From dec1aed1435fc0ed8a844d2fd0c0890f1e9315fd Mon Sep 17 00:00:00 2001 From: Shambhavi Srivastava Date: Wed, 16 Nov 2022 17:03:32 -0800 Subject: [PATCH] Adding more trace point integration tests for the following syscalls: - Chdir - Fchdir - Setgid - Setuid - Setsid - Setresuid - Setresgid Updates #4805 PiperOrigin-RevId: 489076929 --- pkg/sentry/seccheck/points/syscall.proto | 6 +- pkg/sentry/syscalls/linux/points.go | 6 +- test/trace/trace_test.go | 58 +++++++++++++++++ test/trace/workload/workload.cc | 81 +++++++++++++++++++++++- 4 files changed, 143 insertions(+), 8 deletions(-) diff --git a/pkg/sentry/seccheck/points/syscall.proto b/pkg/sentry/seccheck/points/syscall.proto index 70de1d0ec..011d62a58 100644 --- a/pkg/sentry/seccheck/points/syscall.proto +++ b/pkg/sentry/seccheck/points/syscall.proto @@ -121,9 +121,9 @@ message Setresid { gvisor.common.ContextData context_data = 1; Exit exit = 2; uint64 sysno = 3; - uint32 rgid = 4; - uint32 egid = 5; - uint32 sgid = 6; + uint32 rid = 4; + uint32 eid = 5; + uint32 sid = 6; } message Setid { diff --git a/pkg/sentry/syscalls/linux/points.go b/pkg/sentry/syscalls/linux/points.go index f6f29bd92..fc325f86b 100644 --- a/pkg/sentry/syscalls/linux/points.go +++ b/pkg/sentry/syscalls/linux/points.go @@ -512,9 +512,9 @@ func pointSetresidHelper(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.C p := &pb.Setresid{ ContextData: cxtData, Sysno: uint64(info.Sysno), - Rgid: info.Args[0].Uint(), - Egid: info.Args[1].Uint(), - Sgid: info.Args[2].Uint(), + Rid: info.Args[0].Uint(), + Eid: info.Args[1].Uint(), + Sid: info.Args[2].Uint(), } p.Exit = newExitMaybe(info) diff --git a/test/trace/trace_test.go b/test/trace/trace_test.go index fdf10fadd..601960b82 100644 --- a/test/trace/trace_test.go +++ b/test/trace/trace_test.go @@ -109,6 +109,9 @@ func matchPoints(t *testing.T, msgs []test.Message) { pb.MessageType_MESSAGE_SYSCALL_READ: {checker: checkSyscallRead}, pb.MessageType_MESSAGE_SYSCALL_SOCKET: {checker: checkSyscallSocket}, pb.MessageType_MESSAGE_SYSCALL_WRITE: {checker: checkSyscallWrite}, + pb.MessageType_MESSAGE_SYSCALL_CHDIR: {checker: checkSyscallChdir}, + pb.MessageType_MESSAGE_SYSCALL_SETID: {checker: checkSyscallSetid}, + pb.MessageType_MESSAGE_SYSCALL_SETRESID: {checker: checkSyscallSetresid}, // TODO(gvisor.dev/issue/4805): Add validation for these messages. pb.MessageType_MESSAGE_SYSCALL_ACCEPT: {checker: checkTODO}, @@ -479,6 +482,61 @@ func checkSyscallSocket(msg test.Message) error { if want := int32(0); want != p.Protocol { return fmt.Errorf("wrong Protocol, want: %v, got: %v", want, p.Protocol) } + + return nil +} + +func checkSyscallSetid(msg test.Message) error { + p := pb.Setid{} + if err := proto.Unmarshal(msg.Msg, &p); err != nil { + return err + } + if err := checkContextData(p.ContextData); err != nil { + return err + } + if p.Id != 0 { + return fmt.Errorf(" invalid id: %d", p.Id) + } + + return nil +} + +func checkSyscallSetresid(msg test.Message) error { + p := pb.Setresid{} + if err := proto.Unmarshal(msg.Msg, &p); err != nil { + return err + } + if err := checkContextData(p.ContextData); err != nil { + return err + } + if p.GetRid() != 0 { + return fmt.Errorf(" Invalid RID: %d", p.Rid) + } + if p.GetEid() != 0 { + return fmt.Errorf(" Invalid EID: %d", p.Eid) + } + if p.GetSid() != 0 { + return fmt.Errorf(" Invalid SID: %d", p.Sid) + } + + return nil +} + +func checkSyscallChdir(msg test.Message) error { + p := pb.Chdir{} + if err := proto.Unmarshal(msg.Msg, &p); err != nil { + return err + } + if err := checkContextData(p.ContextData); err != nil { + return err + } + if p.Fd < 3 && p.Fd != unix.AT_FDCWD { // Constant used for all file-related syscalls. + return fmt.Errorf("invalid FD: %d", p.Fd) + } + if want := "trace_test.abc"; !strings.Contains(p.Pathname, want) { + return fmt.Errorf("wrong Pathname, got: %q, want: %q", p.Pathname, want) + } + return nil } diff --git a/test/trace/workload/workload.cc b/test/trace/workload/workload.cc index b738cf52f..d8f51f564 100644 --- a/test/trace/workload/workload.cc +++ b/test/trace/workload/workload.cc @@ -13,9 +13,15 @@ // limitations under the License. #include +#include #include +#include #include #include +#include + +#include +#include #include "absl/cleanup/cleanup.h" #include "absl/strings/str_cat.h" @@ -39,7 +45,6 @@ void runForkExecve() { auto kill_or_error = ForkAndExecveat(root.get(), "/bin/true", argv, envv, 0, nullptr, &child, &execve_errno); ASSERT_EQ(0, execve_errno); - // Don't kill child, just wait for gracefully exit. kill_or_error.ValueOrDie().Release(); RetryEINTR(waitpid)(child, nullptr, 0); @@ -190,6 +195,72 @@ void runReadWrite() { } } +void runChdir() { + const auto pathname = "trace_test.abc"; + static constexpr mode_t kDefaultDirMode = 0755; + int path_or_error = mkdir(pathname, kDefaultDirMode); + if (path_or_error != 0) { + err(1, "mkdir"); + } + int res = chdir(pathname); + if (res != 0) { + err(1, "chdir"); + } + rmdir(pathname); +} + +void runFchdir() { + const auto pathname = "trace_test.abc"; + static constexpr mode_t kDefaultDirMode = 0755; + int path_or_error = mkdir(pathname, kDefaultDirMode); + if (path_or_error != 0) { + err(1, "mkdir"); + } + int fd = open(pathname, O_DIRECTORY | O_RDONLY); + int res = fchdir(fd); + if (res != 0) { + err(1, "fchdir"); + } + rmdir(pathname); + close(fd); +} + +void runSetgid() { + auto get = setgid(0); + if (get != 0) { + err(1, "setgid"); + } +} + +void runSetuid() { + auto get = setuid(0); + if (get != 0) { + err(1, "setuid"); + } +} + +void runSetsid() { + auto get = setsid(); + // Operation is not permitted so we get an error. + if (get != -1) { + err(1, "setsid"); + } +} + +void runSetresuid() { + auto get = setresuid(0, 0, 0); + if (get != 0) { + err(1, "setresuid"); + } +} + +void runSetresgid() { + auto get = setresgid(0, 0, 0); + if (get != 0) { + err(1, "setresgid"); + } +} + } // namespace testing } // namespace gvisor @@ -197,6 +268,12 @@ int main(int argc, char** argv) { ::gvisor::testing::runForkExecve(); ::gvisor::testing::runSocket(); ::gvisor::testing::runReadWrite(); - + ::gvisor::testing::runChdir(); + ::gvisor::testing::runFchdir(); + ::gvisor::testing::runSetgid(); + ::gvisor::testing::runSetuid(); + ::gvisor::testing::runSetsid(); + ::gvisor::testing::runSetresuid(); + ::gvisor::testing::runSetresgid(); return 0; }