[LibOS] Don't allow removal of pseudo-files

Pseudo-files under `/dev`, `/proc` and `/sys` should not be removable. Signed-off-by: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com>
gramineproject · Apr 11, 2023 · 7da8af2 · 7da8af2
1 parent e2f7e7e
commit 7da8af2
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 24 deletions.
diff --git a/libos/src/fs/libos_fs_pseudo.c b/libos/src/fs/libos_fs_pseudo.c
@@ -266,6 +266,11 @@ static int pseudo_hstat(struct libos_handle* handle, struct stat* buf) {
     return pseudo_istat(handle->dentry, handle->inode, buf);
 }
 
+static int pseudo_unlink(struct libos_dentry* dent) {
+    __UNUSED(dent);
+    return -EACCES;
+}
+
 static int pseudo_follow_link(struct libos_dentry* dent, char** out_target) {
     assert(locked(&g_dcache_lock));
     assert(dent->inode);
@@ -592,6 +597,7 @@ struct libos_d_ops pseudo_d_ops = {
     .lookup      = &pseudo_lookup,
     .readdir     = &pseudo_readdir,
     .stat        = &pseudo_stat,
+    .unlink      = &pseudo_unlink,
     .follow_link = &pseudo_follow_link,
     .icheckpoint = &pseudo_icheckpoint,
     .irestore    = &pseudo_irestore,

diff --git a/libos/test/regression/proc_cpuinfo.c b/libos/test/regression/proc_cpuinfo.c
@@ -1,8 +1,11 @@
 #define _GNU_SOURCE
+#include <err.h>
+#include <errno.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <unistd.h>
 
 #define CPUINFO_FILE   "/proc/cpuinfo"
 #define BUF_SIZE       (10 * 1024) /* 10KB */
@@ -168,29 +171,21 @@ int main(int argc, char* argv[]) {
     FILE* fp = NULL;
     int cpu_cnt = 0, rv = 0;
 
-    if (argc != 2) {
-        fprintf(stderr, "Usage: %s <CPU feature flags to validate>\n", argv[0]);
-        return 1;
-    }
+    if (argc != 2)
+        errx(1, "Usage: %s <CPU feature flags to validate>", argv[0]);
 
     char* line = calloc(1, BUF_SIZE);
-    if (!line) {
-        fprintf(stderr, "out of memory\n");
-        return 1;
-    }
+    if (!line)
+        errx(1, "out of memory");
 
     struct cpuinfo* ci = malloc(sizeof(*ci));
-    if (!ci) {
-        fprintf(stderr, "out of memory\n");
-        return 1;
-    }
+    if (!ci)
+        errx(1, "out of memory");
 
     init_cpuinfo(ci);
 
-    if ((fp = fopen(CPUINFO_FILE, "r")) == NULL) {
-        perror("fopen");
-        return 1;
-    }
+    if ((fp = fopen(CPUINFO_FILE, "r")) == NULL)
+        err(1, "fopen");
 
     while (fgets(line, BUF_SIZE, fp) != NULL) {
         if (line[0] == '\n') {
@@ -211,11 +206,13 @@ int main(int argc, char* argv[]) {
     if (rv != 0)
         return 1;
 
-    if (cpu_cnt == 0) {
-        fprintf(stderr, "Could not get online cpu info.\n");
-        return 1;
-    }
+    if (cpu_cnt == 0)
+        errx(1, "could not get online cpu info");
+
+    rv = unlink(CPUINFO_FILE);
+    if (rv != -1 || errno != EACCES)
+        errx(1, "Removing %s didn't fail with -EACCES", CPUINFO_FILE);
 
-    printf("cpuinfo test passed\n");
+    puts("TEST OK");
     return 0;
 }
diff --git a/libos/test/regression/test_libos.py b/libos/test/regression/test_libos.py
@@ -1048,9 +1048,7 @@ def test_020_cpuinfo(self):
             cpuinfo['flags'] = ''
 
         stdout, _ = self.run_binary(['proc_cpuinfo', cpuinfo['flags']])
-
-        # proc/cpuinfo Linux-based formatting
-        self.assertIn('cpuinfo test passed', stdout)
+        self.assertIn('TEST OK', stdout)
 
     def test_021_procstat(self):
         stdout, _ = self.run_binary(['proc_stat'])