starry-kernel 0.10.0

A Linux-compatible OS kernel built on ArceOS unikernel
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

//! Linux v7.1 task-target perf permission semantics.

#[path = "../src/perf/access_policy.rs"]
mod access_policy;

use access_policy::{
    PerfAccessCapabilities, PerfCredentialIds, PerfCredentialSnapshot, perf_task_access_allowed,
};

fn credentials(uid: u32, gid: u32) -> PerfCredentialSnapshot {
    PerfCredentialSnapshot::new(
        PerfCredentialIds::new(uid, gid, uid, gid, uid, gid),
        PerfAccessCapabilities::new(false, false, false),
    )
}

#[test]
fn cross_credential_task_target_is_denied_even_when_dumpable() {
    assert!(!perf_task_access_allowed(
        credentials(1000, 1000),
        credentials(2000, 2000),
        false,
        true,
        false,
    ));
}

#[test]
fn real_credentials_must_match_every_target_id_slot() {
    let caller = credentials(1000, 1000);
    let matching = credentials(1000, 1000);
    let mixed_target = PerfCredentialSnapshot::new(
        PerfCredentialIds::new(1000, 1000, 1000, 1000, 2000, 1000),
        PerfAccessCapabilities::new(false, false, false),
    );
    assert!(perf_task_access_allowed(
        caller, matching, false, true, false
    ));
    assert!(!perf_task_access_allowed(
        caller,
        mixed_target,
        false,
        true,
        false,
    ));
    assert!(!perf_task_access_allowed(
        caller, matching, false, false, false,
    ));
}

#[test]
fn thread_group_and_capabilities_bypass_ptrace_id_matching() {
    let caller = credentials(1000, 1000);
    let target = credentials(2000, 2000);
    assert!(perf_task_access_allowed(caller, target, true, false, false));

    let perfmon = PerfCredentialSnapshot::new(
        PerfCredentialIds::new(1000, 1000, 1000, 1000, 1000, 1000),
        PerfAccessCapabilities::new(true, false, true),
    );
    assert!(perf_task_access_allowed(
        perfmon, target, false, false, false
    ));

    let ptrace = PerfCredentialSnapshot::new(
        PerfCredentialIds::new(1000, 1000, 1000, 1000, 1000, 1000),
        PerfAccessCapabilities::new(false, true, false),
    );
    assert!(perf_task_access_allowed(
        ptrace, target, false, false, false
    ));
}

#[test]
fn sigtrap_requires_kill_for_perfmon_bypass() {
    let target = credentials(2000, 2000);
    let perfmon_without_kill = PerfCredentialSnapshot::new(
        PerfCredentialIds::new(1000, 1000, 1000, 1000, 1000, 1000),
        PerfAccessCapabilities::new(true, false, false),
    );

    assert!(!perf_task_access_allowed(
        perfmon_without_kill,
        target,
        false,
        true,
        true,
    ));
}