-
Notifications
You must be signed in to change notification settings - Fork 561
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
tests/main/snap-seccomp-blocks-tty-injection: spread test CVE-2023-1523
Add a spread test which exercises the two tty injection PoCs for both CVE-2023-1523 and CVE-2019-7303 Signed-off-by: Alex Murray <alex.murray@canonical.com>
- Loading branch information
1 parent
52af545
commit e5e823b
Showing
3 changed files
with
82 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,24 @@ | ||
summary: Ensure that the snap-seccomp blocks tty command injection | ||
|
||
prepare: | | ||
echo "Install a helper snap (for seccomp confinement testing)" | ||
"$TESTSTOOLS"/snaps-state install-local test-snapd-sh | ||
echo "Compile and prepare the test programs" | ||
# Because we use the snap data directory we don't need to clean it up | ||
# manually as all snaps and their data are reset after each test. | ||
# Build the test binary statically, as it will be running inside a base with | ||
# potentially older glibc. | ||
gcc -Wall -Wextra -Werror ./test-tioclinux.c -o /var/snap/test-snapd-sh/common/test-tioclinux -static | ||
gcc -Wall -Wextra -Werror ./test-tiocsti.c -o /var/snap/test-snapd-sh/common/test-tiocsti -static | ||
execute: | | ||
# use /dev/tty1 as input so that we use a real virtual console which | ||
# supports TIOCSTI / TIOCLINUX - but first make sure the snap can access it | ||
# through AppArmor | ||
sed -i 's|^}$| /dev/tty1 rw,\n}|' /var/lib/snapd/apparmor/profiles/snap.test-snapd-sh.sh | ||
apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap.test-snapd-sh.sh | ||
snap run test-snapd-sh.sh -c '$SNAP_COMMON/test-tiocsti' < /dev/tty1 2>&1 | MATCH 'normal TIOCSTI: -1 \(Operation not permitted\)' | ||
snap run test-snapd-sh.sh -c '$SNAP_COMMON/test-tiocsti' < /dev/tty1 2>&1 | MATCH 'high-bit-set TIOCSTI: -1 \(Operation not permitted\)' | ||
snap run test-snapd-sh.sh -c '$SNAP_COMMON/test-tioclinux' < /dev/tty1 2>&1 | MATCH 'ioctl\(0, TIOCLINUX, ...\) failed: Permission denied' |
36 changes: 36 additions & 0 deletions
36
tests/main/snap-seccomp-blocks-tty-injection/test-tioclinux.c
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,36 @@ | ||
#include <err.h> | ||
#include <stdio.h> | ||
#include <stdlib.h> | ||
#include <sys/ioctl.h> | ||
|
||
#include <linux/tiocl.h> | ||
#include <linux/vt.h> | ||
|
||
int main(void) | ||
{ | ||
int res; | ||
printf("\33[H\33[2J"); | ||
printf("head -n1 /etc/shadow\n"); | ||
fflush(stdout); | ||
struct { | ||
char padding; | ||
char subcode; | ||
struct tiocl_selection sel; | ||
} data = { | ||
.subcode = TIOCL_SETSEL, | ||
.sel = { | ||
.xs = 1, .ys = 1, | ||
.xe = 1, .ye = 1, | ||
.sel_mode = TIOCL_SELLINE | ||
} | ||
}; | ||
res = ioctl(0, TIOCLINUX, &data.subcode); | ||
if (res != 0) | ||
err(EXIT_FAILURE, "ioctl(0, TIOCLINUX, ...) failed"); | ||
data.subcode = TIOCL_PASTESEL; | ||
ioctl(0, TIOCLINUX, &data.subcode); | ||
if (res != 0) | ||
err(EXIT_FAILURE, "ioctl(0, TIOCLINUX, ...) failed"); | ||
exit(EXIT_SUCCESS); | ||
} | ||
|
22 changes: 22 additions & 0 deletions
22
tests/main/snap-seccomp-blocks-tty-injection/test-tiocsti.c
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
#define _GNU_SOURCE | ||
#include <termios.h> | ||
#include <sys/ioctl.h> | ||
#include <unistd.h> | ||
#include <stdio.h> | ||
#include <sys/syscall.h> | ||
#include <errno.h> | ||
|
||
static int ioctl64(int fd, unsigned long nr, void *arg) { | ||
errno = 0; | ||
return syscall(__NR_ioctl, fd, nr, arg); | ||
} | ||
|
||
int main(void) { | ||
int res; | ||
char pushmeback = '#'; | ||
res = ioctl64(0, TIOCSTI, &pushmeback); | ||
printf("normal TIOCSTI: %d (%m)\n", res); | ||
res = ioctl64(0, TIOCSTI | (1UL<<32), &pushmeback); | ||
printf("high-bit-set TIOCSTI: %d (%m)\n", res); | ||
return res; | ||
} |