1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Landlock tests - Enforcing the same restrictions across multiple threads 4 * 5 * Copyright © 2025 Günther Noack <gnoack3000@gmail.com> 6 */ 7 8 #define _GNU_SOURCE 9 #include <linux/landlock.h> 10 #include <pthread.h> 11 #include <signal.h> 12 #include <sys/prctl.h> 13 14 #include "common.h" 15 16 /* create_ruleset - Create a simple ruleset FD common to all tests */ 17 static int create_ruleset(struct __test_metadata *const _metadata) 18 { 19 struct landlock_ruleset_attr ruleset_attr = { 20 .handled_access_fs = (LANDLOCK_ACCESS_FS_WRITE_FILE | 21 LANDLOCK_ACCESS_FS_TRUNCATE), 22 }; 23 const int ruleset_fd = 24 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); 25 26 ASSERT_LE(0, ruleset_fd) 27 { 28 TH_LOG("landlock_create_ruleset: %s", strerror(errno)); 29 } 30 return ruleset_fd; 31 } 32 33 TEST(single_threaded_success) 34 { 35 const int ruleset_fd = create_ruleset(_metadata); 36 37 disable_caps(_metadata); 38 39 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); 40 ASSERT_EQ(0, landlock_restrict_self(ruleset_fd, 41 LANDLOCK_RESTRICT_SELF_TSYNC)); 42 43 EXPECT_EQ(0, close(ruleset_fd)); 44 } 45 46 static void store_no_new_privs(void *data) 47 { 48 bool *nnp = data; 49 50 if (!nnp) 51 return; 52 *nnp = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0); 53 } 54 55 static void *idle(void *data) 56 { 57 pthread_cleanup_push(store_no_new_privs, data); 58 59 while (true) 60 sleep(1); 61 62 pthread_cleanup_pop(1); 63 } 64 65 FIXTURE(multi_threaded) 66 { 67 int ruleset_fd; 68 }; 69 70 FIXTURE_VARIANT(multi_threaded) 71 { 72 const __u32 restrict_flags; 73 /* Sets no_new_privs with prctl(2) before the enforcement. */ 74 const bool prior_no_new_privs; 75 /* Enforces the maximum number of allowed layers beforehand. */ 76 const bool max_layers; 77 const int expected_errno; 78 /* Expected no_new_privs state of all threads after the call. */ 79 const bool expected_no_new_privs; 80 }; 81 82 /* clang-format off */ 83 FIXTURE_VARIANT_ADD(multi_threaded, success) { 84 /* clang-format on */ 85 .restrict_flags = LANDLOCK_RESTRICT_SELF_TSYNC, 86 .prior_no_new_privs = true, 87 .expected_no_new_privs = true, 88 }; 89 90 /* clang-format off */ 91 FIXTURE_VARIANT_ADD(multi_threaded, no_new_privs) { 92 /* clang-format on */ 93 .restrict_flags = LANDLOCK_RESTRICT_SELF_TSYNC | 94 LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS, 95 .expected_no_new_privs = true, 96 }; 97 98 /* clang-format off */ 99 FIXTURE_VARIANT_ADD(multi_threaded, no_new_privs_max_layers) { 100 /* clang-format on */ 101 .restrict_flags = LANDLOCK_RESTRICT_SELF_TSYNC | 102 LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS, 103 .max_layers = true, 104 .expected_errno = E2BIG, 105 .expected_no_new_privs = false, 106 }; 107 108 FIXTURE_SETUP(multi_threaded) 109 { 110 self->ruleset_fd = create_ruleset(_metadata); 111 112 if (variant->max_layers) { 113 /* Enforces the maximum number of allowed layers. */ 114 for (int i = 0; i < LANDLOCK_MAX_NUM_LAYERS; i++) 115 ASSERT_EQ(0, 116 landlock_restrict_self(self->ruleset_fd, 0)); 117 } 118 119 disable_caps(_metadata); 120 } 121 122 FIXTURE_TEARDOWN(multi_threaded) 123 { 124 EXPECT_EQ(0, close(self->ruleset_fd)); 125 } 126 127 TEST_F(multi_threaded, restrict) 128 { 129 pthread_t t1, t2; 130 bool no_new_privs1, no_new_privs2; 131 132 ASSERT_EQ(0, pthread_create(&t1, NULL, idle, &no_new_privs1)); 133 ASSERT_EQ(0, pthread_create(&t2, NULL, idle, &no_new_privs2)); 134 135 if (variant->prior_no_new_privs) { 136 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); 137 } else { 138 /* No prior prctl(2) PR_SET_NO_NEW_PRIVS call. */ 139 ASSERT_EQ(0, prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)); 140 } 141 142 if (variant->expected_errno) { 143 EXPECT_EQ(-1, landlock_restrict_self(self->ruleset_fd, 144 variant->restrict_flags)); 145 EXPECT_EQ(variant->expected_errno, errno); 146 } else { 147 EXPECT_EQ(0, landlock_restrict_self(self->ruleset_fd, 148 variant->restrict_flags)); 149 } 150 151 /* Checks the no_new_privs state of the calling thread. */ 152 EXPECT_EQ(variant->expected_no_new_privs, 153 prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)); 154 155 ASSERT_EQ(0, pthread_cancel(t1)); 156 ASSERT_EQ(0, pthread_cancel(t2)); 157 ASSERT_EQ(0, pthread_join(t1, NULL)); 158 ASSERT_EQ(0, pthread_join(t2, NULL)); 159 160 /* Checks the no_new_privs state of the sibling threads. */ 161 EXPECT_EQ(variant->expected_no_new_privs, no_new_privs1); 162 EXPECT_EQ(variant->expected_no_new_privs, no_new_privs2); 163 } 164 165 TEST(multi_threaded_success_despite_diverging_domains) 166 { 167 pthread_t t1, t2; 168 const int ruleset_fd = create_ruleset(_metadata); 169 170 disable_caps(_metadata); 171 172 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); 173 174 ASSERT_EQ(0, pthread_create(&t1, NULL, idle, NULL)); 175 ASSERT_EQ(0, pthread_create(&t2, NULL, idle, NULL)); 176 177 /* 178 * The main thread enforces a ruleset, 179 * thereby bringing the threads' Landlock domains out of sync. 180 */ 181 EXPECT_EQ(0, landlock_restrict_self(ruleset_fd, 0)); 182 183 /* Still, TSYNC succeeds, bringing the threads in sync again. */ 184 EXPECT_EQ(0, landlock_restrict_self(ruleset_fd, 185 LANDLOCK_RESTRICT_SELF_TSYNC)); 186 187 ASSERT_EQ(0, pthread_cancel(t1)); 188 ASSERT_EQ(0, pthread_cancel(t2)); 189 ASSERT_EQ(0, pthread_join(t1, NULL)); 190 ASSERT_EQ(0, pthread_join(t2, NULL)); 191 EXPECT_EQ(0, close(ruleset_fd)); 192 } 193 194 struct thread_restrict_data { 195 pthread_t t; 196 int ruleset_fd; 197 int result; 198 }; 199 200 static void *thread_restrict(void *data) 201 { 202 struct thread_restrict_data *d = data; 203 204 d->result = landlock_restrict_self(d->ruleset_fd, 205 LANDLOCK_RESTRICT_SELF_TSYNC); 206 return NULL; 207 } 208 209 TEST(competing_enablement) 210 { 211 const int ruleset_fd = create_ruleset(_metadata); 212 struct thread_restrict_data d[] = { 213 { .ruleset_fd = ruleset_fd }, 214 { .ruleset_fd = ruleset_fd }, 215 }; 216 217 disable_caps(_metadata); 218 219 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); 220 ASSERT_EQ(0, pthread_create(&d[0].t, NULL, thread_restrict, &d[0])); 221 ASSERT_EQ(0, pthread_create(&d[1].t, NULL, thread_restrict, &d[1])); 222 223 /* Wait for threads to finish. */ 224 ASSERT_EQ(0, pthread_join(d[0].t, NULL)); 225 ASSERT_EQ(0, pthread_join(d[1].t, NULL)); 226 227 /* Expect that both succeeded. */ 228 EXPECT_EQ(0, d[0].result); 229 EXPECT_EQ(0, d[1].result); 230 231 EXPECT_EQ(0, close(ruleset_fd)); 232 } 233 234 static void signal_nop_handler(int sig) 235 { 236 } 237 238 struct signaler_data { 239 pthread_t target; 240 volatile bool stop; 241 }; 242 243 static void *signaler_thread(void *data) 244 { 245 struct signaler_data *sd = data; 246 247 while (!sd->stop) 248 pthread_kill(sd->target, SIGUSR1); 249 250 return NULL; 251 } 252 253 /* 254 * Number of idle sibling threads. This must be large enough that even on 255 * machines with many cores, the sibling threads cannot all complete their 256 * credential preparation in a single parallel wave, otherwise the signaler 257 * thread has no window to interrupt wait_for_completion_interruptible(). 258 * 200 threads on a 64-core machine yields ~3 serialized waves, giving the 259 * tight signal loop enough time to land an interruption. 260 */ 261 #define NUM_IDLE_THREADS 200 262 263 /* 264 * Exercises the tsync interruption and cancellation paths in tsync.c. 265 * 266 * When a signal interrupts the calling thread while it waits for sibling 267 * threads to finish their credential preparation 268 * (wait_for_completion_interruptible in landlock_restrict_sibling_threads), 269 * the kernel sets ERESTARTNOINTR, cancels queued task works that have not 270 * started yet (cancel_tsync_works), then waits for the remaining works to 271 * finish. On the error return, syscalls.c aborts the prepared credentials. 272 * The kernel automatically restarts the syscall, so userspace sees success. 273 */ 274 TEST(tsync_interrupt) 275 { 276 size_t i; 277 pthread_t threads[NUM_IDLE_THREADS]; 278 pthread_t signaler; 279 struct signaler_data sd; 280 struct sigaction sa = {}; 281 const int ruleset_fd = create_ruleset(_metadata); 282 283 disable_caps(_metadata); 284 285 /* Install a no-op SIGUSR1 handler so the signal does not kill us. */ 286 sa.sa_handler = signal_nop_handler; 287 sigemptyset(&sa.sa_mask); 288 ASSERT_EQ(0, sigaction(SIGUSR1, &sa, NULL)); 289 290 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); 291 292 for (i = 0; i < NUM_IDLE_THREADS; i++) 293 ASSERT_EQ(0, pthread_create(&threads[i], NULL, idle, NULL)); 294 295 /* 296 * Start a signaler thread that continuously sends SIGUSR1 to the 297 * calling thread. This maximizes the chance of interrupting 298 * wait_for_completion_interruptible() in the kernel's tsync path. 299 */ 300 sd.target = pthread_self(); 301 sd.stop = false; 302 ASSERT_EQ(0, pthread_create(&signaler, NULL, signaler_thread, &sd)); 303 304 /* 305 * The syscall may be interrupted and transparently restarted by the 306 * kernel (ERESTARTNOINTR). From userspace, it should always succeed. 307 */ 308 EXPECT_EQ(0, landlock_restrict_self(ruleset_fd, 309 LANDLOCK_RESTRICT_SELF_TSYNC)); 310 311 sd.stop = true; 312 ASSERT_EQ(0, pthread_join(signaler, NULL)); 313 314 for (i = 0; i < NUM_IDLE_THREADS; i++) { 315 ASSERT_EQ(0, pthread_cancel(threads[i])); 316 ASSERT_EQ(0, pthread_join(threads[i], NULL)); 317 } 318 319 EXPECT_EQ(0, close(ruleset_fd)); 320 } 321 322 /* clang-format off */ 323 FIXTURE(tsync_without_ruleset) {}; 324 /* clang-format on */ 325 326 FIXTURE_VARIANT(tsync_without_ruleset) 327 { 328 const __u32 flags; 329 const int expected_errno; 330 }; 331 332 /* clang-format off */ 333 FIXTURE_VARIANT_ADD(tsync_without_ruleset, tsync_only) { 334 /* clang-format on */ 335 .flags = LANDLOCK_RESTRICT_SELF_TSYNC, 336 .expected_errno = EBADF, 337 }; 338 339 /* clang-format off */ 340 FIXTURE_VARIANT_ADD(tsync_without_ruleset, subdomains_off_same_exec_off) { 341 /* clang-format on */ 342 .flags = LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF | 343 LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF | 344 LANDLOCK_RESTRICT_SELF_TSYNC, 345 .expected_errno = EBADF, 346 }; 347 348 /* clang-format off */ 349 FIXTURE_VARIANT_ADD(tsync_without_ruleset, subdomains_off_new_exec_on) { 350 /* clang-format on */ 351 .flags = LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF | 352 LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | 353 LANDLOCK_RESTRICT_SELF_TSYNC, 354 .expected_errno = EBADF, 355 }; 356 357 /* clang-format off */ 358 FIXTURE_VARIANT_ADD(tsync_without_ruleset, all_flags) { 359 /* clang-format on */ 360 .flags = LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF | 361 LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | 362 LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF | 363 LANDLOCK_RESTRICT_SELF_TSYNC, 364 .expected_errno = EBADF, 365 }; 366 367 /* clang-format off */ 368 FIXTURE_VARIANT_ADD(tsync_without_ruleset, subdomains_off) { 369 /* clang-format on */ 370 .flags = LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF | 371 LANDLOCK_RESTRICT_SELF_TSYNC, 372 .expected_errno = 0, 373 }; 374 375 FIXTURE_SETUP(tsync_without_ruleset) 376 { 377 disable_caps(_metadata); 378 } 379 380 FIXTURE_TEARDOWN(tsync_without_ruleset) 381 { 382 } 383 384 TEST_F(tsync_without_ruleset, check) 385 { 386 int ret; 387 388 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); 389 390 ret = landlock_restrict_self(-1, variant->flags); 391 if (variant->expected_errno) { 392 EXPECT_EQ(-1, ret); 393 EXPECT_EQ(variant->expected_errno, errno); 394 } else { 395 EXPECT_EQ(0, ret); 396 } 397 } 398 399 TEST_HARNESS_MAIN 400