summaryrefslogtreecommitdiffhomepage
path: root/test/syscalls
diff options
context:
space:
mode:
Diffstat (limited to 'test/syscalls')
-rw-r--r--test/syscalls/BUILD4
-rw-r--r--test/syscalls/linux/BUILD18
-rw-r--r--test/syscalls/linux/proc_net.cc8
-rw-r--r--test/syscalls/linux/raw_socket.cc63
-rw-r--r--test/syscalls/linux/socket_generic_test_cases.cc44
-rw-r--r--test/syscalls/linux/socket_ipv4_udp_unbound_loopback_nogotsan.cc4
-rw-r--r--test/syscalls/linux/socket_test_util.cc19
-rw-r--r--test/syscalls/linux/verity_getdents.cc12
-rw-r--r--test/syscalls/linux/verity_ioctl.cc44
-rw-r--r--test/syscalls/linux/verity_mmap.cc16
-rw-r--r--test/syscalls/linux/verity_symlink.cc117
11 files changed, 298 insertions, 51 deletions
diff --git a/test/syscalls/BUILD b/test/syscalls/BUILD
index bcf4c41a8..16c451786 100644
--- a/test/syscalls/BUILD
+++ b/test/syscalls/BUILD
@@ -888,6 +888,10 @@ syscall_test(
)
syscall_test(
+ test = "//test/syscalls/linux:verity_symlink_test",
+)
+
+syscall_test(
add_overlay = True,
test = "//test/syscalls/linux:sync_test",
)
diff --git a/test/syscalls/linux/BUILD b/test/syscalls/linux/BUILD
index 773688f44..9e955f797 100644
--- a/test/syscalls/linux/BUILD
+++ b/test/syscalls/linux/BUILD
@@ -2395,6 +2395,7 @@ cc_library(
"@com_google_absl//absl/strings",
"@com_google_absl//absl/strings:str_format",
gtest,
+ "//test/util:capability_util",
"//test/util:test_util",
],
alwayslink = 1,
@@ -3723,6 +3724,23 @@ cc_binary(
)
cc_binary(
+ name = "verity_symlink_test",
+ testonly = 1,
+ srcs = ["verity_symlink.cc"],
+ linkstatic = 1,
+ deps = [
+ "//test/util:capability_util",
+ gtest,
+ "//test/util:fs_util",
+ "//test/util:mount_util",
+ "//test/util:temp_path",
+ "//test/util:test_main",
+ "//test/util:test_util",
+ "//test/util:verity_util",
+ ],
+)
+
+cc_binary(
name = "sync_test",
testonly = 1,
# Android does not support syncfs in r22.
diff --git a/test/syscalls/linux/proc_net.cc b/test/syscalls/linux/proc_net.cc
index 04fecc02e..3b8a71ab4 100644
--- a/test/syscalls/linux/proc_net.cc
+++ b/test/syscalls/linux/proc_net.cc
@@ -498,13 +498,7 @@ TEST(ProcSysNetIpv4Recovery, CanReadAndWrite) {
// Check initial value is set to 1.
EXPECT_THAT(PreadFd(fd.get(), &buf, sizeof(buf), 0),
SyscallSucceedsWithValue(sizeof(to_write) + 1));
- if (IsRunningOnGvisor()) {
- // TODO(gvisor.dev/issue/5243): TCPRACKLossDetection = 1 should be turned on
- // by default.
- EXPECT_EQ(strcmp(buf, "0\n"), 0);
- } else {
- EXPECT_EQ(strcmp(buf, "1\n"), 0);
- }
+ EXPECT_EQ(strcmp(buf, "1\n"), 0);
// Set tcp_recovery to one of the allowed constants.
EXPECT_THAT(PwriteFd(fd.get(), &to_write, sizeof(to_write), 0),
diff --git a/test/syscalls/linux/raw_socket.cc b/test/syscalls/linux/raw_socket.cc
index 69616b400..f8798bc76 100644
--- a/test/syscalls/linux/raw_socket.cc
+++ b/test/syscalls/linux/raw_socket.cc
@@ -12,6 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+#include <arpa/inet.h>
#include <linux/capability.h>
#include <linux/filter.h>
#include <netinet/in.h>
@@ -76,6 +77,20 @@ class RawSocketTest : public ::testing::TestWithParam<std::tuple<int, int>> {
return 0;
}
+ uint16_t Port(struct sockaddr* s) {
+ if (Family() == AF_INET) {
+ return ntohs(reinterpret_cast<struct sockaddr_in*>(s)->sin_port);
+ }
+ return ntohs(reinterpret_cast<struct sockaddr_in6*>(s)->sin6_port);
+ }
+
+ void* Addr(struct sockaddr* s) {
+ if (Family() == AF_INET) {
+ return &(reinterpret_cast<struct sockaddr_in*>(s)->sin_addr);
+ }
+ return &(reinterpret_cast<struct sockaddr_in6*>(s)->sin6_addr);
+ }
+
// The socket used for both reading and writing.
int s_;
@@ -181,6 +196,54 @@ TEST_P(RawSocketTest, FailAccept) {
ASSERT_THAT(accept(s_, &saddr, &addrlen), SyscallFailsWithErrno(ENOTSUP));
}
+TEST_P(RawSocketTest, BindThenGetSockName) {
+ SKIP_IF(!ASSERT_NO_ERRNO_AND_VALUE(HaveCapability(CAP_NET_RAW)));
+
+ struct sockaddr* addr = reinterpret_cast<struct sockaddr*>(&addr_);
+ ASSERT_THAT(bind(s_, addr, AddrLen()), SyscallSucceeds());
+ struct sockaddr_storage saddr_storage;
+ struct sockaddr* saddr = reinterpret_cast<struct sockaddr*>(&saddr_storage);
+ socklen_t saddrlen = AddrLen();
+ ASSERT_THAT(getsockname(s_, saddr, &saddrlen), SyscallSucceeds());
+ ASSERT_EQ(saddrlen, AddrLen());
+
+ // The port is expected to hold the protocol number.
+ EXPECT_EQ(Port(saddr), Protocol());
+
+ char addrbuf[INET6_ADDRSTRLEN], saddrbuf[INET6_ADDRSTRLEN];
+ const char* addrstr =
+ inet_ntop(addr->sa_family, Addr(addr), addrbuf, sizeof(addrbuf));
+ ASSERT_NE(addrstr, nullptr);
+ const char* saddrstr =
+ inet_ntop(saddr->sa_family, Addr(saddr), saddrbuf, sizeof(saddrbuf));
+ ASSERT_NE(saddrstr, nullptr);
+ EXPECT_STREQ(saddrstr, addrstr);
+}
+
+TEST_P(RawSocketTest, ConnectThenGetSockName) {
+ SKIP_IF(!ASSERT_NO_ERRNO_AND_VALUE(HaveCapability(CAP_NET_RAW)));
+
+ struct sockaddr* addr = reinterpret_cast<struct sockaddr*>(&addr_);
+ ASSERT_THAT(connect(s_, addr, AddrLen()), SyscallSucceeds());
+ struct sockaddr_storage saddr_storage;
+ struct sockaddr* saddr = reinterpret_cast<struct sockaddr*>(&saddr_storage);
+ socklen_t saddrlen = AddrLen();
+ ASSERT_THAT(getsockname(s_, saddr, &saddrlen), SyscallSucceeds());
+ ASSERT_EQ(saddrlen, AddrLen());
+
+ // The port is expected to hold the protocol number.
+ EXPECT_EQ(Port(saddr), Protocol());
+
+ char addrbuf[INET6_ADDRSTRLEN], saddrbuf[INET6_ADDRSTRLEN];
+ const char* addrstr =
+ inet_ntop(addr->sa_family, Addr(addr), addrbuf, sizeof(addrbuf));
+ ASSERT_NE(addrstr, nullptr);
+ const char* saddrstr =
+ inet_ntop(saddr->sa_family, Addr(saddr), saddrbuf, sizeof(saddrbuf));
+ ASSERT_NE(saddrstr, nullptr);
+ EXPECT_STREQ(saddrstr, addrstr);
+}
+
// Test that getpeername() returns nothing before connect().
TEST_P(RawSocketTest, FailGetPeerNameBeforeConnect) {
SKIP_IF(!ASSERT_NO_ERRNO_AND_VALUE(HaveCapability(CAP_NET_RAW)));
diff --git a/test/syscalls/linux/socket_generic_test_cases.cc b/test/syscalls/linux/socket_generic_test_cases.cc
index 5c4cb6c35..fe5171bc8 100644
--- a/test/syscalls/linux/socket_generic_test_cases.cc
+++ b/test/syscalls/linux/socket_generic_test_cases.cc
@@ -14,6 +14,9 @@
#include "test/syscalls/linux/socket_generic.h"
+#ifdef __linux__
+#include <linux/capability.h>
+#endif // __linux__
#include <stdio.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
@@ -24,6 +27,7 @@
#include "absl/strings/string_view.h"
#include "test/syscalls/linux/socket_test_util.h"
#include "test/syscalls/linux/unix_domain_socket_test_util.h"
+#include "test/util/capability_util.h"
#include "test/util/test_util.h"
// This file is a generic socket test file. It must be built with another file
@@ -400,6 +404,46 @@ TEST_P(AllSocketPairTest, RcvBufSucceeds) {
EXPECT_GT(size, 0);
}
+#ifdef __linux__
+
+// Check that setting SO_RCVBUFFORCE above max is not clamped to the maximum
+// receive buffer size.
+TEST_P(AllSocketPairTest, SetSocketRecvBufForceAboveMax) {
+ std::unique_ptr<SocketPair> sockets =
+ ASSERT_NO_ERRNO_AND_VALUE(NewSocketPair());
+
+ // Discover maxmimum buffer size by setting to a really large value.
+ constexpr int kRcvBufSz = 0xffffffff;
+ ASSERT_THAT(setsockopt(sockets->first_fd(), SOL_SOCKET, SO_RCVBUF, &kRcvBufSz,
+ sizeof(kRcvBufSz)),
+ SyscallSucceeds());
+
+ int max = 0;
+ socklen_t max_len = sizeof(max);
+ ASSERT_THAT(
+ getsockopt(sockets->first_fd(), SOL_SOCKET, SO_RCVBUF, &max, &max_len),
+ SyscallSucceeds());
+
+ int above_max = max + 1;
+ int sso = setsockopt(sockets->first_fd(), SOL_SOCKET, SO_RCVBUFFORCE,
+ &above_max, sizeof(above_max));
+ if (!ASSERT_NO_ERRNO_AND_VALUE(HaveCapability(CAP_NET_ADMIN))) {
+ ASSERT_THAT(sso, SyscallFailsWithErrno(EPERM));
+ return;
+ }
+ ASSERT_THAT(sso, SyscallSucceeds());
+
+ int val = 0;
+ socklen_t val_len = sizeof(val);
+ ASSERT_THAT(
+ getsockopt(sockets->first_fd(), SOL_SOCKET, SO_RCVBUF, &val, &val_len),
+ SyscallSucceeds());
+ // The system doubles the passed-in maximum.
+ ASSERT_EQ(above_max * 2, val);
+}
+
+#endif // __linux__
+
TEST_P(AllSocketPairTest, GetSndBufSucceeds) {
auto sockets = ASSERT_NO_ERRNO_AND_VALUE(NewSocketPair());
int size = 0;
diff --git a/test/syscalls/linux/socket_ipv4_udp_unbound_loopback_nogotsan.cc b/test/syscalls/linux/socket_ipv4_udp_unbound_loopback_nogotsan.cc
index 7ca6d52e4..a2c6d4491 100644
--- a/test/syscalls/linux/socket_ipv4_udp_unbound_loopback_nogotsan.cc
+++ b/test/syscalls/linux/socket_ipv4_udp_unbound_loopback_nogotsan.cc
@@ -31,7 +31,7 @@ using IPv4UDPUnboundSocketNogotsanTest = SimpleSocketTest;
// We disable S/R because this test creates a large number of sockets.
TEST_P(IPv4UDPUnboundSocketNogotsanTest, UDPConnectPortExhaustion) {
auto receiver1 = ASSERT_NO_ERRNO_AND_VALUE(NewSocket());
- constexpr int kClients = 65536;
+ const int kClients = ASSERT_NO_ERRNO_AND_VALUE(MaybeLimitEphemeralPorts());
// Bind the first socket to the loopback and take note of the selected port.
auto addr = V4Loopback();
ASSERT_THAT(bind(receiver1->get(), AsSockAddr(&addr.addr), addr.addr_len),
@@ -61,7 +61,7 @@ TEST_P(IPv4UDPUnboundSocketNogotsanTest, UDPConnectPortExhaustion) {
// We disable S/R because this test creates a large number of sockets.
TEST_P(IPv4UDPUnboundSocketNogotsanTest, UDPBindPortExhaustion) {
auto receiver1 = ASSERT_NO_ERRNO_AND_VALUE(NewSocket());
- constexpr int kClients = 65536;
+ const int kClients = ASSERT_NO_ERRNO_AND_VALUE(MaybeLimitEphemeralPorts());
auto addr = V4Loopback();
// Disable cooperative S/R as we are making too many syscalls.
DisableSave ds;
diff --git a/test/syscalls/linux/socket_test_util.cc b/test/syscalls/linux/socket_test_util.cc
index 1afb1ab50..c1cded834 100644
--- a/test/syscalls/linux/socket_test_util.cc
+++ b/test/syscalls/linux/socket_test_util.cc
@@ -1093,14 +1093,21 @@ PosixErrorOr<int> MaybeLimitEphemeralPorts() {
if (!access(kRangeFile, W_OK)) {
ASSIGN_OR_RETURN_ERRNO(FileDescriptor fd,
Open(kRangeFile, O_WRONLY | O_TRUNC, 0));
- max = min + 50;
- const std::string small_range = absl::StrFormat("%d %d", min, max);
+ int newMax = min + 50;
+ const std::string small_range = absl::StrFormat("%d %d", min, newMax);
int n = write(fd.get(), small_range.c_str(), small_range.size());
if (n < 0) {
- return PosixError(
- errno,
- absl::StrFormat("write(%d [%s], \"%s\", %d)", fd.get(), kRangeFile,
- small_range.c_str(), small_range.size()));
+ // Hostinet doesn't allow modifying the host port range. And if we're root
+ // (as we are in some tests), access and open will succeed even if the
+ // file mode is readonly.
+ if (errno != EACCES) {
+ return PosixError(
+ errno,
+ absl::StrFormat("write(%d [%s], \"%s\", %d)", fd.get(), kRangeFile,
+ small_range.c_str(), small_range.size()));
+ }
+ } else {
+ max = newMax;
}
}
return max - min;
diff --git a/test/syscalls/linux/verity_getdents.cc b/test/syscalls/linux/verity_getdents.cc
index 093595dd3..2eafc3dd3 100644
--- a/test/syscalls/linux/verity_getdents.cc
+++ b/test/syscalls/linux/verity_getdents.cc
@@ -58,16 +58,16 @@ class GetDentsTest : public ::testing::Test {
};
TEST_F(GetDentsTest, GetDents) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
std::vector<std::string> expect = {".", "..", filename_};
EXPECT_NO_ERRNO(DirContains(verity_dir, expect, /*exclude=*/{}));
}
TEST_F(GetDentsTest, Deleted) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
EXPECT_THAT(unlink(JoinPath(tmpfs_dir_.path(), filename_).c_str()),
SyscallSucceeds());
@@ -77,8 +77,8 @@ TEST_F(GetDentsTest, Deleted) {
}
TEST_F(GetDentsTest, Renamed) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
std::string new_file_name = "renamed-" + filename_;
EXPECT_THAT(rename(JoinPath(tmpfs_dir_.path(), filename_).c_str(),
diff --git a/test/syscalls/linux/verity_ioctl.cc b/test/syscalls/linux/verity_ioctl.cc
index be91b23d0..e7e4fa64b 100644
--- a/test/syscalls/linux/verity_ioctl.cc
+++ b/test/syscalls/linux/verity_ioctl.cc
@@ -105,8 +105,8 @@ TEST_F(IoctlTest, Measure) {
}
TEST_F(IoctlTest, Mount) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
// Make sure the file can be open and read in the mounted verity fs.
auto const verity_fd = ASSERT_NO_ERRNO_AND_VALUE(
@@ -117,8 +117,8 @@ TEST_F(IoctlTest, Mount) {
}
TEST_F(IoctlTest, NonExistingFile) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
// Confirm that opening a non-existing file in the verity-enabled directory
// triggers the expected error instead of verification failure.
@@ -128,8 +128,8 @@ TEST_F(IoctlTest, NonExistingFile) {
}
TEST_F(IoctlTest, ModifiedFile) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
// Modify the file and check verification failure upon reading from it.
auto const fd = ASSERT_NO_ERRNO_AND_VALUE(
@@ -143,8 +143,8 @@ TEST_F(IoctlTest, ModifiedFile) {
}
TEST_F(IoctlTest, ModifiedMerkle) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
// Modify the Merkle file and check verification failure upon opening the
// corresponding file.
@@ -158,8 +158,8 @@ TEST_F(IoctlTest, ModifiedMerkle) {
}
TEST_F(IoctlTest, ModifiedDirMerkle) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
// Modify the Merkle file for the parent directory and check verification
// failure upon opening the corresponding file.
@@ -173,8 +173,8 @@ TEST_F(IoctlTest, ModifiedDirMerkle) {
}
TEST_F(IoctlTest, Stat) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
struct stat st;
EXPECT_THAT(stat(JoinPath(verity_dir, filename_).c_str(), &st),
@@ -182,8 +182,8 @@ TEST_F(IoctlTest, Stat) {
}
TEST_F(IoctlTest, ModifiedStat) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
EXPECT_THAT(chmod(JoinPath(tmpfs_dir_.path(), filename_).c_str(), 0644),
SyscallSucceeds());
@@ -193,8 +193,8 @@ TEST_F(IoctlTest, ModifiedStat) {
}
TEST_F(IoctlTest, DeleteFile) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
EXPECT_THAT(unlink(JoinPath(tmpfs_dir_.path(), filename_).c_str()),
SyscallSucceeds());
@@ -203,8 +203,8 @@ TEST_F(IoctlTest, DeleteFile) {
}
TEST_F(IoctlTest, DeleteMerkle) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
EXPECT_THAT(
unlink(MerklePath(JoinPath(tmpfs_dir_.path(), filename_)).c_str()),
@@ -214,8 +214,8 @@ TEST_F(IoctlTest, DeleteMerkle) {
}
TEST_F(IoctlTest, RenameFile) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
std::string new_file_name = "renamed-" + filename_;
EXPECT_THAT(rename(JoinPath(tmpfs_dir_.path(), filename_).c_str(),
@@ -226,8 +226,8 @@ TEST_F(IoctlTest, RenameFile) {
}
TEST_F(IoctlTest, RenameMerkle) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
std::string new_file_name = "renamed-" + filename_;
EXPECT_THAT(
diff --git a/test/syscalls/linux/verity_mmap.cc b/test/syscalls/linux/verity_mmap.cc
index dde74cc91..09ced6eb3 100644
--- a/test/syscalls/linux/verity_mmap.cc
+++ b/test/syscalls/linux/verity_mmap.cc
@@ -57,8 +57,8 @@ class MmapTest : public ::testing::Test {
};
TEST_F(MmapTest, MmapRead) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
// Make sure the file can be open and mmapped in the mounted verity fs.
auto const verity_fd = ASSERT_NO_ERRNO_AND_VALUE(
@@ -71,8 +71,8 @@ TEST_F(MmapTest, MmapRead) {
}
TEST_F(MmapTest, ModifiedBeforeMmap) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
// Modify the file and check verification failure upon mmapping.
auto const fd = ASSERT_NO_ERRNO_AND_VALUE(
@@ -90,8 +90,8 @@ TEST_F(MmapTest, ModifiedBeforeMmap) {
}
TEST_F(MmapTest, ModifiedAfterMmap) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
auto const verity_fd = ASSERT_NO_ERRNO_AND_VALUE(
Open(JoinPath(verity_dir, filename_), O_RDONLY, 0777));
@@ -126,8 +126,8 @@ INSTANTIATE_TEST_SUITE_P(
::testing::ValuesIn({MAP_SHARED, MAP_PRIVATE})));
TEST_P(MmapParamTest, Mmap) {
- std::string verity_dir =
- ASSERT_NO_ERRNO_AND_VALUE(MountVerity(tmpfs_dir_.path(), filename_));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
// Make sure the file can be open and mmapped in the mounted verity fs.
auto const verity_fd = ASSERT_NO_ERRNO_AND_VALUE(
diff --git a/test/syscalls/linux/verity_symlink.cc b/test/syscalls/linux/verity_symlink.cc
new file mode 100644
index 000000000..bbf5375cb
--- /dev/null
+++ b/test/syscalls/linux/verity_symlink.cc
@@ -0,0 +1,117 @@
+// Copyright 2021 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <sys/mount.h>
+#include <sys/stat.h>
+
+#include "gmock/gmock.h"
+#include "gtest/gtest.h"
+#include "test/util/capability_util.h"
+#include "test/util/fs_util.h"
+#include "test/util/mount_util.h"
+#include "test/util/temp_path.h"
+#include "test/util/test_util.h"
+#include "test/util/verity_util.h"
+
+namespace gvisor {
+namespace testing {
+
+namespace {
+
+const char kSymlink[] = "verity_symlink";
+
+class SymlinkTest : public ::testing::Test {
+ protected:
+ void SetUp() override {
+ // Verity is implemented in VFS2.
+ SKIP_IF(IsRunningWithVFS1());
+
+ SKIP_IF(!ASSERT_NO_ERRNO_AND_VALUE(HaveCapability(CAP_SYS_ADMIN)));
+ // Mount a tmpfs file system, to be wrapped by a verity fs.
+ tmpfs_dir_ = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateDir());
+ ASSERT_THAT(mount("", tmpfs_dir_.path().c_str(), "tmpfs", 0, ""),
+ SyscallSucceeds());
+
+ // Create a new file in the tmpfs mount.
+ file_ = ASSERT_NO_ERRNO_AND_VALUE(
+ TempPath::CreateFileWith(tmpfs_dir_.path(), kContents, 0777));
+ filename_ = Basename(file_.path());
+
+ // Create a symlink to the file.
+ ASSERT_THAT(symlink(file_.path().c_str(),
+ JoinPath(tmpfs_dir_.path(), kSymlink).c_str()),
+ SyscallSucceeds());
+ }
+
+ TempPath tmpfs_dir_;
+ TempPath file_;
+ std::string filename_;
+};
+
+TEST_F(SymlinkTest, Success) {
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_,
+ {EnableTarget(kSymlink, O_RDONLY | O_NOFOLLOW)}));
+
+ char buf[256];
+ EXPECT_THAT(
+ readlink(JoinPath(verity_dir, kSymlink).c_str(), buf, sizeof(buf)),
+ SyscallSucceeds());
+ auto const verity_fd = ASSERT_NO_ERRNO_AND_VALUE(
+ Open(JoinPath(verity_dir, kSymlink).c_str(), O_RDONLY, 0777));
+ EXPECT_THAT(ReadFd(verity_fd.get(), buf, sizeof(kContents)),
+ SyscallSucceeds());
+}
+
+TEST_F(SymlinkTest, DeleteLink) {
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_,
+ {EnableTarget(kSymlink, O_RDONLY | O_NOFOLLOW)}));
+
+ ASSERT_THAT(unlink(JoinPath(tmpfs_dir_.path(), kSymlink).c_str()),
+ SyscallSucceeds());
+ char buf[256];
+ EXPECT_THAT(
+ readlink(JoinPath(verity_dir, kSymlink).c_str(), buf, sizeof(buf)),
+ SyscallFailsWithErrno(EIO));
+ EXPECT_THAT(open(JoinPath(verity_dir, kSymlink).c_str(), O_RDONLY, 0777),
+ SyscallFailsWithErrno(EIO));
+}
+
+TEST_F(SymlinkTest, ModifyLink) {
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
+ MountVerity(tmpfs_dir_.path(), filename_,
+ {EnableTarget(kSymlink, O_RDONLY | O_NOFOLLOW)}));
+
+ ASSERT_THAT(unlink(JoinPath(tmpfs_dir_.path(), kSymlink).c_str()),
+ SyscallSucceeds());
+
+ std::string newlink = "newlink";
+ ASSERT_THAT(symlink(JoinPath(tmpfs_dir_.path(), newlink).c_str(),
+ JoinPath(tmpfs_dir_.path(), kSymlink).c_str()),
+ SyscallSucceeds());
+ char buf[256];
+ EXPECT_THAT(
+ readlink(JoinPath(verity_dir, kSymlink).c_str(), buf, sizeof(buf)),
+ SyscallFailsWithErrno(EIO));
+ EXPECT_THAT(open(JoinPath(verity_dir, kSymlink).c_str(), O_RDONLY, 0777),
+ SyscallFailsWithErrno(EIO));
+}
+
+} // namespace
+
+} // namespace testing
+} // namespace gvisor
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-31 12:10:30 +0000