1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
|
//go:build testsuite
// The sandbox test program runs cmd/hakurei with configurations simulating
// several common workloads and inspects the resulting container states.
package main
import (
"context"
"log"
"os"
"path/filepath"
"slices"
"strconv"
"sync"
"sync/atomic"
"syscall"
"hakurei.app/fhs"
"hakurei.app/hst"
"hakurei.app/test/internal/testsuite"
)
// mustStart starts a hakurei container and returns the pid of a process within
// the container. This process must be terminated by the caller.
func mustStart(
ctx context.Context,
serial uint64,
username string,
files ...*os.File,
) (pid int, done <-chan error) {
_serial := strconv.FormatUint(serial, 10)
_, done = testsuite.MustStartAs(
ctx, username, files,
"hakurei", "exec",
"sleep", "infinity", _serial,
)
var (
s testsuite.StatScanner
stat syscall.Stat_t
)
for s.Scan() {
select {
case err := <-done:
if err == nil {
log.Fatal("test process terminated unexpectedly")
}
log.Fatal(err)
default:
break
}
if s.Stat().Comm != "sleep" {
continue
}
if args, err := s.Stat().Args(); err != nil {
log.Fatal(err)
} else if !slices.Equal(args, []string{
"sleep",
"infinity",
_serial,
}) {
continue
}
if err := s.Stat().Stat(&stat); err != nil {
log.Fatal(err)
}
id := hst.ToUser[uint32](0, 0)
if stat.Uid != id || stat.Gid != id {
continue
}
break
}
if err := s.Err(); err != nil {
log.Fatal(err)
}
pid = s.Stat().PID
return
}
func main() {
go testsuite.ReceiveSignals()
username := testsuite.GetUser().Username
// the signal handler does not wait for termination
ctx := context.Background()
var wg sync.WaitGroup
defer wg.Wait()
var serial atomic.Uint64
newSerial := func() uint64 { serial.Add(1); return serial.Load() }
testsuite.MustRunAs(
username, "-i",
"hakurei", "exec", "capsh", "--print",
)
wg.Go(func() {
defer log.Println("validated capabilities/securebits in user namespace")
testsuite.MustRunAs(
username, "-i",
"hakurei", "exec", "capsh", "--has-no-new-privs",
)
for _, p := range []byte{'a', 'b', 'i', 'p'} {
testsuite.MustFailAs(
username, "-i",
"hakurei", "exec", "capsh", "--has-"+string(p)+"=CAP_SYS_ADMIN",
)
}
testsuite.MustFailAs(
username, "-i",
"hakurei", "exec", "umount", "-R", "/dev",
)
})
wg.Go(func() {
defer log.Println("validated pd seccomp outcome")
c, cancel := context.WithCancel(ctx)
defer cancel()
pid, done := mustStart(c, newSerial(), username)
testsuite.MustCheckFilter(pid, pdSum)
if err := testsuite.FilterTerminated(<-done); err != nil {
log.Fatal(err)
}
})
wg.Go(func() {
defer log.Println("validated fd leak")
c, cancel := context.WithCancel(ctx)
defer cancel()
pid, done := mustStart(c, newSerial(), username, os.Stdin, os.Stdout, os.Stderr)
prefix := filepath.Join(fhs.Proc, strconv.Itoa(pid), "fd")
var fail bool
if entries, err := os.ReadDir(prefix); err != nil {
log.Fatal(err.Error())
} else {
for _, ent := range entries {
var fd int
if fd, err = strconv.Atoi(ent.Name()); err != nil {
log.Fatal(err.Error())
}
// skip standard streams
if fd <= 2 {
continue
}
fail = true
var d string
if d, err = os.Readlink(filepath.Join(
prefix,
ent.Name(),
)); err != nil {
log.Fatal(err.Error())
}
log.Printf("extra fd %d -> %s", fd, d)
}
}
if fail {
log.Fatal("file descriptors leaked")
}
if err := syscall.Kill(pid, syscall.SIGTERM); err != nil {
log.Fatalf("cannot terminate anchor: %v", err)
} else if err = testsuite.FilterTerminated(<-done); err != nil {
log.Fatal(err)
}
})
if err := os.MkdirAll(testsuite.XDGRuntimeDir, 0700); err != nil {
log.Fatal(err)
} else if err = os.Chown(testsuite.XDGRuntimeDir, 1000, 1000); err != nil {
log.Fatal(err)
}
dbusEnv := testsuite.MustStartSessionBus(username)
testsuite.MustStartSway(&wg, username, dbusEnv)
defer testsuite.TerminateSway(username)
}
|
