1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * A recursive bind mount of a namespace file that lives in another mount
4 * namespace copies whatever is stacked on top of it there. If that includes
5 * the file of the caller's own mount namespace, or of an older one, the copy
6 * would pin the namespace it is put in forever. The bind mount has to be
7 * refused, a plain bind mount of the file itself still works.
8 */
9 #define _GNU_SOURCE
10 #include <errno.h>
11 #include <fcntl.h>
12 #include <sched.h>
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <unistd.h>
17 #include <sys/mount.h>
18 #include <sys/stat.h>
19 #include <sys/wait.h>
20
21 #include "../../kselftest_harness.h"
22
23 #define DIR_LEN 64
24 #define PATH_LEN 128
25
26 /* Child exit codes. */
27 enum {
28 CHILD_OK,
29 CHILD_UNSHARE, /* could not create the newer mount namespace */
30 CHILD_PIPE, /* the parent went away */
31 CHILD_TMPFS, /* could not mount the tmpfs in the new namespace */
32 CHILD_REC_ALLOWED, /* the recursive bind mount was not refused */
33 CHILD_REC_ERRNO, /* it was refused with the wrong error */
34 CHILD_PLAIN_REFUSED, /* the plain bind mount of the file was refused */
35 };
36
write_file(const char * path,const char * s)37 static int write_file(const char *path, const char *s)
38 {
39 ssize_t n = -1;
40 int fd;
41
42 fd = open(path, O_WRONLY | O_CLOEXEC);
43 if (fd >= 0) {
44 n = write(fd, s, strlen(s));
45 close(fd);
46 }
47 return n == (ssize_t)strlen(s) ? 0 : -1;
48 }
49
create_file(const char * path)50 static int create_file(const char *path)
51 {
52 int fd = open(path, O_WRONLY | O_CREAT | O_CLOEXEC, 0644);
53
54 if (fd < 0)
55 return -1;
56 close(fd);
57 return 0;
58 }
59
60 /* Become root in a new user namespace with a private mount namespace. */
enter_userns(void)61 static int enter_userns(void)
62 {
63 uid_t uid = getuid();
64 gid_t gid = getgid();
65 char map[32];
66
67 if (unshare(CLONE_NEWUSER | CLONE_NEWNS))
68 return -1;
69 if (write_file("/proc/self/setgroups", "deny") && errno != ENOENT)
70 return -1;
71 snprintf(map, sizeof(map), "0 %d 1", uid);
72 if (write_file("/proc/self/uid_map", map))
73 return -1;
74 snprintf(map, sizeof(map), "0 %d 1", gid);
75 if (write_file("/proc/self/gid_map", map))
76 return -1;
77 if (setgid(0) || setuid(0))
78 return -1;
79 return mount("", "/", NULL, MS_REC | MS_PRIVATE, NULL);
80 }
81
send_msg(int fd,char msg)82 static int send_msg(int fd, char msg)
83 {
84 return write(fd, &msg, 1) == 1 ? 0 : -1;
85 }
86
recv_msg(int fd)87 static char recv_msg(int fd)
88 {
89 char msg;
90
91 if (read(fd, &msg, 1) != 1)
92 return 0;
93 return msg;
94 }
95
FIXTURE(nsfs_rbind_loop)96 FIXTURE(nsfs_rbind_loop) {
97 char dir[DIR_LEN];
98 char x[PATH_LEN];
99 };
100
FIXTURE_SETUP(nsfs_rbind_loop)101 FIXTURE_SETUP(nsfs_rbind_loop)
102 {
103 snprintf(self->dir, sizeof(self->dir), "/tmp/nsfs_rbind_loop.XXXXXX");
104 ASSERT_NE(mkdtemp(self->dir), NULL);
105 if (enter_userns()) {
106 rmdir(self->dir);
107 SKIP(return, "test requires user namespaces");
108 }
109 ASSERT_EQ(mount("tmpfs", self->dir, "tmpfs", 0, NULL), 0);
110 snprintf(self->x, sizeof(self->x), "%s/x", self->dir);
111 ASSERT_EQ(create_file(self->x), 0);
112 }
113
FIXTURE_TEARDOWN(nsfs_rbind_loop)114 FIXTURE_TEARDOWN(nsfs_rbind_loop)
115 {
116 umount2(self->dir, MNT_DETACH);
117 rmdir(self->dir);
118 }
119
120 /*
121 * The child in the newer mount namespace binds the network namespace file
122 * mount of the parent through @fd. Recursively that would copy the mount of
123 * its own mount namespace file that the parent stacked on top.
124 */
newer_ns_child(const char * dir,int fd,int to_parent,int from_parent)125 static int newer_ns_child(const char *dir, int fd, int to_parent, int from_parent)
126 {
127 char src[32], y[PATH_LEN];
128
129 if (unshare(CLONE_NEWNS))
130 return CHILD_UNSHARE;
131 if (send_msg(to_parent, 'r') || recv_msg(from_parent) != 'g')
132 return CHILD_PIPE;
133
134 snprintf(y, sizeof(y), "%s/y", dir);
135 if (mount("tmpfs", y, "tmpfs", 0, NULL))
136 return CHILD_TMPFS;
137 snprintf(src, sizeof(src), "/proc/self/fd/%d", fd);
138 snprintf(y, sizeof(y), "%s/y/f", dir);
139 if (create_file(y))
140 return CHILD_TMPFS;
141
142 if (!mount(src, y, NULL, MS_BIND | MS_REC, NULL))
143 return CHILD_REC_ALLOWED;
144 if (errno != EINVAL)
145 return CHILD_REC_ERRNO;
146 if (mount(src, y, NULL, MS_BIND, NULL))
147 return CHILD_PLAIN_REFUSED;
148 umount2(y, MNT_DETACH);
149 return CHILD_OK;
150 }
151
TEST_F(nsfs_rbind_loop,own_ns_file_below_foreign_source)152 TEST_F(nsfs_rbind_loop, own_ns_file_below_foreign_source)
153 {
154 int to_child[2], to_parent[2], fd, status;
155 char p[PATH_LEN];
156 pid_t pid;
157
158 snprintf(p, sizeof(p), "%s/y", self->dir);
159 ASSERT_EQ(mkdir(p, 0755), 0);
160
161 /* M, a mount of our network namespace file, held by a descriptor */
162 ASSERT_EQ(mount("/proc/self/ns/net", self->x, NULL, MS_BIND, NULL), 0);
163 fd = open(self->x, O_PATH | O_CLOEXEC);
164 ASSERT_GE(fd, 0);
165
166 ASSERT_EQ(pipe(to_child), 0);
167 ASSERT_EQ(pipe(to_parent), 0);
168 pid = fork();
169 ASSERT_GE(pid, 0);
170 if (pid == 0) {
171 close(to_child[1]);
172 close(to_parent[0]);
173 _exit(newer_ns_child(self->dir, fd, to_parent[1], to_child[0]));
174 }
175 close(to_child[0]);
176 close(to_parent[1]);
177 ASSERT_EQ(recv_msg(to_parent[0]), 'r');
178
179 /* the child's mount namespace file on top of M */
180 snprintf(p, sizeof(p), "/proc/%d/ns/mnt", pid);
181 ASSERT_EQ(mount(p, self->x, NULL, MS_BIND, NULL), 0);
182
183 ASSERT_EQ(send_msg(to_child[1], 'g'), 0);
184 ASSERT_EQ(waitpid(pid, &status, 0), pid);
185 ASSERT_TRUE(WIFEXITED(status));
186 ASSERT_EQ(WEXITSTATUS(status), CHILD_OK);
187
188 close(fd);
189 ASSERT_EQ(umount2(self->x, MNT_DETACH), 0);
190 ASSERT_EQ(umount2(self->x, MNT_DETACH), 0);
191 }
192
193 TEST_HARNESS_MAIN
194