mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
AnilAltinayandgVisor bot
e32283b0cd
The Landlock implementation in gVisor will initially focus on ABI v1 support. Splitting the test coverage into separate files for each ABI version (v1 through v6) makes it easier to manage and avoids confusing LLMs with unsupported higher ABI versions. This refactoring extracts common UAPI definitions and helper functions into landlock_util.h and moves version-specific tests into their own respective .cc files. PiperOrigin-RevId: 959339619
78 lines
2.6 KiB
C++
78 lines
2.6 KiB
C++
// Copyright 2026 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
// Landlock syscall tests (ABI v3).
|
|
|
|
#include <unistd.h>
|
|
|
|
#include <string>
|
|
|
|
#include "gtest/gtest.h"
|
|
#include "test/syscalls/linux/landlock_util.h"
|
|
#include "test/util/multiprocess_util.h"
|
|
#include "test/util/posix_error.h"
|
|
#include "test/util/temp_path.h"
|
|
#include "test/util/test_util.h"
|
|
|
|
namespace gvisor {
|
|
namespace testing {
|
|
|
|
namespace {
|
|
|
|
TEST(LandlockV3Test, TruncateOutsideAllowedTreeDenied) {
|
|
SKIP_IF(IsRunningOnGvisor());
|
|
SKIP_IF(LandlockAbiVersion() < 3);
|
|
|
|
const TempPath root = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateDir());
|
|
const TempPath allowed_dir =
|
|
ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateDirIn(root.path()));
|
|
const TempPath outside = ASSERT_NO_ERRNO_AND_VALUE(
|
|
TempPath::CreateFileWith(root.path(), "content", 0600));
|
|
const std::string allowed = allowed_dir.path();
|
|
static std::string target;
|
|
target = outside.path();
|
|
|
|
int status = ASSERT_NO_ERRNO_AND_VALUE(InForkedProcess([&] {
|
|
ApplyFsPolicy(LANDLOCK_ACCESS_FS_TRUNCATE, allowed,
|
|
LANDLOCK_ACCESS_FS_TRUNCATE);
|
|
_exit(ClassifyFs(truncate(target.c_str(), 0)));
|
|
}));
|
|
EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == kDenied)
|
|
<< "exit status " << status;
|
|
}
|
|
|
|
TEST(LandlockV3Test, TruncateInsideAllowedTreeAllowed) {
|
|
SKIP_IF(IsRunningOnGvisor());
|
|
SKIP_IF(LandlockAbiVersion() < 3);
|
|
|
|
const TempPath allowed_dir = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateDir());
|
|
const TempPath inside = ASSERT_NO_ERRNO_AND_VALUE(
|
|
TempPath::CreateFileWith(allowed_dir.path(), "content", 0600));
|
|
const std::string allowed = allowed_dir.path();
|
|
static std::string target;
|
|
target = inside.path();
|
|
|
|
int status = ASSERT_NO_ERRNO_AND_VALUE(InForkedProcess([&] {
|
|
ApplyFsPolicy(LANDLOCK_ACCESS_FS_TRUNCATE, allowed,
|
|
LANDLOCK_ACCESS_FS_TRUNCATE);
|
|
_exit(ClassifyFs(truncate(target.c_str(), 0)));
|
|
}));
|
|
EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == kAllowed)
|
|
<< "exit status " << status;
|
|
}
|
|
|
|
} // namespace
|
|
} // namespace testing
|
|
} // namespace gvisor
|