Something went wrong. Try again.
Monorepo for Tangled
Something went wrong. Try again.
6.9 kB · 250 lines
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251//go:build linux && integration
package sandbox
import ( "fmt" "os" "os/exec" "path/filepath" "strings" "testing"
"github.com/landlock-lsm/go-landlock/landlock")
// This file exercises actual Landlock enforcement. It works by re-execing the// test binary with an env var that makes it run the "child" code path: the// child applies the ruleset built by BuildRuleSpec and attempts a specific// filesystem operation, exiting 0 (allowed) or non-zero (denied).//// Build tag: linux && integration. Run with:// go test -tags integration ./knotserver/sandbox/...
const ( childEnv = "TANGLED_SANDBOX_INT_CHILD" childRepo = "TANGLED_SANDBOX_INT_REPO" childTarget = "TANGLED_SANDBOX_INT_TARGET" childOp = "TANGLED_SANDBOX_INT_OP")
func TestMain(m *testing.M) { if os.Getenv(childEnv) == "1" { runChild() return } os.Exit(m.Run())}
func runChild() { repoPath := os.Getenv(childRepo) target := os.Getenv(childTarget) op := os.Getenv(childOp)
spec := BuildRuleSpec([]string{repoPath}) rules := []landlock.Rule{ landlock.RODirs(spec.SystemRO...).IgnoreIfMissing(), landlock.RWFiles(spec.DevRW...).WithIoctlDev().IgnoreIfMissing(), landlock.RWDirs(spec.TmpRW...).IgnoreIfMissing(), } if spec.GitConfigRO != "" { rules = append(rules, landlock.ROFiles(spec.GitConfigRO).IgnoreIfMissing()) } for _, p := range spec.RepoRW { rules = append(rules, landlock.RWDirs(p).WithRefer()) } if err := landlock.V8.BestEffort().RestrictPaths(rules...); err != nil { fmt.Fprintf(os.Stderr, "restrict failed: %v\n", err) os.Exit(2) }
var opErr error switch op { case "read": _, opErr = os.ReadFile(target) case "write": opErr = os.WriteFile(target, []byte("x"), 0644) case "list": _, opErr = os.ReadDir(target) default: fmt.Fprintf(os.Stderr, "unknown op %q\n", op) os.Exit(3) }
if opErr != nil { fmt.Fprintln(os.Stderr, opErr) os.Exit(1) } os.Exit(0)}
// runUnderSandbox spawns the test binary as a child, applies Landlock with// the given repoPath as the granted RW path, then attempts op on target.// Returns true if the op was allowed, false if denied.func runUnderSandbox(t *testing.T, repoPath, target, op string) (allowed bool, output string) { t.Helper() cmd := exec.Command(os.Args[0]) cmd.Env = append(os.Environ(), childEnv+"=1", childRepo+"="+repoPath, childTarget+"="+target, childOp+"="+op, ) out, err := cmd.CombinedOutput() if err == nil { return true, string(out) } if exit, ok := err.(*exec.ExitError); ok && exit.ExitCode() == 1 { return false, string(out) } t.Fatalf("child exited unexpectedly: %v\noutput: %s", err, out) return false, ""}
func skipIfNoLandlock(t *testing.T) { t.Helper() if !probeLandlock() { t.Skip("Landlock not available on this kernel") }}
func TestSandboxIntegration_AllowsOwnRepoRead(t *testing.T) { skipIfNoLandlock(t)
root := t.TempDir() repo := filepath.Join(root, "did:plc:abc") target := filepath.Join(repo, "HEAD") mustMkdirAll(t, repo) mustWriteFile(t, target, "ref: refs/heads/main\n")
allowed, out := runUnderSandbox(t, repo, target, "read") if !allowed { t.Errorf("expected read of own repo to be allowed; child said: %s", strings.TrimSpace(out)) }}
func TestSandboxIntegration_DeniesOtherRepoRead(t *testing.T) { skipIfNoLandlock(t)
root := t.TempDir() myRepo := filepath.Join(root, "did:plc:abc") otherRepo := filepath.Join(root, "did:plc:xyz") secret := filepath.Join(otherRepo, "secret-key") mustMkdirAll(t, myRepo) mustMkdirAll(t, otherRepo) mustWriteFile(t, secret, "TOPSECRET\n")
allowed, out := runUnderSandbox(t, myRepo, secret, "read") if allowed { t.Errorf("expected read of other repo to be denied; child read: %s", strings.TrimSpace(out)) }}
func TestSandboxIntegration_AllowsGlobalConfigRead(t *testing.T) { skipIfNoLandlock(t)
root := t.TempDir() myRepo := filepath.Join(root, "did:plc:abc") cfgDir := filepath.Join(root, ".config", "git") cfg := filepath.Join(cfgDir, "config") mustMkdirAll(t, myRepo) mustMkdirAll(t, cfgDir) mustWriteFile(t, cfg, "[user]\n\tname = test\n")
// the child reads $HOME via BuildRuleSpec, so set HOME for it explicitly. t.Setenv("HOME", root)
allowed, out := runUnderSandbox(t, myRepo, cfg, "read") if !allowed { t.Errorf("expected read of $HOME/.config/git/config to be allowed; child said: %s", strings.TrimSpace(out)) }}
func TestSandboxIntegration_DeniesGlobalConfigSibling(t *testing.T) { skipIfNoLandlock(t)
root := t.TempDir() myRepo := filepath.Join(root, "did:plc:abc") cfgDir := filepath.Join(root, ".config", "git") sibling := filepath.Join(cfgDir, "attributes") mustMkdirAll(t, myRepo) mustMkdirAll(t, cfgDir) mustWriteFile(t, sibling, "*.bin -text\n")
t.Setenv("HOME", root)
allowed, out := runUnderSandbox(t, myRepo, sibling, "read") if allowed { t.Errorf("expected read of sibling in .config/git/ to be denied (only the config file is granted); child read: %s", strings.TrimSpace(out)) }}
func TestSandboxIntegration_DeniesScanPathSibling(t *testing.T) { skipIfNoLandlock(t)
root := t.TempDir() myRepo := filepath.Join(root, "did:plc:abc") dbFile := filepath.Join(root, "knotserver.db") mustMkdirAll(t, myRepo) mustWriteFile(t, dbFile, "fake db contents\n")
allowed, out := runUnderSandbox(t, myRepo, dbFile, "read") if allowed { t.Errorf("expected read of sibling file (knotserver.db) to be denied; child read: %s", strings.TrimSpace(out)) }}
func TestSandboxIntegration_DeniesScanPathListing(t *testing.T) { skipIfNoLandlock(t)
root := t.TempDir() myRepo := filepath.Join(root, "did:plc:abc") mustMkdirAll(t, myRepo)
allowed, out := runUnderSandbox(t, myRepo, root, "list") if allowed { t.Errorf("expected listing scan path to be denied; child output: %s", strings.TrimSpace(out)) }}
func TestSandboxIntegration_AllowsOwnRepoWrite(t *testing.T) { skipIfNoLandlock(t)
root := t.TempDir() repo := filepath.Join(root, "did:plc:abc") target := filepath.Join(repo, "new-file") mustMkdirAll(t, repo)
allowed, out := runUnderSandbox(t, repo, target, "write") if !allowed { t.Errorf("expected write to own repo to be allowed; child said: %s", strings.TrimSpace(out)) }}
func TestSandboxIntegration_DeniesSystemWrite(t *testing.T) { skipIfNoLandlock(t)
root := t.TempDir() repo := filepath.Join(root, "did:plc:abc") mustMkdirAll(t, repo)
// /etc is granted RO; writes must be denied. allowed, out := runUnderSandbox(t, repo, "/etc/sandbox-test-should-fail", "write") if allowed { t.Errorf("expected write to /etc to be denied; child output: %s", strings.TrimSpace(out)) }}
func mustMkdirAll(t *testing.T, p string) { t.Helper() if err := os.MkdirAll(p, 0o755); err != nil { t.Fatal(err) }}
func mustWriteFile(t *testing.T, p, content string) { t.Helper() if err := os.WriteFile(p, []byte(content), 0o644); err != nil { t.Fatal(err) }}