tests/overlay: add tests for mmap(2) and mprotect(2)

Add asserts that verify the expected behavior of mmap(2) and mprotect(2)
on overlayfs files.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Tested-by: Paul Moore <paul@paul-moore.com>

Author: WOnder93

policy/test_overlayfs.te

@@ -21,6 +21,12 @@ files_type(test_overlay_files_ro_t)
 type test_overlay_files_rwx_t;
 files_type(test_overlay_files_rwx_t)
 
+type test_overlay_files_map_ro_t;
+files_type(test_overlay_files_map_ro_t)
+
+type test_overlay_files_map_rwx_t;
+files_type(test_overlay_files_map_rwx_t)
+
 type test_overlay_mounter_files_t;
 files_type(test_overlay_mounter_files_t)
 
@@ -60,7 +66,11 @@ allow test_overlay_mounter_t test_overlay_files_ro_t:file mounton;
 allow test_overlay_mounter_t test_overlay_files_ro_t:filesystem { mount relabelfrom relabelto };
 allow test_overlay_mounter_t test_overlay_files_rwx_t:{dir file} mounton;
 allow test_overlay_mounter_t test_overlay_files_rwx_t:filesystem { mount relabelfrom relabelto };
-can_exec(test_overlay_mounter_t, test_overlay_files_ro_t)
+allow test_overlay_mounter_t test_overlay_files_map_ro_t:file mounton;
+allow test_overlay_mounter_t test_overlay_files_map_ro_t:filesystem { mount relabelfrom relabelto };
+allow test_overlay_mounter_t test_overlay_files_map_rwx_t:{dir file} mounton;
+allow test_overlay_mounter_t test_overlay_files_map_rwx_t:filesystem { mount relabelfrom relabelto };
+can_exec(test_overlay_mounter_t, test_overlay_files_map_ro_t)
 
 #
 # Mounter should be allowed to search/read r/o directories and files
@@ -70,10 +80,14 @@ read_files_pattern(test_overlay_mounter_t, test_overlay_files_ro_t, test_overlay
 read_chr_files_pattern(test_overlay_mounter_t, test_overlay_files_ro_t, test_overlay_files_ro_t)
 read_blk_files_pattern(test_overlay_mounter_t, test_overlay_files_ro_t, test_overlay_files_ro_t)
 read_lnk_files_pattern(test_overlay_mounter_t, test_overlay_files_ro_t, test_overlay_files_ro_t)
+list_dirs_pattern(test_overlay_mounter_t, test_overlay_files_map_ro_t, test_overlay_files_map_ro_t)
+read_files_pattern(test_overlay_mounter_t, test_overlay_files_map_ro_t, test_overlay_files_map_ro_t)
+allow_map(test_overlay_mounter_t, test_overlay_files_map_ro_t, file)
 allow test_overlay_mounter_t test_overlay_files_ro_t:dir mounton;
 allow test_overlay_mounter_t test_overlay_mounter_files_t:dir mounton;
-allow test_overlay_mounter_t test_overlay_files_rwx_t:filesystem unmount;
+allow test_overlay_mounter_t test_overlay_files_map_rwx_t:filesystem unmount;
 manage_files_pattern(test_overlay_mounter_t, test_overlay_mounter_files_t, test_overlay_mounter_files_t)
+allow_map(test_overlay_mounter_t, test_overlay_mounter_files_t, file)
 # Needed for transition
 manage_dirs_pattern(test_overlay_mounter_t, test_overlay_mounter_files_t, test_overlay_mounter_files_t)
 #
@@ -90,6 +104,10 @@ manage_dirs_pattern(test_overlay_mounter_t, test_overlay_files_rwx_t, test_overl
 manage_lnk_files_pattern(test_overlay_mounter_t, test_overlay_files_rwx_t, test_overlay_files_rwx_t)
 manage_sock_files_pattern(test_overlay_mounter_t, test_overlay_files_rwx_t, test_overlay_files_rwx_t)
 
+manage_files_pattern(test_overlay_mounter_t, test_overlay_files_map_rwx_t, test_overlay_files_map_rwx_t)
+manage_dirs_pattern(test_overlay_mounter_t, test_overlay_files_map_rwx_t, test_overlay_files_map_rwx_t)
+allow_map(test_overlay_mounter_t, test_overlay_files_map_rwx_t, file)
+
 manage_files_pattern(test_overlay_mounter_t, test_overlay_transition_files_t, test_overlay_transition_files_t)
 
 #
@@ -121,7 +139,11 @@ list_dirs_pattern(test_overlay_client_t, test_overlay_files_ro_t, test_overlay_f
 read_lnk_files_pattern(test_overlay_client_t, test_overlay_files_ro_t, test_overlay_files_ro_t)
 read_chr_files_pattern(test_overlay_client_t, test_overlay_files_ro_t, test_overlay_files_ro_t)
 read_sock_files_pattern(test_overlay_client_t, test_overlay_files_ro_t, test_overlay_files_ro_t)
-can_exec(test_overlay_client_t, test_overlay_files_ro_t)
+
+read_files_pattern(test_overlay_client_t, test_overlay_files_map_ro_t, test_overlay_files_map_ro_t)
+allow_map(test_overlay_client_t, test_overlay_files_map_ro_t, file)
+can_exec(test_overlay_client_t, test_overlay_files_map_ro_t)
+allow test_overlay_client_t test_overlay_files_map_ro_t:file entrypoint;
 
 #
 # Client should be allowed to execute/write/search/read r/w/x directories and files
@@ -131,15 +153,22 @@ manage_dirs_pattern(test_overlay_client_t, test_overlay_files_rwx_t, test_overla
 manage_lnk_files_pattern(test_overlay_client_t, test_overlay_files_rwx_t, test_overlay_files_rwx_t)
 rw_chr_files_pattern(test_overlay_client_t, test_overlay_files_rwx_t, test_overlay_files_rwx_t)
 manage_sock_files_pattern(test_overlay_client_t, test_overlay_files_rwx_t, test_overlay_files_rwx_t)
-can_exec(test_overlay_client_t, test_overlay_files_rwx_t)
-allow test_overlay_client_t test_overlay_files_rwx_t:file entrypoint;
+
+manage_files_pattern(test_overlay_client_t, test_overlay_files_map_rwx_t, test_overlay_files_map_rwx_t)
+manage_dirs_pattern(test_overlay_client_t, test_overlay_files_map_rwx_t, test_overlay_files_map_rwx_t)
+manage_lnk_files_pattern(test_overlay_client_t, test_overlay_files_map_rwx_t, test_overlay_files_map_rwx_t)
+rw_chr_files_pattern(test_overlay_client_t, test_overlay_files_map_rwx_t, test_overlay_files_map_rwx_t)
+manage_sock_files_pattern(test_overlay_client_t, test_overlay_files_map_rwx_t, test_overlay_files_map_rwx_t)
+allow_map(test_overlay_client_t, test_overlay_files_map_rwx_t, file)
+can_exec(test_overlay_client_t, test_overlay_files_map_rwx_t)
+allow test_overlay_client_t test_overlay_files_map_rwx_t:file entrypoint;
 
 #
 # Client needs to manage test_overlay_transition_files_t and transition on file named "transition"
 #
 manage_files_pattern(test_overlay_client_t, test_overlay_transition_files_t, test_overlay_transition_files_t)
 manage_dirs_pattern(test_overlay_client_t, test_overlay_transition_files_t, test_overlay_transition_files_t)
-filetrans_pattern(test_overlay_client_t, test_overlay_files_rwx_t, test_overlay_transition_files_t, file, "transition")
+filetrans_pattern(test_overlay_client_t, test_overlay_files_map_rwx_t, test_overlay_transition_files_t, file, "transition")
 
 #
 # Client needs to search test_file_t directory and execute tests
@@ -153,7 +182,9 @@ can_exec(test_overlay_client_t,test_file_t)
 #
 allow test_overlay_client_t test_overlay_files_rwx_t:file { relabelto relabelfrom };
 allow test_overlay_mounter_t test_overlay_files_rwx_t:file { relabelto relabelfrom };
-can_exec(test_overlay_mounter_t, test_overlay_files_rwx_t)
+allow test_overlay_client_t test_overlay_files_map_rwx_t:file { relabelto relabelfrom };
+allow test_overlay_mounter_t test_overlay_files_map_rwx_t:file { relabelto relabelfrom };
+can_exec(test_overlay_mounter_t, test_overlay_files_map_rwx_t)
 
 #
 # Server needs to manage socket files

tests/overlay/.gitignore

@@ -1 +1,2 @@
 access
+map_access

tests/overlay/map_access.c

@@ -0,0 +1,55 @@
+#include <unistd.h>
+#include <fcntl.h>
+
+#include <sys/mman.h>
+
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+
+int main(int argc, const char **argv)
+{
+	const char *file;
+	void *ptr;
+	int rdonly, fd, ret;
+
+	if (argc != 3 || (strcmp(argv[2], "R_OK") && strcmp(argv[2], "W_OK"))) {
+		fprintf(stderr, "Usage %s <file> R_OK|W_OK\n", argv[0]);
+		return EINVAL;
+	}
+
+	file = argv[1];
+	rdonly = strcmp(argv[2], "R_OK") == 0;
+
+	fd = open(file, rdonly ? O_RDONLY : O_RDWR);
+	if (fd == -1) {
+		perror("open");
+		return 2;
+	}
+
+	/* try direct mmap */
+	ptr = mmap(NULL, 1, rdonly ? PROT_READ : PROT_READ | PROT_WRITE,
+		   MAP_SHARED, fd, 0);
+	if (ptr == MAP_FAILED) {
+		perror("mmap");
+		return 3;
+	}
+	munmap(ptr, 1);
+
+	/* try mmap with PROT_NONE followed by mprotect with full access */
+	ptr = mmap(NULL, 1, PROT_NONE, MAP_SHARED, fd, 0);
+	if (ptr == MAP_FAILED) {
+		perror("mmap PROT_NONE");
+		return 4;
+	}
+
+	ret = mprotect(ptr, 1, rdonly ? PROT_READ : PROT_READ | PROT_WRITE);
+	if (ret == -1) {
+		perror("mprotect");
+		return 5;
+	}
+
+	munmap(ptr, 1);
+	close(fd);
+	return 0;
+}

tests/overlay/setup-overlay

@@ -12,6 +12,8 @@ setup () {
     mkdir -p $BASEDIR/lower/readdir $BASEDIR/lower/writedir $BASEDIR/lower/noaccessdir $BASEDIR/lower/mounterdir
     echo read > $BASEDIR/lower/readfile
     echo write > $BASEDIR/lower/writefile
+    echo mapread > $BASEDIR/lower/mapreadfile
+    echo mapwrite > $BASEDIR/lower/mapwritefile
     echo noaccess > $BASEDIR/lower/noaccessfile
     echo client_nounlink > $BASEDIR/lower/client_nounlinkfile
     echo mounter > $BASEDIR/lower/mounterfile
@@ -35,7 +37,11 @@ setup () {
     chcon -t test_overlay_mounter_files_t $BASEDIR/lower/mounterfile $BASEDIR/lower/mounterdir $BASEDIR/lower/null_mounter
     # Label writefile on lower with a type that is writable by the client which
     # should allow copy up and write.
-    chcon -t test_overlay_files_rwx_t $BASEDIR/lower/writefile $BASEDIR/lower/writedir $BASEDIR/lower/null_write $BASEDIR/lower/transition $BASEDIR/lower/goodentrypoint
+    chcon -t test_overlay_files_rwx_t $BASEDIR/lower/writefile $BASEDIR/lower/writedir $BASEDIR/lower/null_write $BASEDIR/lower/transition
+    # Label mapreadfile and mapwritefile with the appropriate types that
+    # allow map access
+    chcon -t test_overlay_files_map_ro_t $BASEDIR/lower/mapreadfile $BASEDIR/lower/goodentrypoint
+    chcon -t test_overlay_files_map_rwx_t $BASEDIR/lower/mapwritefile
     # Create a directory per container.
     mkdir -p $BASEDIR/container1
 
@@ -48,7 +54,7 @@ setup () {
     # creation and to prevent permission problems when overlayfs
     # internally creates files on behalf of the current process.
     chcon -R -t test_overlay_mounter_files_t $BASEDIR/container1/work $BASEDIR/container1/merged
-    chcon -R -t test_overlay_files_rwx_t  $BASEDIR/container1/upper
+    chcon -R -t test_overlay_files_map_rwx_t  $BASEDIR/container1/upper
 }
 
 # Mount the overlays.