From patchwork Fri Nov 8 17:45:58 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddhesh Poyarekar X-Patchwork-Id: 100649 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id A6EE7385841E for ; Fri, 8 Nov 2024 17:47:15 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org A6EE7385841E DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1731088035; bh=9JHWTny74sIT9nC62N1lrZmcLtttL95PJ1ENG/CxzKw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=C2oMIx8DsD6sOuDTT0WvE3crVJ0DMuS6PUVusOgczRJ9rvZTG2qGvP8LwbViXkanN yXwDEAN88JAcBlNLttkTq73afaK1BtZXLIE0j0qBWv1VYohELCtoYCIQ4AugOk4aWj 6UNkOwOZ++Q/Gt0pf9w+jDDVUv/PiTenAPHIuHrQ= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from rusty.tulip.relay.mailchannels.net (rusty.tulip.relay.mailchannels.net [23.83.218.252]) by sourceware.org (Postfix) with ESMTPS id D9A0E385840E for ; Fri, 8 Nov 2024 17:46:19 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org D9A0E385840E Authentication-Results: sourceware.org; dmarc=fail (p=none dis=none) header.from=sourceware.org Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=sourceware.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org D9A0E385840E Authentication-Results: server2.sourceware.org; arc=pass smtp.remote-ip=23.83.218.252 ARC-Seal: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1731087983; cv=pass; b=FmmArBbIBOu+AZ3HzWq6jUNh28lsu4CHaocI7vxb2lIFnZIVdbqvGEn6kTD8J/qfuwnN9wPMiInPEr2FJxYnrTZs1F3UbQeZEbU1PTpPUuzTHViT5LPSTaN+tZHTFC7W99oFOakNCvDgPBLng7w6jNNQtMi9ElrQ6O0v2QJpqM8= ARC-Message-Signature: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1731087983; c=relaxed/simple; bh=GpNJxf16vYshDtPtIsMp4G5lrIgagQaawVjWIBsoBGw=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=vgzi2/78DWK6AAgdlyQS2ifm0OEym+O/r8dHBJXwHhhh4YE1FfzdTgRd7UJiqSmqoT8tA70f8yHYaNQusCoRG1JmvnxBDXM4JjhIeAznOFTqr6KUf+k7iOEztyhVJJS2Oq5al9bTuT5nDZi7XRaipRV3T+qXbtikkYJwhKo2BN8= ARC-Authentication-Results: i=2; server2.sourceware.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 07C37321F9C; Fri, 8 Nov 2024 17:46:19 +0000 (UTC) Received: from pdx1-sub0-mail-a258.dreamhost.com (100-103-140-160.trex-nlb.outbound.svc.cluster.local [100.103.140.160]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id AE2AD321D58; Fri, 8 Nov 2024 17:46:18 +0000 (UTC) ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1731087978; a=rsa-sha256; cv=none; b=WSWFMZ6DRGYeEIHG8w4wRoVK2lBJrJeF/K0nw+HupE6oc0P3bpDRm5C10H+d1TtkqceVIg YvGHYRWl0B8ECA+hemRqWRHOjz80b8e219+PXKCSymfI+b1mQzxMJAOyLnSjlSbAOD1LWz bqSLDpBvlr48kowAwDXGN23QxUi6LI6/UVpEMaUXIOfvzX9m5AqAvjcrmJdZzDL/IikO3Z R3uFmbTYLI66FUY9g8HAjGG/QcZOVBhynNDxeze+piOig61PxGRqLAeCkfCpNrdfui/wXE 0MIDqVQEZXqoc0Pn6Zk2pMyC3SlYA4EANsVWATuJtSbvuAvAmWQwZJlCQdjwFQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1731087978; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9JHWTny74sIT9nC62N1lrZmcLtttL95PJ1ENG/CxzKw=; b=Rb9QWhXL+SSg0I3d3KdHXTsQyt0b3q1b7OWYAnZEt4UYxkAUEvb3SZGYb25pwiGEgdd6z2 BeVaMufW6qXLLGmpvMcXyfUkYlmfzN3vf9a8J7L7b+Dx45KPH+IHqug5ewZ3AlL2JdQA1s PzADln4cOaRQ/LqnpGl22y0+eH8ebDxeyZ1wh4Y+7mmDdTugcgvRbOXrIRtdx83D4m9Bwx Iu3Ddn0I45vcB7wdAc3JO1nM4M++9iSTLdu1BOvhyYfgKHY7BeDYqWzh7pwpJTyvQI8BBM qRoJeBs9GFdh1T+exXRHnheowfaqWUNGPg07NBinwrOgZwgwHFrp8s0/24kwOg== ARC-Authentication-Results: i=1; rspamd-7ffc46dcc8-lgv9z; auth=pass smtp.auth=dreamhost smtp.mailfrom=siddhesh@sourceware.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|siddhesh@gotplt.org X-MailChannels-Auth-Id: dreamhost X-Daffy-Obese: 5ead4b3a2d813d49_1731087978926_1658180160 X-MC-Loop-Signature: 1731087978926:3779320602 X-MC-Ingress-Time: 1731087978926 Received: from pdx1-sub0-mail-a258.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.103.140.160 (trex/7.0.2); Fri, 08 Nov 2024 17:46:18 +0000 Received: from fedora.. (unknown [184.146.156.41]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: siddhesh@gotplt.org) by pdx1-sub0-mail-a258.dreamhost.com (Postfix) with ESMTPSA id 4XlRFQ2WJpz9C; Fri, 8 Nov 2024 09:46:18 -0800 (PST) From: Siddhesh Poyarekar To: libc-alpha@sourceware.org Cc: adhemerval.zanella@linaro.org Subject: [PATCH v2 3/3] io: Add setuid tests for faccessat Date: Fri, 8 Nov 2024 12:45:58 -0500 Message-ID: <20241108174559.470880-4-siddhesh@sourceware.org> X-Mailer: git-send-email 2.46.0 In-Reply-To: <20241016192108.811046-1-siddhesh@sourceware.org> References: <20241016192108.811046-1-siddhesh@sourceware.org> MIME-Version: 1.0 X-Spam-Status: No, score=-1170.6 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_NONE, KAM_DMARC_STATUS, KAM_SHORT, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_SOFTFAIL, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces~patchwork=sourceware.org@sourceware.org Add a new test tst-faccessat-setuid that iterates through real and effective UID/GID combination and tests the faccessat() interface for default and AT_EACCESS flags. Signed-off-by: Siddhesh Poyarekar --- io/Makefile | 1 + io/tst-faccessat-setuid.c | 163 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 164 insertions(+) create mode 100644 io/tst-faccessat-setuid.c diff --git a/io/Makefile b/io/Makefile index a8d575e9ce..f5813a81c7 100644 --- a/io/Makefile +++ b/io/Makefile @@ -188,6 +188,7 @@ tests := \ tst-closefrom \ tst-copy_file_range \ tst-faccessat \ + tst-faccessat-setuid \ tst-fchmod-errors \ tst-fchmod-fuse \ tst-fchmodat \ diff --git a/io/tst-faccessat-setuid.c b/io/tst-faccessat-setuid.c new file mode 100644 index 0000000000..aab0261914 --- /dev/null +++ b/io/tst-faccessat-setuid.c @@ -0,0 +1,163 @@ +/* Smoke test for faccessat with different UID/GID combinations. Needs root + access. + Copyright The GNU Toolchain Authors. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include + +#define SOMEFILE "some-file" + +static int dir_fd; +uid_t users[3]; +gid_t groups[3]; + +struct test_case +{ + int mode; + uid_t uid; + uid_t euid; + gid_t gid; + gid_t egid; + int flags; + bool succeeds; +}; + +static void +run_one_test_child (void *in) +{ + struct test_case *t = (struct test_case *) in; + + printf ("TEST: MODE=%s, UID=%d, EUID=%d, GID=%d, EGID=%d, FLAGS=%s: ", + t->mode == R_OK ? "R_OK" : "W_OK", t->uid, t->euid, t->gid, t->egid, + t->flags ? "AT_EACCESS" : "0"); + + if (setregid (t->gid, t->egid) != 0) + FAIL_EXIT1 ("Could not change group: %m\n"); + if (setreuid (t->uid, t->euid) != 0) + FAIL_EXIT1 ("Could not change user: %m\n"); + + if (faccessat (dir_fd, SOMEFILE, t->mode, t->flags) != 0 && t->succeeds) + FAIL_EXIT1 ("faccessat failed: %m\n"); + + if (!t->succeeds && errno != EACCES) + FAIL_EXIT1 ("Unexpected faccessat failure: %m\n"); + + printf ("OK%s\n", !t->succeeds ? " (FAILED with EACCES)" : ""); +} + +static void +run_one_test (int mode, int u, int eu, int g, int eg, int flags, bool succeeds) +{ + struct test_case t = + {mode, users[u], users[eu], groups[g], groups[eg], flags, succeeds}; + support_isolate_in_subprocess (run_one_test_child, &t); +} + +static int +do_test (void) +{ + + /* We need to start as root. */ + if (getuid () != 0) + FAIL_UNSUPPORTED ("Test needs to be run as root (UID 0)\n"); + + /* Collect 3 distinct users and groups to test with. */ + struct passwd *ent = NULL; + int count = 0; + while ((ent = getpwent ()) != NULL && count < 3) + { + if (ent->pw_uid == 0 || ent->pw_gid == 0) + continue; + + int i = count; + bool skip = false; + while (i > 0) + if (groups[--i] == ent->pw_gid) + skip = true; + + if (skip) + continue; + + users[count] = ent->pw_uid; + groups[count++] = ent->pw_gid; + } + + if (count < 3) + FAIL_UNSUPPORTED ("Not enough users in the system to do this test\n"); + + printf ("Testing with UID/GID:\n"); + while (--count >= 0) + printf (" UID: %d, GID: %d\n", users[count], groups[count]); + printf ("\n"); + + char *tempdir = support_create_temp_directory ("tst-faccessat-setuid."); + dir_fd = xopen (tempdir, O_RDONLY | O_DIRECTORY, 0); + + xfchmod (dir_fd, 0777); + + /* Now, create a file in it, which will be our test case. */ + + int fd = openat (dir_fd, SOMEFILE, O_CREAT|O_RDWR|O_EXCL, 0640); + if (fd == -1) + { + if (errno == ENOSYS) + FAIL_UNSUPPORTED ("*at functions not supported"); + + FAIL_EXIT1 ("file creation failed"); + } + xwrite (fd, "hello", 5); + + if (fchown (fd, users[0], groups[1]) == -1) + FAIL_EXIT1 ("fchown failed: %m\n"); + xclose (fd); + + char *somefile = xasprintf ("%s/" SOMEFILE, tempdir); + add_temp_file (somefile); + + /* Finally, run through the combinations. */ + for (int u = 0; u < 3; u++) + for (int eu = 0; eu < 3; eu++) + for (int g = 0; g < 3; g++) + for (int eg = 0; eg < 3; eg++) + { + run_one_test (R_OK, u, eu, g, eg, 0, u == 0 || g == 1); + run_one_test (W_OK, u, eu, g, eg, 0, u == 0); + run_one_test (R_OK, u, eu, g, eg, AT_EACCESS, eu == 0 || eg == 1); + run_one_test (W_OK, u, eu, g, eg, AT_EACCESS, eu == 0); + } + + xclose (dir_fd); + free (tempdir); + free (somefile); + + return 0; +} +#include