1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Author: Aleksa Sarai <cyphar@cyphar.com> 4 * Copyright (C) 2018-2019 SUSE LLC. 5 */ 6 7 #define _GNU_SOURCE 8 #include <errno.h> 9 #include <fcntl.h> 10 #include <sched.h> 11 #include <sys/stat.h> 12 #include <sys/types.h> 13 #include <sys/mount.h> 14 #include <sys/mman.h> 15 #include <sys/prctl.h> 16 #include <signal.h> 17 #include <stdio.h> 18 #include <stdlib.h> 19 #include <stdbool.h> 20 #include <string.h> 21 #include <syscall.h> 22 #include <limits.h> 23 #include <unistd.h> 24 25 #include "../kselftest.h" 26 #include "helpers.h" 27 28 /* Construct a test directory with the following structure: 29 * 30 * root/ 31 * |-- a/ 32 * | `-- c/ 33 * `-- b/ 34 */ 35 int setup_testdir(void) 36 { 37 int dfd; 38 char dirname[] = "/tmp/ksft-openat2-rename-attack.XXXXXX"; 39 40 /* Make the top-level directory. */ 41 if (!mkdtemp(dirname)) 42 ksft_exit_fail_msg("setup_testdir: failed to create tmpdir\n"); 43 dfd = open(dirname, O_PATH | O_DIRECTORY); 44 if (dfd < 0) 45 ksft_exit_fail_msg("setup_testdir: failed to open tmpdir\n"); 46 47 E_mkdirat(dfd, "a", 0755); 48 E_mkdirat(dfd, "b", 0755); 49 E_mkdirat(dfd, "a/c", 0755); 50 51 return dfd; 52 } 53 54 /* Swap @dirfd/@a and @dirfd/@b constantly. Parent must kill this process. */ 55 pid_t spawn_attack(int dirfd, char *a, char *b) 56 { 57 pid_t child = fork(); 58 if (child != 0) 59 return child; 60 61 /* If the parent (the test process) dies, kill ourselves too. */ 62 E_prctl(PR_SET_PDEATHSIG, SIGKILL); 63 64 /* Swap @a and @b. */ 65 for (;;) 66 renameat2(dirfd, a, dirfd, b, RENAME_EXCHANGE); 67 exit(1); 68 } 69 70 #define NUM_RENAME_TESTS 2 71 #define ROUNDS 400000 72 73 const char *flagname(int resolve) 74 { 75 switch (resolve) { 76 case RESOLVE_IN_ROOT: 77 return "RESOLVE_IN_ROOT"; 78 case RESOLVE_BENEATH: 79 return "RESOLVE_BENEATH"; 80 } 81 return "(unknown)"; 82 } 83 84 void test_rename_attack(int resolve) 85 { 86 int dfd, afd; 87 pid_t child; 88 void (*resultfn)(const char *msg, ...) = ksft_test_result_pass; 89 int escapes = 0, other_errs = 0, exdevs = 0, eagains = 0, successes = 0; 90 91 struct open_how how = { 92 .flags = O_PATH, 93 .resolve = resolve, 94 }; 95 96 if (!openat2_supported) { 97 how.resolve = 0; 98 ksft_print_msg("openat2(2) unsupported -- using openat(2) instead\n"); 99 } 100 101 dfd = setup_testdir(); 102 afd = openat(dfd, "a", O_PATH); 103 if (afd < 0) 104 ksft_exit_fail_msg("test_rename_attack: failed to open 'a'\n"); 105 106 child = spawn_attack(dfd, "a/c", "b"); 107 108 for (int i = 0; i < ROUNDS; i++) { 109 int fd; 110 char *victim_path = "c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../../c/../.."; 111 112 if (openat2_supported) 113 fd = sys_openat2(afd, victim_path, &how); 114 else 115 fd = sys_openat(afd, victim_path, &how); 116 117 if (fd < 0) { 118 if (fd == -EAGAIN) 119 eagains++; 120 else if (fd == -EXDEV) 121 exdevs++; 122 else if (fd == -ENOENT) 123 escapes++; /* escaped outside and got ENOENT... */ 124 else 125 other_errs++; /* unexpected error */ 126 } else { 127 if (fdequal(fd, afd, NULL)) 128 successes++; 129 else 130 escapes++; /* we got an unexpected fd */ 131 } 132 close(fd); 133 } 134 135 if (escapes > 0) 136 resultfn = ksft_test_result_fail; 137 ksft_print_msg("non-escapes: EAGAIN=%d EXDEV=%d E<other>=%d success=%d\n", 138 eagains, exdevs, other_errs, successes); 139 resultfn("rename attack with %s (%d runs, got %d escapes)\n", 140 flagname(resolve), ROUNDS, escapes); 141 142 /* Should be killed anyway, but might as well make sure. */ 143 E_kill(child, SIGKILL); 144 } 145 146 #define NUM_TESTS NUM_RENAME_TESTS 147 148 int main(int argc, char **argv) 149 { 150 ksft_print_header(); 151 ksft_set_plan(NUM_TESTS); 152 153 test_rename_attack(RESOLVE_BENEATH); 154 test_rename_attack(RESOLVE_IN_ROOT); 155 156 if (ksft_get_fail_cnt() + ksft_get_error_cnt() > 0) 157 ksft_exit_fail(); 158 else 159 ksft_exit_pass(); 160 } 161