[Devel] [PATCH 1/1] smack: introduce some simple tests for smack task label c/r
Serge E. Hallyn
serue at us.ibm.com
Thu Aug 27 14:45:04 PDT 2009
(these tests aren't run by default, so I went ahead and applied
them even though the smack c/r patchset isn't applied on the kernel
yet.)
Signed-off-by: Serge Hallyn <serue at us.ibm.com>
---
smack/.runtest.sh.swp | Bin 0 -> 12288 bytes
smack/Makefile | 8 +++++
smack/README | 7 +++++
smack/ckpt.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++
smack/runtest.sh | 71 +++++++++++++++++++++++++++++++++++++++++++++++++
smack/smackpolicy | 6 ++++
6 files changed, 159 insertions(+), 0 deletions(-)
create mode 100644 smack/.runtest.sh.swp
create mode 100644 smack/Makefile
create mode 100644 smack/README
create mode 100644 smack/ckpt.c
create mode 100644 smack/runtest.sh
create mode 100644 smack/smackpolicy
diff --git a/smack/.runtest.sh.swp b/smack/.runtest.sh.swp
new file mode 100644
index 0000000000000000000000000000000000000000..6f0cdce4c6c976e8fe5041a820ebb4e025038727
GIT binary patch
literal 12288
zcmeI2OK2oT7{@D$U}lpjdep<0Nz`4n=OyAAH);}BjoG-8ta?}_sr1yOoAh+`R at G!S
z*<BUAco96Q2T^<-e6X-6;z`h(2ake}i&s5(5(Po<U)|H4nXJ1TVLdEV!;kLjuKFJT
z`l?`tTB|)Zzex8~Y7E!)jJ@~wYmc3MX^5>%Fs7t5_VuN%D2zMX^?Ietjh1mGTx(Z+
z**<^NbJk$hS1U$nqpP~j{f(;X#I{+{!TAH+8>fI%;PNQYF)i=lXlkogZ`?)W<%t_^
zeDd<xc2=AMP64NYQ@|<U6mSYS1)Ks-fh$6R#IPaud=ctZy{AWd_aWRZ?s5t^1)Ks-
z0jGddz$xGqa0)mDoB~b(r+`!73Ra-WZSdFr##rgr^Z-DX3x5A!_dECjd=0(=pMtl+
z%b*F4gQvkPxC30x*w|m-5AZYi27CbC1aE*B!3zNYHjHh6XTVYLICu!m0oWP4ow3oM
zz!%_S at DUIIenuPMX2wQ-1)qUWz=z;{03Rc-1N0qP0*63}v3=ixFTv*kIqW+N-UaV~
zS3nm$2o8d~p~Ei#wo7jT<X1wBr6XVgcmO(;ZUNT-s5Sg2_z`>y&Vg3}`VQX&UB3s=
z!Cg)Pr+`zyDc}@v3j99`h?AkA8WVmXsXQ~-iXuu+8&Z1mkP@!7XqFjkg={$OS;svc
z`0&j9ktym5dkq-OOcXEkkNF*g`yLU%e|HJ5s<5ABks5(rYkKF_m*$|Cfd~c~yTd6y
zrVm9cm2S|c73<%k!r9HetC^-oJc?vjG|5O(IPxi#AYbD2=Sf4|&;+t$$mhulj)ku9
zW;=|_ENsznntXsfae`{}?0sYc5wl73(gAs1Q^{m{U<h84=hNh=#f4)_hYz12Z-WjI
zEcfc-82pCuI&}j9Q;HH5ZibOq7Zhp)b)plhEI=&`8Ll^q2xXiG&6O$dlua!!n=GPO
z8VX}=kf><hNw$gOt+90oZxnG2qllm{u~_samRgx!?FOMASSfU{%6fr6F|)i}W+vd>
z9q&ca?(cF<lRYgDl=GmnT5g8TERtQ4Z|XYrCzWdLZBscnR3;BAX{R+lO=S!!7xU0_
zIKAp~%v?5;tL&oMQ)3E=#i)nfC7=g_*-O at g>9u(n8;}P=o4PSza*z2n_MTr~VOeMQ
zQ#Dc2uWAvss at xb=^*c(5xWD$OK1En<SrPUm)5Nh7^7v7HYg^P5E#8StmVil%j#aAu
zMq=QmC}%r`m-0HN1W!wzlOG6JkkE<3Hb>2ObXuDIWo}Kjq{1gGiP$dLY?WiPRBiHF
zgea7kp4hhQ)rP{-tu>MyKMFU63R_z%2{(bx8!hZ=+d?rdJIWVSfd$!a<Dj at b@_i;R
z)<j03zeU!J-I|B()?Dn(z0G-c>F5ILM|PrSe49!8QZ^0)ioIfBNe$cDOatsWI8BrK
zV%C#LV8hFoaW>Qjbzu)WU$KP_t9x+JmN at vHnQ!R}8_&9(rgbHftT!v%>_0%K7 at MG(
x4mM9UMax2AQXj>fZN+#!CzCA|t_Ox1wc5QjKf8!mDyguE@#<O_SJyZu;2-#vq-p>F
literal 0
HcmV?d00001
diff --git a/smack/Makefile b/smack/Makefile
new file mode 100644
index 0000000..5377520
--- /dev/null
+++ b/smack/Makefile
@@ -0,0 +1,8 @@
+targets = ckpt
+
+all: $(targets)
+
+ckpt: ckpt.c ../cr.h
+
+clean:
+ rm -f $(targets) out context cr-test.out
diff --git a/smack/README b/smack/README
new file mode 100644
index 0000000..05d3a93
--- /dev/null
+++ b/smack/README
@@ -0,0 +1,7 @@
+This test is only for smack-enabled kernels. It does a few
+sanity checks to test whether task contexts are properly
+restored, are restored only if requested, and ar restored only
+if permitted.
+
+Restoration of smack labels on other objects (esp. ipc objects)
+remains a TODO.
diff --git a/smack/ckpt.c b/smack/ckpt.c
new file mode 100644
index 0000000..ff47982
--- /dev/null
+++ b/smack/ckpt.c
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2008 Oren Laadan
+ */
+
+#define _GNU_SOURCE /* or _BSD_SOURCE or _SVID_SOURCE */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <asm/unistd.h>
+#include <sys/syscall.h>
+#include "../cr.h"
+
+#define OUTFILE "./cr-test.out"
+
+int main(int argc, char *argv[])
+{
+ pid_t pid = getpid();
+ FILE *file;
+ int ret;
+ int n;
+ char ctx[200];
+
+ close(0);
+ close(2);
+
+ unlink(OUTFILE);
+ file = fopen(OUTFILE, "w+");
+ if (!file) {
+ perror("open");
+ exit(1);
+ }
+
+ if (dup2(0,2) < 0) {
+ perror("dups");
+ exit(1);
+ }
+
+ fprintf(file, "hello, world!\n");
+ fflush(file);
+
+ ret = syscall(__NR_checkpoint, pid, STDOUT_FILENO, CHECKPOINT_SUBTREE);
+ if (ret < 0) {
+ perror("checkpoint");
+ exit(2);
+ }
+
+ fprintf(file, "world, hello!\n");
+ fprintf(file, "ret = %d\n", ret);
+ fflush(file);
+ file = fopen("/proc/self/attr/current", "r");
+ if (!file)
+ return 1;
+ n = fread(ctx, 1, 200, file);
+ fclose(file);
+ file = fopen("./context", "w");
+ if (!file)
+ return 1;
+ fwrite(ctx, 1, n, file);
+ fclose(file);
+
+ return 0;
+}
+
diff --git a/smack/runtest.sh b/smack/runtest.sh
new file mode 100644
index 0000000..c36ca9b
--- /dev/null
+++ b/smack/runtest.sh
@@ -0,0 +1,71 @@
+#!/bin/bash
+# Copyright 2009 IBM Corp.
+# Author: Serge Hallyn
+
+smackload() {
+ mount | grep smack
+ if [ $? -ne 0 ]; then
+ echo "BROK: please mount smackfs"
+ exit 1
+ fi
+ s=`which smackload`
+ if [ $? -ne 0 ]; then
+ echo "BROK: please install smackload"
+ exit 1
+ fi
+ cat smackpolicy | $s
+ if [ $? -ne 0 ]; then
+ echo "BROK: couldn't load policy"
+ exit 1
+ fi
+ echo "policy loaded"
+}
+
+source ../common.sh
+verify_freezer
+verify_paths
+
+smackload
+
+rm -f ./cr-test.out out
+
+echo "Creating a checkpoint image using task context vs1 for use in all tests"
+echo vs1 > /proc/self/attr/current
+./ckpt > out
+
+echo "Test 1: existing contexts are maintained by default on retart"
+echo vs2 > /proc/self/attr/current
+${MKTREE} < out
+context=`cat context`
+if [ -z "$context" -o "$context" != "vs2" ]; then
+ echo "FAIL: did not maintain context vs2 on restart"
+ exit 1
+fi
+thaw
+echo "PASS"
+
+echo "Test 2: can we restore contexts on restart"
+${MKTREE} -k < out
+context=`cat context`
+if [ -z "$context" -o "$context" != "vs1" ]; then
+ echo "FAIL: did not restore context vs1 on restart"
+ echo "(was $context)"
+ exit 1
+fi
+thaw
+echo "PASS"
+
+capsh=`which capsh`
+if [ $? -ne 0 ]; then
+ echo "capsh not installed, not running the last test"
+ exit 0
+fi
+echo "Testing whether privilege is required to set task context on restart"
+$capsh --drop=cap_mac_admin -- -c ${MKTREE} -k < out
+if [ $? -eq 0 ]; then
+ echo "FAIL: we were allowed to restore context without cap_mac_admin"
+ exit 1
+fi
+
+echo "All smack tests passed"
+exit 0
diff --git a/smack/smackpolicy b/smack/smackpolicy
new file mode 100644
index 0000000..ed0d471
--- /dev/null
+++ b/smack/smackpolicy
@@ -0,0 +1,6 @@
+vs1 _ rwax
+_ vs1 rwax
+vs2 vs1 rwax
+vs1 vs2 rwax
+vs2 _ rwax
+_ vs2 rwax
--
1.6.1.1
_______________________________________________
Containers mailing list
Containers at lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containers
More information about the Devel
mailing list