src/test/test-seccomp.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2016 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <sched.h>
  21 #include <stdlib.h>
  22 #include <sys/eventfd.h>
  23 #include <sys/mman.h>
  24 #include <sys/poll.h>
  25 #include <sys/shm.h>
  26 #include <sys/types.h>
  27 #include <unistd.h>
  28
  29 #include "alloc-util.h"
  30 #include "fd-util.h"
  31 #include "macro.h"
  32 #include "missing.h"
  33 #include "nsflags.h"
  34 #include "process-util.h"
  35 #include "raw-clone.h"
  36 #include "seccomp-util.h"
  37 #include "set.h"
  38 #include "string-util.h"
  39 #include "util.h"
  40 #include "virt.h"
  41
  42 static void test_seccomp_arch_to_string(void) {
  43         uint32_t a, b;
  44         const char *name;
  45
  46         a = seccomp_arch_native();
  47         assert_se(a > 0);
  48         name = seccomp_arch_to_string(a);
  49         assert_se(name);
  50         assert_se(seccomp_arch_from_string(name, &b) >= 0);
  51         assert_se(a == b);
  52 }
  53
  54 static void test_architecture_table(void) {
  55         const char *n, *n2;
  56
  57         NULSTR_FOREACH(n,
  58                        "native\0"
  59                        "x86\0"
  60                        "x86-64\0"
  61                        "x32\0"
  62                        "arm\0"
  63                        "arm64\0"
  64                        "mips\0"
  65                        "mips64\0"
  66                        "mips64-n32\0"
  67                        "mips-le\0"
  68                        "mips64-le\0"
  69                        "mips64-le-n32\0"
  70                        "ppc\0"
  71                        "ppc64\0"
  72                        "ppc64-le\0"
  73                        "s390\0"
  74                        "s390x\0") {
  75                 uint32_t c;
  76
  77                 assert_se(seccomp_arch_from_string(n, &c) >= 0);
  78                 n2 = seccomp_arch_to_string(c);
  79                 log_info("seccomp-arch: %s → 0x%"PRIx32" → %s", n, c, n2);
  80                 assert_se(streq_ptr(n, n2));
  81         }
  82 }
  83
  84 static void test_syscall_filter_set_find(void) {
  85         assert_se(!syscall_filter_set_find(NULL));
  86         assert_se(!syscall_filter_set_find(""));
  87         assert_se(!syscall_filter_set_find("quux"));
  88         assert_se(!syscall_filter_set_find("@quux"));
  89
  90         assert_se(syscall_filter_set_find("@clock") == syscall_filter_sets + SYSCALL_FILTER_SET_CLOCK);
  91         assert_se(syscall_filter_set_find("@default") == syscall_filter_sets + SYSCALL_FILTER_SET_DEFAULT);
  92         assert_se(syscall_filter_set_find("@raw-io") == syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO);
  93 }
  94
  95 static void test_filter_sets(void) {
  96         unsigned i;
  97         int r;
  98
  99         if (!is_seccomp_available())
 100                 return;
 101         if (geteuid() != 0)
 102                 return;
 103
 104         for (i = 0; i < _SYSCALL_FILTER_SET_MAX; i++) {
 105                 pid_t pid;
 106
 107                 log_info("Testing %s", syscall_filter_sets[i].name);
 108
 109                 pid = fork();
 110                 assert_se(pid >= 0);
 111
 112                 if (pid == 0) { /* Child? */
 113                         int fd;
 114
 115                         if (i == SYSCALL_FILTER_SET_DEFAULT) /* if we look at the default set, whitelist instead of blacklist */
 116                                 r = seccomp_load_syscall_filter_set(SCMP_ACT_ERRNO(EUCLEAN), syscall_filter_sets + i, SCMP_ACT_ALLOW);
 117                         else
 118                                 r = seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + i, SCMP_ACT_ERRNO(EUCLEAN));
 119                         if (r < 0)
 120                                 _exit(EXIT_FAILURE);
 121
 122                         /* Test the sycall filter with one random system call */
 123                         fd = eventfd(0, EFD_NONBLOCK|EFD_CLOEXEC);
 124                         if (IN_SET(i, SYSCALL_FILTER_SET_IO_EVENT, SYSCALL_FILTER_SET_DEFAULT))
 125                                 assert_se(fd < 0 && errno == EUCLEAN);
 126                         else {
 127                                 assert_se(fd >= 0);
 128                                 safe_close(fd);
 129                         }
 130
 131                         _exit(EXIT_SUCCESS);
 132                 }
 133
 134                 assert_se(wait_for_terminate_and_warn(syscall_filter_sets[i].name, pid, true) == EXIT_SUCCESS);
 135         }
 136 }
 137
 138 static void test_restrict_namespace(void) {
 139         _cleanup_free_ char *s = NULL;
 140         unsigned long ul;
 141         pid_t pid;
 142
 143         assert_se(namespace_flag_to_string(0) == NULL);
 144         assert_se(streq(namespace_flag_to_string(CLONE_NEWNS), "mnt"));
 145         assert_se(namespace_flag_to_string(CLONE_NEWNS|CLONE_NEWIPC) == NULL);
 146         assert_se(streq(namespace_flag_to_string(CLONE_NEWCGROUP), "cgroup"));
 147
 148         assert_se(namespace_flag_from_string("mnt") == CLONE_NEWNS);
 149         assert_se(namespace_flag_from_string(NULL) == 0);
 150         assert_se(namespace_flag_from_string("") == 0);
 151         assert_se(namespace_flag_from_string("uts") == CLONE_NEWUTS);
 152         assert_se(namespace_flag_from_string(namespace_flag_to_string(CLONE_NEWUTS)) == CLONE_NEWUTS);
 153         assert_se(streq(namespace_flag_to_string(namespace_flag_from_string("ipc")), "ipc"));
 154
 155         assert_se(namespace_flag_from_string_many(NULL, &ul) == 0 && ul == 0);
 156         assert_se(namespace_flag_from_string_many("", &ul) == 0 && ul == 0);
 157         assert_se(namespace_flag_from_string_many("mnt uts ipc", &ul) == 0 && ul == (CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWIPC));
 158
 159         assert_se(namespace_flag_to_string_many(NAMESPACE_FLAGS_ALL, &s) == 0);
 160         assert_se(streq(s, "cgroup ipc net mnt pid user uts"));
 161         assert_se(namespace_flag_from_string_many(s, &ul) == 0 && ul == NAMESPACE_FLAGS_ALL);
 162
 163         if (!is_seccomp_available())
 164                 return;
 165         if (geteuid() != 0)
 166                 return;
 167
 168         pid = fork();
 169         assert_se(pid >= 0);
 170
 171         if (pid == 0) {
 172
 173                 assert_se(seccomp_restrict_namespaces(CLONE_NEWNS|CLONE_NEWNET) >= 0);
 174
 175                 assert_se(unshare(CLONE_NEWNS) == 0);
 176                 assert_se(unshare(CLONE_NEWNET) == 0);
 177                 assert_se(unshare(CLONE_NEWUTS) == -1);
 178                 assert_se(errno == EPERM);
 179                 assert_se(unshare(CLONE_NEWIPC) == -1);
 180                 assert_se(errno == EPERM);
 181                 assert_se(unshare(CLONE_NEWNET|CLONE_NEWUTS) == -1);
 182                 assert_se(errno == EPERM);
 183
 184                 /* We use fd 0 (stdin) here, which of course will fail with EINVAL on setns(). Except of course our
 185                  * seccomp filter worked, and hits first and makes it return EPERM */
 186                 assert_se(setns(0, CLONE_NEWNS) == -1);
 187                 assert_se(errno == EINVAL);
 188                 assert_se(setns(0, CLONE_NEWNET) == -1);
 189                 assert_se(errno == EINVAL);
 190                 assert_se(setns(0, CLONE_NEWUTS) == -1);
 191                 assert_se(errno == EPERM);
 192                 assert_se(setns(0, CLONE_NEWIPC) == -1);
 193                 assert_se(errno == EPERM);
 194                 assert_se(setns(0, CLONE_NEWNET|CLONE_NEWUTS) == -1);
 195                 assert_se(errno == EPERM);
 196                 assert_se(setns(0, 0) == -1);
 197                 assert_se(errno == EPERM);
 198
 199                 pid = raw_clone(CLONE_NEWNS);
 200                 assert_se(pid >= 0);
 201                 if (pid == 0)
 202                         _exit(EXIT_SUCCESS);
 203                 pid = raw_clone(CLONE_NEWNET);
 204                 assert_se(pid >= 0);
 205                 if (pid == 0)
 206                         _exit(EXIT_SUCCESS);
 207                 pid = raw_clone(CLONE_NEWUTS);
 208                 assert_se(pid < 0);
 209                 assert_se(errno == EPERM);
 210                 pid = raw_clone(CLONE_NEWIPC);
 211                 assert_se(pid < 0);
 212                 assert_se(errno == EPERM);
 213                 pid = raw_clone(CLONE_NEWNET|CLONE_NEWUTS);
 214                 assert_se(pid < 0);
 215                 assert_se(errno == EPERM);
 216
 217                 _exit(EXIT_SUCCESS);
 218         }
 219
 220         assert_se(wait_for_terminate_and_warn("nsseccomp", pid, true) == EXIT_SUCCESS);
 221 }
 222
 223 static void test_protect_sysctl(void) {
 224         pid_t pid;
 225
 226         if (!is_seccomp_available())
 227                 return;
 228         if (geteuid() != 0)
 229                 return;
 230
 231         if (detect_container() > 0) /* in containers _sysctl() is likely missing anyway */
 232                 return;
 233
 234         pid = fork();
 235         assert_se(pid >= 0);
 236
 237         if (pid == 0) {
 238                 assert_se(syscall(__NR__sysctl, NULL) < 0);
 239                 assert_se(errno == EFAULT);
 240
 241                 assert_se(seccomp_protect_sysctl() >= 0);
 242
 243                 assert_se(syscall(__NR__sysctl, 0, 0, 0) < 0);
 244                 assert_se(errno == EPERM);
 245
 246                 _exit(EXIT_SUCCESS);
 247         }
 248
 249         assert_se(wait_for_terminate_and_warn("sysctlseccomp", pid, true) == EXIT_SUCCESS);
 250 }
 251
 252 static void test_restrict_address_families(void) {
 253         pid_t pid;
 254
 255         if (!is_seccomp_available())
 256                 return;
 257         if (geteuid() != 0)
 258                 return;
 259
 260         pid = fork();
 261         assert_se(pid >= 0);
 262
 263         if (pid == 0) {
 264                 int fd;
 265                 Set *s;
 266
 267                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 268                 assert_se(fd >= 0);
 269                 safe_close(fd);
 270
 271                 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
 272                 assert_se(fd >= 0);
 273                 safe_close(fd);
 274
 275                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
 276                 assert_se(fd >= 0);
 277                 safe_close(fd);
 278
 279                 assert_se(s = set_new(NULL));
 280                 assert_se(set_put(s, INT_TO_PTR(AF_UNIX)) >= 0);
 281
 282                 assert_se(seccomp_restrict_address_families(s, false) >= 0);
 283
 284                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 285                 assert_se(fd >= 0);
 286                 safe_close(fd);
 287
 288                 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
 289 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
 290                 assert_se(fd >= 0);
 291                 safe_close(fd);
 292 #else
 293                 assert_se(fd < 0);
 294                 assert_se(errno == EAFNOSUPPORT);
 295 #endif
 296
 297                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
 298                 assert_se(fd >= 0);
 299                 safe_close(fd);
 300
 301                 set_clear(s);
 302
 303                 assert_se(set_put(s, INT_TO_PTR(AF_INET)) >= 0);
 304
 305                 assert_se(seccomp_restrict_address_families(s, true) >= 0);
 306
 307                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 308                 assert_se(fd >= 0);
 309                 safe_close(fd);
 310
 311                 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
 312 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
 313                 assert_se(fd >= 0);
 314                 safe_close(fd);
 315 #else
 316                 assert_se(fd < 0);
 317                 assert_se(errno == EAFNOSUPPORT);
 318 #endif
 319
 320                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
 321 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
 322                 assert_se(fd >= 0);
 323                 safe_close(fd);
 324 #else
 325                 assert_se(fd < 0);
 326                 assert_se(errno == EAFNOSUPPORT);
 327 #endif
 328
 329                 _exit(EXIT_SUCCESS);
 330         }
 331
 332         assert_se(wait_for_terminate_and_warn("socketseccomp", pid, true) == EXIT_SUCCESS);
 333 }
 334
 335 static void test_restrict_realtime(void) {
 336         pid_t pid;
 337
 338         if (!is_seccomp_available())
 339                 return;
 340         if (geteuid() != 0)
 341                 return;
 342
 343         if (detect_container() > 0) /* in containers RT privs are likely missing anyway */
 344                 return;
 345
 346         pid = fork();
 347         assert_se(pid >= 0);
 348
 349         if (pid == 0) {
 350                 assert_se(sched_setscheduler(0, SCHED_FIFO, &(struct sched_param) { .sched_priority = 1 }) >= 0);
 351                 assert_se(sched_setscheduler(0, SCHED_RR, &(struct sched_param) { .sched_priority = 1 }) >= 0);
 352                 assert_se(sched_setscheduler(0, SCHED_IDLE, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 353                 assert_se(sched_setscheduler(0, SCHED_BATCH, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 354                 assert_se(sched_setscheduler(0, SCHED_OTHER, &(struct sched_param) {}) >= 0);
 355
 356                 assert_se(seccomp_restrict_realtime() >= 0);
 357
 358                 assert_se(sched_setscheduler(0, SCHED_IDLE, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 359                 assert_se(sched_setscheduler(0, SCHED_BATCH, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 360                 assert_se(sched_setscheduler(0, SCHED_OTHER, &(struct sched_param) {}) >= 0);
 361
 362                 assert_se(sched_setscheduler(0, SCHED_FIFO, &(struct sched_param) { .sched_priority = 1 }) < 0);
 363                 assert_se(errno == EPERM);
 364                 assert_se(sched_setscheduler(0, SCHED_RR, &(struct sched_param) { .sched_priority = 1 }) < 0);
 365                 assert_se(errno == EPERM);
 366
 367                 _exit(EXIT_SUCCESS);
 368         }
 369
 370         assert_se(wait_for_terminate_and_warn("realtimeseccomp", pid, true) == EXIT_SUCCESS);
 371 }
 372
 373 static void test_memory_deny_write_execute_mmap(void) {
 374         pid_t pid;
 375
 376         if (!is_seccomp_available())
 377                 return;
 378         if (geteuid() != 0)
 379                 return;
 380
 381         pid = fork();
 382         assert_se(pid >= 0);
 383
 384         if (pid == 0) {
 385                 void *p;
 386
 387                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 388                 assert_se(p != MAP_FAILED);
 389                 assert_se(munmap(p, page_size()) >= 0);
 390
 391                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 392                 assert_se(p != MAP_FAILED);
 393                 assert_se(munmap(p, page_size()) >= 0);
 394
 395                 assert_se(seccomp_memory_deny_write_execute() >= 0);
 396
 397                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 398 #if defined(__x86_64__) || defined(__i386__) || defined(__powerpc64__) || defined(__arm__) || defined(__aarch64__)
 399                 assert_se(p == MAP_FAILED);
 400                 assert_se(errno == EPERM);
 401 #else /* unknown architectures */
 402                 assert_se(p != MAP_FAILED);
 403                 assert_se(munmap(p, page_size()) >= 0);
 404 #endif
 405
 406                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 407                 assert_se(p != MAP_FAILED);
 408                 assert_se(munmap(p, page_size()) >= 0);
 409
 410                 _exit(EXIT_SUCCESS);
 411         }
 412
 413         assert_se(wait_for_terminate_and_warn("memoryseccomp-mmap", pid, true) == EXIT_SUCCESS);
 414 }
 415
 416 static void test_memory_deny_write_execute_shmat(void) {
 417         int shmid;
 418         pid_t pid;
 419
 420         if (!is_seccomp_available())
 421                 return;
 422         if (geteuid() != 0)
 423                 return;
 424
 425         shmid = shmget(IPC_PRIVATE, page_size(), 0);
 426         assert_se(shmid >= 0);
 427
 428         pid = fork();
 429         assert_se(pid >= 0);
 430
 431         if (pid == 0) {
 432                 void *p;
 433
 434                 p = shmat(shmid, NULL, 0);
 435                 assert_se(p != MAP_FAILED);
 436                 assert_se(shmdt(p) == 0);
 437
 438                 p = shmat(shmid, NULL, SHM_EXEC);
 439                 assert_se(p != MAP_FAILED);
 440                 assert_se(shmdt(p) == 0);
 441
 442                 assert_se(seccomp_memory_deny_write_execute() >= 0);
 443
 444                 p = shmat(shmid, NULL, SHM_EXEC);
 445 #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__)
 446                 assert_se(p == MAP_FAILED);
 447                 assert_se(errno == EPERM);
 448 #else /* __i386__, __powerpc64__, and "unknown" architectures */
 449                 assert_se(p != MAP_FAILED);
 450                 assert_se(shmdt(p) == 0);
 451 #endif
 452
 453                 p = shmat(shmid, NULL, 0);
 454                 assert_se(p != MAP_FAILED);
 455                 assert_se(shmdt(p) == 0);
 456
 457                 _exit(EXIT_SUCCESS);
 458         }
 459
 460         assert_se(wait_for_terminate_and_warn("memoryseccomp-shmat", pid, true) == EXIT_SUCCESS);
 461 }
 462
 463 static void test_restrict_archs(void) {
 464         pid_t pid;
 465
 466         if (!is_seccomp_available())
 467                 return;
 468         if (geteuid() != 0)
 469                 return;
 470
 471         pid = fork();
 472         assert_se(pid >= 0);
 473
 474         if (pid == 0) {
 475                 _cleanup_set_free_ Set *s = NULL;
 476
 477                 assert_se(access("/", F_OK) >= 0);
 478
 479                 assert_se(s = set_new(NULL));
 480
 481 #ifdef __x86_64__
 482                 assert_se(set_put(s, UINT32_TO_PTR(SCMP_ARCH_X86+1)) >= 0);
 483 #endif
 484                 assert_se(seccomp_restrict_archs(s) >= 0);
 485
 486                 assert_se(access("/", F_OK) >= 0);
 487                 assert_se(seccomp_restrict_archs(NULL) >= 0);
 488
 489                 assert_se(access("/", F_OK) >= 0);
 490
 491                 _exit(EXIT_SUCCESS);
 492         }
 493
 494         assert_se(wait_for_terminate_and_warn("archseccomp", pid, true) == EXIT_SUCCESS);
 495 }
 496
 497 static void test_load_syscall_filter_set_raw(void) {
 498         pid_t pid;
 499
 500         if (!is_seccomp_available())
 501                 return;
 502         if (geteuid() != 0)
 503                 return;
 504
 505         pid = fork();
 506         assert_se(pid >= 0);
 507
 508         if (pid == 0) {
 509                 _cleanup_set_free_ Set *s = NULL;
 510
 511                 assert_se(access("/", F_OK) >= 0);
 512                 assert_se(poll(NULL, 0, 0) == 0);
 513
 514                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, NULL, SCMP_ACT_KILL) >= 0);
 515                 assert_se(access("/", F_OK) >= 0);
 516                 assert_se(poll(NULL, 0, 0) == 0);
 517
 518                 assert_se(s = set_new(NULL));
 519                 assert_se(set_put(s, UINT32_TO_PTR(__NR_access + 1)) >= 0);
 520
 521                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUCLEAN)) >= 0);
 522
 523                 assert_se(access("/", F_OK) < 0);
 524                 assert_se(errno == EUCLEAN);
 525
 526                 assert_se(poll(NULL, 0, 0) == 0);
 527
 528                 s = set_free(s);
 529
 530                 assert_se(s = set_new(NULL));
 531                 assert_se(set_put(s, UINT32_TO_PTR(__NR_poll + 1)) >= 0);
 532
 533                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUNATCH)) >= 0);
 534
 535                 assert_se(access("/", F_OK) < 0);
 536                 assert_se(errno == EUCLEAN);
 537
 538                 assert_se(poll(NULL, 0, 0) < 0);
 539                 assert_se(errno == EUNATCH);
 540
 541                 _exit(EXIT_SUCCESS);
 542         }
 543
 544         assert_se(wait_for_terminate_and_warn("syscallrawseccomp", pid, true) == EXIT_SUCCESS);
 545 }
 546
 547 int main(int argc, char *argv[]) {
 548
 549         log_set_max_level(LOG_DEBUG);
 550
 551         test_seccomp_arch_to_string();
 552         test_architecture_table();
 553         test_syscall_filter_set_find();
 554         test_filter_sets();
 555         test_restrict_namespace();
 556         test_protect_sysctl();
 557         test_restrict_address_families();
 558         test_restrict_realtime();
 559         test_memory_deny_write_execute_mmap();
 560         test_memory_deny_write_execute_shmat();
 561         test_restrict_archs();
 562         test_load_syscall_filter_set_raw();
 563
 564         return 0;
 565 }