releases/3.16.3/mnt-add-tests-for-unprivileged-remount-cases-that-have-found-to-be-faulty.patch

   1 From db181ce011e3c033328608299cd6fac06ea50130 Mon Sep 17 00:00:00 2001
   2 From: "Eric W. Biederman" <ebiederm@xmission.com>
   3 Date: Tue, 29 Jul 2014 15:50:44 -0700
   4 Subject: mnt: Add tests for unprivileged remount cases that have found to be faulty
   5
   6 From: "Eric W. Biederman" <ebiederm@xmission.com>
   7
   8 commit db181ce011e3c033328608299cd6fac06ea50130 upstream.
   9
  10 Kenton Varda <kenton@sandstorm.io> discovered that by remounting a
  11 read-only bind mount read-only in a user namespace the
  12 MNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user
  13 to the remount a read-only mount read-write.
  14
  15 Upon review of the code in remount it was discovered that the code allowed
  16 nosuid, noexec, and nodev to be cleared.  It was also discovered that
  17 the code was allowing the per mount atime flags to be changed.
  18
  19 The first naive patch to fix these issues contained the flaw that using
  20 default atime settings when remounting a filesystem could be disallowed.
  21
  22 To avoid this problems in the future add tests to ensure unprivileged
  23 remounts are succeeding and failing at the appropriate times.
  24
  25 Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
  26 Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
  27 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  28
  29 ---
  30  tools/testing/selftests/Makefile                          |    1
  31  tools/testing/selftests/mount/Makefile                    |   17
  32  tools/testing/selftests/mount/unprivileged-remount-test.c |  242 ++++++++++++++
  33  3 files changed, 260 insertions(+)
  34
  35 --- a/tools/testing/selftests/Makefile
  36 +++ b/tools/testing/selftests/Makefile
  37 @@ -4,6 +4,7 @@ TARGETS += efivarfs
  38  TARGETS += kcmp
  39  TARGETS += memory-hotplug
  40  TARGETS += mqueue
  41 +TARGETS += mount
  42  TARGETS += net
  43  TARGETS += ptrace
  44  TARGETS += timers
  45 --- /dev/null
  46 +++ b/tools/testing/selftests/mount/Makefile
  47 @@ -0,0 +1,17 @@
  48 +# Makefile for mount selftests.
  49 +
  50 +all: unprivileged-remount-test
  51 +
  52 +unprivileged-remount-test: unprivileged-remount-test.c
  53 +       gcc -Wall -O2 unprivileged-remount-test.c -o unprivileged-remount-test
  54 +
  55 +# Allow specific tests to be selected.
  56 +test_unprivileged_remount: unprivileged-remount-test
  57 +       @if [ -f /proc/self/uid_map ] ; then ./unprivileged-remount-test ; fi
  58 +
  59 +run_tests: all test_unprivileged_remount
  60 +
  61 +clean:
  62 +       rm -f unprivileged-remount-test
  63 +
  64 +.PHONY: all test_unprivileged_remount
  65 --- /dev/null
  66 +++ b/tools/testing/selftests/mount/unprivileged-remount-test.c
  67 @@ -0,0 +1,242 @@
  68 +#define _GNU_SOURCE
  69 +#include <sched.h>
  70 +#include <stdio.h>
  71 +#include <errno.h>
  72 +#include <string.h>
  73 +#include <sys/types.h>
  74 +#include <sys/mount.h>
  75 +#include <sys/wait.h>
  76 +#include <stdlib.h>
  77 +#include <unistd.h>
  78 +#include <fcntl.h>
  79 +#include <grp.h>
  80 +#include <stdbool.h>
  81 +#include <stdarg.h>
  82 +
  83 +#ifndef CLONE_NEWNS
  84 +# define CLONE_NEWNS 0x00020000
  85 +#endif
  86 +#ifndef CLONE_NEWUTS
  87 +# define CLONE_NEWUTS 0x04000000
  88 +#endif
  89 +#ifndef CLONE_NEWIPC
  90 +# define CLONE_NEWIPC 0x08000000
  91 +#endif
  92 +#ifndef CLONE_NEWNET
  93 +# define CLONE_NEWNET 0x40000000
  94 +#endif
  95 +#ifndef CLONE_NEWUSER
  96 +# define CLONE_NEWUSER 0x10000000
  97 +#endif
  98 +#ifndef CLONE_NEWPID
  99 +# define CLONE_NEWPID 0x20000000
 100 +#endif
 101 +
 102 +#ifndef MS_RELATIME
 103 +#define MS_RELATIME (1 << 21)
 104 +#endif
 105 +#ifndef MS_STRICTATIME
 106 +#define MS_STRICTATIME (1 << 24)
 107 +#endif
 108 +
 109 +static void die(char *fmt, ...)
 110 +{
 111 +       va_list ap;
 112 +       va_start(ap, fmt);
 113 +       vfprintf(stderr, fmt, ap);
 114 +       va_end(ap);
 115 +       exit(EXIT_FAILURE);
 116 +}
 117 +
 118 +static void write_file(char *filename, char *fmt, ...)
 119 +{
 120 +       char buf[4096];
 121 +       int fd;
 122 +       ssize_t written;
 123 +       int buf_len;
 124 +       va_list ap;
 125 +
 126 +       va_start(ap, fmt);
 127 +       buf_len = vsnprintf(buf, sizeof(buf), fmt, ap);
 128 +       va_end(ap);
 129 +       if (buf_len < 0) {
 130 +               die("vsnprintf failed: %s\n",
 131 +                   strerror(errno));
 132 +       }
 133 +       if (buf_len >= sizeof(buf)) {
 134 +               die("vsnprintf output truncated\n");
 135 +       }
 136 +
 137 +       fd = open(filename, O_WRONLY);
 138 +       if (fd < 0) {
 139 +               die("open of %s failed: %s\n",
 140 +                   filename, strerror(errno));
 141 +       }
 142 +       written = write(fd, buf, buf_len);
 143 +       if (written != buf_len) {
 144 +               if (written >= 0) {
 145 +                       die("short write to %s\n", filename);
 146 +               } else {
 147 +                       die("write to %s failed: %s\n",
 148 +                               filename, strerror(errno));
 149 +               }
 150 +       }
 151 +       if (close(fd) != 0) {
 152 +               die("close of %s failed: %s\n",
 153 +                       filename, strerror(errno));
 154 +       }
 155 +}
 156 +
 157 +static void create_and_enter_userns(void)
 158 +{
 159 +       uid_t uid;
 160 +       gid_t gid;
 161 +
 162 +       uid = getuid();
 163 +       gid = getgid();
 164 +
 165 +       if (unshare(CLONE_NEWUSER) !=0) {
 166 +               die("unshare(CLONE_NEWUSER) failed: %s\n",
 167 +                       strerror(errno));
 168 +       }
 169 +
 170 +       write_file("/proc/self/uid_map", "0 %d 1", uid);
 171 +       write_file("/proc/self/gid_map", "0 %d 1", gid);
 172 +
 173 +       if (setgroups(0, NULL) != 0) {
 174 +               die("setgroups failed: %s\n",
 175 +                       strerror(errno));
 176 +       }
 177 +       if (setgid(0) != 0) {
 178 +               die ("setgid(0) failed %s\n",
 179 +                       strerror(errno));
 180 +       }
 181 +       if (setuid(0) != 0) {
 182 +               die("setuid(0) failed %s\n",
 183 +                       strerror(errno));
 184 +       }
 185 +}
 186 +
 187 +static
 188 +bool test_unpriv_remount(int mount_flags, int remount_flags, int invalid_flags)
 189 +{
 190 +       pid_t child;
 191 +
 192 +       child = fork();
 193 +       if (child == -1) {
 194 +               die("fork failed: %s\n",
 195 +                       strerror(errno));
 196 +       }
 197 +       if (child != 0) { /* parent */
 198 +               pid_t pid;
 199 +               int status;
 200 +               pid = waitpid(child, &status, 0);
 201 +               if (pid == -1) {
 202 +                       die("waitpid failed: %s\n",
 203 +                               strerror(errno));
 204 +               }
 205 +               if (pid != child) {
 206 +                       die("waited for %d got %d\n",
 207 +                               child, pid);
 208 +               }
 209 +               if (!WIFEXITED(status)) {
 210 +                       die("child did not terminate cleanly\n");
 211 +               }
 212 +               return WEXITSTATUS(status) == EXIT_SUCCESS ? true : false;
 213 +       }
 214 +
 215 +       create_and_enter_userns();
 216 +       if (unshare(CLONE_NEWNS) != 0) {
 217 +               die("unshare(CLONE_NEWNS) failed: %s\n",
 218 +                       strerror(errno));
 219 +       }
 220 +
 221 +       if (mount("testing", "/tmp", "ramfs", mount_flags, NULL) != 0) {
 222 +               die("mount of /tmp failed: %s\n",
 223 +                       strerror(errno));
 224 +       }
 225 +
 226 +       create_and_enter_userns();
 227 +
 228 +       if (unshare(CLONE_NEWNS) != 0) {
 229 +               die("unshare(CLONE_NEWNS) failed: %s\n",
 230 +                       strerror(errno));
 231 +       }
 232 +
 233 +       if (mount("/tmp", "/tmp", "none",
 234 +                 MS_REMOUNT | MS_BIND | remount_flags, NULL) != 0) {
 235 +               /* system("cat /proc/self/mounts"); */
 236 +               die("remount of /tmp failed: %s\n",
 237 +                   strerror(errno));
 238 +       }
 239 +
 240 +       if (mount("/tmp", "/tmp", "none",
 241 +                 MS_REMOUNT | MS_BIND | invalid_flags, NULL) == 0) {
 242 +               /* system("cat /proc/self/mounts"); */
 243 +               die("remount of /tmp with invalid flags "
 244 +                   "succeeded unexpectedly\n");
 245 +       }
 246 +       exit(EXIT_SUCCESS);
 247 +}
 248 +
 249 +static bool test_unpriv_remount_simple(int mount_flags)
 250 +{
 251 +       return test_unpriv_remount(mount_flags, mount_flags, 0);
 252 +}
 253 +
 254 +static bool test_unpriv_remount_atime(int mount_flags, int invalid_flags)
 255 +{
 256 +       return test_unpriv_remount(mount_flags, mount_flags, invalid_flags);
 257 +}
 258 +
 259 +int main(int argc, char **argv)
 260 +{
 261 +       if (!test_unpriv_remount_simple(MS_RDONLY|MS_NODEV)) {
 262 +               die("MS_RDONLY malfunctions\n");
 263 +       }
 264 +       if (!test_unpriv_remount_simple(MS_NODEV)) {
 265 +               die("MS_NODEV malfunctions\n");
 266 +       }
 267 +       if (!test_unpriv_remount_simple(MS_NOSUID|MS_NODEV)) {
 268 +               die("MS_NOSUID malfunctions\n");
 269 +       }
 270 +       if (!test_unpriv_remount_simple(MS_NOEXEC|MS_NODEV)) {
 271 +               die("MS_NOEXEC malfunctions\n");
 272 +       }
 273 +       if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODEV,
 274 +                                      MS_NOATIME|MS_NODEV))
 275 +       {
 276 +               die("MS_RELATIME malfunctions\n");
 277 +       }
 278 +       if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODEV,
 279 +                                      MS_NOATIME|MS_NODEV))
 280 +       {
 281 +               die("MS_STRICTATIME malfunctions\n");
 282 +       }
 283 +       if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODEV,
 284 +                                      MS_STRICTATIME|MS_NODEV))
 285 +       {
 286 +               die("MS_RELATIME malfunctions\n");
 287 +       }
 288 +       if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODIRATIME|MS_NODEV,
 289 +                                      MS_NOATIME|MS_NODEV))
 290 +       {
 291 +               die("MS_RELATIME malfunctions\n");
 292 +       }
 293 +       if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODIRATIME|MS_NODEV,
 294 +                                      MS_NOATIME|MS_NODEV))
 295 +       {
 296 +               die("MS_RELATIME malfunctions\n");
 297 +       }
 298 +       if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODIRATIME|MS_NODEV,
 299 +                                      MS_STRICTATIME|MS_NODEV))
 300 +       {
 301 +               die("MS_RELATIME malfunctions\n");
 302 +       }
 303 +       if (!test_unpriv_remount(MS_STRICTATIME|MS_NODEV, MS_NODEV,
 304 +                                MS_NOATIME|MS_NODEV))
 305 +       {
 306 +               die("Default atime malfunctions\n");
 307 +       }
 308 +       return EXIT_SUCCESS;
 309 +}