Quelle  check-exec-tests.sh   Sprache: Shell

#!/usr/bin/env bash
# SPDX-License-Identifier: GPL-2.0
#
# Test the "inc" interpreter.
#
# See include/uapi/linux/securebits.h, include/uapi/linux/fcntl.h and
# samples/check-exec/inc.c
#
# Copyright © 2024 Microsoft Corporation

set -u -e -o pipefail

EXPECTED_OUTPUT="1"
exec 2>/dev/null

DIR="$(dirname $(readlink -f "$0"))"
source "${DIR}"/../kselftest/ktap_helpers.sh

exec_direct() {
 local expect="$1"
 local script="$2"
 shift 2
 local ret=0
 local out

 # Updates PATH for `env` to execute the `inc` interpreter.
 out="$(PATH="." "$@" "${script}")" || ret=$?

 if [[ ${ret} -ne ${expect} ]]; then
  echo "ERROR: Wrong expectation for direct file execution: ${ret}"
  return 1
 fi
 if [[ ${ret} -eq 0 && "${out}" != "${EXPECTED_OUTPUT}" ]]; then
  echo "ERROR: Wrong output for direct file execution: ${out}"
  return 1
 fi
}

exec_indirect() {
 local expect="$1"
 local script="$2"
 shift 2
 local ret=0
 local out

 # Script passed as argument.
 out="$("$@" ./inc "${script}")" || ret=$?

 if [[ ${ret} -ne ${expect} ]]; then
  echo "ERROR: Wrong expectation for indirect file execution: ${ret}"
  return 1
 fi
 if [[ ${ret} -eq 0 && "${out}" != "${EXPECTED_OUTPUT}" ]]; then
  echo "ERROR: Wrong output for indirect file execution: ${out}"
  return 1
 fi
}

exec_stdin_reg() {
 local expect="$1"
 local script="$2"
 shift 2
 local ret=0
 local out

 # Executing stdin must be allowed if the related file is executable.
 out="$("$@" ./inc -i < "${script}")" || ret=$?

 if [[ ${ret} -ne ${expect} ]]; then
  echo "ERROR: Wrong expectation for stdin regular file execution: ${ret}"
  return 1
 fi
 if [[ ${ret} -eq 0 && "${out}" != "${EXPECTED_OUTPUT}" ]]; then
  echo "ERROR: Wrong output for stdin regular file execution: ${out}"
  return 1
 fi
}

exec_stdin_pipe() {
 local expect="$1"
 shift
 local ret=0
 local out

 # A pipe is not executable.
 out="$(cat script-exec.inc | "$@" ./inc -i)" || ret=$?

 if [[ ${ret} -ne ${expect} ]]; then
  echo "ERROR: Wrong expectation for stdin pipe execution: ${ret}"
  return 1
 fi
}

exec_argument() {
 local expect="$1"
 local ret=0
 shift
 local out

 # Script not coming from a file must not be executed.
 out="$("$@" ./inc -c "$(< script-exec.inc)")" || ret=$?

 if [[ ${ret} -ne ${expect} ]]; then
  echo "ERROR: Wrong expectation for arbitrary argument execution: ${ret}"
  return 1
 fi
 if [[ ${ret} -eq 0 && "${out}" != "${EXPECTED_OUTPUT}" ]]; then
  echo "ERROR: Wrong output for arbitrary argument execution: ${out}"
  return 1
 fi
}

exec_interactive() {
 exec_stdin_pipe "$@"
 exec_argument "$@"
}

ktap_test() {
 ktap_test_result "$*" "$@"
}

ktap_print_header
ktap_set_plan 28

# Without secbit configuration, nothing is changed.

ktap_print_msg "By default, executable scripts are allowed to be interpreted and executed."
ktap_test exec_direct 0 script-exec.inc
ktap_test exec_indirect 0 script-exec.inc

ktap_print_msg "By default, executable stdin is allowed to be interpreted."
ktap_test exec_stdin_reg 0 script-exec.inc

ktap_print_msg "By default, non-executable scripts are allowed to be interpreted, but not directly executed."
# We get 126 because of direct execution by Bash.
ktap_test exec_direct 126 script-noexec.inc
ktap_test exec_indirect 0 script-noexec.inc

ktap_print_msg "By default, non-executable stdin is allowed to be interpreted."
ktap_test exec_stdin_reg 0 script-noexec.inc

ktap_print_msg "By default, interactive commands are allowed to be interpreted."
ktap_test exec_interactive 0

# With only file restriction: protect non-malicious users from inadvertent errors (e.g. python ~/Downloads/*.py).

ktap_print_msg "With -f, executable scripts are allowed to be interpreted and executed."
ktap_test exec_direct 0 script-exec.inc ./set-exec -f --
ktap_test exec_indirect 0 script-exec.inc ./set-exec -f --

ktap_print_msg "With -f, executable stdin is allowed to be interpreted."
ktap_test exec_stdin_reg 0 script-exec.inc ./set-exec -f --

ktap_print_msg "With -f, non-executable scripts are not allowed to be executed nor interpreted."
# Direct execution of non-executable script is alwayse denied by the kernel.
ktap_test exec_direct 1 script-noexec.inc ./set-exec -f --
ktap_test exec_indirect 1 script-noexec.inc ./set-exec -f --

ktap_print_msg "With -f, non-executable stdin is allowed to be interpreted."
ktap_test exec_stdin_reg 0 script-noexec.inc ./set-exec -f --

ktap_print_msg "With -f, interactive commands are allowed to be interpreted."
ktap_test exec_interactive 0 ./set-exec -f --

# With only denied interactive commands: check or monitor script content (e.g. with LSM).

ktap_print_msg "With -i, executable scripts are allowed to be interpreted and executed."
ktap_test exec_direct 0 script-exec.inc ./set-exec -i --
ktap_test exec_indirect 0 script-exec.inc ./set-exec -i --

ktap_print_msg "With -i, executable stdin is allowed to be interpreted."
ktap_test exec_stdin_reg 0 script-exec.inc ./set-exec -i --

ktap_print_msg "With -i, non-executable scripts are allowed to be interpreted, but not directly executed."
# Direct execution of non-executable script is alwayse denied by the kernel.
ktap_test exec_direct 1 script-noexec.inc ./set-exec -i --
ktap_test exec_indirect 0 script-noexec.inc ./set-exec -i --

ktap_print_msg "With -i, non-executable stdin is not allowed to be interpreted."
ktap_test exec_stdin_reg 1 script-noexec.inc ./set-exec -i --

ktap_print_msg "With -i, interactive commands are not allowed to be interpreted."
ktap_test exec_interactive 1 ./set-exec -i --

# With both file restriction and denied interactive commands: only allow executable scripts.

ktap_print_msg "With -fi, executable scripts are allowed to be interpreted and executed."
ktap_test exec_direct 0 script-exec.inc ./set-exec -fi --
ktap_test exec_indirect 0 script-exec.inc ./set-exec -fi --

ktap_print_msg "With -fi, executable stdin is allowed to be interpreted."
ktap_test exec_stdin_reg 0 script-exec.inc ./set-exec -fi --

ktap_print_msg "With -fi, non-executable scripts are not allowed to be interpreted nor executed."
# Direct execution of non-executable script is alwayse denied by the kernel.
ktap_test exec_direct 1 script-noexec.inc ./set-exec -fi --
ktap_test exec_indirect 1 script-noexec.inc ./set-exec -fi --

ktap_print_msg "With -fi, non-executable stdin is not allowed to be interpreted."
ktap_test exec_stdin_reg 1 script-noexec.inc ./set-exec -fi --

ktap_print_msg "With -fi, interactive commands are not allowed to be interpreted."
ktap_test exec_interactive 1 ./set-exec -fi --

ktap_finished