/*	$NetBSD: t_lua.c,v 1.1.6.2 2026/06/29 20:00:05 martin Exp $	*/

/*-
 * Copyright (c) 2026 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#include <sys/cdefs.h>
__RCSID("$NetBSD: t_lua.c,v 1.1.6.2 2026/06/29 20:00:05 martin Exp $");

/*
 * Test lua(4)
 *
 * Minimal tests to verify access control -- if we want to use lua(4)
 * for anything else, this needs more tests.
 */

#include <sys/lua.h>
#include <sys/ioctl.h>
#include <sys/module.h>
#include <sys/stat.h>
#include <sys/wait.h>

#include <atf-c.h>
#include <err.h>
#include <errno.h>
#include <fcntl.h>
#include <pwd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include "h_macros.h"

#define	_PATH_DEV_LUA	"/dev/lua"
#define	TEST_STATE	"t_lua"

static void
require_lua(void)
{
	struct iovec iov;
	const modstat_t *mp;
	size_t nbytes = 8192;
	const int *countp;
	unsigned i, count;

	for (;;) {
		memset(&iov, 0, sizeof(iov));
		REQUIRE_LIBC(iov.iov_base = malloc(nbytes), NULL);
		iov.iov_len = nbytes;
		RL(modctl(MODCTL_STAT, &iov));
		if (iov.iov_len <= nbytes)
			break;
		free(iov.iov_base);
		nbytes = iov.iov_len;
	}
	countp = (const int *)iov.iov_base;
	ATF_REQUIRE_MSG(*countp >= 0, "count=%d", *countp);
	count = (unsigned)*countp;
	ATF_REQUIRE_MSG(count <= iov.iov_len/sizeof(*mp),
	    "count=%u iov_len=%zu max=%zu",
	    count, iov.iov_len, iov.iov_len/sizeof(*mp));
	mp = (const void *)(countp + 1);
	for (i = 0; i < count; i++) {
		modstat_t m;

		memcpy(&m, &mp[i], sizeof(m));
		if (strcmp(m.ms_name, "lua") == 0)
			goto out;
	}
	atf_tc_skip("lua.kmod not loaded");

out:	free(iov.iov_base);
}

static int lua_fd = -1;

ATF_TC_WITH_CLEANUP(access);
ATF_TC_HEAD(access, tc)
{
	atf_tc_set_md_var(tc, "descr", "Verifies /dev/lua access control");
	atf_tc_set_md_var(tc, "require.user", "root");
}
ATF_TC_BODY(access, tc)
{
	int fd;
	char cwd[PATH_MAX], path[PATH_MAX];
	struct lua_create cr;
	struct lua_load ld;
	struct lua_require rq;
	struct lua_info info;

	require_lua();

	REQUIRE_LIBC(getcwd(cwd, sizeof(cwd)), NULL);
	if ((size_t)snprintf(path, sizeof(path), "%s/test.lua", cwd) >=
	    sizeof(path))
		atf_tc_fail("overlong working directory");
	RL(fd = open(path, O_WRONLY|O_CREAT));
	RL(close(fd));

	/*
	 * Verify that if we're read-only, we can query info but not
	 * create states.
	 */
	RL(fd = open(_PATH_DEV_LUA, O_RDONLY));
	RL(ioctl(fd, LUAINFO, &info));
	ATF_REQUIRE_ERRNO(EACCES, ioctl(fd, LUACREATE, &cr) == -1);
	ATF_REQUIRE_ERRNO(EACCES, ioctl(fd, LUALOAD, &ld) == -1);
	ATF_REQUIRE_ERRNO(EACCES, ioctl(fd, LUAREQUIRE, &rq) == -1);
	ATF_REQUIRE_ERRNO(EACCES, ioctl(fd, LUADESTROY, &cr) == -1);
	RL(close(fd));

	/*
	 * Verify that if we're write-only, we can create states and
	 * load things but not query them.
	 */
	RL(fd = open(_PATH_DEV_LUA, O_WRONLY));

	ATF_REQUIRE_ERRNO(EACCES, ioctl(fd, LUAINFO, &info) == -1);

	memset(&cr, 0, sizeof(cr));
	strlcpy(cr.name, "_invalid", sizeof(cr.name));
	ATF_REQUIRE_ERRNO(ENXIO, ioctl(fd, LUACREATE, &cr) == -1);

	memset(&cr, 0, sizeof(cr));
	strlcpy(cr.name, TEST_STATE, sizeof(cr.name));
	RL(ioctl(fd, LUACREATE, &cr));

	memset(&cr, 0, sizeof(cr));
	strlcpy(cr.name, TEST_STATE, sizeof(cr.name));
	ATF_REQUIRE_ERRNO(EBUSY, ioctl(fd, LUACREATE, &cr) == -1);

	lua_fd = fd;		/* for cleanup */

	memset(&ld, 0, sizeof(ld));
	strlcpy(ld.state, TEST_STATE, sizeof(ld.state));
	strlcpy(ld.path, path, sizeof(ld.path));
	RL(ioctl(fd, LUALOAD, &ld));

	/* XXX LUAREQUIRE */

	RL(ioctl(fd, LUADESTROY, &cr));

	RL(close(fd));
}
ATF_TC_CLEANUP(access, tc)
{
	struct lua_create cr;

	memset(&cr, 0, sizeof(cr));
	strlcpy(cr.name, TEST_STATE, sizeof(cr.name));
	(void)ioctl(lua_fd, LUADESTROY, &cr);
}

ATF_TC(perms);
ATF_TC_HEAD(perms, tc)
{
	atf_tc_set_md_var(tc, "descr", "Verifies permissions on /dev/lua");
	atf_tc_set_md_var(tc, "require.user", "root");
}
ATF_TC_BODY(perms, tc)
{
	struct stat st;
	struct passwd *pw;
	pid_t child;
	int status;

	RL(stat(_PATH_DEV_LUA, &st));
	ATF_REQUIRE_MSG(st.st_uid == 0,
	    "/dev/lua should be root-owned: uid=%d", (int)st.st_uid);
	ATF_REQUIRE_MSG((st.st_mode & S_IWOTH) == 0,
	    "/dev/lua should not be world-writable: mode=%04o", st.st_mode);

	REQUIRE_LIBC(pw = getpwnam("nobody"), NULL);

	RL(child = fork());
	if (child == 0) {
		if (setgroups(0, NULL) == -1)
			err(EXIT_FAILURE, "setgroups");
		if (setregid(pw->pw_gid, pw->pw_gid))
			err(EXIT_FAILURE, "setregid");
		if (setreuid(pw->pw_uid, pw->pw_uid))
			err(EXIT_FAILURE, "setreuid");
		if (open(_PATH_DEV_LUA, O_WRONLY) != -1) {
			errx(EXIT_FAILURE,
			    "open /dev/lua unexpectedly succeeded");
		}
		if (errno != EACCES) {
			err(EXIT_FAILURE,
			    "open /dev/lua didn't fail with EACCES");
		}
		_exit(0);
	}
	RL(waitpid(child, &status, 0));
	ATF_REQUIRE_MSG(!WIFSIGNALED(status),
	    "child terminated on signal %d", WTERMSIG(status));
	ATF_REQUIRE_MSG(WIFEXITED(status),
	    "child exited unexpectedly, status=0x%x", status);
	ATF_REQUIRE_MSG(WEXITSTATUS(status) == 0,
	    "child exited with code %d", WEXITSTATUS(status));
}

ATF_TP_ADD_TCS(tp)
{

	ATF_TP_ADD_TC(tp, access);
	ATF_TP_ADD_TC(tp, perms);

	return atf_no_error();
}
