search

SELinuxProject / selinux-testsuite

This is the upstream SELinux testsuite which is designed as a basic set of regression tests for the SELinux kernel functionality.
GNU General Public License v2.0
54 stars 43 forks source link

Add AF_VSOCK SOCK_STREAM client/server test #75

Closed brazdil closed 3 years ago

brazdil commented 3 years ago

If AF_VSOCK and vsock_loopback are supported by the system, run a test that exchanges a byte of data between a client and a server listening on VMADDR_CID_LOCAL and a random port.

This tests that vsock_socket created with socket() inherits the SID of the current process, and that the vsock_socket returned by accept() inherits the same SID.

SOCK_DGRAM is not tested as it is only supported in the VMCI transport.

Signed-off-by: David Brazdil dbrazdil@google.com

brazdil commented 3 years ago

Tested on Fedora 33, stock and vanilla kernel. Note that this currently fails without this patch. Probably doesn't make much sense to merge this test before that patch lands in the kernel, and then a kernel version check will be needed here.

WOnder93 commented 3 years ago

Thanks, this looks very good! I have just two comments:

  1. The test currently only checks the positive case - i.e. that a domain that has the necessary permissions is able to perform all operations sucessfully, but it would be nice to also have negative test cases (i.e. check that a domain that has all but connect will fail at connect(2), etc.).
  2. This not currently documented (yeah, I should fix that...), but we generally prefer to have also testsuite patches posted to the list (I think there is at least 1 regular contributor to the testsuite who doesn't have a GH account). So if it wouldn't be too much trouble, could you please post next revisions [also] by email to selinux@vger.kernel.org? If you'd rather not, I can post them for you. (For some small fixes I wouldn't bother, but at least new test additions should rather go to the list ;)
brazdil commented 3 years ago

Hey Ondrej, no worries. Extended the test and will swing it by the list.

WOnder93 commented 3 years ago

Megrged via 0a3f86ab841efa0f2bbd048243a801915d6808ba, thanks!