mirror of
https://github.com/checkpoint-restore/criu.git
synced 2026-07-21 01:06:58 +00:00
ef39c4657b
This test creates 2 users to check how secure is using criu with setuid bit set. Signed-off-by: Ruslan Kuprieiev <kupruser@gmail.com> Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
80 lines
1.5 KiB
Bash
Executable file
80 lines
1.5 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
PID=
|
|
|
|
function run_as {
|
|
echo "== Run ${LOOP} as $1"
|
|
echo ${PIDFILE}
|
|
rm -f ${PIDFILE}
|
|
su $1 -c "${LOOP} $2 < /dev/null 2> /dev/null > ${PIDFILE} &"
|
|
PID=`cat ${PIDFILE}`
|
|
echo ${PID}
|
|
}
|
|
|
|
function dump_as {
|
|
echo "== Dump ${PID} as $@"
|
|
su $@ -c "${CRIU} dump --tree ${PID} --images-dir ${IMGS} --shell-job"
|
|
return $?
|
|
}
|
|
|
|
function rstr_as {
|
|
echo "== Restore ${IMGS} as $@"
|
|
su $@ -c "${CRIU} restore --images-dir ${IMGS} --shell-job --restore-detached"
|
|
return $?
|
|
}
|
|
|
|
function result {
|
|
local BGRED='\033[41m'
|
|
local BGGREEN='\033[42m'
|
|
local NORMAL=$(tput sgr0)
|
|
|
|
if [ $1 -ne 0 ]; then
|
|
echo -e "${BGRED}FAIL${NORMAL}"
|
|
else
|
|
echo -e "${BGGREEN}PASS${NORMAL}"
|
|
fi
|
|
}
|
|
|
|
function test_root {
|
|
echo "==== Check that non-root can't dump/restore process owned by root"
|
|
|
|
run_as ${ROOT}
|
|
|
|
dump_as ${USR1} ; result $((!$?))
|
|
dump_as ${ROOT} ; result $(($?))
|
|
|
|
rstr_as ${USR1} ; result $((!$?))
|
|
rstr_as ${ROOT} ; result $(($?))
|
|
|
|
kill -SIGKILL ${PID}
|
|
}
|
|
|
|
function test_other {
|
|
echo "==== Check that user2 can't dump/restore process owned by user1"
|
|
|
|
run_as ${USR1}
|
|
|
|
dump_as ${USR2} ; result $((!$?))
|
|
dump_as ${USR1} ; result $(($?))
|
|
|
|
rstr_as ${USR2} ; result $((!$?))
|
|
rstr_as ${USR1} ; result $(($?))
|
|
|
|
kill -SIGKILL ${PID}
|
|
}
|
|
|
|
function test_own {
|
|
echo "==== Check that user1 can dump/restore his own process that changes it's gid to one from groups"
|
|
|
|
run_as ${USR1} "--chgrp"
|
|
|
|
dump_as ${USR1} ; result $(($?))
|
|
|
|
rstr_as ${USR1} ; result $(($?))
|
|
|
|
kill -SIGKILL ${PID}
|
|
}
|
|
|
|
test_root
|
|
test_other
|
|
test_own
|