[d-kernel] [PATCH v7 2/2] AltHa: add tests

["Vladimir D. Seleznev" <vseleznv@altlinux.org>]

---
 security/altha/altha-test.sh | 114 +++++++++++++++++++++++++++++++++++
 1 file changed, 114 insertions(+)
 create mode 100755 security/altha/altha-test.sh

diff --git a/security/altha/altha-test.sh b/security/altha/altha-test.sh
new file mode 100755
index 000000000000..b8057947eb4e
--- /dev/null
+++ b/security/altha/altha-test.sh
@@ -0,0 +1,114 @@
+#!/bin/bash -efu
+# SPDX-License-Identifier: GPL-2.0
+#
+# AltHa test for nosuid feature
+
+sysctl -q kernel.altha.nosuid.enabled >/dev/null || {
+	echo >&2 "AltHa is not enabled, quitting"
+	exit 2
+}
+
+ret=0
+
+num_failed=0
+num_tests=0
+
+nosuid_enabled=kernel.altha.nosuid.enabled
+nosuid_exeptions=kernel.altha.nosuid.exceptions
+ID_CMD=/usr/bin/id
+NC_CMD=/usr/bin/nc
+
+tmpdir="$(mktemp -d)"
+cleanup()
+{
+	[ ! -f "$tmpdir/id_perms" ] ||
+		chmod "$(cat "$tmpdir/id_perms")" "$ID_CMD"
+
+	local caps
+	if [ -f "$tmpdir/nc_caps" ]; then
+		caps="$(cat "$tmpdir/nc_caps")"
+		setcap "${caps:--r}" "$NC_CMD"
+	fi
+
+	[ ! -f "$tmpdir/nosuid_enabled" ] ||
+		sysctl "$nosuid_enabled=$(cat "$tmpdir/nosuid_enabled")"
+
+	[ ! -f "$tmpdir/nosuid_exceptions" ] ||
+		sysctl "$nosuid_exeptions=$(cat "$tmpdir/nosuid_exceptions")"
+
+	rm -r "$tmpdir"
+	exit "$@"
+}
+trap 'cleanup $?' EXIT QUIT INT ERR
+
+save_altha_state()
+{
+	sysctl "$nosuid_enabled" |cut -f3 -d' ' > "$tmpdir/nosuid_enabled"
+	sysctl "$nosuid_exeptions" |cut -f3 -d' ' > "$tmpdir/nosuid_exceptions"
+}
+
+run_test()
+{
+	local test_cmd="$1"; shift
+	local test_cond="$1"; shift
+
+	while IFS=$'\t' read -r precond expres; do
+		num_tests=$((num_tests + 1))
+
+		eval "$precond"
+		eval "$test_cmd" >"$tmpdir/result" 2>&1 ||:
+
+		if [ "$(cat "$tmpdir/result")" != "$expres" ]; then
+			echo >&2 "$test_cmd FAILED with $precond"
+			echo >&2 "expected result: $expres"
+			echo >&2 "actual result: $(cat "$tmpdir/result")"
+			num_failed=$((num_failed + 1))
+		fi
+	done <"$test_cond"
+}
+
+check_setuid()
+{
+	# save id perm and make it setuid
+	stat -c '%a' "$ID_CMD" > "$tmpdir/id_perms"
+	chmod 4755 "$ID_CMD"
+
+	local nobody_uid
+	nobody_uid="$(grep -E '^\<nobody\>' /etc/passwd |cut -f3 -d:)"
+
+	cat <<EOF >"$tmpdir/setuid_test"
+sysctl $nosuid_enabled=0	0
+sysctl $nosuid_enabled=1	$nobody_uid
+sysctl $nosuid_exeptions=$ID_CMD	0
+EOF
+
+
+	run_test 'su nobody -s /bin/bash -c "id -u"' "$tmpdir/setuid_test"
+}
+
+check_setcap()
+{
+	getcap "$NC_CMD" |cut -d' ' -f3 > "$tmpdir/nc_caps"
+	setcap cap_net_bind_service,cap_net_admin+ep "$NC_CMD"
+
+	cat <<EOF >"$tmpdir/setcap_test"
+sysctl $nosuid_enabled=0
+sysctl $nosuid_enabled=1	nc: Permission denied
+sysctl $nosuid_exeptions=$NC_CMD
+EOF
+
+	run_test "timeout 1 nc -l 9" "$tmpdir/setcap_test"
+}
+
+save_altha_state
+check_setuid
+check_setcap
+
+if [ "$num_failed" -ne 0 ]; then
+	echo >&2 "$num_failed of $num_tests tests FAILED"
+	ret=1
+else
+	echo >&2 "All $num_tests tests succeed"
+fi
+
+exit $ret
-- 
2.33.3