Received: by 2002:a05:6902:102b:0:0:0:0 with SMTP id x11csp1786349ybt; Thu, 2 Jul 2020 13:55:40 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxyps7XGs3CGOTJOlAoQ5eoskkUZqngcwsLi5NbC7T/oiD/UGbw2RsM3gVmHUbuoQHTwt3W X-Received: by 2002:a05:6402:176e:: with SMTP id da14mr21366861edb.262.1593723340052; Thu, 02 Jul 2020 13:55:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1593723340; cv=none; d=google.com; s=arc-20160816; b=VM9ln3mwFWnIrbd33OkSD18JAfICIK8mVaJlbr4PvrRCBnfsMaMnyyONwO09HheAYY +tV69DTA+y1T7PYGh0h+kG0NdbePDRlqc94jjr0r8imO8NJRV9zIMQ6ztg5aBEvbGzVR KH7iUCY6ZYdVe8XV2eBN0oR/RC5HlA6RjhEfm1jXZMaNfzDMJcNWiOGnp882AqlF01nj g9HL5cWE+WnUGdBWfhe8wS0VMuNeKdrKt87UjbicucUbZogFV1V4fQWIMshrLn2sjISf NNqW6GQ7bXoqPoM4Exkc49/I8tRXthMMYWQY5ziXHW4F8SVgjU9n4xMcrZVfJuACxnfX JBGg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date; bh=0cuQS31f/aNMBzoqVEPypY5gprQ7kkb1CtHhFTqNpR0=; b=LKYihxfHAhz4BRakAXRay9I1FQ3UCol6GcjoTS/3v4wwVtLEE/GiQ+bJIueyHGsVTn b9eyw+gUTks7ahige7loSF8dfgyG7keXV7JYlEAuQqFcVFZ+2ntY7JtlyTOFVYPIe9D5 GV2/k7odQsQO2cuyiBbEYXINCUSnzz53Z2OY0qe/CsS11h2P1tPZP5dA4R2pocDPEVQO ATgoYiJPIvUXcdilVoIpj4LdJNCZpEYSPU+ZhA30TO5E/8hH7vz4JMDtidI9ArGrgXqC 89CArX1Q/0oMQhb6Psszd+trdV7AXzZCeen9NE/8xjVbOSOiryNLIfWmLpi4CmuHpk6E 9qqQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id dk7si5668828edb.86.2020.07.02.13.55.17; Thu, 02 Jul 2020 13:55:40 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726140AbgGBUxJ (ORCPT + 99 others); Thu, 2 Jul 2020 16:53:09 -0400 Received: from mail.hallyn.com ([178.63.66.53]:57554 "EHLO mail.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725937AbgGBUxI (ORCPT ); Thu, 2 Jul 2020 16:53:08 -0400 Received: by mail.hallyn.com (Postfix, from userid 1001) id A3E47A2E; Thu, 2 Jul 2020 15:53:05 -0500 (CDT) Date: Thu, 2 Jul 2020 15:53:05 -0500 From: "Serge E. Hallyn" To: Adrian Reber Cc: Christian Brauner , Eric Biederman , Pavel Emelyanov , Oleg Nesterov , Dmitry Safonov <0x7f454c46@gmail.com>, Andrei Vagin , Nicolas Viennot , =?utf-8?B?TWljaGHFgiBDxYJhcGnFhHNraQ==?= , Kamil Yurtsever , Dirk Petersen , Christine Flood , Casey Schaufler , Mike Rapoport , Radostin Stoyanov , Cyrill Gorcunov , Serge Hallyn , Stephen Smalley , Sargun Dhillon , Arnd Bergmann , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, selinux@vger.kernel.org, Eric Paris , Jann Horn , linux-fsdevel@vger.kernel.org Subject: Re: [PATCH v4 2/3] selftests: add clone3() CAP_CHECKPOINT_RESTORE test Message-ID: <20200702205305.GA3283@mail.hallyn.com> References: <20200701064906.323185-1-areber@redhat.com> <20200701064906.323185-3-areber@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200701064906.323185-3-areber@redhat.com> User-Agent: Mutt/1.9.4 (2018-02-28) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Jul 01, 2020 at 08:49:05AM +0200, Adrian Reber wrote: > This adds a test that changes its UID, uses capabilities to > get CAP_CHECKPOINT_RESTORE and uses clone3() with set_tid to > create a process with a given PID as non-root. Seems worth also verifying that it fails if you have no capabilities. I don't see that in the existing clone3/ test dir. > Signed-off-by: Adrian Reber > --- > tools/testing/selftests/clone3/Makefile | 4 +- > .../clone3/clone3_cap_checkpoint_restore.c | 203 ++++++++++++++++++ > 2 files changed, 206 insertions(+), 1 deletion(-) > create mode 100644 tools/testing/selftests/clone3/clone3_cap_checkpoint_restore.c > > diff --git a/tools/testing/selftests/clone3/Makefile b/tools/testing/selftests/clone3/Makefile > index cf976c732906..ef7564cb7abe 100644 > --- a/tools/testing/selftests/clone3/Makefile > +++ b/tools/testing/selftests/clone3/Makefile > @@ -1,6 +1,8 @@ > # SPDX-License-Identifier: GPL-2.0 > CFLAGS += -g -I../../../../usr/include/ > +LDLIBS += -lcap > > -TEST_GEN_PROGS := clone3 clone3_clear_sighand clone3_set_tid > +TEST_GEN_PROGS := clone3 clone3_clear_sighand clone3_set_tid \ > + clone3_cap_checkpoint_restore > > include ../lib.mk > diff --git a/tools/testing/selftests/clone3/clone3_cap_checkpoint_restore.c b/tools/testing/selftests/clone3/clone3_cap_checkpoint_restore.c > new file mode 100644 > index 000000000000..2cc3d57b91f2 > --- /dev/null > +++ b/tools/testing/selftests/clone3/clone3_cap_checkpoint_restore.c > @@ -0,0 +1,203 @@ > +// SPDX-License-Identifier: GPL-2.0 > + > +/* > + * Based on Christian Brauner's clone3() example. > + * These tests are assuming to be running in the host's > + * PID namespace. > + */ > + > +/* capabilities related code based on selftests/bpf/test_verifier.c */ > + > +#define _GNU_SOURCE > +#include > +#include > +#include > +#include > +#include > +#include > +#include > +#include > +#include > +#include > +#include > +#include > +#include > +#include > + > +#include "../kselftest.h" > +#include "clone3_selftests.h" > + > +#ifndef MAX_PID_NS_LEVEL > +#define MAX_PID_NS_LEVEL 32 > +#endif > + > +static void child_exit(int ret) > +{ > + fflush(stdout); > + fflush(stderr); > + _exit(ret); > +} > + > +static int call_clone3_set_tid(pid_t * set_tid, size_t set_tid_size) > +{ > + int status; > + pid_t pid = -1; > + > + struct clone_args args = { > + .exit_signal = SIGCHLD, > + .set_tid = ptr_to_u64(set_tid), > + .set_tid_size = set_tid_size, > + }; > + > + pid = sys_clone3(&args, sizeof(struct clone_args)); > + if (pid < 0) { > + ksft_print_msg("%s - Failed to create new process\n", > + strerror(errno)); > + return -errno; > + } > + > + if (pid == 0) { > + int ret; > + char tmp = 0; > + > + ksft_print_msg > + ("I am the child, my PID is %d (expected %d)\n", > + getpid(), set_tid[0]); > + > + if (set_tid[0] != getpid()) > + child_exit(EXIT_FAILURE); > + child_exit(EXIT_SUCCESS); > + } > + > + ksft_print_msg("I am the parent (%d). My child's pid is %d\n", > + getpid(), pid); > + > + if (waitpid(pid, &status, 0) < 0) { > + ksft_print_msg("Child returned %s\n", strerror(errno)); > + return -errno; > + } > + > + if (!WIFEXITED(status)) > + return -1; > + > + return WEXITSTATUS(status); > +} > + > +static int test_clone3_set_tid(pid_t * set_tid, > + size_t set_tid_size, int expected) > +{ > + int ret; > + > + ksft_print_msg("[%d] Trying clone3() with CLONE_SET_TID to %d\n", > + getpid(), set_tid[0]); > + ret = call_clone3_set_tid(set_tid, set_tid_size); > + > + ksft_print_msg > + ("[%d] clone3() with CLONE_SET_TID %d says :%d - expected %d\n", > + getpid(), set_tid[0], ret, expected); > + if (ret != expected) { > + ksft_test_result_fail > + ("[%d] Result (%d) is different than expected (%d)\n", > + getpid(), ret, expected); > + return -1; > + } > + ksft_test_result_pass > + ("[%d] Result (%d) matches expectation (%d)\n", getpid(), ret, > + expected); > + > + return 0; > +} > + > +struct libcap { > + struct __user_cap_header_struct hdr; > + struct __user_cap_data_struct data[2]; > +}; > + > +static int set_capability() > +{ > + cap_value_t cap_values[] = { CAP_SETUID, CAP_SETGID }; > + struct libcap *cap; > + int ret = -1; > + cap_t caps; > + > + caps = cap_get_proc(); > + if (!caps) { > + perror("cap_get_proc"); > + return -1; > + } > + > + /* Drop all capabilities */ > + if (cap_clear(caps)) { > + perror("cap_clear"); > + goto out; > + } > + > + cap_set_flag(caps, CAP_EFFECTIVE, 2, cap_values, CAP_SET); > + cap_set_flag(caps, CAP_PERMITTED, 2, cap_values, CAP_SET); > + > + cap = (struct libcap *) caps; > + > + /* 40 -> CAP_CHECKPOINT_RESTORE */ > + cap->data[1].effective |= 1 << (40 - 32); > + cap->data[1].permitted |= 1 << (40 - 32); > + > + if (cap_set_proc(caps)) { > + perror("cap_set_proc"); > + goto out; > + } > + ret = 0; > +out: > + if (cap_free(caps)) > + perror("cap_free"); > + return ret; > +} > + > +int main(int argc, char *argv[]) > +{ > + pid_t pid; > + int status; > + int ret = 0; > + pid_t set_tid[1]; > + uid_t uid = getuid(); > + > + ksft_print_header(); > + test_clone3_supported(); > + ksft_set_plan(2); > + > + if (uid != 0) { > + ksft_cnt.ksft_xskip = ksft_plan; > + ksft_print_msg("Skipping all tests as non-root\n"); > + return ksft_exit_pass(); > + } > + > + memset(&set_tid, 0, sizeof(set_tid)); > + > + /* Find the current active PID */ > + pid = fork(); > + if (pid == 0) { > + ksft_print_msg("Child has PID %d\n", getpid()); > + child_exit(EXIT_SUCCESS); > + } > + if (waitpid(pid, &status, 0) < 0) > + ksft_exit_fail_msg("Waiting for child %d failed", pid); > + > + /* After the child has finished, its PID should be free. */ > + set_tid[0] = pid; > + > + if (set_capability()) > + ksft_test_result_fail > + ("Could not set CAP_CHECKPOINT_RESTORE\n"); > + prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0); > + /* This would fail without CAP_CHECKPOINT_RESTORE */ > + setgid(1000); > + setuid(1000); > + set_tid[0] = pid; > + ret |= test_clone3_set_tid(set_tid, 1, -EPERM); > + if (set_capability()) > + ksft_test_result_fail > + ("Could not set CAP_CHECKPOINT_RESTORE\n"); > + /* This should work as we have CAP_CHECKPOINT_RESTORE as non-root */ > + ret |= test_clone3_set_tid(set_tid, 1, 0); > + > + return !ret ? ksft_exit_pass() : ksft_exit_fail(); > +} > -- > 2.26.2