, 0);
	200	+ ASSERT_GE(asprintf(&self->hardcoded_fdpath, "self/fd/%d",
	201	+ self->hardcoded_fd), 0);
	202	+ ASSERT_GE(asprintf(&self->procselfexe, "/proc/%d/exe", getpid()), 0);
107	203	}
108	204
109		−struct basic_test {
110		− const char *name;
111		− const char *dir;
112		− const char *path;
113		− struct open_how how;
114		− bool pass;
115		− union {
116		− int err;
117		− const char *path;
118		− } out;
119		−};
120		−
121		−#define NUM_OPENAT2_OPATH_TESTS 88
122		−
123		−void test_openat2_opath_tests(void)
	205	+FIXTURE_TEARDOWN(openat2_resolve)
124	206	{
125		− int rootfd, hardcoded_fd;
126		− char procselfexe, hardcoded_fdpath;
127		−
128		− E_asprintf(&procselfexe, "/proc/%d/exe", getpid());
129		− rootfd = setup_testdir();
130		−
131		− hardcoded_fd = open("/dev/null", O_RDONLY);
132		− E_assert(hardcoded_fd >= 0, "open fd to hardcode");
133		− E_asprintf(&hardcoded_fdpath, "self/fd/%d", hardcoded_fd);
	207	+ free(self->procselfexe);
	208	+ free(self->hardcoded_fdpath);
	209	+ if (self->hardcoded_fd >= 0)
	210	+ close(self->hardcoded_fd);
	211	+ if (self->rootfd >= 0)
	212	+ close(self->rootfd);
	213	+}
134	214
135		− struct basic_test tests[] = {
136		− / RESOLVE_BENEATH /
	215	+/* Attempts to cross the dirfd should be blocked with -EXDEV. */
	216	+TEST_F(openat2_resolve, resolve_beneath)
	217	+{
	218	+ struct resolve_test tests[] = {
137	219	/* Attempts to cross dirfd should be blocked. */
138	220	{ .name = "[beneath] jump to /",
139	221	.path = "/", .how.resolve = RESOLVE_BENEATH,
@@ -206,9 +288,17 @@ void test_openat2_opath_tests(void) · 66 unmodified lines
206	288	{ .name = "[beneath] tricky absolute + garbage link outside $root",
207	289	.path = "abscheeky/garbagelink", .how.resolve = RESOLVE_BENEATH,
208	290	.out.err = -EXDEV, .pass = false },
	291	+ };
	292	+
	293	+ for (int i = 0; i < ARRAY_SIZE(tests); i++)
	294	+ verify_resolve_test(_metadata, self->rootfd,
	295	+ self->hardcoded_fd, &tests[i]);
	296	+}
209	297
210		− / RESOLVE_IN_ROOT /
211		− /* All attempts to cross the dirfd will be scoped-to-root. */
	298	+/* All attempts to cross the dirfd will be scoped-to-root. */
	299	+TEST_F(openat2_resolve, resolve_in_root)
	300	+{
	301	+ struct resolve_test tests[] = {
212	302	{ .name = "[in_root] jump to /",
213	303	.path = "/", .how.resolve = RESOLVE_IN_ROOT,
214	304	.out.path = NULL, .pass = true },
@@ -297,8 +387,17 @@ void test_openat2_opath_tests(void) · 82 unmodified lines
297	387	.how.mode = 0700,
298	388	.how.resolve = RESOLVE_IN_ROOT,
299	389	.out.path = "newfile3", .pass = true },
	390	+ };
300	391
301		− / RESOLVE_NO_XDEV /
	392	+ for (int i = 0; i < ARRAY_SIZE(tests); i++)
	393	+ verify_resolve_test(_metadata, self->rootfd,
	394	+ self->hardcoded_fd, &tests[i]);
	395	+}
	396	+
	397	+/* Crossing mount boundaries should be blocked. */
	398	+TEST_F(openat2_resolve, resolve_no_xdev)
	399	+{
	400	+ struct resolve_test tests[] = {
302	401	/* Crossing down into a mountpoint is disallowed. */
303	402	{ .name = "[no_xdev] cross into $mnt",
304	403	.path = "mnt", .how.resolve = RESOLVE_NO_XDEV,
@@ -347,10 +446,19 @@ void test_openat2_opath_tests(void) · 42 unmodified lines
347	446	.out.err = -EXDEV, .pass = false },
348	447	/* Except magic-link jumps inside the same vfsmount. */
349	448	{ .name = "[no_xdev] jump through magic-link to same procfs",
350		− .dir = "/proc", .path = hardcoded_fdpath, .how.resolve = RESOLVE_NO_XDEV,
351		− .out.path = "/proc", .pass = true, },
	449	+ .dir = "/proc", .path = self->hardcoded_fdpath, .how.resolve = RESOLVE_NO_XDEV,
	450	+ .out.path = "/proc", .pass = true, },
	451	+ };
	452	+
	453	+ for (int i = 0; i < ARRAY_SIZE(tests); i++)
	454	+ verify_resolve_test(_metadata, self->rootfd,
	455	+ self->hardcoded_fd, &tests[i]);
	456	+}
352	457
353		− / RESOLVE_NO_MAGICLINKS /
	458	+/* Procfs-style magic-link resolution should be blocked. */
	459	+TEST_F(openat2_resolve, resolve_no_magiclinks)
	460	+{
	461	+ struct resolve_test tests[] = {
354	462	/* Regular symlinks should work. */
355	463	{ .name = "[no_magiclinks] ordinary relative symlink",
356	464	.path = "relsym", .how.resolve = RESOLVE_NO_MAGICLINKS,
@@ -365,7 +473,7 @@ void test_openat2_opath_tests(void) · 8 unmodified lines
365	473	{ .name = "[no_magiclinks] normal path to magic-link with O_NOFOLLOW",
366	474	.path = "/proc/self/exe", .how.flags = O_NOFOLLOW,
367	475	.how.resolve = RESOLVE_NO_MAGICLINKS,
368		− .out.path = procselfexe, .pass = true },
	476	+ .out.path = self->procselfexe, .pass = true },
369	477	{ .name = "[no_magiclinks] symlink to magic-link path component",
370	478	.path = "procroot/etc", .how.resolve = RESOLVE_NO_MAGICLINKS,
371	479	.out.err = -ELOOP, .pass = false },
@@ -376,8 +484,17 @@ void test_openat2_opath_tests(void) · 4 unmodified lines
376	484	.path = "/proc/self/root/etc", .how.flags = O_NOFOLLOW,
377	485	.how.resolve = RESOLVE_NO_MAGICLINKS,
378	486	.out.err = -ELOOP, .pass = false },
	487	+ };
	488	+
	489	+ for (int i = 0; i < ARRAY_SIZE(tests); i++)
	490	+ verify_resolve_test(_metadata, self->rootfd,
	491	+ self->hardcoded_fd, &tests[i]);
	492	+}
379	493
380		− / RESOLVE_NO_SYMLINKS /
	494	+/* All symlink resolution should be blocked. */
	495	+TEST_F(openat2_resolve, resolve_no_symlinks)
	496	+{
	497	+ struct resolve_test tests[] = {
381	498	/* Normal paths should work. */
382	499	{ .name = "[no_symlinks] ordinary path to '.'",
383	500	.path = ".", .how.resolve = RESOLVE_NO_SYMLINKS,
@@ -436,88 +553,9 @@ void test_openat2_opath_tests(void) · 52 unmodified lines
436	553	.out.err = -ELOOP, .pass = false },
437	554	};
438	555
439		− BUILD_BUG_ON(ARRAY_LEN(tests) != NUM_OPENAT2_OPATH_TESTS);
440		−
441		− for (int i = 0; i < ARRAY_LEN(tests); i++) {
442		− int dfd, fd;
443		− char *fdpath = NULL;
444		− bool failed;
445		− void (resultfn)(const char msg, ...) = ksft_test_result_pass;
446		− struct basic_test *test = &tests[i];
447		−
448		− if (!openat2_supported) {
449		− ksft_print_msg("openat2(2) unsupported\n");
450		− resultfn = ksft_test_result_skip;
451		− goto skip;
452		− }
453		−
454		− /* Auto-set O_PATH. */
455		− if (!(test->how.flags & O_CREAT))
456		− test->how.flags \|= O_PATH;
457		−
458		− if (test->dir)
459		− dfd = openat(rootfd, test->dir, O_PATH \| O_DIRECTORY);
460		− else
461		− dfd = dup(rootfd);
462		− E_assert(dfd, "failed to openat root '%s': %m", test->dir);
463		−
464		− E_dup2(dfd, hardcoded_fd);
465		−
466		− fd = sys_openat2(dfd, test->path, &test->how);
467		− if (test->pass)
468		− failed = (fd < 0 \|\| !fdequal(fd, rootfd, test->out.path));
469		− else
470		− failed = (fd != test->out.err);
471		− if (fd >= 0) {
472		− fdpath = fdreadlink(fd);
473		− close(fd);
474		− }
475		− close(dfd);
476		−
477		− if (failed) {
478		− resultfn = ksft_test_result_fail;
479		−
480		− ksft_print_msg("openat2 unexpectedly returned ");
481		− if (fdpath)
482		− ksft_print_msg("%d['%s']\n", fd, fdpath);
483		− else
484		− ksft_print_msg("%d (%s)\n", fd, strerror(-fd));
485		− }
486		−
487		−skip:
488		− if (test->pass)
489		− resultfn("%s gives path '%s'\n", test->name,
490		− test->out.path ?: ".");
491		− else
492		− resultfn("%s fails with %d (%s)\n", test->name,
493		− test->out.err, strerror(-test->out.err));
494		−
495		− fflush(stdout);
496		− free(fdpath);
497		− }
498		−
499		− free(procselfexe);
500		− close(rootfd);
501		−
502		− free(hardcoded_fdpath);
503		− close(hardcoded_fd);
	556	+ for (int i = 0; i < ARRAY_SIZE(tests); i++)
	557	+ verify_resolve_test(_metadata, self->rootfd,
	558	+ self->hardcoded_fd, &tests[i]);
504	559	}
505	560
506		−#define NUM_TESTS NUM_OPENAT2_OPATH_TESTS
507		−
508		−int main(int argc, char **argv)
509		−{
510		− ksft_print_header();
511		− ksft_set_plan(NUM_TESTS);
512		−
513		− /* NOTE: We should be checking for CAP_SYS_ADMIN here... */
514		− if (geteuid() != 0)
515		− ksft_exit_skip("all tests require euid == 0\n");
516		−
517		− test_openat2_opath_tests();
518		−
519		− if (ksft_get_fail_cnt() + ksft_get_error_cnt() > 0)
520		− ksft_exit_fail();
521		− else
522		− ksft_exit_pass();
523		−}
	561	+TEST_HARNESS_MAIN

tools/testing/selftests/openat2/helpers.c+0−109

@@ -1,109 +0,0 @@
1		−// SPDX-License-Identifier: GPL-2.0-or-later
2		−/*
3		− * Author: Aleksa Sarai <cyphar@cyphar.com>
4		− * Copyright (C) 2018-2019 SUSE LLC.
5		− */
6		−
7		−#define _GNU_SOURCE
8		−#include <errno.h>
9		−#include <fcntl.h>
10		−#include <stdbool.h>
11		−#include <string.h>
12		−#include <syscall.h>
13		−#include <limits.h>
14		−
15		−#include "helpers.h"
16		−
17		−bool needs_openat2(const struct open_how *how)
18		−{
19		− return how->resolve != 0;
20		−}
21		−
22		−int raw_openat2(int dfd, const char path, void how, size_t size)
23		−{
24		− int ret = syscall(__NR_openat2, dfd, path, how, size);
25		− return ret >= 0 ? ret : -errno;
26		−}
27		−
28		−int sys_openat2(int dfd, const char path, struct open_how how)
29		−{
30		− return raw_openat2(dfd, path, how, sizeof(*how));
31		−}
32		−
33		−int sys_openat(int dfd, const char path, struct open_how how)
34		−{
35		− int ret = openat(dfd, path, how->flags, how->mode);
36		− return ret >= 0 ? ret : -errno;
37		−}
38		−
39		−int sys_renameat2(int olddirfd, const char *oldpath,
40		− int newdirfd, const char *newpath, unsigned int flags)
41		−{
42		− int ret = syscall(__NR_renameat2, olddirfd, oldpath,
43		− newdirfd, newpath, flags);
44		− return ret >= 0 ? ret : -errno;
45		−}
46		−
47		−int touchat(int dfd, const char *path)
48		−{
49		− int fd = openat(dfd, path, O_CREAT, 0700);
50		− if (fd >= 0)
51		− close(fd);
52		− return fd;
53		−}
54		−
55		−char *fdreadlink(int fd)
56		−{
57		− char target, tmp;
58		−
59		− E_asprintf(&tmp, "/proc/self/fd/%d", fd);
60		−
61		− target = malloc(PATH_MAX);
62		− if (!target)
63		− ksft_exit_fail_msg("fdreadlink: malloc failed\n");
64		− memset(target, 0, PATH_MAX);
65		−
66		− E_readlink(tmp, target, PATH_MAX);
67		− free(tmp);
68		− return target;
69		−}
70		−
71		−bool fdequal(int fd, int dfd, const char *path)
72		−{
73		− char fdpath, dfdpath, *other;
74		− bool cmp;
75		−
76		− fdpath = fdreadlink(fd);
77		− dfdpath = fdreadlink(dfd);
78		−
79		− if (!path)
80		− E_asprintf(&other, "%s", dfdpath);
81		− else if (*path == '/')
82		− E_asprintf(&other, "%s", path);
83		− else
84		− E_asprintf(&other, "%s/%s", dfdpath, path);
85		−
86		− cmp = !strcmp(fdpath, other);
87		−
88		− free(fdpath);
89		− free(dfdpath);
90		− free(other);
91		− return cmp;
92		−}
93		−
94		−bool openat2_supported = false;
95		−
96		−void __attribute__((constructor)) init(void)
97		−{
98		− struct open_how how = {};
99		− int fd;
100		−
101		− BUILD_BUG_ON(sizeof(struct open_how) != OPEN_HOW_SIZE_VER0);
102		−
103		− /* Check openat2(2) support. */
104		− fd = sys_openat2(AT_FDCWD, ".", &how);
105		− openat2_supported = (fd >= 0);
106		−
107		− if (fd >= 0)
108		− close(fd);
109		−}

tools/testing/selftests/openat2/helpers.h+0−108

@@ -1,108 +0,0 @@
1		−// SPDX-License-Identifier: GPL-2.0-or-later
2		−/*
3		− * Author: Aleksa Sarai <cyphar@cyphar.com>
4		− * Copyright (C) 2018-2019 SUSE LLC.
5		− */
6		−
7		−#ifndef __RESOLVEAT_H__
8		−#define __RESOLVEAT_H__
9		−
10		−#define _GNU_SOURCE
11		−#include <stdint.h>
12		−#include <stdbool.h>
13		−#include <errno.h>
14		−#include <linux/types.h>
15		−#include "kselftest.h"
16		−
17		−#define ARRAY_LEN(X) (sizeof (X) / sizeof (*(X)))
18		−#define BUILD_BUG_ON(e) ((void)(sizeof(struct { int:(-!!(e)); })))
19		−
20		−#ifndef SYS_openat2
21		−#ifndef __NR_openat2
22		−#define __NR_openat2 437
23		−#endif /* __NR_openat2 */
24		−#define SYS_openat2 __NR_openat2
25		−#endif /* SYS_openat2 */
26		−
27		−/*
28		− * Arguments for how openat2(2) should open the target path. If @resolve is
29		− * zero, then openat2(2) operates very similarly to openat(2).
30		− *
31		− * However, unlike openat(2), unknown bits in @flags result in -EINVAL rather
32		− * than being silently ignored. @mode must be zero unless one of {O_CREAT,
33		− * O_TMPFILE} are set.
34		− *
35		− * @flags: O_* flags.
36		− * @mode: O_CREAT/O_TMPFILE file mode.
37		− * @resolve: RESOLVE_* flags.
38		− */
39		−struct open_how {
40		− __u64 flags;
41		− __u64 mode;
42		− __u64 resolve;
43		−};
44		−
45		−#define OPEN_HOW_SIZE_VER0 24 /* sizeof first published struct */
46		−#define OPEN_HOW_SIZE_LATEST OPEN_HOW_SIZE_VER0
47		−
48		−bool needs_openat2(const struct open_how *how);
49		−
50		−#ifndef RESOLVE_IN_ROOT
51		−/* how->resolve flags for openat2(2). */
52		−#define RESOLVE_NO_XDEV 0x01 /* Block mount-point crossings
53		− (includes bind-mounts). */
54		−#define RESOLVE_NO_MAGICLINKS 0x02 /* Block traversal through procfs-style
55		− "magic-links". */
56		−#define RESOLVE_NO_SYMLINKS 0x04 /* Block traversal through all symlinks
57		− (implies OEXT_NO_MAGICLINKS) */
58		−#define RESOLVE_BENEATH 0x08 /* Block "lexical" trickery like
59		− "..", symlinks, and absolute
60		− paths which escape the dirfd. */
61		−#define RESOLVE_IN_ROOT 0x10 /* Make all jumps to "/" and ".."
62		− be scoped inside the dirfd
63		− (similar to chroot(2)). */
64		−#endif /* RESOLVE_IN_ROOT */
65		−
66		−#define E_func(func, ...) \
67		− do { \
68		− errno = 0; \
69		− if (func(__VA_ARGS__) < 0) \
70		− ksft_exit_fail_msg("%s:%d %s failed - errno:%d\n", \
71		− __FILE__, __LINE__, #func, errno); \
72		− } while (0)
73		−
74		−#define E_asprintf(...) E_func(asprintf, __VA_ARGS__)
75		−#define E_chmod(...) E_func(chmod, __VA_ARGS__)
76		−#define E_dup2(...) E_func(dup2, __VA_ARGS__)
77		−#define E_fchdir(...) E_func(fchdir, __VA_ARGS__)
78		−#define E_fstatat(...) E_func(fstatat, __VA_ARGS__)
79		−#define E_kill(...) E_func(kill, __VA_ARGS__)
80		−#define E_mkdirat(...) E_func(mkdirat, __VA_ARGS__)
81		−#define E_mount(...) E_func(mount, __VA_ARGS__)
82		−#define E_prctl(...) E_func(prctl, __VA_ARGS__)
83		−#define E_readlink(...) E_func(readlink, __VA_ARGS__)
84		−#define E_setresuid(...) E_func(setresuid, __VA_ARGS__)
85		−#define E_symlinkat(...) E_func(symlinkat, __VA_ARGS__)
86		−#define E_touchat(...) E_func(touchat, __VA_ARGS__)
87		−#define E_unshare(...) E_func(unshare, __VA_ARGS__)
88		−
89		−#define E_assert(expr, msg, ...) \
90		− do { \
91		− if (!(expr)) \
92		− ksft_exit_fail_msg("ASSERT(%s:%d) failed (%s): " msg "\n", \
93		− __FILE__, __LINE__, #expr, ##__VA_ARGS__); \
94		− } while (0)
95		−
96		−int raw_openat2(int dfd, const char path, void how, size_t size);
97		−int sys_openat2(int dfd, const char path, struct open_how how);
98		−int sys_openat(int dfd, const char path, struct open_how how);
99		−int sys_renameat2(int olddirfd, const char *oldpath,
100		− int newdirfd, const char *newpath, unsigned int flags);
101		−
102		−int touchat(int dfd, const char *path);
103		−char *fdreadlink(int fd);
104		−bool fdequal(int fd, int dfd, const char *path);
105		−
106		−extern bool openat2_supported;
107		−
108		−#endif /* __RESOLVEAT_H__ */

tools/testing/selftests/openat2/rename_attack_test.c+0−160

@@ -1,160 +0,0 @@
1		−// SPDX-License-Identifier: GPL-2.0-or-later
2		−/*
3		− * Author: Aleksa Sarai <cyphar@cyphar.com>
4		− * Copyright (C) 2018-2019 SUSE LLC.
5		− */
6		−
7		−#define _GNU_SOURCE
8		−#include <errno.h>
9		−#include <fcntl.h>
10		−#include <sched.h>
11		−#include <sys/stat.h>
12		−#include <sys/types.h>
13		−#include <sys/mount.h>
14		−#include <sys/mman.h>
15		−#include <sys/prctl.h>
16		−#include <signal.h>
17		−#include <stdio.h>
18		−#include <stdlib.h>
19		−#include <stdbool.h>
20		−#include <string.h>
21		−#include <syscall.h>
22		−#include <limits.h>
23		−#include <unistd.h>
24		−
25		−#include "kselftest.h"
26		−#include "helpers.h"
27		−
28		−/* Construct a test directory with the following structure:
29		− *
30		− * root/
31		− * \|-- a/
32		− * \| `-- c/
33		− * `-- b/
34		− */
35		−int setup_testdir(void)
36		−{
37		− int dfd;
38		− char dirname[] = "/tmp/ksft-openat2-rename-attack.XXXXXX";
39		−
40		− /* Make the top-level directory. */
41		− if (!mkdtemp(dirname))
42		− ksft_exit_fail_msg("setup_testdir: failed to create tmpdir\n");
43		− dfd = open(dirname, O_PATH \| O_DIRECTORY);
44		− if (dfd < 0)
45		− ksft_exit_fail_msg("setup_testdir: failed to open tmpdir\n");
46		−
47		− E_mkdirat(dfd, "a", 0755);
48		− E_mkdirat(dfd, "b", 0755);
49		− E_mkdirat(dfd, "a/c", 0755);
50		−
51		− return dfd;
52		−}
53		−
54		−/* Swap @dirfd/@a and @dirfd/@b constantly. Parent must kill this process. */
55		−pid_t spawn_attack(int dirfd, char a, char b)
56		−{
57		− pid_t child = fork();
58		− if (child != 0)
59		− return child;
60		−
61		− /* If the parent (the test process) dies, kill ourselves too. */
62		− E_prctl(PR_SET_PDEATHSIG, SIGKILL);
63		−
64		− /* Swap @a and @b. */
65		− for (;;)
66		− renameat2(dirfd, a, dirfd, b, RENAME_EXCHANGE);
67		− exit(1);
68		−}
69		−
70		−#define NUM_RENAME_TESTS 2
71		−#define ROUNDS 400000
72		−
73		−const char *flagname(int resolve)
74		−{
75		− switch (resolve) {
76		− case RESOLVE_IN_ROOT:
77		− return "RESOLVE_IN_ROOT";
78		− case RESOLVE_BENEATH:
79		− return "RESOLVE_BENEATH";
80		− }
81		− return "(unknown)";
82		−}
83		−
84		−void test_rename_attack(int resolve)
85		−{
86		− int dfd, afd;
87		− pid_t child;
88		− void (resultfn)(const char msg, ...) = ksft_test_result_pass;
89		− int escapes = 0, other_errs = 0, exdevs = 0, eagains = 0, successes = 0;
90		−
91		− struct open_how how = {
92		− .flags = O_PATH,
93		− .resolve = resolve,
94		− };
95		−
96		− if (!openat2_supported) {
97		− how.resolve = 0;
98		− ksft_print_msg("openat2(2) unsupported -- using openat(2) instead\n");
99		− }
100		−
101		− dfd = setup_testdir();
102		− afd = openat(dfd, "a", O_PATH);
103		− if (afd < 0)
104		− ksft_exit_fail_msg("test_rename_attack: failed to open 'a'\n");
105		−
106		− child = spawn_attack(dfd, "a/c", "b");
107		−
108		− for (int i = 0; i < ROUNDS; i++) {
109		− int fd;
110		− char *victim_path = "c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../..";
111		−
112		− if (openat2_supported)
113		− fd = sys_openat2(afd, victim_path, &how);
114		− else
115		− fd = sys_openat(afd, victim_path, &how);
116		−
117		− if (fd < 0) {
118		− if (fd == -EAGAIN)
119		− eagains++;
120		− else if (fd == -EXDEV)
121		− exdevs++;
122		− else if (fd == -ENOENT)
123		− escapes++; /* escaped outside and got ENOENT... */
124		− else
125		− other_errs++; /* unexpected error */
126		− } else {
127		− if (fdequal(fd, afd, NULL))
128		− successes++;
129		− else
130		− escapes++; /* we got an unexpected fd */
131		− }
132		− close(fd);
133		− }
134		−
135		− if (escapes > 0)
136		− resultfn = ksft_test_result_fail;
137		− ksft_print_msg("non-escapes: EAGAIN=%d EXDEV=%d E<other>=%d success=%d\n",
138		− eagains, exdevs, other_errs, successes);
139		− resultfn("rename attack with %s (%d runs, got %d escapes)\n",
140		− flagname(resolve), ROUNDS, escapes);
141		−
142		− /* Should be killed anyway, but might as well make sure. */
143		− E_kill(child, SIGKILL);
144		−}
145		−
146		−#define NUM_TESTS NUM_RENAME_TESTS
147		−
148		−int main(int argc, char **argv)
149		−{
150		− ksft_print_header();
151		− ksft_set_plan(NUM_TESTS);
152		−
153		− test_rename_attack(RESOLVE_BENEATH);
154		− test_rename_attack(RESOLVE_IN_ROOT);
155		−
156		− if (ksft_get_fail_cnt() + ksft_get_error_cnt() > 0)
157		− ksft_exit_fail();
158		− else
159		− ksft_exit_pass();
160		−}