mirror/flatpak
1
0
Fork 0
mirror of https://github.com/flatpak/flatpak.git synced 2026-01-29 10:01:18 -05:00
Code Issues Packages Projects Releases Wiki Activity
Files
f8a9153d0ed464dbd1668976bf5b00edc845c80d
flatpak/tests/test-instance.c
Simon McVittie c68f31d86a build: Consistently include libglnx header as "libglnx.h" 
Recent Meson versions have warnings if you add the subprojects
directory as an include path, because the way Meson wants to consume
subprojects is by the subproject's build system producing a Meson
dependency object that encapsulates its include directory. Flatpak
doesn't have a Meson build system yet, but I'm working on that.

libglnx seems to be set up to have the libglnx directory be its include
path instead: for example, ostree (by the author of libglnx) already
uses "libglnx.h" or <libglnx.h> everywhere. Do the same here.

Signed-off-by: Simon McVittie <smcv@collabora.com>
2022-04-11 10:32:34 +02:00

508 lines
21 KiB
C
Raw Blame History

/*
* Copyright © 2021 Collabora Ltd.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
*/
#include "config.h"
#include <fcntl.h>
#include <stdio.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <utime.h>
#include <glib.h>
#include <glib/gstdio.h>
#include "flatpak.h"
#include "flatpak-instance-private.h"
#include "flatpak-run-private.h"
#include "libglnx.h"
#include "tests/libglnx-testlib.h"
#include "testlib.h"
static void
populate_with_files (const char *dir)
{
static const char * const names[] = { "one", "two", "three" };
gsize i;
for (i = 0; i < G_N_ELEMENTS (names); i++)
{
g_autoptr(GError) error = NULL;
g_autofree char *path = g_build_filename (dir, names[i], NULL);
g_file_set_contents (path, "hello", -1, &error);
g_assert_no_error (error);
}
}
static void
test_gc (void)
{
g_autoptr(GBytes) bytes = NULL;
g_autoptr(GError) error = NULL;
g_autoptr(GPtrArray) instances = NULL;
g_autofree char *instances_dir = flatpak_instance_get_instances_directory ();
g_autofree char *apps_dir = flatpak_instance_get_instances_directory ();
g_autofree char *hold_lock = g_test_build_filename (G_TEST_BUILT, "hold-lock", NULL);
g_autofree char *alive_app_dir = NULL;
g_autofree char *alive_app_lock = NULL;
g_autofree char *alive_app_tmp = NULL;
g_autofree char *alive_instance_dir = NULL;
g_autofree char *alive_instance_info = NULL;
g_autofree char *alive_instance_lock = NULL;
g_autofree char *alive_dead_instance_dir = NULL;
g_autofree char *alive_dead_instance_info = NULL;
g_autofree char *alive_dead_instance_lock = NULL;
g_autofree char *dead_app_dir = NULL;
g_autofree char *dead_app_lock = NULL;
g_autofree char *dead_app_tmp = NULL;
g_autofree char *dead_instance_dir = NULL;
g_autofree char *dead_instance_info = NULL;
g_autofree char *dead_instance_lock = NULL;
struct utimbuf a_while_ago = {};
const char *hold_lock_argv[] =
{
"<BUILT>/hold-lock",
"--lock-file",
"<instance>/.ref",
"--lock-file",
"<appID>/.ref",
NULL
};
GPid pid = -1;
int stdout_fd = -1;
int wstatus = 0;
FlatpakInstance *instance;
struct stat stat_buf;
/* com.example.Alive has one instance, #1, running.
* A second instance, #2, was running until recently but has exited. */
alive_app_dir = g_build_filename (apps_dir, "com.example.Alive", NULL);
g_assert_no_errno (g_mkdir_with_parents (alive_app_dir, 0700));
alive_app_tmp = g_build_filename (alive_app_dir, "tmp", NULL);
g_assert_no_errno (g_mkdir_with_parents (alive_app_tmp, 0700));
populate_with_files (alive_app_tmp);
alive_app_lock = g_build_filename (alive_app_dir, ".ref", NULL);
g_file_set_contents (alive_app_lock, "", 0, &error);
g_assert_no_error (error);
alive_instance_dir = g_build_filename (instances_dir, "1", NULL);
g_assert_no_errno (g_mkdir_with_parents (alive_instance_dir, 0700));
alive_instance_info = g_build_filename (alive_instance_dir, "info", NULL);
g_file_set_contents (alive_instance_info,
"[" FLATPAK_METADATA_GROUP_APPLICATION "]\n"
FLATPAK_METADATA_KEY_NAME "=com.example.Alive\n",
-1, &error);
g_assert_no_error (error);
alive_instance_lock = g_build_filename (alive_instance_dir, ".ref", NULL);
g_file_set_contents (alive_instance_lock, "", 0, &error);
g_assert_no_error (error);
alive_dead_instance_dir = g_build_filename (instances_dir, "2", NULL);
g_assert_no_errno (g_mkdir_with_parents (alive_dead_instance_dir, 0700));
alive_dead_instance_info = g_build_filename (alive_dead_instance_dir, "info", NULL);
g_file_set_contents (alive_dead_instance_info,
"[" FLATPAK_METADATA_GROUP_APPLICATION "]\n"
FLATPAK_METADATA_KEY_NAME "=com.example.Alive\n",
-1, &error);
g_assert_no_error (error);
alive_dead_instance_lock = g_build_filename (alive_dead_instance_dir, ".ref", NULL);
g_file_set_contents (alive_dead_instance_lock, "", 0, &error);
g_assert_no_error (error);
/* This represents the running instance #1. We have to do this
* out-of-process because the locks we use are process-oriented,
* so the locks we take during GC would not conflict with locks held
* by our own process. */
hold_lock_argv[0] = hold_lock;
hold_lock_argv[2] = alive_instance_lock;
hold_lock_argv[4] = alive_app_lock;
g_spawn_async_with_pipes (NULL,
(gchar **) hold_lock_argv,
NULL,
G_SPAWN_DO_NOT_REAP_CHILD,
NULL,
NULL,
&pid,
NULL,
&stdout_fd,
NULL,
&error);
g_assert_no_error (error);
g_assert_cmpint (pid, >, 1);
g_assert_cmpint (stdout_fd, >=, 0);
/* com.example.Dead has no instances running.
* Instance #4 was running until recently but has exited. */
dead_app_dir = g_build_filename (apps_dir, "com.example.Dead", NULL);
g_assert_no_errno (g_mkdir_with_parents (dead_app_dir, 0700));
dead_app_tmp = g_build_filename (dead_app_dir, "tmp", NULL);
g_assert_no_errno (g_mkdir_with_parents (dead_app_tmp, 0700));
populate_with_files (dead_app_tmp);
dead_app_lock = g_build_filename (dead_app_dir, ".ref", NULL);
g_file_set_contents (dead_app_lock, "", 0, &error);
g_assert_no_error (error);
dead_instance_dir = g_build_filename (instances_dir, "4", NULL);
g_assert_no_errno (g_mkdir_with_parents (dead_instance_dir, 0700));
dead_instance_info = g_build_filename (dead_instance_dir, "info", NULL);
g_file_set_contents (dead_instance_info,
"[" FLATPAK_METADATA_GROUP_APPLICATION "]\n"
FLATPAK_METADATA_KEY_NAME "=com.example.Dead\n",
-1, &error);
g_assert_no_error (error);
dead_instance_lock = g_build_filename (dead_instance_dir, ".ref", NULL);
g_file_set_contents (dead_instance_lock, "", 0, &error);
g_assert_no_error (error);
/* Wait for the child to be ready */
bytes = glnx_fd_readall_bytes (stdout_fd, NULL, &error);
g_assert_no_error (error);
g_assert_nonnull (bytes);
g_assert_cmpuint (g_bytes_get_size (bytes), ==, 0);
/* Pretend the locks were created in early 1970, to bypass the workaround
* for a race */
g_assert_no_errno (g_utime (alive_app_lock, &a_while_ago));
g_assert_no_errno (g_utime (alive_instance_lock, &a_while_ago));
g_assert_no_errno (g_utime (alive_dead_instance_lock, &a_while_ago));
g_assert_no_errno (g_utime (dead_app_lock, &a_while_ago));
g_assert_no_errno (g_utime (dead_instance_lock, &a_while_ago));
/* This has the side-effect of GC'ing instances */
instances = flatpak_instance_get_all ();
/* We GC exactly those instances that are no longer running */
g_assert_no_errno (stat (alive_instance_dir, &stat_buf));
g_assert_cmpint (stat (alive_dead_instance_dir, &stat_buf) == 0 ? 0 : errno, ==, ENOENT);
g_assert_cmpint (stat (dead_instance_dir, &stat_buf) == 0 ? 0 : errno, ==, ENOENT);
/* We don't GC the per-app directories themselves, or their lock files */
g_assert_no_errno (stat (alive_app_dir, &stat_buf));
g_assert_no_errno (stat (alive_app_lock, &stat_buf));
g_assert_no_errno (stat (dead_app_dir, &stat_buf));
g_assert_no_errno (stat (dead_app_lock, &stat_buf));
/* We GC the tmp subdirectory if there is no instance alive.
* We do not GC it if there is still an instance holding the lock. */
g_assert_no_errno (stat (alive_app_tmp, &stat_buf));
g_assert_cmpint (stat (dead_app_tmp, &stat_buf) == 0 ? 0 : errno, ==, ENOENT);
g_assert_cmpuint (instances->len, ==, 1);
instance = g_ptr_array_index (instances, 0);
g_assert_true (FLATPAK_IS_INSTANCE (instance));
g_assert_cmpstr (flatpak_instance_get_id (instance), ==, "1");
kill (pid, SIGTERM);
g_assert_no_errno (waitpid (pid, &wstatus, 0));
g_assert_true (WIFSIGNALED (wstatus));
g_assert_cmpint (WTERMSIG (wstatus), ==, SIGTERM);
g_spawn_close_pid (pid);
}
static void
test_claim_per_app_temp_directory (void)
{
/* Run in a temporary directory so we can create a bunch of symlinks */
_GLNX_TEST_SCOPED_TEMP_DIR;
gboolean ok;
glnx_autofd int lock_fd = -1;
glnx_autofd int fd = -1;
g_autofree char *result = NULL;
g_autofree char *flag_path = NULL;
g_autofree char *symlink_path = NULL;
g_autofree char *non_directory_path = NULL;
g_autofree char *dir_in_tmp = NULL;
g_autoptr(GError) error = NULL;
struct stat stat_buf;
/* In real life this would be the per-app-ID lock, but in fact
* we just need some sort of file descriptor - as currently
* implemented, we don't even need to lock it. */
lock_fd = open ("mock-per-app-id-lock",
O_CLOEXEC | O_CREAT | O_NOCTTY | O_NOFOLLOW,
0600);
g_assert_no_errno (lock_fd >= 0 ? 0 : -1);
/* This emulates the sort of directory that we want to reuse. */
dir_in_tmp = g_strdup ("/tmp/flatpak-com.example.App-XXXXXX");
g_assert_nonnull (g_mkdtemp (dir_in_tmp));
ok = flatpak_instance_claim_per_app_temp_directory ("com.example.App",
lock_fd,
AT_FDCWD,
"doesnt-exist",
"/tmp",
&result,
&error);
g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND);
g_assert_null (result);
g_assert_false (ok);
g_clear_error (&error);
/* If link_path is a symlink to a directory not in /tmp, we refuse
* to reuse it */
g_assert_no_errno (symlink ("/nope", "bad-prefix"));
ok = flatpak_instance_claim_per_app_temp_directory ("com.example.App",
lock_fd,
AT_FDCWD,
"bad-prefix",
"/tmp",
&result,
&error);
g_assert_nonnull (error);
g_assert_cmpstr (error->message, ==, "/nope does not start with /tmp");
g_assert_null (result);
g_assert_false (ok);
g_clear_error (&error);
/* Similar */
g_assert_no_errno (symlink ("/tmptation", "bad-prefix2"));
ok = flatpak_instance_claim_per_app_temp_directory ("com.example.App",
lock_fd,
AT_FDCWD,
"bad-prefix2",
"/tmp",
&result,
&error);
g_assert_nonnull (error);
g_assert_cmpstr (error->message, ==, "/tmptation does not start with /tmp/");
g_assert_null (result);
g_assert_false (ok);
g_clear_error (&error);
/* If link_path points to a subdirectory of /tmp that doesn't match the
* expected pattern, we refuse to reuse it */
g_assert_no_errno (symlink ("/tmp/nope", "bad-prefix3"));
ok = flatpak_instance_claim_per_app_temp_directory ("com.example.App",
lock_fd,
AT_FDCWD,
"bad-prefix3",
"/tmp",
&result,
&error);
g_assert_nonnull (error);
g_assert_cmpstr (error->message, ==, "/tmp/nope does not start with /tmp/flatpak-");
g_assert_null (result);
g_assert_false (ok);
g_clear_error (&error);
/* Similar */
g_assert_no_errno (symlink ("/tmp/flatpak-/nope", "too-many-levels"));
ok = flatpak_instance_claim_per_app_temp_directory ("com.example.App",
lock_fd,
AT_FDCWD,
"too-many-levels",
"/tmp",
&result,
&error);
g_assert_nonnull (error);
g_assert_cmpstr (error->message, ==,
"/tmp/flatpak-/nope has too many directory separators");
g_assert_null (result);
g_assert_false (ok);
g_clear_error (&error);
/* Similar */
g_assert_no_errno (symlink ("/tmp/flatpak-abc/", "too-many-levels2"));
ok = flatpak_instance_claim_per_app_temp_directory ("com.example.App",
lock_fd,
AT_FDCWD,
"too-many-levels2",
"/tmp",
&result,
&error);
g_assert_nonnull (error);
g_assert_cmpstr (error->message, ==,
"/tmp/flatpak-abc/ has too many directory separators");
g_assert_null (result);
g_assert_false (ok);
g_clear_error (&error);
g_assert_no_errno (symlink ("/tmp/flatpak-org.example.Other-XXXXXX", "wrong-app"));
ok = flatpak_instance_claim_per_app_temp_directory ("com.example.App",
lock_fd,
AT_FDCWD,
"wrong-app",
"/tmp",
&result,
&error);
g_assert_nonnull (error);
g_assert_cmpstr (error->message, ==,
"/tmp/flatpak-org.example.Other-XXXXXX does not "
"start with /tmp/flatpak-com.example.App");
g_assert_null (result);
g_assert_false (ok);
g_clear_error (&error);
g_assert_no_errno (symlink ("/tmp/flatpak-com.example.ApparentlyNot", "wrong-app2"));
ok = flatpak_instance_claim_per_app_temp_directory ("com.example.App",
lock_fd,
AT_FDCWD,
"wrong-app2",
"/tmp",
&result,
&error);
g_assert_nonnull (error);
g_assert_cmpstr (error->message, ==,
"/tmp/flatpak-com.example.ApparentlyNot does not "
"start with /tmp/flatpak-com.example.App-");
g_assert_null (result);
g_assert_false (ok);
g_clear_error (&error);
/* If it points to a filesystem object matching the right pattern, but
* that is not a directory, we refuse to reuse it */
non_directory_path = g_strdup ("/tmp/flatpak-com.example.App-XXXXXX");
g_assert_no_errno ((fd = g_mkstemp (non_directory_path)));
g_assert_no_errno (symlink (non_directory_path, "not-a-directory"));
ok = flatpak_instance_claim_per_app_temp_directory ("com.example.App",
lock_fd,
AT_FDCWD,
"not-a-directory",
"/tmp",
&result,
&error);
g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_DIRECTORY);
g_assert_null (result);
g_assert_false (ok);
g_clear_error (&error);
/* Reuse @non_directory_path as the name of a symlink to a directory:
* we consider that to be equally invalid. Create it inside our
* directory in /tmp so that we can rename() it into place,
* because symlink() does not overwrite, but rename() does. */
symlink_path = g_build_filename (dir_in_tmp, "symlink", NULL);
g_assert_no_errno (symlink (dir_in_tmp, symlink_path));
/* Overwrite the file with the symlink */
g_assert_no_errno (rename (symlink_path, non_directory_path));
/* We'll refuse to follow the symlink: for all we know it could be
* attacker-controlled. */
ok = flatpak_instance_claim_per_app_temp_directory ("com.example.App",
lock_fd,
AT_FDCWD,
"not-a-directory",
"/tmp",
&result,
&error);
/* Either of these would be reasonable */
if (error->code == G_IO_ERROR_TOO_MANY_LINKS)
g_assert_error (error, G_IO_ERROR, G_IO_ERROR_TOO_MANY_LINKS);
else
g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_DIRECTORY);
g_assert_null (result);
g_assert_false (ok);
g_clear_error (&error);
/* If link_path points to a directory owned by someone else, we refuse
* to use it. This part of the test will be skipped unless you pre-create
* this directory as root. */
if (stat ("/tmp/flatpak-com.example.App-OwnedByRoot", &stat_buf) == 0
&& stat_buf.st_uid == 0
&& geteuid () != 0)
{
g_assert_no_errno (symlink ("/tmp/flatpak-com.example.App-OwnedByRoot",
"not-our-directory"));
ok = flatpak_instance_claim_per_app_temp_directory ("com.example.App",
lock_fd,
AT_FDCWD,
"not-our-directory",
"/tmp",
&result,
&error);
g_assert_nonnull (error);
g_assert_cmpstr (error->message, ==,
"/tmp/flatpak-com.example.App-OwnedByRoot does not "
"belong to this user");
g_assert_null (result);
g_assert_false (ok);
g_clear_error (&error);
}
glnx_close_fd (&fd);
g_assert_no_errno (unlink (non_directory_path));
g_clear_pointer (&non_directory_path, g_free);
/* Even when we have a symlink to a directory matching the right pattern
* that we own, if it doesn't contain the flag file that indicates that
* it's one of our temp directories, we'll still refuse to use it. */
g_assert_no_errno (symlink (dir_in_tmp, "good-symlink"));
ok = flatpak_instance_claim_per_app_temp_directory ("com.example.App",
lock_fd,
AT_FDCWD,
"good-symlink",
"/tmp",
&result,
&error);
g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND);
g_assert_true (g_str_has_prefix (error->message,
"opening flag file /tmp/flatpak-com.example.App-"));
g_assert_nonnull (strstr (error->message, "/.flatpak-tmpdir:"));
g_assert_null (result);
g_assert_false (ok);
g_clear_error (&error);
/* Create the flag file (of course in real life this would have happened
* much sooner) */
flag_path = g_build_filename (dir_in_tmp, ".flatpak-tmpdir", NULL);
g_file_set_contents (flag_path, "", 0, &error);
g_assert_no_error (error);
/* Now we are finally willing to reuse the directory! A happy ending
* at last. */
ok = flatpak_instance_claim_per_app_temp_directory ("com.example.App",
lock_fd,
AT_FDCWD,
"good-symlink",
"/tmp",
&result,
&error);
g_assert_no_error (error);
g_assert_cmpstr (result, ==, dir_in_tmp);
g_assert_true (ok);
g_assert_no_errno (unlink (flag_path));
}
int
main (int argc, char *argv[])
{
int res;
isolated_test_dir_global_setup ();
g_test_init (&argc, &argv, NULL);
g_test_add_func ("/instance/gc", test_gc);
g_test_add_func ("/instance/claim-per-app-temp-directory",
test_claim_per_app_temp_directory);
res = g_test_run ();
isolated_test_dir_global_teardown ();
return res;
}
Reference in New Issue View Git Blame Copy Permalink