src/test/test-namespace.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <fcntl.h>
   4 #include <sys/socket.h>
   5 #include <sys/stat.h>
   6
   7 #include "alloc-util.h"
   8 #include "fd-util.h"
   9 #include "namespace.h"
  10 #include "process-util.h"
  11 #include "string-util.h"
  12 #include "tests.h"
  13 #include "user-util.h"
  14 #include "util.h"
  15 #include "virt.h"
  16
  17 static void test_tmpdir(const char *id, const char *A, const char *B) {
  18         _cleanup_free_ char *a, *b;
  19         struct stat x, y;
  20         char *c, *d;
  21
  22         assert_se(setup_tmp_dirs(id, &a, &b) == 0);
  23         assert_se(startswith(a, A));
  24         assert_se(startswith(b, B));
  25
  26         assert_se(stat(a, &x) >= 0);
  27         assert_se(stat(b, &y) >= 0);
  28
  29         assert_se(S_ISDIR(x.st_mode));
  30         assert_se(S_ISDIR(y.st_mode));
  31
  32         assert_se((x.st_mode & 01777) == 0700);
  33         assert_se((y.st_mode & 01777) == 0700);
  34
  35         c = strjoina(a, "/tmp");
  36         d = strjoina(b, "/tmp");
  37
  38         assert_se(stat(c, &x) >= 0);
  39         assert_se(stat(d, &y) >= 0);
  40
  41         assert_se(S_ISDIR(x.st_mode));
  42         assert_se(S_ISDIR(y.st_mode));
  43
  44         assert_se((x.st_mode & 01777) == 01777);
  45         assert_se((y.st_mode & 01777) == 01777);
  46
  47         assert_se(rmdir(c) >= 0);
  48         assert_se(rmdir(d) >= 0);
  49
  50         assert_se(rmdir(a) >= 0);
  51         assert_se(rmdir(b) >= 0);
  52 }
  53
  54 static void test_netns(void) {
  55         _cleanup_close_pair_ int s[2] = { -1, -1 };
  56         pid_t pid1, pid2, pid3;
  57         int r, n = 0;
  58         siginfo_t si;
  59
  60         if (geteuid() > 0) {
  61                 (void) log_tests_skipped("not root");
  62                 return;
  63         }
  64
  65         assert_se(socketpair(AF_UNIX, SOCK_DGRAM, 0, s) >= 0);
  66
  67         pid1 = fork();
  68         assert_se(pid1 >= 0);
  69
  70         if (pid1 == 0) {
  71                 r = setup_netns(s);
  72                 assert_se(r >= 0);
  73                 _exit(r);
  74         }
  75
  76         pid2 = fork();
  77         assert_se(pid2 >= 0);
  78
  79         if (pid2 == 0) {
  80                 r = setup_netns(s);
  81                 assert_se(r >= 0);
  82                 exit(r);
  83         }
  84
  85         pid3 = fork();
  86         assert_se(pid3 >= 0);
  87
  88         if (pid3 == 0) {
  89                 r = setup_netns(s);
  90                 assert_se(r >= 0);
  91                 exit(r);
  92         }
  93
  94         r = wait_for_terminate(pid1, &si);
  95         assert_se(r >= 0);
  96         assert_se(si.si_code == CLD_EXITED);
  97         n += si.si_status;
  98
  99         r = wait_for_terminate(pid2, &si);
 100         assert_se(r >= 0);
 101         assert_se(si.si_code == CLD_EXITED);
 102         n += si.si_status;
 103
 104         r = wait_for_terminate(pid3, &si);
 105         assert_se(r >= 0);
 106         assert_se(si.si_code == CLD_EXITED);
 107         n += si.si_status;
 108
 109         assert_se(n == 1);
 110 }
 111
 112 static void test_protect_kernel_logs(void) {
 113         int r;
 114         pid_t pid;
 115         static const NamespaceInfo ns_info = {
 116                 .protect_kernel_logs = true,
 117         };
 118
 119         if (geteuid() > 0) {
 120                 (void) log_tests_skipped("not root");
 121                 return;
 122         }
 123
 124         /* In a container we likely don't have access to /dev/kmsg */
 125         if (detect_container() > 0) {
 126                 (void) log_tests_skipped("in container");
 127                 return;
 128         }
 129
 130
 131         pid = fork();
 132         assert_se(pid >= 0);
 133
 134         if (pid == 0) {
 135                 _cleanup_close_ int fd = -1;
 136
 137                 fd = open("/dev/kmsg", O_RDONLY | O_CLOEXEC);
 138                 assert_se(fd > 0);
 139
 140                 r = setup_namespace(NULL,
 141                                     NULL,
 142                                     &ns_info,
 143                                     NULL,
 144                                     NULL,
 145                                     NULL,
 146                                     NULL,
 147                                     NULL, 0,
 148                                     NULL, 0,
 149                                     NULL,
 150                                     NULL,
 151                                     NULL,
 152                                     PROTECT_HOME_NO,
 153                                     PROTECT_SYSTEM_NO,
 154                                     0,
 155                                     NULL,
 156                                     0,
 157                                     NULL,
 158                                     NULL,
 159                                     0,
 160                                     NULL);
 161                 assert_se(r == 0);
 162
 163                 assert_se(setresuid(UID_NOBODY, UID_NOBODY, UID_NOBODY) >= 0);
 164                 assert_se(open("/dev/kmsg", O_RDONLY | O_CLOEXEC) < 0);
 165                 assert_se(errno == EACCES);
 166
 167                 _exit(EXIT_SUCCESS);
 168         }
 169
 170         assert_se(wait_for_terminate_and_check("ns-kernellogs", pid, WAIT_LOG) == EXIT_SUCCESS);
 171 }
 172
 173 int main(int argc, char *argv[]) {
 174         sd_id128_t bid;
 175         char boot_id[SD_ID128_STRING_MAX];
 176         _cleanup_free_ char *x = NULL, *y = NULL, *z = NULL, *zz = NULL;
 177
 178         test_setup_logging(LOG_INFO);
 179
 180         if (!have_namespaces()) {
 181                 log_tests_skipped("Don't have namespace support");
 182                 return EXIT_TEST_SKIP;
 183         }
 184
 185         assert_se(sd_id128_get_boot(&bid) >= 0);
 186         sd_id128_to_string(bid, boot_id);
 187
 188         x = strjoin("/tmp/systemd-private-", boot_id, "-abcd.service-");
 189         y = strjoin("/var/tmp/systemd-private-", boot_id, "-abcd.service-");
 190         assert_se(x && y);
 191
 192         test_tmpdir("abcd.service", x, y);
 193
 194         z = strjoin("/tmp/systemd-private-", boot_id, "-sys-devices-pci0000:00-0000:00:1a.0-usb3-3\\x2d1-3\\x2d1:1.0-bluetooth-hci0.device-");
 195         zz = strjoin("/var/tmp/systemd-private-", boot_id, "-sys-devices-pci0000:00-0000:00:1a.0-usb3-3\\x2d1-3\\x2d1:1.0-bluetooth-hci0.device-");
 196
 197         assert_se(z && zz);
 198
 199         test_tmpdir("sys-devices-pci0000:00-0000:00:1a.0-usb3-3\\x2d1-3\\x2d1:1.0-bluetooth-hci0.device", z, zz);
 200
 201         test_netns();
 202         test_protect_kernel_logs();
 203
 204         return EXIT_SUCCESS;
 205 }