github.com/google/syzkaller@v0.0.0-20251211124644-a066d2bc4b02/sys/linux/test/landlock_fs_disconnected (about)

     1  # Test access through a disconnected directory.
     2  
     3  # Creates a private mount namespace with CLONE_NEWNS.  This avoids a syz-manager
     4  # error because of a bogus call to umount(./0/file0/file2/file3):
     5  # none/cover C/repeat C/thr/cover C/repeat C: FAIL
     6  
     7  unshare(0x20000)
     8  
     9  # Create a tmpfs mount.
    10  
    11  mkdirat(0xffffffffffffff9c, &AUTO='./file0\x00', 0x1c0)
    12  mount$tmpfs(0x0, &AUTO='./file0\x00', &AUTO='tmpfs\x00', 0x0, 0x0)
    13  
    14  # Create directories and a test file in the tmpfs mount.
    15  
    16  mkdirat(0xffffffffffffff9c, &AUTO='./file0/file1\x00', 0x1c0)
    17  mkdirat(0xffffffffffffff9c, &AUTO='./file0/file1/file2\x00', 0x1c0)
    18  mkdirat(0xffffffffffffff9c, &AUTO='./file0/file1/file2/file3\x00', 0x1c0)
    19  mkdirat(0xffffffffffffff9c, &AUTO='./file0/file1/file2/file3/file4\x00', 0x1c0)
    20  mknodat(0xffffffffffffff9c, &AUTO='./file0/file1/file2/file3/file5\x00', 0x81c0, 0x0)
    21  mkdirat(0xffffffffffffff9c, &AUTO='./file0/file6\x00', 0x1c0)
    22  
    23  # Creates first bind mount from file3 to file3.  This is an optional call useful
    24  # to extend coverage of is_access_to_paths_allowed().
    25  
    26  mount$bind(&AUTO='./file0/file1/file2/file3\x00', &AUTO='./file0/file1/file2/file3\x00', 0x0, 0x1000, 0x0)
    27  
    28  # Creates second recursive bind mount from file1 to file6.
    29  
    30  mount$bind(&AUTO='./file0/file1\x00', &AUTO='./file0/file6\x00', 0x0, 0x5000, 0x0)
    31  
    32  # Opens directory from the bind mount.
    33  
    34  r0 = openat$dir(0xffffffffffffff9c, &AUTO='./file0/file6/file2\x00', 0x0, 0x0)
    35  
    36  # Moves file2 to make it a disconnected directory.
    37  
    38  renameat2(0xffffffffffffff9c, &AUTO='./file0/file1/file2\x00', 0xffffffffffffff9c, &AUTO='./file0/file2\x00', 0x0)
    39  
    40  # Creates a ruleset with read and refer restrictions.
    41  
    42  r1 = landlock_create_ruleset(&AUTO={0x2004, 0x0, 0x0}, AUTO, 0x0)
    43  
    44  # Adds a rule to allow read on one side of the rename.  This is an optional call
    45  # useful to extend coverage of collect_domain_accesses().
    46  
    47  r2 = openat$dir(0xffffffffffffff9c, &AUTO='./file0/file2/file3/file4\x00', 0x0, 0x0)
    48  landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, AUTO, &AUTO={0x4, r2}, 0x0)
    49  
    50  prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1)
    51  landlock_restrict_self(r1, 0x0)
    52  
    53  # Tries to open and rename a file from the disconnected directory.
    54  
    55  openat(r0, &AUTO='file3/file5\x00', 0x0, 0x0) # EACCES
    56  renameat2(r0, &AUTO='file3/file5\x00', r0, &AUTO='file3/file4/file5\x00', 0x0) # EXDEV