mod common; // Implementation note: to allow unprivileged users to run it, this test makes // use of user and mount namespaces. On systems that allow unprivileged user // namespaces (Linux >= 3.8 compiled with CONFIG_USER_NS), the test should run // without root. #[cfg(target_os = "linux")] mod test_mount { use std::fs::{self, File}; use std::io::{self, Read, Write}; use std::os::unix::fs::OpenOptionsExt; use std::os::unix::fs::PermissionsExt; use std::process::{self, Command}; use libc::{EACCES, EROFS}; use nix::errno::Errno; use nix::mount::{mount, umount, MsFlags}; use nix::sched::{unshare, CloneFlags}; use nix::sys::stat::{self, Mode}; use nix::unistd::getuid; static SCRIPT_CONTENTS: &[u8] = b"#!/bin/sh exit 23"; const EXPECTED_STATUS: i32 = 23; const NONE: Option<&'static [u8]> = None; #[allow(clippy::bind_instead_of_map)] // False positive pub fn test_mount_tmpfs_without_flags_allows_rwx() { let tempdir = tempfile::tempdir().unwrap(); mount(NONE, tempdir.path(), Some(b"tmpfs".as_ref()), MsFlags::empty(), NONE) .unwrap_or_else(|e| panic!("mount failed: {}", e)); let test_path = tempdir.path().join("test"); // Verify write. fs::OpenOptions::new() .create(true) .write(true) .mode((Mode::S_IRWXU | Mode::S_IRWXG | Mode::S_IRWXO).bits()) .open(&test_path) .or_else(|e| if Errno::from_i32(e.raw_os_error().unwrap()) == Errno::EOVERFLOW { // Skip tests on certain Linux kernels which have a bug // regarding tmpfs in namespaces. // Ubuntu 14.04 and 16.04 are known to be affected; 16.10 is // not. There is no legitimate reason for open(2) to return // EOVERFLOW here. // https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1659087 let stderr = io::stderr(); let mut handle = stderr.lock(); writeln!(handle, "Buggy Linux kernel detected. Skipping test.") .unwrap(); process::exit(0); } else { panic!("open failed: {}", e); } ) .and_then(|mut f| f.write(SCRIPT_CONTENTS)) .unwrap_or_else(|e| panic!("write failed: {}", e)); // Verify read. let mut buf = Vec::new(); File::open(&test_path) .and_then(|mut f| f.read_to_end(&mut buf)) .unwrap_or_else(|e| panic!("read failed: {}", e)); assert_eq!(buf, SCRIPT_CONTENTS); // Verify execute. assert_eq!(EXPECTED_STATUS, Command::new(&test_path) .status() .unwrap_or_else(|e| panic!("exec failed: {}", e)) .code() .unwrap_or_else(|| panic!("child killed by signal"))); umount(tempdir.path()).unwrap_or_else(|e| panic!("umount failed: {}", e)); } pub fn test_mount_rdonly_disallows_write() { let tempdir = tempfile::tempdir().unwrap(); mount(NONE, tempdir.path(), Some(b"tmpfs".as_ref()), MsFlags::MS_RDONLY, NONE) .unwrap_or_else(|e| panic!("mount failed: {}", e)); // EROFS: Read-only file system assert_eq!(EROFS as i32, File::create(tempdir.path().join("test")).unwrap_err().raw_os_error().unwrap()); umount(tempdir.path()).unwrap_or_else(|e| panic!("umount failed: {}", e)); } pub fn test_mount_noexec_disallows_exec() { let tempdir = tempfile::tempdir().unwrap(); mount(NONE, tempdir.path(), Some(b"tmpfs".as_ref()), MsFlags::MS_NOEXEC, NONE) .unwrap_or_else(|e| panic!("mount failed: {}", e)); let test_path = tempdir.path().join("test"); fs::OpenOptions::new() .create(true) .write(true) .mode((Mode::S_IRWXU | Mode::S_IRWXG | Mode::S_IRWXO).bits()) .open(&test_path) .and_then(|mut f| f.write(SCRIPT_CONTENTS)) .unwrap_or_else(|e| panic!("write failed: {}", e)); // Verify that we cannot execute despite a+x permissions being set. let mode = stat::Mode::from_bits_truncate(fs::metadata(&test_path) .map(|md| md.permissions().mode()) .unwrap_or_else(|e| { panic!("metadata failed: {}", e) })); assert!(mode.contains(Mode::S_IXUSR | Mode::S_IXGRP | Mode::S_IXOTH), "{:?} did not have execute permissions", &test_path); // EACCES: Permission denied assert_eq!(EACCES as i32, Command::new(&test_path).status().unwrap_err().raw_os_error().unwrap()); umount(tempdir.path()).unwrap_or_else(|e| panic!("umount failed: {}", e)); } pub fn test_mount_bind() { let tempdir = tempfile::tempdir().unwrap(); let file_name = "test"; { let mount_point = tempfile::tempdir().unwrap(); mount(Some(tempdir.path()), mount_point.path(), NONE, MsFlags::MS_BIND, NONE) .unwrap_or_else(|e| panic!("mount failed: {}", e)); fs::OpenOptions::new() .create(true) .write(true) .mode((Mode::S_IRWXU | Mode::S_IRWXG | Mode::S_IRWXO).bits()) .open(mount_point.path().join(file_name)) .and_then(|mut f| f.write(SCRIPT_CONTENTS)) .unwrap_or_else(|e| panic!("write failed: {}", e)); umount(mount_point.path()).unwrap_or_else(|e| panic!("umount failed: {}", e)); } // Verify the file written in the mount shows up in source directory, even // after unmounting. let mut buf = Vec::new(); File::open(tempdir.path().join(file_name)) .and_then(|mut f| f.read_to_end(&mut buf)) .unwrap_or_else(|e| panic!("read failed: {}", e)); assert_eq!(buf, SCRIPT_CONTENTS); } pub fn setup_namespaces() { // Hold on to the uid in the parent namespace. let uid = getuid(); unshare(CloneFlags::CLONE_NEWNS | CloneFlags::CLONE_NEWUSER).unwrap_or_else(|e| { let stderr = io::stderr(); let mut handle = stderr.lock(); writeln!(handle, "unshare failed: {}. Are unprivileged user namespaces available?", e).unwrap(); writeln!(handle, "mount is not being tested").unwrap(); // Exit with success because not all systems support unprivileged user namespaces, and // that's not what we're testing for. process::exit(0); }); // Map user as uid 1000. fs::OpenOptions::new() .write(true) .open("/proc/self/uid_map") .and_then(|mut f| f.write(format!("1000 {} 1\n", uid).as_bytes())) .unwrap_or_else(|e| panic!("could not write uid map: {}", e)); } } // Test runner /// Mimic normal test output (hackishly). #[cfg(target_os = "linux")] macro_rules! run_tests { ( $($test_fn:ident),* ) => {{ println!(); $( print!("test test_mount::{} ... ", stringify!($test_fn)); $test_fn(); println!("ok"); )* println!(); }} } #[cfg(target_os = "linux")] fn main() { use test_mount::{setup_namespaces, test_mount_tmpfs_without_flags_allows_rwx, test_mount_rdonly_disallows_write, test_mount_noexec_disallows_exec, test_mount_bind}; skip_if_cirrus!("Fails for an unknown reason Cirrus CI. Bug #1351"); setup_namespaces(); run_tests!(test_mount_tmpfs_without_flags_allows_rwx, test_mount_rdonly_disallows_write, test_mount_noexec_disallows_exec, test_mount_bind); } #[cfg(not(target_os = "linux"))] fn main() {}