test/sandbox: verify outcome via mountinfo
Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
parent
1eb837eab8
commit
0eb1bc6301
SSH Key Fingerprint:
SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
@ -23,6 +23,9 @@
|
||||
go,
|
||||
gcc,
|
||||
|
||||
# for check
|
||||
util-linux,
|
||||
|
||||
glibc, # for ldd
|
||||
withStatic ? stdenv.hostPlatform.isStatic,
|
||||
}:
|
||||
@ -118,6 +121,7 @@ buildGoModule rec {
|
||||
go
|
||||
gcc
|
||||
xorg.xorgproto
|
||||
util-linux
|
||||
]
|
||||
++ buildInputs
|
||||
++ nativeBuildInputs;
|
||||
|
||||
@ -11,7 +11,6 @@ import (
|
||||
"io/fs"
|
||||
"log"
|
||||
"os"
|
||||
"slices"
|
||||
)
|
||||
|
||||
var (
|
||||
@ -24,15 +23,15 @@ func printf(format string, v ...any) { printfFunc(format, v...) }
|
||||
func fatalf(format string, v ...any) { fatalfFunc(format, v...) }
|
||||
|
||||
type TestCase struct {
|
||||
FS *FS `json:"fs"`
|
||||
Mount []*Mntent `json:"mount"`
|
||||
Seccomp bool `json:"seccomp"`
|
||||
FS *FS `json:"fs"`
|
||||
Mount []*MountinfoEntry `json:"mount"`
|
||||
Seccomp bool `json:"seccomp"`
|
||||
}
|
||||
|
||||
type T struct {
|
||||
FS fs.FS
|
||||
|
||||
MountsPath, PMountsPath string
|
||||
MountsPath string
|
||||
}
|
||||
|
||||
func (t *T) MustCheckFile(wantFilePath string) {
|
||||
@ -50,47 +49,23 @@ func (t *T) MustCheck(want *TestCase) {
|
||||
printf("[SKIP] skipping fs check")
|
||||
}
|
||||
|
||||
if want.Mount != nil && t.PMountsPath != "" {
|
||||
pm := mustOpenMounts(t.PMountsPath)
|
||||
passthruMounts := slices.AppendSeq(make([]*Mntent, 0, 128), pm.Entries())
|
||||
if err := pm.Err(); err != nil {
|
||||
fatalf("cannot parse host mounts: %v", err)
|
||||
}
|
||||
|
||||
for _, e := range want.Mount {
|
||||
if e.Opts == "host_passthrough" {
|
||||
for _, ent := range passthruMounts {
|
||||
if e.FSName == ent.FSName && e.Type == ent.Type {
|
||||
// special case for tmpfs bind mounts
|
||||
if e.FSName == "tmpfs" && e.Dir != ent.Dir {
|
||||
continue
|
||||
}
|
||||
|
||||
e.Opts = ent.Opts
|
||||
goto out
|
||||
}
|
||||
}
|
||||
fatalf("host passthrough missing %q", e.FSName)
|
||||
out:
|
||||
}
|
||||
}
|
||||
|
||||
f := mustOpenMounts(t.MountsPath)
|
||||
if want.Mount != nil {
|
||||
m := mustParseMountinfo(t.MountsPath)
|
||||
i := 0
|
||||
for e := range f.Entries() {
|
||||
for ent := range m.Entries() {
|
||||
if i == len(want.Mount) {
|
||||
fatalf("got more than %d entries", i)
|
||||
}
|
||||
if !e.Is(want.Mount[i]) {
|
||||
fatalf("entry %d\n got: %s\nwant: %s", i,
|
||||
e, want.Mount[i])
|
||||
if !ent.EqualWithIgnore(want.Mount[i], "//ignore") {
|
||||
printf("[FAIL] %s", ent)
|
||||
} else {
|
||||
printf("[ OK ] %s", ent)
|
||||
}
|
||||
printf("[ OK ] %s", e)
|
||||
|
||||
i++
|
||||
}
|
||||
if err := f.Err(); err != nil {
|
||||
fatalf("cannot parse mounts: %v", err)
|
||||
if err := m.Err(); err != nil {
|
||||
fatalf("%v", err)
|
||||
}
|
||||
} else {
|
||||
printf("[SKIP] skipping mounts check")
|
||||
@ -115,11 +90,11 @@ func mustDecode(wantFilePath string, v any) {
|
||||
}
|
||||
}
|
||||
|
||||
func mustOpenMounts(name string) *MountsFile {
|
||||
if f, err := OpenMounts(name); err != nil {
|
||||
fatalf("cannot open mounts %q: %v", name, err)
|
||||
func mustParseMountinfo(name string) *Mountinfo {
|
||||
m := NewMountinfo(name)
|
||||
if err := m.Parse(); err != nil {
|
||||
fatalf("%v", err)
|
||||
panic("unreachable")
|
||||
} else {
|
||||
return f
|
||||
}
|
||||
return m
|
||||
}
|
||||
|
||||
@ -1,6 +1,8 @@
|
||||
{
|
||||
writeText,
|
||||
buildGoModule,
|
||||
pkg-config,
|
||||
util-linux,
|
||||
|
||||
version,
|
||||
}:
|
||||
@ -11,6 +13,9 @@ buildGoModule {
|
||||
src = ../.;
|
||||
vendorHash = null;
|
||||
|
||||
buildInputs = [ util-linux ];
|
||||
nativeBuildInputs = [ pkg-config ];
|
||||
|
||||
preBuild = ''
|
||||
go mod init git.gensokyo.uk/security/fortify/test >& /dev/null
|
||||
cp ${writeText "main.go" ''
|
||||
@ -19,7 +24,7 @@ buildGoModule {
|
||||
import "os"
|
||||
import "git.gensokyo.uk/security/fortify/test/sandbox"
|
||||
|
||||
func main() { (&sandbox.T{FS: os.DirFS("/"), PMountsPath: "/.fortify/mounts"}).MustCheckFile(os.Args[1]) }
|
||||
func main() { (&sandbox.T{FS: os.DirFS("/")}).MustCheckFile(os.Args[1]) }
|
||||
''} main.go
|
||||
'';
|
||||
}
|
||||
|
||||
@ -14,14 +14,18 @@ let
|
||||
;
|
||||
};
|
||||
|
||||
ent = fsname: dir: type: opts: freq: passno: {
|
||||
ignore = "//ignore";
|
||||
|
||||
ent = root: target: vfs_optstr: fstype: source: fs_optstr: {
|
||||
id = -1;
|
||||
parent = -1;
|
||||
inherit
|
||||
fsname
|
||||
dir
|
||||
type
|
||||
opts
|
||||
freq
|
||||
passno
|
||||
root
|
||||
target
|
||||
vfs_optstr
|
||||
fstype
|
||||
source
|
||||
fs_optstr
|
||||
;
|
||||
};
|
||||
|
||||
@ -34,6 +38,7 @@ let
|
||||
inherit
|
||||
fs
|
||||
ent
|
||||
ignore
|
||||
;
|
||||
};
|
||||
in
|
||||
@ -44,12 +49,6 @@ let
|
||||
share = foot;
|
||||
packages = [ ];
|
||||
command = "${checkSandbox tc.name tc.want} > /dev/console";
|
||||
extraPaths = [
|
||||
{
|
||||
src = "/proc/mounts";
|
||||
dst = "/.fortify/mounts";
|
||||
}
|
||||
];
|
||||
};
|
||||
in
|
||||
{
|
||||
|
||||
@ -1,4 +1,8 @@
|
||||
{ fs, ent }:
|
||||
{
|
||||
fs,
|
||||
ent,
|
||||
ignore,
|
||||
}:
|
||||
{
|
||||
name = "mapuid";
|
||||
tty = false;
|
||||
@ -12,7 +16,6 @@
|
||||
fortify = fs "16d" null null;
|
||||
init0 = fs "80001ff" null null;
|
||||
} null;
|
||||
mounts = fs "124" null null;
|
||||
} null;
|
||||
bin = fs "800001ed" { sh = fs "80001ff" null null; } null;
|
||||
dev = fs "800001ed" {
|
||||
@ -182,42 +185,41 @@
|
||||
} null;
|
||||
|
||||
mount = [
|
||||
(ent "tmpfs" "/" "tmpfs" "rw,nosuid,nodev,relatime,uid=1000003,gid=1000003" 0 0)
|
||||
(ent "proc" "/proc" "proc" "rw,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "tmpfs" "/.fortify" "tmpfs" "rw,nosuid,nodev,relatime,size=4k,mode=755,uid=1000003,gid=1000003" 0 0)
|
||||
(ent "tmpfs" "/dev" "tmpfs" "rw,nosuid,nodev,relatime,mode=755,uid=1000003,gid=1000003" 0 0)
|
||||
(ent "devtmpfs" "/dev/null" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/zero" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/full" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/random" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/urandom" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/tty" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devpts" "/dev/pts" "devpts" "rw,nosuid,noexec,relatime,mode=620,ptmxmode=666" 0 0)
|
||||
(ent "mqueue" "/dev/mqueue" "mqueue" "rw,relatime" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/bin" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/usr/bin" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "overlay" "/nix/store" "overlay" "ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on" 0 0)
|
||||
(ent "overlay" "/run/current-system" "overlay" "ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on" 0 0)
|
||||
(ent "sysfs" "/sys/block" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "sysfs" "/sys/bus" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "sysfs" "/sys/class" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "sysfs" "/sys/dev" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "sysfs" "/sys/devices" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "overlay" "/run/opengl-driver" "overlay" "ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on" 0 0)
|
||||
(ent "devtmpfs" "/dev/dri" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "proc" "/.fortify/mounts" "proc" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/.fortify/etc" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "tmpfs" "/run/user" "tmpfs" "rw,nosuid,nodev,relatime,size=1024k,mode=755,uid=1000003,gid=1000003" 0 0)
|
||||
(ent "tmpfs" "/run/user/1000" "tmpfs" "rw,nosuid,nodev,relatime,size=8192k,mode=755,uid=1000003,gid=1000003" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/tmp" "ext4" "rw,nosuid,nodev,relatime" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/var/lib/fortify/u0/a3" "ext4" "rw,nosuid,nodev,relatime" 0 0)
|
||||
(ent "tmpfs" "/etc/passwd" "tmpfs" "ro,nosuid,nodev,relatime,uid=1000003,gid=1000003" 0 0)
|
||||
(ent "tmpfs" "/etc/group" "tmpfs" "ro,nosuid,nodev,relatime,uid=1000003,gid=1000003" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/run/user/1000/wayland-0" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "tmpfs" "/run/user/1000/pulse/native" "tmpfs" "host_passthrough" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/run/user/1000/bus" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "tmpfs" "/var/run/nscd" "tmpfs" "rw,nosuid,nodev,relatime,size=8k,mode=755,uid=1000003,gid=1000003" 0 0)
|
||||
(ent "overlay" "/.fortify/sbin/fortify" "overlay" "ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on" 0 0)
|
||||
(ent "/newroot" "/" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,uid=1000003,gid=1000003")
|
||||
(ent "/" "/proc" "rw,nosuid,nodev,noexec,relatime" "proc" "proc" "rw")
|
||||
(ent "/" "/.fortify" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=4k,mode=755,uid=1000003,gid=1000003")
|
||||
(ent "/" "/dev" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,mode=755,uid=1000003,gid=1000003")
|
||||
(ent "/null" "/dev/null" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/zero" "/dev/zero" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/full" "/dev/full" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/random" "/dev/random" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/urandom" "/dev/urandom" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/tty" "/dev/tty" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/" "/dev/pts" "rw,nosuid,noexec,relatime" "devpts" "devpts" "rw,mode=620,ptmxmode=666")
|
||||
(ent "/" "/dev/mqueue" "rw,relatime" "mqueue" "mqueue" "rw")
|
||||
(ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/" "/nix/store" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on")
|
||||
(ent ignore "/run/current-system" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on")
|
||||
(ent "/block" "/sys/block" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent "/bus" "/sys/bus" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent "/class" "/sys/class" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent "/dev" "/sys/dev" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent "/devices" "/sys/devices" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent ignore "/run/opengl-driver" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on")
|
||||
(ent "/dri" "/dev/dri" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/etc" "/.fortify/etc" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/" "/run/user" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=1024k,mode=755,uid=1000003,gid=1000003")
|
||||
(ent "/" "/run/user/65534" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=8192k,mode=755,uid=1000003,gid=1000003")
|
||||
(ent "/tmp/fortify.1000/tmpdir/1" "/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/var/lib/fortify/u0/a1" "/var/lib/fortify/u0/a1" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,uid=1000003,gid=1000003")
|
||||
(ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,uid=1000003,gid=1000003")
|
||||
(ent ignore "/run/user/65534/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent ignore "/run/user/65534/pulse/native" "ro,nosuid,nodev,relatime" "tmpfs" "tmpfs" ignore)
|
||||
(ent ignore "/run/user/65534/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/" "/var/run/nscd" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=8k,mode=755,uid=1000003,gid=1000003")
|
||||
(ent ignore "/.fortify/sbin/fortify" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on")
|
||||
];
|
||||
|
||||
seccomp = true;
|
||||
|
||||
@ -1,4 +1,8 @@
|
||||
{ fs, ent }:
|
||||
{
|
||||
fs,
|
||||
ent,
|
||||
ignore,
|
||||
}:
|
||||
{
|
||||
name = "preset";
|
||||
tty = false;
|
||||
@ -12,7 +16,6 @@
|
||||
fortify = fs "16d" null null;
|
||||
init0 = fs "80001ff" null null;
|
||||
} null;
|
||||
mounts = fs "124" null null;
|
||||
} null;
|
||||
bin = fs "800001ed" { sh = fs "80001ff" null null; } null;
|
||||
dev = fs "800001ed" {
|
||||
@ -182,42 +185,41 @@
|
||||
} null;
|
||||
|
||||
mount = [
|
||||
(ent "tmpfs" "/" "tmpfs" "rw,nosuid,nodev,relatime,uid=1000001,gid=1000001" 0 0)
|
||||
(ent "proc" "/proc" "proc" "rw,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "tmpfs" "/.fortify" "tmpfs" "rw,nosuid,nodev,relatime,size=4k,mode=755,uid=1000001,gid=1000001" 0 0)
|
||||
(ent "tmpfs" "/dev" "tmpfs" "rw,nosuid,nodev,relatime,mode=755,uid=1000001,gid=1000001" 0 0)
|
||||
(ent "devtmpfs" "/dev/null" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/zero" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/full" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/random" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/urandom" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/tty" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devpts" "/dev/pts" "devpts" "rw,nosuid,noexec,relatime,mode=620,ptmxmode=666" 0 0)
|
||||
(ent "mqueue" "/dev/mqueue" "mqueue" "rw,relatime" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/bin" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/usr/bin" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "overlay" "/nix/store" "overlay" "ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on" 0 0)
|
||||
(ent "overlay" "/run/current-system" "overlay" "ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on" 0 0)
|
||||
(ent "sysfs" "/sys/block" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "sysfs" "/sys/bus" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "sysfs" "/sys/class" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "sysfs" "/sys/dev" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "sysfs" "/sys/devices" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "overlay" "/run/opengl-driver" "overlay" "ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on" 0 0)
|
||||
(ent "devtmpfs" "/dev/dri" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "proc" "/.fortify/mounts" "proc" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/.fortify/etc" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "tmpfs" "/run/user" "tmpfs" "rw,nosuid,nodev,relatime,size=1024k,mode=755,uid=1000001,gid=1000001" 0 0)
|
||||
(ent "tmpfs" "/run/user/65534" "tmpfs" "rw,nosuid,nodev,relatime,size=8192k,mode=755,uid=1000001,gid=1000001" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/tmp" "ext4" "rw,nosuid,nodev,relatime" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/var/lib/fortify/u0/a1" "ext4" "rw,nosuid,nodev,relatime" 0 0)
|
||||
(ent "tmpfs" "/etc/passwd" "tmpfs" "ro,nosuid,nodev,relatime,uid=1000001,gid=1000001" 0 0)
|
||||
(ent "tmpfs" "/etc/group" "tmpfs" "ro,nosuid,nodev,relatime,uid=1000001,gid=1000001" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/run/user/65534/wayland-0" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "tmpfs" "/run/user/65534/pulse/native" "tmpfs" "host_passthrough" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/run/user/65534/bus" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "tmpfs" "/var/run/nscd" "tmpfs" "rw,nosuid,nodev,relatime,size=8k,mode=755,uid=1000001,gid=1000001" 0 0)
|
||||
(ent "overlay" "/.fortify/sbin/fortify" "overlay" "ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on" 0 0)
|
||||
(ent "/newroot" "/" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,uid=1000001,gid=1000001")
|
||||
(ent "/" "/proc" "rw,nosuid,nodev,noexec,relatime" "proc" "proc" "rw")
|
||||
(ent "/" "/.fortify" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=4k,mode=755,uid=1000001,gid=1000001")
|
||||
(ent "/" "/dev" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,mode=755,uid=1000001,gid=1000001")
|
||||
(ent "/null" "/dev/null" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/zero" "/dev/zero" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/full" "/dev/full" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/random" "/dev/random" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/urandom" "/dev/urandom" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/tty" "/dev/tty" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/" "/dev/pts" "rw,nosuid,noexec,relatime" "devpts" "devpts" "rw,mode=620,ptmxmode=666")
|
||||
(ent "/" "/dev/mqueue" "rw,relatime" "mqueue" "mqueue" "rw")
|
||||
(ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/" "/nix/store" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on")
|
||||
(ent ignore "/run/current-system" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on")
|
||||
(ent "/block" "/sys/block" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent "/bus" "/sys/bus" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent "/class" "/sys/class" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent "/dev" "/sys/dev" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent "/devices" "/sys/devices" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent ignore "/run/opengl-driver" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on")
|
||||
(ent "/dri" "/dev/dri" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/etc" "/.fortify/etc" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/" "/run/user" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=1024k,mode=755,uid=1000001,gid=1000001")
|
||||
(ent "/" "/run/user/65534" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=8192k,mode=755,uid=1000001,gid=1000001")
|
||||
(ent "/tmp/fortify.1000/tmpdir/1" "/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/var/lib/fortify/u0/a1" "/var/lib/fortify/u0/a1" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,uid=1000001,gid=1000001")
|
||||
(ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,uid=1000001,gid=1000001")
|
||||
(ent ignore "/run/user/65534/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent ignore "/run/user/65534/pulse/native" "ro,nosuid,nodev,relatime" "tmpfs" "tmpfs" ignore)
|
||||
(ent ignore "/run/user/65534/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/" "/var/run/nscd" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=8k,mode=755,uid=1000001,gid=1000001")
|
||||
(ent ignore "/.fortify/sbin/fortify" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on")
|
||||
];
|
||||
|
||||
seccomp = true;
|
||||
|
||||
@ -1,4 +1,8 @@
|
||||
{ fs, ent }:
|
||||
{
|
||||
fs,
|
||||
ent,
|
||||
ignore,
|
||||
}:
|
||||
{
|
||||
name = "tty";
|
||||
tty = true;
|
||||
@ -12,7 +16,6 @@
|
||||
fortify = fs "16d" null null;
|
||||
init0 = fs "80001ff" null null;
|
||||
} null;
|
||||
mounts = fs "124" null null;
|
||||
} null;
|
||||
bin = fs "800001ed" { sh = fs "80001ff" null null; } null;
|
||||
dev = fs "800001ed" {
|
||||
@ -182,42 +185,41 @@
|
||||
} null;
|
||||
|
||||
mount = [
|
||||
(ent "tmpfs" "/" "tmpfs" "rw,nosuid,nodev,relatime,uid=1000002,gid=1000002" 0 0)
|
||||
(ent "proc" "/proc" "proc" "rw,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "tmpfs" "/.fortify" "tmpfs" "rw,nosuid,nodev,relatime,size=4k,mode=755,uid=1000002,gid=1000002" 0 0)
|
||||
(ent "tmpfs" "/dev" "tmpfs" "rw,nosuid,nodev,relatime,mode=755,uid=1000002,gid=1000002" 0 0)
|
||||
(ent "devtmpfs" "/dev/null" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/zero" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/full" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/random" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/urandom" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devtmpfs" "/dev/tty" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "devpts" "/dev/pts" "devpts" "rw,nosuid,noexec,relatime,mode=620,ptmxmode=666" 0 0)
|
||||
(ent "mqueue" "/dev/mqueue" "mqueue" "rw,relatime" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/bin" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/usr/bin" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "overlay" "/nix/store" "overlay" "ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on" 0 0)
|
||||
(ent "overlay" "/run/current-system" "overlay" "ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on" 0 0)
|
||||
(ent "sysfs" "/sys/block" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "sysfs" "/sys/bus" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "sysfs" "/sys/class" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "sysfs" "/sys/dev" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "sysfs" "/sys/devices" "sysfs" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "overlay" "/run/opengl-driver" "overlay" "ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on" 0 0)
|
||||
(ent "devtmpfs" "/dev/dri" "devtmpfs" "host_passthrough" 0 0)
|
||||
(ent "proc" "/.fortify/mounts" "proc" "ro,nosuid,nodev,noexec,relatime" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/.fortify/etc" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "tmpfs" "/run/user" "tmpfs" "rw,nosuid,nodev,relatime,size=1024k,mode=755,uid=1000002,gid=1000002" 0 0)
|
||||
(ent "tmpfs" "/run/user/65534" "tmpfs" "rw,nosuid,nodev,relatime,size=8192k,mode=755,uid=1000002,gid=1000002" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/tmp" "ext4" "rw,nosuid,nodev,relatime" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/var/lib/fortify/u0/a2" "ext4" "rw,nosuid,nodev,relatime" 0 0)
|
||||
(ent "tmpfs" "/etc/passwd" "tmpfs" "ro,nosuid,nodev,relatime,uid=1000002,gid=1000002" 0 0)
|
||||
(ent "tmpfs" "/etc/group" "tmpfs" "ro,nosuid,nodev,relatime,uid=1000002,gid=1000002" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/run/user/65534/wayland-0" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "tmpfs" "/run/user/65534/pulse/native" "tmpfs" "host_passthrough" 0 0)
|
||||
(ent "/dev/disk/by-label/nixos" "/run/user/65534/bus" "ext4" "ro,nosuid,nodev,relatime" 0 0)
|
||||
(ent "tmpfs" "/var/run/nscd" "tmpfs" "rw,nosuid,nodev,relatime,size=8k,mode=755,uid=1000002,gid=1000002" 0 0)
|
||||
(ent "overlay" "/.fortify/sbin/fortify" "overlay" "ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on" 0 0)
|
||||
(ent "/newroot" "/" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,uid=1000002,gid=1000002")
|
||||
(ent "/" "/proc" "rw,nosuid,nodev,noexec,relatime" "proc" "proc" "rw")
|
||||
(ent "/" "/.fortify" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=4k,mode=755,uid=1000002,gid=1000002")
|
||||
(ent "/" "/dev" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,mode=755,uid=1000002,gid=1000002")
|
||||
(ent "/null" "/dev/null" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/zero" "/dev/zero" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/full" "/dev/full" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/random" "/dev/random" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/urandom" "/dev/urandom" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/tty" "/dev/tty" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/" "/dev/pts" "rw,nosuid,noexec,relatime" "devpts" "devpts" "rw,mode=620,ptmxmode=666")
|
||||
(ent "/" "/dev/mqueue" "rw,relatime" "mqueue" "mqueue" "rw")
|
||||
(ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/" "/nix/store" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on")
|
||||
(ent ignore "/run/current-system" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on")
|
||||
(ent "/block" "/sys/block" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent "/bus" "/sys/bus" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent "/class" "/sys/class" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent "/dev" "/sys/dev" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent "/devices" "/sys/devices" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
|
||||
(ent ignore "/run/opengl-driver" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on")
|
||||
(ent "/dri" "/dev/dri" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
|
||||
(ent "/etc" "/.fortify/etc" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/" "/run/user" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=1024k,mode=755,uid=1000002,gid=1000002")
|
||||
(ent "/" "/run/user/65534" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=8192k,mode=755,uid=1000002,gid=1000002")
|
||||
(ent "/tmp/fortify.1000/tmpdir/1" "/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/var/lib/fortify/u0/a1" "/var/lib/fortify/u0/a1" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,uid=1000002,gid=1000002")
|
||||
(ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,uid=1000002,gid=1000002")
|
||||
(ent ignore "/run/user/65534/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent ignore "/run/user/65534/pulse/native" "ro,nosuid,nodev,relatime" "tmpfs" "tmpfs" ignore)
|
||||
(ent ignore "/run/user/65534/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
|
||||
(ent "/" "/var/run/nscd" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=8k,mode=755,uid=1000002,gid=1000002")
|
||||
(ent ignore "/.fortify/sbin/fortify" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on")
|
||||
];
|
||||
|
||||
seccomp = true;
|
||||
|
||||
@ -1,16 +1,18 @@
|
||||
package sandbox
|
||||
|
||||
/*
|
||||
#cgo linux pkg-config: --static mount
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
#include <mntent.h>
|
||||
#include <libmount.h>
|
||||
|
||||
const char *F_PROC_MOUNTS = "";
|
||||
const char *F_SET_TYPE = "r";
|
||||
const char *F_MOUNTINFO_PATH = "/proc/self/mountinfo";
|
||||
*/
|
||||
import "C"
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"iter"
|
||||
"runtime"
|
||||
@ -18,147 +20,138 @@ import (
|
||||
"unsafe"
|
||||
)
|
||||
|
||||
type Mntent struct {
|
||||
/* name of mounted filesystem */
|
||||
FSName string `json:"fsname"`
|
||||
/* filesystem path prefix */
|
||||
Dir string `json:"dir"`
|
||||
/* mount type (see mntent.h) */
|
||||
Type string `json:"type"`
|
||||
/* mount options (see mntent.h) */
|
||||
Opts string `json:"opts"`
|
||||
/* dump frequency in days */
|
||||
Freq int `json:"freq"`
|
||||
/* pass number on parallel fsck */
|
||||
Passno int `json:"passno"`
|
||||
}
|
||||
var (
|
||||
ErrMountinfoParse = errors.New("invalid mountinfo records")
|
||||
ErrMountinfoIter = errors.New("cannot allocate iterator")
|
||||
ErrMountinfoFault = errors.New("cannot iterate on filesystems")
|
||||
)
|
||||
|
||||
func (e *Mntent) String() string {
|
||||
return fmt.Sprintf("%s %s %s %s %d %d",
|
||||
e.FSName, e.Dir, e.Type, e.Opts, e.Freq, e.Passno)
|
||||
}
|
||||
type (
|
||||
Mountinfo struct {
|
||||
mu sync.RWMutex
|
||||
p string
|
||||
err error
|
||||
|
||||
func (e *Mntent) Is(want *Mntent) bool {
|
||||
if want == nil {
|
||||
return e == nil
|
||||
tb *C.struct_libmnt_table
|
||||
itr *C.struct_libmnt_iter
|
||||
|
||||
fs *C.struct_libmnt_fs
|
||||
}
|
||||
return (e.FSName == want.FSName || want.FSName == "\x00") &&
|
||||
(e.Dir == want.Dir || want.Dir == "\x00") &&
|
||||
(e.Type == want.Type || want.Type == "\x00") &&
|
||||
(e.Opts == want.Opts || want.Opts == "\x00") &&
|
||||
(e.Freq == want.Freq || want.Freq == -1) &&
|
||||
(e.Passno == want.Passno || want.Passno == -1)
|
||||
}
|
||||
|
||||
type MountsFile struct {
|
||||
m *mounts
|
||||
mu sync.Mutex
|
||||
done bool
|
||||
}
|
||||
|
||||
func OpenMounts(name string) (*MountsFile, error) {
|
||||
f := new(MountsFile)
|
||||
f.m = new(mounts)
|
||||
f.m.p = name
|
||||
return f, f.m.open()
|
||||
}
|
||||
|
||||
func (f *MountsFile) Err() error { return f.m.Err() }
|
||||
func (f *MountsFile) Entries() iter.Seq[*Mntent] {
|
||||
return func(yield func(*Mntent) bool) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
if f.done {
|
||||
return
|
||||
}
|
||||
|
||||
for f.m.scan() {
|
||||
e := new(Mntent)
|
||||
f.m.copy(e)
|
||||
if !yield(e) {
|
||||
return
|
||||
}
|
||||
}
|
||||
f.done = true
|
||||
f.m.close()
|
||||
// MountinfoEntry represents deterministic mountinfo parts of a libmnt_fs entry.
|
||||
MountinfoEntry struct {
|
||||
// mount ID: a unique ID for the mount (may be reused after umount(2)).
|
||||
ID int `json:"id"`
|
||||
// parent ID: the ID of the parent mount (or of self for the root of this mount namespace's mount tree).
|
||||
Parent int `json:"parent"`
|
||||
// root: the pathname of the directory in the filesystem which forms the root of this mount.
|
||||
Root string `json:"root"`
|
||||
// mount point: the pathname of the mount point relative to the process's root directory.
|
||||
Target string `json:"target"`
|
||||
// mount options: per-mount options (see mount(2)).
|
||||
VfsOptstr string `json:"vfs_optstr"`
|
||||
// filesystem type: the filesystem type in the form "type[.subtype]".
|
||||
FsType string `json:"fstype"`
|
||||
// mount source: filesystem-specific information or "none".
|
||||
Source string `json:"source"`
|
||||
// super options: per-superblock options (see mount(2)).
|
||||
FsOptstr string `json:"fs_optstr"`
|
||||
}
|
||||
)
|
||||
|
||||
func (m *Mountinfo) copy(v *MountinfoEntry) {
|
||||
if m.fs == nil {
|
||||
panic("invalid entry")
|
||||
}
|
||||
v.ID = int(C.mnt_fs_get_id(m.fs))
|
||||
v.Parent = int(C.mnt_fs_get_parent_id(m.fs))
|
||||
v.Root = C.GoString(C.mnt_fs_get_root(m.fs))
|
||||
v.Target = C.GoString(C.mnt_fs_get_target(m.fs))
|
||||
v.VfsOptstr = C.GoString(C.mnt_fs_get_vfs_options(m.fs))
|
||||
v.FsType = C.GoString(C.mnt_fs_get_fstype(m.fs))
|
||||
v.Source = C.GoString(C.mnt_fs_get_source(m.fs))
|
||||
v.FsOptstr = C.GoString(C.mnt_fs_get_fs_options(m.fs))
|
||||
}
|
||||
|
||||
type mounts struct {
|
||||
p string
|
||||
f *C.FILE
|
||||
mu sync.RWMutex
|
||||
func NewMountinfo(p string) *Mountinfo { m := new(Mountinfo); m.p = p; return m }
|
||||
|
||||
ent *C.struct_mntent
|
||||
err error
|
||||
}
|
||||
func (m *Mountinfo) Err() error { m.mu.RLock(); defer m.mu.RUnlock(); return m.err }
|
||||
|
||||
func (m *mounts) open() error {
|
||||
func (m *Mountinfo) Parse() error {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
|
||||
if m.f != nil {
|
||||
if m.tb != nil {
|
||||
panic("open called twice")
|
||||
}
|
||||
|
||||
if m.p == "" {
|
||||
m.p = "/proc/mounts"
|
||||
m.tb = C.mnt_new_table_from_file(C.F_MOUNTINFO_PATH)
|
||||
} else {
|
||||
name := C.CString(m.p)
|
||||
m.tb = C.mnt_new_table_from_file(name)
|
||||
C.free(unsafe.Pointer(name))
|
||||
}
|
||||
if m.tb == nil {
|
||||
return ErrMountinfoParse
|
||||
}
|
||||
m.itr = C.mnt_new_iter(C.MNT_ITER_FORWARD)
|
||||
if m.itr == nil {
|
||||
C.mnt_unref_table(m.tb)
|
||||
return ErrMountinfoIter
|
||||
}
|
||||
|
||||
name := C.CString(m.p)
|
||||
f, err := C.setmntent(name, C.F_SET_TYPE)
|
||||
C.free(unsafe.Pointer(name))
|
||||
|
||||
if f == nil {
|
||||
return err
|
||||
}
|
||||
m.f = f
|
||||
runtime.SetFinalizer(m, (*mounts).close)
|
||||
return err
|
||||
runtime.SetFinalizer(m, (*Mountinfo).Unref)
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *mounts) close() {
|
||||
func (m *Mountinfo) Unref() {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
|
||||
if m.f == nil {
|
||||
panic("close called before open")
|
||||
if m.tb == nil {
|
||||
panic("unref called before parse")
|
||||
}
|
||||
|
||||
C.endmntent(m.f)
|
||||
C.mnt_unref_table(m.tb)
|
||||
C.mnt_free_iter(m.itr)
|
||||
runtime.SetFinalizer(m, nil)
|
||||
}
|
||||
|
||||
func (m *mounts) scan() bool {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
func (m *Mountinfo) Entries() iter.Seq[*MountinfoEntry] {
|
||||
return func(yield func(*MountinfoEntry) bool) {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
|
||||
if m.f == nil {
|
||||
panic("invalid file")
|
||||
C.mnt_reset_iter(m.itr, -1)
|
||||
|
||||
var rc C.int
|
||||
ent := new(MountinfoEntry)
|
||||
for rc = C.mnt_table_next_fs(m.tb, m.itr, &m.fs); rc == 0; rc = C.mnt_table_next_fs(m.tb, m.itr, &m.fs) {
|
||||
m.copy(ent)
|
||||
if !yield(ent) {
|
||||
return
|
||||
}
|
||||
}
|
||||
if rc < 0 {
|
||||
m.err = ErrMountinfoFault
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
m.ent, m.err = C.getmntent(m.f)
|
||||
return m.ent != nil
|
||||
}
|
||||
|
||||
func (m *mounts) Err() error {
|
||||
m.mu.RLock()
|
||||
defer m.mu.RUnlock()
|
||||
|
||||
return m.err
|
||||
func (e *MountinfoEntry) EqualWithIgnore(want *MountinfoEntry, ignore string) bool {
|
||||
return (e.ID == want.ID || want.ID == -1) &&
|
||||
(e.Parent == want.Parent || want.Parent == -1) &&
|
||||
(e.Root == want.Root || want.Root == ignore) &&
|
||||
(e.Target == want.Target || want.Target == ignore) &&
|
||||
(e.VfsOptstr == want.VfsOptstr || want.VfsOptstr == ignore) &&
|
||||
(e.FsType == want.FsType || want.FsType == ignore) &&
|
||||
(e.Source == want.Source || want.Source == ignore) &&
|
||||
(e.FsOptstr == want.FsOptstr || want.FsOptstr == ignore)
|
||||
}
|
||||
|
||||
func (m *mounts) copy(v *Mntent) {
|
||||
m.mu.RLock()
|
||||
defer m.mu.RUnlock()
|
||||
|
||||
if m.ent == nil {
|
||||
panic("invalid entry")
|
||||
}
|
||||
v.FSName = C.GoString(m.ent.mnt_fsname)
|
||||
v.Dir = C.GoString(m.ent.mnt_dir)
|
||||
v.Type = C.GoString(m.ent.mnt_type)
|
||||
v.Opts = C.GoString(m.ent.mnt_opts)
|
||||
v.Freq = int(m.ent.mnt_freq)
|
||||
v.Passno = int(m.ent.mnt_passno)
|
||||
func (e *MountinfoEntry) String() string {
|
||||
return fmt.Sprintf("%d %d %s %s %s %s %s %s",
|
||||
e.ID, e.Parent, e.Root, e.Target, e.VfsOptstr, e.FsType, e.Source, e.FsOptstr)
|
||||
}
|
||||
|
||||
@ -8,80 +8,79 @@ import (
|
||||
"git.gensokyo.uk/security/fortify/test/sandbox"
|
||||
)
|
||||
|
||||
func TestMounts(t *testing.T) {
|
||||
func TestMountinfo(t *testing.T) {
|
||||
testCases := []struct {
|
||||
name string
|
||||
|
||||
sample string
|
||||
want []sandbox.Mntent
|
||||
want []*sandbox.MountinfoEntry
|
||||
}{
|
||||
{"fpkg", `tmpfs / tmpfs rw,nosuid,nodev,relatime,uid=1000002,gid=1000002 0 0
|
||||
proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0
|
||||
tmpfs /.fortify tmpfs rw,nosuid,nodev,relatime,size=4k,mode=755,uid=1000002,gid=1000002 0 0
|
||||
tmpfs /dev tmpfs rw,nosuid,nodev,relatime,mode=755,uid=1000002,gid=1000002 0 0
|
||||
devtmpfs /dev/null devtmpfs rw,nosuid,size=49396k,nr_inodes=121247,mode=755 0 0
|
||||
devtmpfs /dev/zero devtmpfs rw,nosuid,size=49396k,nr_inodes=121247,mode=755 0 0
|
||||
devtmpfs /dev/full devtmpfs rw,nosuid,size=49396k,nr_inodes=121247,mode=755 0 0
|
||||
devtmpfs /dev/random devtmpfs rw,nosuid,size=49396k,nr_inodes=121247,mode=755 0 0
|
||||
devtmpfs /dev/urandom devtmpfs rw,nosuid,size=49396k,nr_inodes=121247,mode=755 0 0
|
||||
devtmpfs /dev/tty devtmpfs rw,nosuid,size=49396k,nr_inodes=121247,mode=755 0 0
|
||||
devpts /dev/pts devpts rw,nosuid,noexec,relatime,mode=620,ptmxmode=666 0 0
|
||||
mqueue /dev/mqueue mqueue rw,relatime 0 0
|
||||
/dev/disk/by-label/nixos /nix/store ext4 ro,nosuid,nodev,relatime 0 0
|
||||
/dev/disk/by-label/nixos /.fortify/app ext4 ro,nosuid,nodev,relatime 0 0
|
||||
/dev/disk/by-label/nixos /etc/resolv.conf ext4 ro,nosuid,nodev,relatime 0 0
|
||||
sysfs /sys/block sysfs ro,nosuid,nodev,noexec,relatime 0 0
|
||||
sysfs /sys/bus sysfs ro,nosuid,nodev,noexec,relatime 0 0
|
||||
sysfs /sys/class sysfs ro,nosuid,nodev,noexec,relatime 0 0
|
||||
sysfs /sys/dev sysfs ro,nosuid,nodev,noexec,relatime 0 0
|
||||
sysfs /sys/devices sysfs ro,nosuid,nodev,noexec,relatime 0 0
|
||||
/dev/disk/by-label/nixos /.fortify/nixGL ext4 ro,nosuid,nodev,relatime 0 0
|
||||
devtmpfs /dev/dri devtmpfs rw,nosuid,size=49396k,nr_inodes=121247,mode=755 0 0
|
||||
/dev/disk/by-label/nixos /.fortify/etc ext4 ro,nosuid,nodev,relatime 0 0
|
||||
tmpfs /run/user tmpfs rw,nosuid,nodev,relatime,size=1024k,mode=755,uid=1000002,gid=1000002 0 0
|
||||
tmpfs /run/user/65534 tmpfs rw,nosuid,nodev,relatime,size=8192k,mode=755,uid=1000002,gid=1000002 0 0
|
||||
/dev/disk/by-label/nixos /tmp ext4 rw,nosuid,nodev,relatime 0 0
|
||||
/dev/disk/by-label/nixos /data/data/org.codeberg.dnkl.foot ext4 rw,nosuid,nodev,relatime 0 0
|
||||
tmpfs /etc/passwd tmpfs ro,nosuid,nodev,relatime,uid=1000002,gid=1000002 0 0
|
||||
tmpfs /etc/group tmpfs ro,nosuid,nodev,relatime,uid=1000002,gid=1000002 0 0
|
||||
/dev/disk/by-label/nixos /run/user/65534/wayland-0 ext4 ro,nosuid,nodev,relatime 0 0
|
||||
tmpfs /run/user/65534/pulse/native tmpfs ro,nosuid,nodev,relatime,size=98784k,nr_inodes=24696,mode=700,uid=1000,gid=100 0 0
|
||||
/dev/disk/by-label/nixos /run/user/65534/bus ext4 ro,nosuid,nodev,relatime 0 0
|
||||
overlay /.fortify/sbin/fortify overlay ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on 0 0
|
||||
`, []sandbox.Mntent{
|
||||
{"tmpfs", "/", "tmpfs", "rw,nosuid,nodev,relatime,uid=1000002,gid=1000002", 0, 0},
|
||||
{"proc", "/proc", "proc", "rw,nosuid,nodev,noexec,relatime", 0, 0},
|
||||
{"tmpfs", "/.fortify", "tmpfs", "rw,nosuid,nodev,relatime,size=4k,mode=755,uid=1000002,gid=1000002", 0, 0},
|
||||
{"tmpfs", "/dev", "tmpfs", "rw,nosuid,nodev,relatime,mode=755,uid=1000002,gid=1000002", 0, 0},
|
||||
{"devtmpfs", "/dev/null", "devtmpfs", "rw,nosuid,size=49396k,nr_inodes=121247,mode=755", 0, 0},
|
||||
{"devtmpfs", "/dev/zero", "devtmpfs", "rw,nosuid,size=49396k,nr_inodes=121247,mode=755", 0, 0},
|
||||
{"devtmpfs", "/dev/full", "devtmpfs", "rw,nosuid,size=49396k,nr_inodes=121247,mode=755", 0, 0},
|
||||
{"devtmpfs", "/dev/random", "devtmpfs", "rw,nosuid,size=49396k,nr_inodes=121247,mode=755", 0, 0},
|
||||
{"devtmpfs", "/dev/urandom", "devtmpfs", "rw,nosuid,size=49396k,nr_inodes=121247,mode=755", 0, 0},
|
||||
{"devtmpfs", "/dev/tty", "devtmpfs", "rw,nosuid,size=49396k,nr_inodes=121247,mode=755", 0, 0},
|
||||
{"devpts", "/dev/pts", "devpts", "rw,nosuid,noexec,relatime,mode=620,ptmxmode=666", 0, 0},
|
||||
{"mqueue", "/dev/mqueue", "mqueue", "rw,relatime", 0, 0},
|
||||
{"/dev/disk/by-label/nixos", "/nix/store", "ext4", "ro,nosuid,nodev,relatime", 0, 0},
|
||||
{"/dev/disk/by-label/nixos", "/.fortify/app", "ext4", "ro,nosuid,nodev,relatime", 0, 0},
|
||||
{"/dev/disk/by-label/nixos", "/etc/resolv.conf", "ext4", "ro,nosuid,nodev,relatime", 0, 0},
|
||||
{"sysfs", "/sys/block", "sysfs", "ro,nosuid,nodev,noexec,relatime", 0, 0},
|
||||
{"sysfs", "/sys/bus", "sysfs", "ro,nosuid,nodev,noexec,relatime", 0, 0},
|
||||
{"sysfs", "/sys/class", "sysfs", "ro,nosuid,nodev,noexec,relatime", 0, 0},
|
||||
{"sysfs", "/sys/dev", "sysfs", "ro,nosuid,nodev,noexec,relatime", 0, 0},
|
||||
{"sysfs", "/sys/devices", "sysfs", "ro,nosuid,nodev,noexec,relatime", 0, 0},
|
||||
{"/dev/disk/by-label/nixos", "/.fortify/nixGL", "ext4", "ro,nosuid,nodev,relatime", 0, 0},
|
||||
{"devtmpfs", "/dev/dri", "devtmpfs", "rw,nosuid,size=49396k,nr_inodes=121247,mode=755", 0, 0},
|
||||
{"/dev/disk/by-label/nixos", "/.fortify/etc", "ext4", "ro,nosuid,nodev,relatime", 0, 0},
|
||||
{"tmpfs", "/run/user", "tmpfs", "rw,nosuid,nodev,relatime,size=1024k,mode=755,uid=1000002,gid=1000002", 0, 0},
|
||||
{"tmpfs", "/run/user/65534", "tmpfs", "rw,nosuid,nodev,relatime,size=8192k,mode=755,uid=1000002,gid=1000002", 0, 0},
|
||||
{"/dev/disk/by-label/nixos", "/tmp", "ext4", "rw,nosuid,nodev,relatime", 0, 0},
|
||||
{"/dev/disk/by-label/nixos", "/data/data/org.codeberg.dnkl.foot", "ext4", "rw,nosuid,nodev,relatime", 0, 0},
|
||||
{"tmpfs", "/etc/passwd", "tmpfs", "ro,nosuid,nodev,relatime,uid=1000002,gid=1000002", 0, 0},
|
||||
{"tmpfs", "/etc/group", "tmpfs", "ro,nosuid,nodev,relatime,uid=1000002,gid=1000002", 0, 0},
|
||||
{"/dev/disk/by-label/nixos", "/run/user/65534/wayland-0", "ext4", "ro,nosuid,nodev,relatime", 0, 0},
|
||||
{"tmpfs", "/run/user/65534/pulse/native", "tmpfs", "ro,nosuid,nodev,relatime,size=98784k,nr_inodes=24696,mode=700,uid=1000,gid=100", 0, 0},
|
||||
{"/dev/disk/by-label/nixos", "/run/user/65534/bus", "ext4", "ro,nosuid,nodev,relatime", 0, 0},
|
||||
{"overlay", "/.fortify/sbin/fortify", "overlay", "ro,nosuid,nodev,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work,uuid=on", 0, 0},
|
||||
{"util-linux", `15 20 0:3 / /proc rw,relatime - proc /proc rw
|
||||
16 20 0:15 / /sys rw,relatime - sysfs /sys rw
|
||||
17 20 0:5 / /dev rw,relatime - devtmpfs udev rw,size=1983516k,nr_inodes=495879,mode=755
|
||||
18 17 0:10 / /dev/pts rw,relatime - devpts devpts rw,gid=5,mode=620,ptmxmode=000
|
||||
19 17 0:16 / /dev/shm rw,relatime - tmpfs tmpfs rw
|
||||
20 1 8:4 / / rw,noatime - ext3 /dev/sda4 rw,errors=continue,user_xattr,acl,barrier=0,data=ordered
|
||||
21 16 0:17 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755
|
||||
22 21 0:18 / /sys/fs/cgroup/systemd rw,nosuid,nodev,noexec,relatime - cgroup cgroup rw,release_agent=/lib/systemd/systemd-cgroups-agent,name=systemd
|
||||
23 21 0:19 / /sys/fs/cgroup/cpuset rw,nosuid,nodev,noexec,relatime - cgroup cgroup rw,cpuset
|
||||
24 21 0:20 / /sys/fs/cgroup/ns rw,nosuid,nodev,noexec,relatime - cgroup cgroup rw,ns
|
||||
25 21 0:21 / /sys/fs/cgroup/cpu rw,nosuid,nodev,noexec,relatime - cgroup cgroup rw,cpu
|
||||
26 21 0:22 / /sys/fs/cgroup/cpuacct rw,nosuid,nodev,noexec,relatime - cgroup cgroup rw,cpuacct
|
||||
27 21 0:23 / /sys/fs/cgroup/memory rw,nosuid,nodev,noexec,relatime - cgroup cgroup rw,memory
|
||||
28 21 0:24 / /sys/fs/cgroup/devices rw,nosuid,nodev,noexec,relatime - cgroup cgroup rw,devices
|
||||
29 21 0:25 / /sys/fs/cgroup/freezer rw,nosuid,nodev,noexec,relatime - cgroup cgroup rw,freezer
|
||||
30 21 0:26 / /sys/fs/cgroup/net_cls rw,nosuid,nodev,noexec,relatime - cgroup cgroup rw,net_cls
|
||||
31 21 0:27 / /sys/fs/cgroup/blkio rw,nosuid,nodev,noexec,relatime - cgroup cgroup rw,blkio
|
||||
32 16 0:28 / /sys/kernel/security rw,relatime - autofs systemd-1 rw,fd=22,pgrp=1,timeout=300,minproto=5,maxproto=5,direct
|
||||
33 17 0:29 / /dev/hugepages rw,relatime - autofs systemd-1 rw,fd=23,pgrp=1,timeout=300,minproto=5,maxproto=5,direct
|
||||
34 16 0:30 / /sys/kernel/debug rw,relatime - autofs systemd-1 rw,fd=24,pgrp=1,timeout=300,minproto=5,maxproto=5,direct
|
||||
35 15 0:31 / /proc/sys/fs/binfmt_misc rw,relatime - autofs systemd-1 rw,fd=25,pgrp=1,timeout=300,minproto=5,maxproto=5,direct
|
||||
36 17 0:32 / /dev/mqueue rw,relatime - autofs systemd-1 rw,fd=26,pgrp=1,timeout=300,minproto=5,maxproto=5,direct
|
||||
37 15 0:14 / /proc/bus/usb rw,relatime - usbfs /proc/bus/usb rw
|
||||
38 33 0:33 / /dev/hugepages rw,relatime - hugetlbfs hugetlbfs rw
|
||||
39 36 0:12 / /dev/mqueue rw,relatime - mqueue mqueue rw
|
||||
40 20 8:6 / /boot rw,noatime - ext3 /dev/sda6 rw,errors=continue,barrier=0,data=ordered
|
||||
41 20 253:0 / /home/kzak rw,noatime - ext4 /dev/mapper/kzak-home rw,barrier=1,data=ordered
|
||||
42 35 0:34 / /proc/sys/fs/binfmt_misc rw,relatime - binfmt_misc none rw
|
||||
43 16 0:35 / /sys/fs/fuse/connections rw,relatime - fusectl fusectl rw
|
||||
44 41 0:36 / /home/kzak/.gvfs rw,nosuid,nodev,relatime - fuse.gvfs-fuse-daemon gvfs-fuse-daemon rw,user_id=500,group_id=500
|
||||
45 20 0:37 / /var/lib/nfs/rpc_pipefs rw,relatime - rpc_pipefs sunrpc rw
|
||||
47 20 0:38 / /mnt/sounds rw,relatime - cifs //foo.home/bar/ rw,unc=\\foo.home\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344
|
||||
49 20 0:56 / /mnt/test/foobar rw,relatime,nosymfollow shared:323 - tmpfs tmpfs rw`, []*sandbox.MountinfoEntry{
|
||||
e(15, 20, "/", "/proc", "rw,relatime", "proc", "/proc", "rw"),
|
||||
e(16, 20, "/", "/sys", "rw,relatime", "sysfs", "/sys", "rw"),
|
||||
e(17, 20, "/", "/dev", "rw,relatime", "devtmpfs", "udev", "rw,size=1983516k,nr_inodes=495879,mode=755"),
|
||||
e(18, 17, "/", "/dev/pts", "rw,relatime", "devpts", "devpts", "rw,gid=5,mode=620,ptmxmode=000"),
|
||||
e(19, 17, "/", "/dev/shm", "rw,relatime", "tmpfs", "tmpfs", "rw"),
|
||||
e(20, 1, "/", "/", "rw,noatime", "ext3", "/dev/sda4", "rw,errors=continue,user_xattr,acl,barrier=0,data=ordered"),
|
||||
e(21, 16, "/", "/sys/fs/cgroup", "rw,nosuid,nodev,noexec,relatime", "tmpfs", "tmpfs", "rw,mode=755"),
|
||||
e(22, 21, "/", "/sys/fs/cgroup/systemd", "rw,nosuid,nodev,noexec,relatime", "cgroup", "cgroup", "rw,release_agent=/lib/systemd/systemd-cgroups-agent,name=systemd"),
|
||||
e(23, 21, "/", "/sys/fs/cgroup/cpuset", "rw,nosuid,nodev,noexec,relatime", "cgroup", "cgroup", "rw,cpuset"),
|
||||
e(24, 21, "/", "/sys/fs/cgroup/ns", "rw,nosuid,nodev,noexec,relatime", "cgroup", "cgroup", "rw,ns"),
|
||||
e(25, 21, "/", "/sys/fs/cgroup/cpu", "rw,nosuid,nodev,noexec,relatime", "cgroup", "cgroup", "rw,cpu"),
|
||||
e(26, 21, "/", "/sys/fs/cgroup/cpuacct", "rw,nosuid,nodev,noexec,relatime", "cgroup", "cgroup", "rw,cpuacct"),
|
||||
e(27, 21, "/", "/sys/fs/cgroup/memory", "rw,nosuid,nodev,noexec,relatime", "cgroup", "cgroup", "rw,memory"),
|
||||
e(28, 21, "/", "/sys/fs/cgroup/devices", "rw,nosuid,nodev,noexec,relatime", "cgroup", "cgroup", "rw,devices"),
|
||||
e(29, 21, "/", "/sys/fs/cgroup/freezer", "rw,nosuid,nodev,noexec,relatime", "cgroup", "cgroup", "rw,freezer"),
|
||||
e(30, 21, "/", "/sys/fs/cgroup/net_cls", "rw,nosuid,nodev,noexec,relatime", "cgroup", "cgroup", "rw,net_cls"),
|
||||
e(31, 21, "/", "/sys/fs/cgroup/blkio", "rw,nosuid,nodev,noexec,relatime", "cgroup", "cgroup", "rw,blkio"),
|
||||
e(32, 16, "/", "/sys/kernel/security", "rw,relatime", "autofs", "systemd-1", "rw,fd=22,pgrp=1,timeout=300,minproto=5,maxproto=5,direct"),
|
||||
e(33, 17, "/", "/dev/hugepages", "rw,relatime", "autofs", "systemd-1", "rw,fd=23,pgrp=1,timeout=300,minproto=5,maxproto=5,direct"),
|
||||
e(34, 16, "/", "/sys/kernel/debug", "rw,relatime", "autofs", "systemd-1", "rw,fd=24,pgrp=1,timeout=300,minproto=5,maxproto=5,direct"),
|
||||
e(35, 15, "/", "/proc/sys/fs/binfmt_misc", "rw,relatime", "autofs", "systemd-1", "rw,fd=25,pgrp=1,timeout=300,minproto=5,maxproto=5,direct"),
|
||||
e(36, 17, "/", "/dev/mqueue", "rw,relatime", "autofs", "systemd-1", "rw,fd=26,pgrp=1,timeout=300,minproto=5,maxproto=5,direct"),
|
||||
e(37, 15, "/", "/proc/bus/usb", "rw,relatime", "usbfs", "/proc/bus/usb", "rw"),
|
||||
e(38, 33, "/", "/dev/hugepages", "rw,relatime", "hugetlbfs", "hugetlbfs", "rw"),
|
||||
e(39, 36, "/", "/dev/mqueue", "rw,relatime", "mqueue", "mqueue", "rw"),
|
||||
e(40, 20, "/", "/boot", "rw,noatime", "ext3", "/dev/sda6", "rw,errors=continue,barrier=0,data=ordered"),
|
||||
e(41, 20, "/", "/home/kzak", "rw,noatime", "ext4", "/dev/mapper/kzak-home", "rw,barrier=1,data=ordered"),
|
||||
e(42, 35, "/", "/proc/sys/fs/binfmt_misc", "rw,relatime", "binfmt_misc", "none", "rw"),
|
||||
e(43, 16, "/", "/sys/fs/fuse/connections", "rw,relatime", "fusectl", "fusectl", "rw"),
|
||||
e(44, 41, "/", "/home/kzak/.gvfs", "rw,nosuid,nodev,relatime", "fuse.gvfs-fuse-daemon", "gvfs-fuse-daemon", "rw,user_id=500,group_id=500"),
|
||||
e(45, 20, "/", "/var/lib/nfs/rpc_pipefs", "rw,relatime", "rpc_pipefs", "sunrpc", "rw"),
|
||||
e(47, 20, "/", "/mnt/sounds", "rw,relatime", "cifs", "//foo.home/bar/", "rw,unc=\\\\foo.home\\bar,username=kzak,domain=SRGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.111.1,posixpaths,serverino,acl,rsize=16384,wsize=57344"),
|
||||
e(49, 20, "/", "/mnt/test/foobar", "rw,relatime,nosymfollow", "tmpfs", "tmpfs", "rw"),
|
||||
}},
|
||||
}
|
||||
|
||||
@ -92,29 +91,33 @@ overlay /.fortify/sbin/fortify overlay ro,nosuid,nodev,relatime,lowerdir=/mnt-ro
|
||||
}
|
||||
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
f, err := sandbox.OpenMounts(name)
|
||||
if err != nil {
|
||||
t.Fatalf("OpenMounts: error = %v", err)
|
||||
m := sandbox.NewMountinfo(name)
|
||||
if err := m.Parse(); err != nil {
|
||||
t.Fatalf("Parse: error = %v", err)
|
||||
}
|
||||
|
||||
i := 0
|
||||
for e := range f.Entries() {
|
||||
for ent := range m.Entries() {
|
||||
if i == len(tc.want) {
|
||||
t.Errorf("Entries: got more than %d entries", i)
|
||||
t.FailNow()
|
||||
}
|
||||
if *e != tc.want[i] {
|
||||
t.Errorf("Entries: entry %d\n got: %s\nwant: %s", i,
|
||||
e, &tc.want[i])
|
||||
if !ent.EqualWithIgnore(tc.want[i], "\x00") {
|
||||
t.Errorf("Entries: entry %d\n got: %#v\nwant: %#v", i,
|
||||
ent, &tc.want[i])
|
||||
t.FailNow()
|
||||
} else {
|
||||
t.Logf("%s", ent)
|
||||
}
|
||||
|
||||
i++
|
||||
}
|
||||
|
||||
if err = f.Err(); err != nil {
|
||||
t.Fatalf("MountsFile: error = %v", err)
|
||||
if err := m.Err(); err != nil {
|
||||
t.Fatalf("Mountinfo: error = %v", err)
|
||||
}
|
||||
|
||||
m.Unref()
|
||||
})
|
||||
|
||||
if err := os.Remove(name); err != nil {
|
||||
@ -122,3 +125,18 @@ overlay /.fortify/sbin/fortify overlay ro,nosuid,nodev,relatime,lowerdir=/mnt-ro
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func e(
|
||||
id, parent int, root, target, vfsOptstr string, fsType, source, fsOptstr string,
|
||||
) *sandbox.MountinfoEntry {
|
||||
return &sandbox.MountinfoEntry{
|
||||
ID: id,
|
||||
Parent: parent,
|
||||
Root: root,
|
||||
Target: target,
|
||||
VfsOptstr: vfsOptstr,
|
||||
FsType: fsType,
|
||||
Source: source,
|
||||
FsOptstr: fsOptstr,
|
||||
}
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user