# Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
#
# Based on tests from http://bazaar.launchpad.net/~ubuntu-bugcontrol/qa-regression-testing/master/view/head:/scripts/test-kernel-security.py
# Copyright (C) 2008-2011 Canonical Ltd.
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 3,
# as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
import pwd
import tempfile
import shutil
import logging, os
from autotest_lib.client.bin import test, utils
from autotest_lib.client.common_lib import error
class security_HardlinkRestrictions(test.test):
version = 1
def _passed(self, msg):
logging.info('ok: %s' % (msg))
def _failed(self, msg):
logging.error('FAIL: %s' % (msg))
self._failures.append(msg)
def _fatal(self, msg):
logging.error('FATAL: %s' % (msg))
raise error.TestError(msg)
def check(self, boolean, msg, fatal=False):
if boolean == True:
self._passed(msg)
else:
msg = "could not satisfy '%s'" % (msg)
if fatal:
self._fatal(msg)
else:
self._failed(msg)
def _is_readable(self, path, user, expected=True):
rc = utils.system("su -c 'cat %s' %s" % (path, user),
ignore_status=True)
status = (rc == 0)
if status != expected:
if expected:
self._failed("'%s' was unable to read file '%s'" %
(user, path))
else:
self._failed("'%s' was able to read file '%s'" %
(user, path))
return status
def _is_writable(self, path, user, expected=True):
rc = utils.system("su -c 'echo > %s' %s" % (path, user),
ignore_status=True)
status = (rc == 0)
if status != expected:
if expected:
self._failed("'%s' was unable to write file '%s'" %
(user, path))
else:
self._failed("'%s' was able to write file '%s'" %
(user, path))
return status
def _can_hardlink(self, source, target, user, expected=True):
rc = utils.system("su -c 'ln %s %s' %s" % (source, target, user),
ignore_status=True)
status = (rc == 0)
if status != expected:
if expected:
self._failed("'%s' was unable to hardlink file '%s' as '%s'" %
(user, source, target))
else:
self._failed("'%s' was able to hardlink file '%s' as '%s'" %
(user, source, target))
# Check and clean up hardlink if it was created.
if os.path.exists(target):
if not expected:
self._failed("'%s' was able to create hardlink '%s' to '%s'" %
(user, target, source))
os.unlink(target)
return status
def _check_hardlinks(self, user):
uid = pwd.getpwnam(user)[2]
# Verify we have a distinct user.
if uid == 0:
self._failed("The '%s' user is root(%d)!" % (user, uid))
return
# Build a world-writable directory, owned by user.
tmpdir = tempfile.mkdtemp(prefix='hardlinks-')
self._rmdir.append(tmpdir)
os.chown(tmpdir, uid, 0)
# Create test target files.
secret = tempfile.NamedTemporaryFile(prefix="secret-")
readable = tempfile.NamedTemporaryFile(prefix="readable-")
os.chmod(readable.name, 0444)
available = tempfile.NamedTemporaryFile(prefix="available-")
os.chmod(available.name, 0666)
# Verify secret target is unreadable/unwritable.
self._is_readable(secret.name, user, expected=False)
self._is_writable(secret.name, user, expected=False)
# Verify readable target is only readable.
self._is_readable(readable.name, user)
self._is_writable(readable.name, user, expected=False)
# Verify available target is both readable/writable.
self._is_readable(available.name, user)
self._is_writable(available.name, user)
# Create pathnames for hardlinks.
mine = os.path.join(tmpdir, 'mine')
evil = os.path.join(tmpdir, 'evil')
not_evil = os.path.join(tmpdir, 'not-evil')
# Allow hardlink to files owned by the user, or writable.
self._is_writable(mine, user)
self._can_hardlink(mine, not_evil, user)
self._can_hardlink(available.name, not_evil, user)
# Disallow hardlinking to unwritable or unreadlabe files.
self._can_hardlink(readable.name, evil, user, expected=False)
self._can_hardlink(secret.name, evil, user, expected=False)
# Disallow hardlinks to unowned non-regular files. This uses
# /dev because the other locations are mounted nodev, which
# will cause the read/write tests to fail.
devdir = tempfile.mkdtemp(prefix="hardlinks-", dir="/dev")
self._rmdir.append(devdir)
os.chown(devdir, uid, 0)
null = os.path.join(devdir, "null")
dev_evil = os.path.join(devdir, "evil")
dev_not_evil = os.path.join(devdir, "not-evil")
utils.system("mknod -m 0666 %s c 1 3" % (null))
self._is_readable(null, user)
self._is_writable(null, user)
self._can_hardlink(null, dev_evil, user, expected=False)
# Allow hardlinks to owned non-regular files.
os.chown(null, uid, 0)
self._can_hardlink(null, dev_not_evil, user)
# Allow CAP_FOWNER to hardlink non-regular files.
self._can_hardlink(null, dev_not_evil, "root")
def run_once(self):
# Empty failure list means test passes.
self._failures = []
# Prepare list of directories to clean up.
self._rmdir = []
# Verify hardlink restrictions sysctl exists and is enabled.
sysctl = "/proc/sys/fs/protected_hardlinks"
if (not os.path.exists(sysctl)):
# Fall back to looking for Yama link restriction sysctl.
sysctl = "/proc/sys/kernel/yama/protected_nonaccess_hardlinks"
self.check(os.path.exists(sysctl), "%s exists" % (sysctl), fatal=True)
self.check(open(sysctl).read() == '1\n', "%s enabled" % (sysctl),
fatal=True)
# Test the basic "user hardlinks to unwritable source" situation
# first, in a more auditable way than the extensive behavior tests
# that follow.
if os.path.exists("/tmp/evil-hardlink"):
os.unlink("/tmp/evil-hardlink")
rc = utils.system("su -c 'ln /etc/shadow /tmp/evil-hardlink' chronos",
ignore_status=True)
if rc != 1 or os.path.exists("/tmp/evil-hardlink"):
self._failed("chronos user was able to create malicious hardlink")
# Test hardlink restrictions.
self._check_hardlinks(user='chronos')
# Clean up from the tests.
for path in self._rmdir:
if os.path.exists(path):
shutil.rmtree(path, ignore_errors=True)
# Raise a failure if anything unexpected was seen.
if len(self._failures):
raise error.TestFail((", ".join(self._failures)))