| Message ID | 20250723154610.3860563-1-wegao@suse.com |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | [v5] open16: allow restricted O_CREAT of FIFOs and regular files | expand |
| Context | Check | Description |
|---|---|---|
| ltpci/debian_stable_s390x-linux-gnu-gcc_s390x | success | success |
| ltpci/debian_stable_powerpc64le-linux-gnu-gcc_ppc64el | success | success |
| ltpci/debian_stable_aarch64-linux-gnu-gcc_arm64 | success | success |
| ltpci/debian_stable_gcc | success | success |
| ltpci/ubuntu_jammy_gcc | success | success |
| ltpci/quay-io-centos-centos_stream9_gcc | success | success |
| ltpci/ubuntu_bionic_gcc | success | success |
| ltpci/debian_stable_gcc | success | success |
| ltpci/debian_oldstable_gcc | success | success |
| ltpci/alpine_latest_gcc | success | success |
| ltpci/fedora_latest_clang | success | success |
| ltpci/opensuse-leap_latest_gcc | success | success |
| ltpci/debian_oldstable_clang | success | success |
| ltpci/opensuse-archive_42-2_gcc | success | success |
| ltpci/debian_testing_gcc | success | success |
| ltpci/debian_testing_clang | success | success |
Hi! On Wed Jul 23, 2025 at 5:46 PM CEST, Wei Gao via ltp wrote: > This commit adds test cases to verify the security restrictions for opening > FIFOs and regular files in world-writable sticky directories. > > Signed-off-by: Wei Gao <wegao@suse.com> > --- > runtest/syscalls | 1 + > testcases/kernel/syscalls/open/.gitignore | 1 + > testcases/kernel/syscalls/open/open16.c | 124 ++++++++++++++++++++++ > 3 files changed, 126 insertions(+) > create mode 100644 testcases/kernel/syscalls/open/open16.c > > diff --git a/runtest/syscalls b/runtest/syscalls > index 3531c2a3c..0de9bfaef 100644 > --- a/runtest/syscalls > +++ b/runtest/syscalls > @@ -984,6 +984,7 @@ open12 open12 > open13 open13 > open14 open14 > open15 open15 > +open16 open16 > > openat01 openat01 > openat02 openat02 > diff --git a/testcases/kernel/syscalls/open/.gitignore b/testcases/kernel/syscalls/open/.gitignore > index af5997572..d2cacc02e 100644 > --- a/testcases/kernel/syscalls/open/.gitignore > +++ b/testcases/kernel/syscalls/open/.gitignore > @@ -13,3 +13,4 @@ > /open13 > /open14 > /open15 > +/open16 > diff --git a/testcases/kernel/syscalls/open/open16.c b/testcases/kernel/syscalls/open/open16.c > new file mode 100644 > index 000000000..6e01dde26 > --- /dev/null > +++ b/testcases/kernel/syscalls/open/open16.c > @@ -0,0 +1,124 @@ > +// SPDX-License-Identifier: GPL-2.0-or-later > +/* > + * Copyright (c) 2023 Wei Gao <wegao@suse.com> > + */ > + > +/*\ > + * Verify disallows open of FIFOs or regular files not owned by the user in world > + * writable sticky directories > + */ > + > +#include <pwd.h> > +#include <stdlib.h> > +#include "tst_test.h" > +#include "tst_safe_file_at.h" > + > +#define FILENAME "setuid04_testfile" Never used. > +#define DIR "ltp_tmp_check1" > +#define TEST_FILE "test_file_1" > +#define TEST_FIFO "test_fifo_1" > +#define LTP_USR_UID1 1000 > +#define LTP_USR_UID2 1001 If target is to have a UID that doesn't belong to the current user, we can just have: pw = SAFE_GETPWNAM("nobody"); and use the provided UID. > +#define PROTECTED_REGULAR "/proc/sys/fs/protected_regular" > +#define PROTECTED_FIFOS "/proc/sys/fs/protected_fifos" > +#define TEST_FIFO_PATH DIR "/" TEST_FIFO > + > +static int dir_fd; Not initialized to -1. > + > +static void run(void) > +{ > + SAFE_CHMOD(DIR, 0777 | S_ISVTX); > + SAFE_FILE_PRINTF(PROTECTED_REGULAR, "0"); > + SAFE_FILE_PRINTF(PROTECTED_FIFOS, "0"); > + > + if (!SAFE_FORK()) { > + SAFE_SETUID(LTP_USR_UID1); > + > + int fd = SAFE_OPENAT(dir_fd, TEST_FILE, O_CREAT | O_RDWR, 0777); > + > + SAFE_CLOSE(fd); > + > + SAFE_MKFIFO(TEST_FIFO_PATH, 0777); > + > + exit(0); > + } > + > + tst_reap_children(); > + > + if (!SAFE_FORK()) { > + SAFE_SETUID(LTP_USR_UID2); > + > + int fd = TST_EXP_FD(openat(dir_fd, TEST_FILE, O_CREAT | O_RDWR, 0777)); > + > + if (TST_PASS) > + SAFE_CLOSE(fd); > + > + fd = TST_EXP_FD(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777)); > + > + if (TST_PASS) > + SAFE_CLOSE(fd); > + > + exit(0); > + } > + > + tst_reap_children(); > + > + SAFE_FILE_PRINTF(PROTECTED_REGULAR, "1"); > + SAFE_FILE_PRINTF(PROTECTED_FIFOS, "1"); > + > + if (!SAFE_FORK()) { > + SAFE_SETUID(LTP_USR_UID2); > + TST_EXP_FAIL(openat(dir_fd, TEST_FILE, O_RDWR | O_CREAT, 0777), EACCES); > + TST_EXP_FAIL(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777), EACCES); > + > + exit(0); > + } > + > + tst_reap_children(); > + > + SAFE_FILE_PRINTF(PROTECTED_REGULAR, "2"); > + SAFE_FILE_PRINTF(PROTECTED_FIFOS, "2"); > + SAFE_CHMOD(DIR, 0020 | S_ISVTX); > + > + if (!SAFE_FORK()) { > + SAFE_SETUID(LTP_USR_UID2); > + TST_EXP_FAIL(openat(dir_fd, TEST_FILE, O_RDWR | O_CREAT, 0777), EACCES); > + TST_EXP_FAIL(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777), EACCES); > + > + exit(0); > + } > + > + tst_reap_children(); > + SAFE_UNLINK(TEST_FIFO_PATH); > +} > + > +static void setup(void) > +{ > + umask(0); > + SAFE_MKDIR(DIR, 0777 | S_ISVTX); > + dir_fd = SAFE_OPEN(DIR, O_DIRECTORY); > +} > + > +static void cleanup(void) > +{ > + if (dir_fd != -1) > + SAFE_CLOSE(dir_fd); > +} > + > +static struct tst_test test = { > + .setup = setup, > + .cleanup = cleanup, > + .needs_root = 1, > + .test_all = run, > + .needs_tmpdir = 1, > + .forks_child = 1, > + .save_restore = (const struct tst_path_val[]) { > + {PROTECTED_REGULAR, NULL, TST_SR_TCONF}, > + {PROTECTED_FIFOS, NULL, TST_SR_TCONF}, > + {} > + }, > + .tags = (const struct tst_tag[]) { > + {"linux-git", "30aba6656f61"}, > + {} > + } > +};
diff --git a/runtest/syscalls b/runtest/syscalls index 3531c2a3c..0de9bfaef 100644 --- a/runtest/syscalls +++ b/runtest/syscalls @@ -984,6 +984,7 @@ open12 open12 open13 open13 open14 open14 open15 open15 +open16 open16 openat01 openat01 openat02 openat02 diff --git a/testcases/kernel/syscalls/open/.gitignore b/testcases/kernel/syscalls/open/.gitignore index af5997572..d2cacc02e 100644 --- a/testcases/kernel/syscalls/open/.gitignore +++ b/testcases/kernel/syscalls/open/.gitignore @@ -13,3 +13,4 @@ /open13 /open14 /open15 +/open16 diff --git a/testcases/kernel/syscalls/open/open16.c b/testcases/kernel/syscalls/open/open16.c new file mode 100644 index 000000000..6e01dde26 --- /dev/null +++ b/testcases/kernel/syscalls/open/open16.c @@ -0,0 +1,124 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Copyright (c) 2023 Wei Gao <wegao@suse.com> + */ + +/*\ + * Verify disallows open of FIFOs or regular files not owned by the user in world + * writable sticky directories + */ + +#include <pwd.h> +#include <stdlib.h> +#include "tst_test.h" +#include "tst_safe_file_at.h" + +#define FILENAME "setuid04_testfile" +#define DIR "ltp_tmp_check1" +#define TEST_FILE "test_file_1" +#define TEST_FIFO "test_fifo_1" +#define LTP_USR_UID1 1000 +#define LTP_USR_UID2 1001 +#define PROTECTED_REGULAR "/proc/sys/fs/protected_regular" +#define PROTECTED_FIFOS "/proc/sys/fs/protected_fifos" +#define TEST_FIFO_PATH DIR "/" TEST_FIFO + +static int dir_fd; + +static void run(void) +{ + SAFE_CHMOD(DIR, 0777 | S_ISVTX); + SAFE_FILE_PRINTF(PROTECTED_REGULAR, "0"); + SAFE_FILE_PRINTF(PROTECTED_FIFOS, "0"); + + if (!SAFE_FORK()) { + SAFE_SETUID(LTP_USR_UID1); + + int fd = SAFE_OPENAT(dir_fd, TEST_FILE, O_CREAT | O_RDWR, 0777); + + SAFE_CLOSE(fd); + + SAFE_MKFIFO(TEST_FIFO_PATH, 0777); + + exit(0); + } + + tst_reap_children(); + + if (!SAFE_FORK()) { + SAFE_SETUID(LTP_USR_UID2); + + int fd = TST_EXP_FD(openat(dir_fd, TEST_FILE, O_CREAT | O_RDWR, 0777)); + + if (TST_PASS) + SAFE_CLOSE(fd); + + fd = TST_EXP_FD(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777)); + + if (TST_PASS) + SAFE_CLOSE(fd); + + exit(0); + } + + tst_reap_children(); + + SAFE_FILE_PRINTF(PROTECTED_REGULAR, "1"); + SAFE_FILE_PRINTF(PROTECTED_FIFOS, "1"); + + if (!SAFE_FORK()) { + SAFE_SETUID(LTP_USR_UID2); + TST_EXP_FAIL(openat(dir_fd, TEST_FILE, O_RDWR | O_CREAT, 0777), EACCES); + TST_EXP_FAIL(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777), EACCES); + + exit(0); + } + + tst_reap_children(); + + SAFE_FILE_PRINTF(PROTECTED_REGULAR, "2"); + SAFE_FILE_PRINTF(PROTECTED_FIFOS, "2"); + SAFE_CHMOD(DIR, 0020 | S_ISVTX); + + if (!SAFE_FORK()) { + SAFE_SETUID(LTP_USR_UID2); + TST_EXP_FAIL(openat(dir_fd, TEST_FILE, O_RDWR | O_CREAT, 0777), EACCES); + TST_EXP_FAIL(open(TEST_FIFO_PATH, O_RDWR | O_CREAT, 0777), EACCES); + + exit(0); + } + + tst_reap_children(); + SAFE_UNLINK(TEST_FIFO_PATH); +} + +static void setup(void) +{ + umask(0); + SAFE_MKDIR(DIR, 0777 | S_ISVTX); + dir_fd = SAFE_OPEN(DIR, O_DIRECTORY); +} + +static void cleanup(void) +{ + if (dir_fd != -1) + SAFE_CLOSE(dir_fd); +} + +static struct tst_test test = { + .setup = setup, + .cleanup = cleanup, + .needs_root = 1, + .test_all = run, + .needs_tmpdir = 1, + .forks_child = 1, + .save_restore = (const struct tst_path_val[]) { + {PROTECTED_REGULAR, NULL, TST_SR_TCONF}, + {PROTECTED_FIFOS, NULL, TST_SR_TCONF}, + {} + }, + .tags = (const struct tst_tag[]) { + {"linux-git", "30aba6656f61"}, + {} + } +};
This commit adds test cases to verify the security restrictions for opening FIFOs and regular files in world-writable sticky directories. Signed-off-by: Wei Gao <wegao@suse.com> --- runtest/syscalls | 1 + testcases/kernel/syscalls/open/.gitignore | 1 + testcases/kernel/syscalls/open/open16.c | 124 ++++++++++++++++++++++ 3 files changed, 126 insertions(+) create mode 100644 testcases/kernel/syscalls/open/open16.c