/*
* Test sealing with active mmap()s
* Modifying seals is only allowed if no other mmap() refs exist.
*/
static void test_share_mmap(void)
{
int fd;
void *p;
fd = mfd_assert_new("kern_memfd_share_mmap",
MFD_DEF_SIZE,
MFD_CLOEXEC | MFD_ALLOW_SEALING);
mfd_assert_has_seals(fd, 0);
/* shared/writable ref prevents sealing WRITE, but allows others */
p = mfd_assert_mmap_shared(fd);
mfd_fail_add_seals(fd, F_SEAL_WRITE);
mfd_assert_has_seals(fd, 0);
mfd_assert_add_seals(fd, F_SEAL_SHRINK);
mfd_assert_has_seals(fd, F_SEAL_SHRINK);
munmap(p, MFD_DEF_SIZE);
/* readable ref allows sealing */
p = mfd_assert_mmap_private(fd);
mfd_assert_add_seals(fd, F_SEAL_WRITE);
mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
munmap(p, MFD_DEF_SIZE);
close(fd);
}
/*
* Test sharing via fork()
* Test whether seal-modifications work as expected with forked childs.
*/
static void test_share_fork(char *banner, char *b_suffix)
{
int fd;
pid_t pid;
printf("%s %s %s\n", memfd_str, banner, b_suffix);
fd = mfd_assert_new("kern_memfd_share_fork",
mfd_def_size,
MFD_CLOEXEC | MFD_ALLOW_SEALING);
mfd_assert_has_seals(fd, 0);
pid = spawn_idle_thread(0);
mfd_assert_add_seals(fd, F_SEAL_SEAL);
mfd_assert_has_seals(fd, F_SEAL_SEAL);
mfd_fail_add_seals(fd, F_SEAL_WRITE);
mfd_assert_has_seals(fd, F_SEAL_SEAL);
join_idle_thread(pid);
mfd_fail_add_seals(fd, F_SEAL_WRITE);
mfd_assert_has_seals(fd, F_SEAL_SEAL);
close(fd);
}
/*
* Test sealing with active mmap()s
* Modifying seals is only allowed if no other mmap() refs exist.
*/
static void test_share_mmap(char *banner, char *b_suffix)
{
int fd;
void *p;
printf("%s %s %s\n", memfd_str, banner, b_suffix);
fd = mfd_assert_new("kern_memfd_share_mmap",
mfd_def_size,
MFD_CLOEXEC | MFD_ALLOW_SEALING);
mfd_assert_has_seals(fd, 0);
/* shared/writable ref prevents sealing WRITE, but allows others */
p = mfd_assert_mmap_shared(fd);
mfd_fail_add_seals(fd, F_SEAL_WRITE);
mfd_assert_has_seals(fd, 0);
mfd_assert_add_seals(fd, F_SEAL_SHRINK);
mfd_assert_has_seals(fd, F_SEAL_SHRINK);
munmap(p, mfd_def_size);
/* readable ref allows sealing */
p = mfd_assert_mmap_private(fd);
mfd_assert_add_seals(fd, F_SEAL_WRITE);
mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
munmap(p, mfd_def_size);
close(fd);
}
/*
* Test SEAL_FUTURE_WRITE
* Test whether SEAL_FUTURE_WRITE actually prevents modifications.
*/
static void test_seal_future_write(void)
{
int fd, fd2;
void *p;
printf("%s SEAL-FUTURE-WRITE\n", memfd_str);
fd = mfd_assert_new("kern_memfd_seal_future_write",
mfd_def_size,
MFD_CLOEXEC | MFD_ALLOW_SEALING);
p = mfd_assert_mmap_shared(fd);
mfd_assert_has_seals(fd, 0);
mfd_assert_add_seals(fd, F_SEAL_FUTURE_WRITE);
mfd_assert_has_seals(fd, F_SEAL_FUTURE_WRITE);
/* read should pass, writes should fail */
mfd_assert_read(fd);
mfd_assert_read_shared(fd);
mfd_fail_write(fd);
fd2 = mfd_assert_reopen_fd(fd);
/* read should pass, writes should still fail */
mfd_assert_read(fd2);
mfd_assert_read_shared(fd2);
mfd_fail_write(fd2);
munmap(p, mfd_def_size);
close(fd2);
close(fd);
}
/*
* Test sealing with open(/proc/self/fd/%d)
* Via /proc we can get access to a separate file-context for the same memfd.
* This is *not* like dup(), but like a real separate open(). Make sure the
* semantics are as expected and we correctly check for RDONLY / WRONLY / RDWR.
*/
static void test_share_open(void)
{
int fd, fd2;
fd = mfd_assert_new("kern_memfd_share_open",
MFD_DEF_SIZE,
MFD_CLOEXEC | MFD_ALLOW_SEALING);
mfd_assert_has_seals(fd, 0);
fd2 = mfd_assert_open(fd, O_RDWR, 0);
mfd_assert_add_seals(fd, F_SEAL_WRITE);
mfd_assert_has_seals(fd, F_SEAL_WRITE);
mfd_assert_has_seals(fd2, F_SEAL_WRITE);
mfd_assert_add_seals(fd2, F_SEAL_SHRINK);
mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK);
close(fd);
fd = mfd_assert_open(fd2, O_RDONLY, 0);
mfd_fail_add_seals(fd, F_SEAL_SEAL);
mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK);
close(fd2);
fd2 = mfd_assert_open(fd, O_RDWR, 0);
mfd_assert_add_seals(fd2, F_SEAL_SEAL);
mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_SEAL);
mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_SEAL);
close(fd2);
close(fd);
}
/*
* Test SEAL_SHRINK | SEAL_GROW
* Test whether SEAL_SHRINK | SEAL_GROW actually prevents resizing
*/
static void test_seal_resize(void)
{
int fd;
fd = mfd_assert_new("kern_memfd_seal_resize",
MFD_DEF_SIZE,
MFD_CLOEXEC | MFD_ALLOW_SEALING);
mfd_assert_has_seals(fd, 0);
mfd_assert_add_seals(fd, F_SEAL_SHRINK | F_SEAL_GROW);
mfd_assert_has_seals(fd, F_SEAL_SHRINK | F_SEAL_GROW);
mfd_assert_read(fd);
mfd_assert_write(fd);
mfd_fail_shrink(fd);
mfd_fail_grow(fd);
mfd_fail_grow_write(fd);
close(fd);
}
/*
* Test SEAL_GROW
* Test whether SEAL_GROW actually prevents growing
*/
static void test_seal_grow(void)
{
int fd;
printf("%s SEAL-GROW\n", memfd_str);
fd = mfd_assert_new("kern_memfd_seal_grow",
mfd_def_size,
MFD_CLOEXEC | MFD_ALLOW_SEALING);
mfd_assert_has_seals(fd, 0);
mfd_assert_add_seals(fd, F_SEAL_GROW);
mfd_assert_has_seals(fd, F_SEAL_GROW);
mfd_assert_read(fd);
mfd_assert_write(fd);
mfd_assert_shrink(fd);
mfd_fail_grow(fd);
mfd_fail_grow_write(fd);
close(fd);
}
/*
* Test sharing via fork()
* Test whether seal-modifications work as expected with forked childs.
*/
static void test_share_fork(void)
{
int fd;
pid_t pid;
fd = mfd_assert_new("kern_memfd_share_fork",
MFD_DEF_SIZE,
MFD_CLOEXEC | MFD_ALLOW_SEALING);
mfd_assert_has_seals(fd, 0);
pid = spawn_idle_thread(0);
mfd_assert_add_seals(fd, F_SEAL_SEAL);
mfd_assert_has_seals(fd, F_SEAL_SEAL);
mfd_fail_add_seals(fd, F_SEAL_WRITE);
mfd_assert_has_seals(fd, F_SEAL_SEAL);
join_idle_thread(pid);
mfd_fail_add_seals(fd, F_SEAL_WRITE);
mfd_assert_has_seals(fd, F_SEAL_SEAL);
close(fd);
}
/*
* Test sealing with open(/proc/self/fd/%d)
* Via /proc we can get access to a separate file-context for the same memfd.
* This is *not* like dup(), but like a real separate open(). Make sure the
* semantics are as expected and we correctly check for RDONLY / WRONLY / RDWR.
*/
static void test_share_open(char *banner, char *b_suffix)
{
int fd, fd2;
printf("%s %s %s\n", memfd_str, banner, b_suffix);
fd = mfd_assert_new("kern_memfd_share_open",
mfd_def_size,
MFD_CLOEXEC | MFD_ALLOW_SEALING);
mfd_assert_has_seals(fd, 0);
fd2 = mfd_assert_open(fd, O_RDWR, 0);
mfd_assert_add_seals(fd, F_SEAL_WRITE);
mfd_assert_has_seals(fd, F_SEAL_WRITE);
mfd_assert_has_seals(fd2, F_SEAL_WRITE);
mfd_assert_add_seals(fd2, F_SEAL_SHRINK);
mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK);
close(fd);
fd = mfd_assert_open(fd2, O_RDONLY, 0);
mfd_fail_add_seals(fd, F_SEAL_SEAL);
mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK);
close(fd2);
fd2 = mfd_assert_open(fd, O_RDWR, 0);
mfd_assert_add_seals(fd2, F_SEAL_SEAL);
mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_SEAL);
mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_SEAL);
close(fd2);
close(fd);
}
/*
* Test basic sealing
* A very basic sealing test to see whether setting/retrieving seals works.
*/
static void test_basic(void)
{
int fd;
printf("%s BASIC\n", memfd_str);
fd = mfd_assert_new("kern_memfd_basic",
mfd_def_size,
MFD_CLOEXEC | MFD_ALLOW_SEALING);
/* add basic seals */
mfd_assert_has_seals(fd, 0);
mfd_assert_add_seals(fd, F_SEAL_SHRINK |
F_SEAL_WRITE);
mfd_assert_has_seals(fd, F_SEAL_SHRINK |
F_SEAL_WRITE);
/* add them again */
mfd_assert_add_seals(fd, F_SEAL_SHRINK |
F_SEAL_WRITE);
mfd_assert_has_seals(fd, F_SEAL_SHRINK |
F_SEAL_WRITE);
/* add more seals and seal against sealing */
mfd_assert_add_seals(fd, F_SEAL_GROW | F_SEAL_SEAL);
mfd_assert_has_seals(fd, F_SEAL_SHRINK |
F_SEAL_GROW |
F_SEAL_WRITE |
F_SEAL_SEAL);
/* verify that sealing no longer works */
mfd_fail_add_seals(fd, F_SEAL_GROW);
mfd_fail_add_seals(fd, 0);
close(fd);
/* verify sealing does not work without MFD_ALLOW_SEALING */
fd = mfd_assert_new("kern_memfd_basic",
mfd_def_size,
MFD_CLOEXEC);
mfd_assert_has_seals(fd, F_SEAL_SEAL);
mfd_fail_add_seals(fd, F_SEAL_SHRINK |
F_SEAL_GROW |
F_SEAL_WRITE);
mfd_assert_has_seals(fd, F_SEAL_SEAL);
close(fd);
}
int main(int argc, char **argv)
{
static const char zero[MFD_DEF_SIZE];
int fd, mfd, r;
void *p;
int was_sealed;
pid_t pid;
if (argc < 2) {
printf("error: please pass path to file in fuse_mnt mount-point\n");
abort();
}
/* open FUSE memfd file for GUP testing */
printf("opening: %s\n", argv[1]);
fd = open(argv[1], O_RDONLY | O_CLOEXEC);
if (fd < 0) {
printf("cannot open(\"%s\"): %m\n", argv[1]);
abort();
}
/* create new memfd-object */
mfd = mfd_assert_new("kern_memfd_fuse",
MFD_DEF_SIZE,
MFD_CLOEXEC | MFD_ALLOW_SEALING);
/* mmap memfd-object for writing */
p = mfd_assert_mmap_shared(mfd);
/* pass mfd+mapping to a separate sealing-thread which tries to seal
* the memfd objects with SEAL_WRITE while we write into it */
global_mfd = mfd;
global_p = p;
pid = spawn_sealing_thread();
/* Use read() on the FUSE file to read into our memory-mapped memfd
* object. This races the other thread which tries to seal the
* memfd-object.
* If @fd is on the memfd-fake-FUSE-FS, the read() is delayed by 1s.
* This guarantees that the receive-buffer is pinned for 1s until the
* data is written into it. The racing ADD_SEALS should thus fail as
* the pages are still pinned. */
r = read(fd, p, MFD_DEF_SIZE);
if (r < 0) {
printf("read() failed: %m\n");
abort();
} else if (!r) {
printf("unexpected EOF on read()\n");
abort();
}
was_sealed = mfd_assert_get_seals(mfd) & F_SEAL_WRITE;
/* Wait for sealing-thread to finish and verify that it
* successfully sealed the file after the second try. */
join_sealing_thread(pid);
mfd_assert_has_seals(mfd, F_SEAL_WRITE);
/* *IF* the memfd-object was sealed at the time our read() returned,
* then the kernel did a page-replacement or canceled the read() (or
* whatever magic it did..). In that case, the memfd object is still
* all zero.
* In case the memfd-object was *not* sealed, the read() was successfull
* and the memfd object must *not* be all zero.
* Note that in real scenarios, there might be a mixture of both, but
* in this test-cases, we have explicit 200ms delays which should be
* enough to avoid any in-flight writes. */
p = mfd_assert_mmap_private(mfd);
if (was_sealed && memcmp(p, zero, MFD_DEF_SIZE)) {
printf("memfd sealed during read() but data not discarded\n");
abort();
} else if (!was_sealed && !memcmp(p, zero, MFD_DEF_SIZE)) {
printf("memfd sealed after read() but data discarded\n");
abort();
}
close(mfd);
close(fd);
printf("fuse: DONE\n");
return 0;
}
