src/test/test-seccomp.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2016 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <sched.h>
  21 #include <stdlib.h>
  22 #include <sys/eventfd.h>
  23 #include <sys/mman.h>
  24 #include <sys/poll.h>
  25 #include <sys/shm.h>
  26 #include <sys/types.h>
  27 #include <unistd.h>
  28
  29 #include "alloc-util.h"
  30 #include "fd-util.h"
  31 #include "macro.h"
  32 #include "missing.h"
  33 #include "nsflags.h"
  34 #include "process-util.h"
  35 #include "raw-clone.h"
  36 #include "seccomp-util.h"
  37 #include "set.h"
  38 #include "string-util.h"
  39 #include "util.h"
  40 #include "virt.h"
  41
  42 static void test_seccomp_arch_to_string(void) {
  43         uint32_t a, b;
  44         const char *name;
  45
  46         a = seccomp_arch_native();
  47         assert_se(a > 0);
  48         name = seccomp_arch_to_string(a);
  49         assert_se(name);
  50         assert_se(seccomp_arch_from_string(name, &b) >= 0);
  51         assert_se(a == b);
  52 }
  53
  54 static void test_architecture_table(void) {
  55         const char *n, *n2;
  56
  57         NULSTR_FOREACH(n,
  58                        "native\0"
  59                        "x86\0"
  60                        "x86-64\0"
  61                        "x32\0"
  62                        "arm\0"
  63                        "arm64\0"
  64                        "mips\0"
  65                        "mips64\0"
  66                        "mips64-n32\0"
  67                        "mips-le\0"
  68                        "mips64-le\0"
  69                        "mips64-le-n32\0"
  70                        "ppc\0"
  71                        "ppc64\0"
  72                        "ppc64-le\0"
  73                        "s390\0"
  74                        "s390x\0") {
  75                 uint32_t c;
  76
  77                 assert_se(seccomp_arch_from_string(n, &c) >= 0);
  78                 n2 = seccomp_arch_to_string(c);
  79                 log_info("seccomp-arch: %s → 0x%"PRIx32" → %s", n, c, n2);
  80                 assert_se(streq_ptr(n, n2));
  81         }
  82 }
  83
  84 static void test_syscall_filter_set_find(void) {
  85         assert_se(!syscall_filter_set_find(NULL));
  86         assert_se(!syscall_filter_set_find(""));
  87         assert_se(!syscall_filter_set_find("quux"));
  88         assert_se(!syscall_filter_set_find("@quux"));
  89
  90         assert_se(syscall_filter_set_find("@clock") == syscall_filter_sets + SYSCALL_FILTER_SET_CLOCK);
  91         assert_se(syscall_filter_set_find("@default") == syscall_filter_sets + SYSCALL_FILTER_SET_DEFAULT);
  92         assert_se(syscall_filter_set_find("@raw-io") == syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO);
  93 }
  94
  95 static void test_filter_sets(void) {
  96         unsigned i;
  97         int r;
  98
  99         if (!is_seccomp_available())
 100                 return;
 101         if (geteuid() != 0)
 102                 return;
 103
 104         for (i = 0; i < _SYSCALL_FILTER_SET_MAX; i++) {
 105                 pid_t pid;
 106
 107                 log_info("Testing %s", syscall_filter_sets[i].name);
 108
 109                 pid = fork();
 110                 assert_se(pid >= 0);
 111
 112                 if (pid == 0) { /* Child? */
 113                         int fd;
 114
 115                         if (i == SYSCALL_FILTER_SET_DEFAULT) /* if we look at the default set, whitelist instead of blacklist */
 116                                 r = seccomp_load_syscall_filter_set(SCMP_ACT_ERRNO(EUCLEAN), syscall_filter_sets + i, SCMP_ACT_ALLOW);
 117                         else
 118                                 r = seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + i, SCMP_ACT_ERRNO(EUCLEAN));
 119                         if (r < 0)
 120                                 _exit(EXIT_FAILURE);
 121
 122                         /* Test the sycall filter with one random system call */
 123                         fd = eventfd(0, EFD_NONBLOCK|EFD_CLOEXEC);
 124                         if (IN_SET(i, SYSCALL_FILTER_SET_IO_EVENT, SYSCALL_FILTER_SET_DEFAULT))
 125                                 assert_se(fd < 0 && errno == EUCLEAN);
 126                         else {
 127                                 assert_se(fd >= 0);
 128                                 safe_close(fd);
 129                         }
 130
 131                         _exit(EXIT_SUCCESS);
 132                 }
 133
 134                 assert_se(wait_for_terminate_and_warn(syscall_filter_sets[i].name, pid, true) == EXIT_SUCCESS);
 135         }
 136 }
 137
 138 static void test_restrict_namespace(void) {
 139         _cleanup_free_ char *s = NULL;
 140         unsigned long ul;
 141         pid_t pid;
 142
 143         assert_se(namespace_flag_to_string(0) == NULL);
 144         assert_se(streq(namespace_flag_to_string(CLONE_NEWNS), "mnt"));
 145         assert_se(namespace_flag_to_string(CLONE_NEWNS|CLONE_NEWIPC) == NULL);
 146         assert_se(streq(namespace_flag_to_string(CLONE_NEWCGROUP), "cgroup"));
 147
 148         assert_se(namespace_flag_from_string("mnt") == CLONE_NEWNS);
 149         assert_se(namespace_flag_from_string(NULL) == 0);
 150         assert_se(namespace_flag_from_string("") == 0);
 151         assert_se(namespace_flag_from_string("uts") == CLONE_NEWUTS);
 152         assert_se(namespace_flag_from_string(namespace_flag_to_string(CLONE_NEWUTS)) == CLONE_NEWUTS);
 153         assert_se(streq(namespace_flag_to_string(namespace_flag_from_string("ipc")), "ipc"));
 154
 155         assert_se(namespace_flag_from_string_many(NULL, &ul) == 0 && ul == 0);
 156         assert_se(namespace_flag_from_string_many("", &ul) == 0 && ul == 0);
 157         assert_se(namespace_flag_from_string_many("mnt uts ipc", &ul) == 0 && ul == (CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWIPC));
 158
 159         assert_se(namespace_flag_to_string_many(NAMESPACE_FLAGS_ALL, &s) == 0);
 160         assert_se(streq(s, "cgroup ipc net mnt pid user uts"));
 161         assert_se(namespace_flag_from_string_many(s, &ul) == 0 && ul == NAMESPACE_FLAGS_ALL);
 162
 163 #if SECCOMP_RESTRICT_NAMESPACES_BROKEN == 0
 164
 165         if (!is_seccomp_available())
 166                 return;
 167         if (geteuid() != 0)
 168                 return;
 169
 170         pid = fork();
 171         assert_se(pid >= 0);
 172
 173         if (pid == 0) {
 174
 175                 assert_se(seccomp_restrict_namespaces(CLONE_NEWNS|CLONE_NEWNET) >= 0);
 176
 177                 assert_se(unshare(CLONE_NEWNS) == 0);
 178                 assert_se(unshare(CLONE_NEWNET) == 0);
 179                 assert_se(unshare(CLONE_NEWUTS) == -1);
 180                 assert_se(errno == EPERM);
 181                 assert_se(unshare(CLONE_NEWIPC) == -1);
 182                 assert_se(errno == EPERM);
 183                 assert_se(unshare(CLONE_NEWNET|CLONE_NEWUTS) == -1);
 184                 assert_se(errno == EPERM);
 185
 186                 /* We use fd 0 (stdin) here, which of course will fail with EINVAL on setns(). Except of course our
 187                  * seccomp filter worked, and hits first and makes it return EPERM */
 188                 assert_se(setns(0, CLONE_NEWNS) == -1);
 189                 assert_se(errno == EINVAL);
 190                 assert_se(setns(0, CLONE_NEWNET) == -1);
 191                 assert_se(errno == EINVAL);
 192                 assert_se(setns(0, CLONE_NEWUTS) == -1);
 193                 assert_se(errno == EPERM);
 194                 assert_se(setns(0, CLONE_NEWIPC) == -1);
 195                 assert_se(errno == EPERM);
 196                 assert_se(setns(0, CLONE_NEWNET|CLONE_NEWUTS) == -1);
 197                 assert_se(errno == EPERM);
 198                 assert_se(setns(0, 0) == -1);
 199                 assert_se(errno == EPERM);
 200
 201                 pid = raw_clone(CLONE_NEWNS);
 202                 assert_se(pid >= 0);
 203                 if (pid == 0)
 204                         _exit(EXIT_SUCCESS);
 205                 pid = raw_clone(CLONE_NEWNET);
 206                 assert_se(pid >= 0);
 207                 if (pid == 0)
 208                         _exit(EXIT_SUCCESS);
 209                 pid = raw_clone(CLONE_NEWUTS);
 210                 assert_se(pid < 0);
 211                 assert_se(errno == EPERM);
 212                 pid = raw_clone(CLONE_NEWIPC);
 213                 assert_se(pid < 0);
 214                 assert_se(errno == EPERM);
 215                 pid = raw_clone(CLONE_NEWNET|CLONE_NEWUTS);
 216                 assert_se(pid < 0);
 217                 assert_se(errno == EPERM);
 218
 219                 _exit(EXIT_SUCCESS);
 220         }
 221
 222         assert_se(wait_for_terminate_and_warn("nsseccomp", pid, true) == EXIT_SUCCESS);
 223 #endif
 224 }
 225
 226 static void test_protect_sysctl(void) {
 227         pid_t pid;
 228
 229         if (!is_seccomp_available())
 230                 return;
 231         if (geteuid() != 0)
 232                 return;
 233
 234         if (detect_container() > 0) /* in containers _sysctl() is likely missing anyway */
 235                 return;
 236
 237         pid = fork();
 238         assert_se(pid >= 0);
 239
 240         if (pid == 0) {
 241                 assert_se(syscall(__NR__sysctl, NULL) < 0);
 242                 assert_se(errno == EFAULT);
 243
 244                 assert_se(seccomp_protect_sysctl() >= 0);
 245
 246                 assert_se(syscall(__NR__sysctl, 0, 0, 0) < 0);
 247                 assert_se(errno == EPERM);
 248
 249                 _exit(EXIT_SUCCESS);
 250         }
 251
 252         assert_se(wait_for_terminate_and_warn("sysctlseccomp", pid, true) == EXIT_SUCCESS);
 253 }
 254
 255 static void test_restrict_address_families(void) {
 256         pid_t pid;
 257
 258         if (!is_seccomp_available())
 259                 return;
 260         if (geteuid() != 0)
 261                 return;
 262
 263         pid = fork();
 264         assert_se(pid >= 0);
 265
 266         if (pid == 0) {
 267                 int fd;
 268                 Set *s;
 269
 270                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 271                 assert_se(fd >= 0);
 272                 safe_close(fd);
 273
 274                 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
 275                 assert_se(fd >= 0);
 276                 safe_close(fd);
 277
 278                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
 279                 assert_se(fd >= 0);
 280                 safe_close(fd);
 281
 282                 assert_se(s = set_new(NULL));
 283                 assert_se(set_put(s, INT_TO_PTR(AF_UNIX)) >= 0);
 284
 285                 assert_se(seccomp_restrict_address_families(s, false) >= 0);
 286
 287                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 288                 assert_se(fd >= 0);
 289                 safe_close(fd);
 290
 291                 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
 292 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
 293                 assert_se(fd >= 0);
 294                 safe_close(fd);
 295 #else
 296                 assert_se(fd < 0);
 297                 assert_se(errno == EAFNOSUPPORT);
 298 #endif
 299
 300                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
 301                 assert_se(fd >= 0);
 302                 safe_close(fd);
 303
 304                 set_clear(s);
 305
 306                 assert_se(set_put(s, INT_TO_PTR(AF_INET)) >= 0);
 307
 308                 assert_se(seccomp_restrict_address_families(s, true) >= 0);
 309
 310                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 311                 assert_se(fd >= 0);
 312                 safe_close(fd);
 313
 314                 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
 315 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
 316                 assert_se(fd >= 0);
 317                 safe_close(fd);
 318 #else
 319                 assert_se(fd < 0);
 320                 assert_se(errno == EAFNOSUPPORT);
 321 #endif
 322
 323                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
 324 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
 325                 assert_se(fd >= 0);
 326                 safe_close(fd);
 327 #else
 328                 assert_se(fd < 0);
 329                 assert_se(errno == EAFNOSUPPORT);
 330 #endif
 331
 332                 _exit(EXIT_SUCCESS);
 333         }
 334
 335         assert_se(wait_for_terminate_and_warn("socketseccomp", pid, true) == EXIT_SUCCESS);
 336 }
 337
 338 static void test_restrict_realtime(void) {
 339         pid_t pid;
 340
 341         if (!is_seccomp_available())
 342                 return;
 343         if (geteuid() != 0)
 344                 return;
 345
 346         if (detect_container() > 0) /* in containers RT privs are likely missing anyway */
 347                 return;
 348
 349         pid = fork();
 350         assert_se(pid >= 0);
 351
 352         if (pid == 0) {
 353                 assert_se(sched_setscheduler(0, SCHED_FIFO, &(struct sched_param) { .sched_priority = 1 }) >= 0);
 354                 assert_se(sched_setscheduler(0, SCHED_RR, &(struct sched_param) { .sched_priority = 1 }) >= 0);
 355                 assert_se(sched_setscheduler(0, SCHED_IDLE, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 356                 assert_se(sched_setscheduler(0, SCHED_BATCH, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 357                 assert_se(sched_setscheduler(0, SCHED_OTHER, &(struct sched_param) {}) >= 0);
 358
 359                 assert_se(seccomp_restrict_realtime() >= 0);
 360
 361                 assert_se(sched_setscheduler(0, SCHED_IDLE, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 362                 assert_se(sched_setscheduler(0, SCHED_BATCH, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 363                 assert_se(sched_setscheduler(0, SCHED_OTHER, &(struct sched_param) {}) >= 0);
 364
 365                 assert_se(sched_setscheduler(0, SCHED_FIFO, &(struct sched_param) { .sched_priority = 1 }) < 0);
 366                 assert_se(errno == EPERM);
 367                 assert_se(sched_setscheduler(0, SCHED_RR, &(struct sched_param) { .sched_priority = 1 }) < 0);
 368                 assert_se(errno == EPERM);
 369
 370                 _exit(EXIT_SUCCESS);
 371         }
 372
 373         assert_se(wait_for_terminate_and_warn("realtimeseccomp", pid, true) == EXIT_SUCCESS);
 374 }
 375
 376 static void test_memory_deny_write_execute_mmap(void) {
 377         pid_t pid;
 378
 379         if (!is_seccomp_available())
 380                 return;
 381         if (geteuid() != 0)
 382                 return;
 383
 384         pid = fork();
 385         assert_se(pid >= 0);
 386
 387         if (pid == 0) {
 388                 void *p;
 389
 390                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 391                 assert_se(p != MAP_FAILED);
 392                 assert_se(munmap(p, page_size()) >= 0);
 393
 394                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 395                 assert_se(p != MAP_FAILED);
 396                 assert_se(munmap(p, page_size()) >= 0);
 397
 398                 assert_se(seccomp_memory_deny_write_execute() >= 0);
 399
 400                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 401 #if defined(__x86_64__) || defined(__i386__) || defined(__powerpc64__)
 402                 assert_se(p == MAP_FAILED);
 403                 assert_se(errno == EPERM);
 404 #else /* unknown architectures */
 405                 assert_se(p != MAP_FAILED);
 406                 assert_se(munmap(p, page_size()) >= 0);
 407 #endif
 408
 409                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 410                 assert_se(p != MAP_FAILED);
 411                 assert_se(munmap(p, page_size()) >= 0);
 412
 413                 _exit(EXIT_SUCCESS);
 414         }
 415
 416         assert_se(wait_for_terminate_and_warn("memoryseccomp-mmap", pid, true) == EXIT_SUCCESS);
 417 }
 418
 419 static void test_memory_deny_write_execute_shmat(void) {
 420         int shmid;
 421         pid_t pid;
 422
 423         if (!is_seccomp_available())
 424                 return;
 425         if (geteuid() != 0)
 426                 return;
 427
 428         shmid = shmget(IPC_PRIVATE, page_size(), 0);
 429         assert_se(shmid >= 0);
 430
 431         pid = fork();
 432         assert_se(pid >= 0);
 433
 434         if (pid == 0) {
 435                 void *p;
 436
 437                 p = shmat(shmid, NULL, 0);
 438                 assert_se(p != MAP_FAILED);
 439                 assert_se(shmdt(p) == 0);
 440
 441                 p = shmat(shmid, NULL, SHM_EXEC);
 442                 assert_se(p != MAP_FAILED);
 443                 assert_se(shmdt(p) == 0);
 444
 445                 assert_se(seccomp_memory_deny_write_execute() >= 0);
 446
 447                 p = shmat(shmid, NULL, SHM_EXEC);
 448 #if defined(__x86_64__)
 449                 assert_se(p == MAP_FAILED);
 450                 assert_se(errno == EPERM);
 451 #else /* __i386__, __powerpc64__, and "unknown" architectures */
 452                 assert_se(p != MAP_FAILED);
 453                 assert_se(shmdt(p) == 0);
 454 #endif
 455
 456                 p = shmat(shmid, NULL, 0);
 457                 assert_se(p != MAP_FAILED);
 458                 assert_se(shmdt(p) == 0);
 459
 460                 _exit(EXIT_SUCCESS);
 461         }
 462
 463         assert_se(wait_for_terminate_and_warn("memoryseccomp-shmat", pid, true) == EXIT_SUCCESS);
 464 }
 465
 466 static void test_restrict_archs(void) {
 467         pid_t pid;
 468
 469         if (!is_seccomp_available())
 470                 return;
 471         if (geteuid() != 0)
 472                 return;
 473
 474         pid = fork();
 475         assert_se(pid >= 0);
 476
 477         if (pid == 0) {
 478                 _cleanup_set_free_ Set *s = NULL;
 479
 480                 assert_se(access("/", F_OK) >= 0);
 481
 482                 assert_se(s = set_new(NULL));
 483
 484 #ifdef __x86_64__
 485                 assert_se(set_put(s, UINT32_TO_PTR(SCMP_ARCH_X86+1)) >= 0);
 486 #endif
 487                 assert_se(seccomp_restrict_archs(s) >= 0);
 488
 489                 assert_se(access("/", F_OK) >= 0);
 490                 assert_se(seccomp_restrict_archs(NULL) >= 0);
 491
 492                 assert_se(access("/", F_OK) >= 0);
 493
 494                 _exit(EXIT_SUCCESS);
 495         }
 496
 497         assert_se(wait_for_terminate_and_warn("archseccomp", pid, true) == EXIT_SUCCESS);
 498 }
 499
 500 static void test_load_syscall_filter_set_raw(void) {
 501         pid_t pid;
 502
 503         if (!is_seccomp_available())
 504                 return;
 505         if (geteuid() != 0)
 506                 return;
 507
 508         pid = fork();
 509         assert_se(pid >= 0);
 510
 511         if (pid == 0) {
 512                 _cleanup_set_free_ Set *s = NULL;
 513
 514                 assert_se(access("/", F_OK) >= 0);
 515                 assert_se(poll(NULL, 0, 0) == 0);
 516
 517                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, NULL, SCMP_ACT_KILL) >= 0);
 518                 assert_se(access("/", F_OK) >= 0);
 519                 assert_se(poll(NULL, 0, 0) == 0);
 520
 521                 assert_se(s = set_new(NULL));
 522                 assert_se(set_put(s, UINT32_TO_PTR(__NR_access + 1)) >= 0);
 523
 524                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUCLEAN)) >= 0);
 525
 526                 assert_se(access("/", F_OK) < 0);
 527                 assert_se(errno == EUCLEAN);
 528
 529                 assert_se(poll(NULL, 0, 0) == 0);
 530
 531                 s = set_free(s);
 532
 533                 assert_se(s = set_new(NULL));
 534                 assert_se(set_put(s, UINT32_TO_PTR(__NR_poll + 1)) >= 0);
 535
 536                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUNATCH)) >= 0);
 537
 538                 assert_se(access("/", F_OK) < 0);
 539                 assert_se(errno == EUCLEAN);
 540
 541                 assert_se(poll(NULL, 0, 0) < 0);
 542                 assert_se(errno == EUNATCH);
 543
 544                 _exit(EXIT_SUCCESS);
 545         }
 546
 547         assert_se(wait_for_terminate_and_warn("syscallrawseccomp", pid, true) == EXIT_SUCCESS);
 548 }
 549
 550 int main(int argc, char *argv[]) {
 551
 552         log_set_max_level(LOG_DEBUG);
 553
 554         test_seccomp_arch_to_string();
 555         test_architecture_table();
 556         test_syscall_filter_set_find();
 557         test_filter_sets();
 558         test_restrict_namespace();
 559         test_protect_sysctl();
 560         test_restrict_address_families();
 561         test_restrict_realtime();
 562         test_memory_deny_write_execute_mmap();
 563         test_memory_deny_write_execute_shmat();
 564         test_restrict_archs();
 565         test_load_syscall_filter_set_raw();
 566
 567         return 0;
 568 }