From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Serge E. Hallyn" Subject: [PATCH 1/1] smack: introduce some simple tests for smack task label c/r Date: Thu, 27 Aug 2009 16:45:04 -0500 Message-ID: <20090827214503.GA28551@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Linux Containers List-Id: containers.vger.kernel.org (these tests aren't run by default, so I went ahead and applied them even though the smack c/r patchset isn't applied on the kernel yet.) Signed-off-by: Serge Hallyn --- smack/.runtest.sh.swp | Bin 0 -> 12288 bytes smack/Makefile | 8 +++++ smack/README | 7 +++++ smack/ckpt.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++ smack/runtest.sh | 71 +++++++++++++++++++++++++++++++++++++++++++++++++ smack/smackpolicy | 6 ++++ 6 files changed, 159 insertions(+), 0 deletions(-) create mode 100644 smack/.runtest.sh.swp create mode 100644 smack/Makefile create mode 100644 smack/README create mode 100644 smack/ckpt.c create mode 100644 smack/runtest.sh create mode 100644 smack/smackpolicy diff --git a/smack/.runtest.sh.swp b/smack/.runtest.sh.swp new file mode 100644 index 0000000000000000000000000000000000000000..6f0cdce4c6c976e8fe5041a820ebb4e025038727 GIT binary patch literal 12288 zcmeI2OK2oT7{@D$U}lpjdep<0Nz`4n=OyAAH);}BjoG-8ta?}_sr1yOoAh+`R@G!S z*%Fs7t5_VuN%D2zMX^?Ietjh1mGTx(Z+ z**<^NbJk$hS1U$nqpP~j{f(;X#I{+{!TAH+8>fI%;PNQYF)i=lXlkogZ`?)W<%t_^ zeDdy&Vg3}`VQX&UB3s= z!Cg)Pr+`zyDc}@v3j99`h?AkA8WVmXsXQ~-iXuu+8&Z1mkP@!7XqFjkg={$OS;svc z`0&j9ktym5dkq-OOcXEkkNF*g`yLU%e|HJ5s<5ABks5(rYkKF_m*$|Cfd~c~yTd6y zrVm9cm2S|c73<%k!r9HetC^-oJc?vjG|5O(IPxi#AYbD2=Sf4|&;+t$$mhulj)ku9 zW;=|_ENsznntXsfae`{}?0sYc5wl73(gAs1Q^{m{U z9q&ca?(cF9u(n8;}P=o4PSza*z2n_MTr~VOeMQ zQ#Dc2uWAvss@xb=^*c(5xWD$OK1En2ObXuDIWo}Kjq{1gGiP$dLY?WiPRBiHF zgea7kp4hhQ)rP{-tu>MyKMFU63R_z%2{(bx8!hZ=+d?rdJIWVSfd$!aF5ILM|PrSe49!8QZ^0)ioIfBNe$cDOatsWI8BrK zV%C#LV8hFoaW>Qjbzu)WU$KP_t9x+JmN@vHnQ!R}8_&9(rgbHftT!v%>_0%K7@MG( x4mM9UMax2AQXj>fZN+#!CzCA|t_Ox1wc5QjKf8!mDyguE@#F literal 0 HcmV?d00001 diff --git a/smack/Makefile b/smack/Makefile new file mode 100644 index 0000000..5377520 --- /dev/null +++ b/smack/Makefile @@ -0,0 +1,8 @@ +targets = ckpt + +all: $(targets) + +ckpt: ckpt.c ../cr.h + +clean: + rm -f $(targets) out context cr-test.out diff --git a/smack/README b/smack/README new file mode 100644 index 0000000..05d3a93 --- /dev/null +++ b/smack/README @@ -0,0 +1,7 @@ +This test is only for smack-enabled kernels. It does a few +sanity checks to test whether task contexts are properly +restored, are restored only if requested, and ar restored only +if permitted. + +Restoration of smack labels on other objects (esp. ipc objects) +remains a TODO. diff --git a/smack/ckpt.c b/smack/ckpt.c new file mode 100644 index 0000000..ff47982 --- /dev/null +++ b/smack/ckpt.c @@ -0,0 +1,67 @@ +/* + * Copyright (C) 2008 Oren Laadan + */ + +#define _GNU_SOURCE /* or _BSD_SOURCE or _SVID_SOURCE */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include "../cr.h" + +#define OUTFILE "./cr-test.out" + +int main(int argc, char *argv[]) +{ + pid_t pid = getpid(); + FILE *file; + int ret; + int n; + char ctx[200]; + + close(0); + close(2); + + unlink(OUTFILE); + file = fopen(OUTFILE, "w+"); + if (!file) { + perror("open"); + exit(1); + } + + if (dup2(0,2) < 0) { + perror("dups"); + exit(1); + } + + fprintf(file, "hello, world!\n"); + fflush(file); + + ret = syscall(__NR_checkpoint, pid, STDOUT_FILENO, CHECKPOINT_SUBTREE); + if (ret < 0) { + perror("checkpoint"); + exit(2); + } + + fprintf(file, "world, hello!\n"); + fprintf(file, "ret = %d\n", ret); + fflush(file); + file = fopen("/proc/self/attr/current", "r"); + if (!file) + return 1; + n = fread(ctx, 1, 200, file); + fclose(file); + file = fopen("./context", "w"); + if (!file) + return 1; + fwrite(ctx, 1, n, file); + fclose(file); + + return 0; +} + diff --git a/smack/runtest.sh b/smack/runtest.sh new file mode 100644 index 0000000..c36ca9b --- /dev/null +++ b/smack/runtest.sh @@ -0,0 +1,71 @@ +#!/bin/bash +# Copyright 2009 IBM Corp. +# Author: Serge Hallyn + +smackload() { + mount | grep smack + if [ $? -ne 0 ]; then + echo "BROK: please mount smackfs" + exit 1 + fi + s=`which smackload` + if [ $? -ne 0 ]; then + echo "BROK: please install smackload" + exit 1 + fi + cat smackpolicy | $s + if [ $? -ne 0 ]; then + echo "BROK: couldn't load policy" + exit 1 + fi + echo "policy loaded" +} + +source ../common.sh +verify_freezer +verify_paths + +smackload + +rm -f ./cr-test.out out + +echo "Creating a checkpoint image using task context vs1 for use in all tests" +echo vs1 > /proc/self/attr/current +./ckpt > out + +echo "Test 1: existing contexts are maintained by default on retart" +echo vs2 > /proc/self/attr/current +${MKTREE} < out +context=`cat context` +if [ -z "$context" -o "$context" != "vs2" ]; then + echo "FAIL: did not maintain context vs2 on restart" + exit 1 +fi +thaw +echo "PASS" + +echo "Test 2: can we restore contexts on restart" +${MKTREE} -k < out +context=`cat context` +if [ -z "$context" -o "$context" != "vs1" ]; then + echo "FAIL: did not restore context vs1 on restart" + echo "(was $context)" + exit 1 +fi +thaw +echo "PASS" + +capsh=`which capsh` +if [ $? -ne 0 ]; then + echo "capsh not installed, not running the last test" + exit 0 +fi +echo "Testing whether privilege is required to set task context on restart" +$capsh --drop=cap_mac_admin -- -c ${MKTREE} -k < out +if [ $? -eq 0 ]; then + echo "FAIL: we were allowed to restore context without cap_mac_admin" + exit 1 +fi + +echo "All smack tests passed" +exit 0 diff --git a/smack/smackpolicy b/smack/smackpolicy new file mode 100644 index 0000000..ed0d471 --- /dev/null +++ b/smack/smackpolicy @@ -0,0 +1,6 @@ +vs1 _ rwax +_ vs1 rwax +vs2 vs1 rwax +vs1 vs2 rwax +vs2 _ rwax +_ vs2 rwax -- 1.6.1.1