github.com/google/syzkaller@v0.0.0-20240517125934-c0f1611a36d6/sys/linux/test/landlock_fs_accesses (about)

     1  # Create and access multiple type of files
     2  #
     3  # Device creation requires some privileges:
     4  # requires: -sandbox=namespace -sandbox=setuid
     5  
     6  # Makes a character device /dev/null
     7  
     8  mknodat(0xffffffffffffff9c, &AUTO='./file0\x00', 0x21c0, 0x103)
     9  
    10  # Makes a directory.
    11  
    12  mkdirat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x1c0)
    13  
    14  # Makes a regular file.
    15  
    16  mknodat(0xffffffffffffff9c, &AUTO='./file2\x00', 0x81c0, 0x0)
    17  
    18  # Makes a socket.
    19  
    20  mknodat(0xffffffffffffff9c, &AUTO='./file3\x00', 0xc1c0, 0x0)
    21  
    22  # Makes a fifo.
    23  
    24  mknodat(0xffffffffffffff9c, &AUTO='./file4\x00', 0x11c0, 0x0)
    25  
    26  # Makes a block device /dev/loop0
    27  
    28  mknodat(0xffffffffffffff9c, &AUTO='./file5\x00', 0x61c0, 0x700)
    29  
    30  # Makes a symlink.
    31  
    32  symlinkat(&AUTO='./file2\x00', 0xffffffffffffff9c, &AUTO='./file6\x00')
    33  
    34  # Creates a ruleset to restrict all kind of file creation.
    35  
    36  r0 = landlock_create_ruleset(&AUTO={0x1fff, 0x0}, AUTO, 0x0)
    37  prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1)
    38  landlock_restrict_self(r0, 0x0)
    39  
    40  # No need to close this FD for this test.
    41  
    42  # Checks LANDLOCK_ACCESS_FS_EXECUTE.
    43  
    44  execveat(0xffffffffffffff9c, &AUTO='./file2\x00', 0x0, 0x0, 0x0) # EACCES
    45  
    46  # Checks LANDLOCK_ACCESS_FS_WRITE_FILE.
    47  
    48  openat$dir(0xffffffffffffff9c, &AUTO='./file2\x00', 0x1, 0x0) # EACCES
    49  
    50  # Checks LANDLOCK_ACCESS_FS_READ_FILE.
    51  
    52  openat$dir(0xffffffffffffff9c, &AUTO='./file2\x00', 0x0, 0x0) # EACCES
    53  
    54  # Checks LANDLOCK_ACCESS_FS_READ_DIR.
    55  
    56  openat$dir(0xffffffffffffff9c, &AUTO='./file1\x00', 0x0, 0x0) # EACCES
    57  
    58  # Checks LANDLOCK_ACCESS_FS_REMOVE_DIR.
    59  
    60  unlinkat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x200) # EACCES
    61  
    62  # Checks LANDLOCK_ACCESS_FS_REMOVE_FILE.
    63  
    64  unlinkat(0xffffffffffffff9c, &AUTO='./file2\x00', 0x0) # EACCES
    65  
    66  # Checks LANDLOCK_ACCESS_FS_MAKE_CHAR.
    67  
    68  mknodat(0xffffffffffffff9c, &AUTO='./file7\x00', 0x21c0, 0x103) # EACCES
    69  renameat2(0xffffffffffffff9c, &AUTO='./file0\x00', 0xffffffffffffff9c, &AUTO='./file7\x00', 0x0) # EACCES
    70  linkat(0xffffffffffffff9c, &AUTO='./file0\x00', 0xffffffffffffff9c, &AUTO='./file7\x00', 0x0) # EACCES
    71  
    72  # Checks LANDLOCK_ACCESS_FS_MAKE_DIR.
    73  
    74  mkdirat(0xffffffffffffff9c, &AUTO='./file7\x00', 0x1c0) # EACCES
    75  renameat2(0xffffffffffffff9c, &AUTO='./file1\x00', 0xffffffffffffff9c, &AUTO='./file7\x00', 0x0) # EACCES
    76  
    77  # Checks LANDLOCK_ACCESS_FS_MAKE_REG.
    78  
    79  mknodat(0xffffffffffffff9c, &AUTO='./file7\x00', 0x81c0, 0x0) # EACCES
    80  renameat2(0xffffffffffffff9c, &AUTO='./file2\x00', 0xffffffffffffff9c, &AUTO='./file7\x00', 0x0) # EACCES
    81  linkat(0xffffffffffffff9c, &AUTO='./file2\x00', 0xffffffffffffff9c, &AUTO='./file7\x00', 0x0) # EACCES
    82  
    83  # Checks LANDLOCK_ACCESS_FS_MAKE_SOCK.
    84  
    85  mknodat(0xffffffffffffff9c, &AUTO='./file7\x00', 0xc1c0, 0x0) # EACCES
    86  renameat2(0xffffffffffffff9c, &AUTO='./file3\x00', 0xffffffffffffff9c, &AUTO='./file7\x00', 0x0) # EACCES
    87  linkat(0xffffffffffffff9c, &AUTO='./file3\x00', 0xffffffffffffff9c, &AUTO='./file7\x00', 0x0) # EACCES
    88  
    89  # Checks LANDLOCK_ACCESS_FS_MAKE_FIFO.
    90  
    91  mknodat(0xffffffffffffff9c, &AUTO='./file7\x00', 0x11c0, 0x0) # EACCES
    92  renameat2(0xffffffffffffff9c, &AUTO='./file4\x00', 0xffffffffffffff9c, &AUTO='./file7\x00', 0x0) # EACCES
    93  linkat(0xffffffffffffff9c, &AUTO='./file4\x00', 0xffffffffffffff9c, &AUTO='./file7\x00', 0x0) # EACCES
    94  
    95  # Checks LANDLOCK_ACCESS_FS_MAKE_BLOCK.
    96  
    97  mknodat(0xffffffffffffff9c, &AUTO='./file7\x00', 0x61c0, 0x700) # EACCES
    98  renameat2(0xffffffffffffff9c, &AUTO='./file5\x00', 0xffffffffffffff9c, &AUTO='./file7\x00', 0x0) # EACCES
    99  linkat(0xffffffffffffff9c, &AUTO='./file5\x00', 0xffffffffffffff9c, &AUTO='./file7\x00', 0x0) # EACCES
   100  
   101  # Checks LANDLOCK_ACCESS_FS_MAKE_SYM.
   102  
   103  symlinkat(&AUTO='./file2\x00', 0xffffffffffffff9c, &AUTO='./file7\x00') # EACCES
   104  renameat2(0xffffffffffffff9c, &AUTO='./file6\x00', 0xffffffffffffff9c, &AUTO='./file7\x00', 0x0) # EACCES
   105  linkat(0xffffffffffffff9c, &AUTO='./file6\x00', 0xffffffffffffff9c, &AUTO='./file7\x00', 0x0) # EACCES