#!/usr/bin/python
#
# Copyright (c) 2010 The Chromium Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

__author__ = 'kdlucas@chromium.org (Kelly Lucas)'

import logging
import os
import re
import shutil
import stat

from autotest_lib.client.bin import test
from autotest_lib.client.common_lib import error


class platform_FilePerms(test.test):
    """
    Test file permissions.
    """
    version = 2
    mount_path = '/bin/mount'
    standard_options = ['nosuid', 'nodev', 'noexec']
    standard_rw_options = ['rw'] + standard_options
    standard_ro_options = ['ro'] + standard_options
    loop_device = r'/dev/loop[0-9]+$'
    root_device = r'/dev/root$'
    # When adding an expectation that isn't simply "standard_*_options",
    # please leave either an explanation for why that mount is special,
    # or a bug number tracking work to harden that mount point, in a comment.
    expected_mount_options = {
        '/dev': {
            'type': ['devtmpfs'],
            'options': ['rw', 'nosuid', 'noexec', 'mode=755']},
        '/sys/fs/pstore': {
            'type': ['pstore'],
            'options': standard_rw_options},
        '/dev/pts': { # Special case, we want to track gid/mode too.
            'type': ['devpts'],
            'options': ['rw', 'nosuid', 'noexec', 'gid=5', 'mode=620']},
        '/dev/shm': {'type': ['tmpfs'], 'options': standard_rw_options},
        '/home': {'type': ['ext4'], 'options': standard_rw_options},
        '/home/chronos': {'type': ['ext4'], 'options': standard_rw_options},
        '/media': {'type': ['tmpfs'], 'options': standard_rw_options},
        '/mnt/stateful_partition': {
            'type': ['ext4'],
            'options': standard_rw_options},
        '/mnt/stateful_partition/encrypted': {
            'type': ['ext4'],
            'options': standard_rw_options},
        '/opt/google/containers/android/rootfs/android-data/data/dalvik-cache/'
        'arm': {
            'type': ['ext4'],
            'options': standard_rw_options},
        '/opt/google/containers/android/rootfs/android-data/data/dalvik-cache/'
        'x86': {
            'type': ['ext4'],
            'options': standard_rw_options},
        '/opt/google/containers/android/rootfs/android-data/data/dalvik-cache/'
        'x86_64': {
            'type': ['ext4'],
            'options': standard_rw_options},
        # Special case - Android container has devices and suid programs.
        # Note that after the user logs in we remount it as "exec",
        # therefore we do not enforce 'noexec'.
        '/opt/google/containers/android/rootfs/root': {
            'device': loop_device,
            'type': ['squashfs'],
            'options': ['ro']},
        '/opt/google/containers/android/rootfs/root/system/lib/arm': {
            'device': loop_device,
            'type': ['squashfs'],
            'options': ['ro', 'nosuid', 'nodev']},
        '/opt/google/containers/arc-sdcard/mountpoints/container-root': {
            'device': loop_device,
            'type': ['squashfs'],
            'options': ['ro', 'noexec']},
        '/opt/google/containers/arc-obb-mounter/mountpoints/container-root': {
            'device': loop_device,
            'type': ['squashfs'],
            'options': ['ro', 'noexec']},
        '/run/arc/adbd': {
            'type': ['tmpfs'],
            'options': standard_rw_options + ['mode=770']},
        '/run/arc/debugfs/sync': {
            'type': ['debugfs'],
            'options': standard_rw_options },
        '/run/arc/debugfs/tracing': {  # for devices in dev mode.
            'type': ['debugfs', 'tracefs'],
            'options': standard_rw_options },
        '/run/arc/media': {
            'type': ['tmpfs'] ,
            'options': standard_ro_options + ['mode=755']},
        '/run/arc/obb': {
            'type': ['tmpfs'],
            'options': standard_ro_options + ['mode=755']},
        '/run/arc/oem': {
            'type': ['tmpfs'],
            'options': standard_rw_options + ['mode=755']},
        '/run/arc/sdcard': {
            'type': ['tmpfs'],
            'options': standard_ro_options + ['mode=755']},
        '/run/arc/shared_mounts': {
            'type': ['tmpfs'],
            'options': standard_rw_options + ['mode=755']},
        '/proc': { 'type': ['proc'], 'options': standard_rw_options},
        '/run': { # Special case, we want to track mode too.
            'type': ['tmpfs'],
            'options': standard_rw_options + ['mode=755']},
        # Special case, we want to track group/mode too.
        # gid 605 == debugfs-access
        '/run/debugfs_gpu': {
            'type': ['debugfs'],
            'options': standard_rw_options + ['gid=605', 'mode=750']},
        '/run/lock': {'type': ['tmpfs'], 'options': standard_rw_options},
        '/run/imageloader/PepperFlashPlayer': {
            'type': ['squashfs'],
            'options': ['ro', 'nodev', 'nosuid']},
        '/sys': {'type': ['sysfs'], 'options': standard_rw_options},
        # TODO: /run is already a tmpfs mountpoint, so ip should probably
        # be modified to detect that, and not create a second mountpoint.
        # crbug.com/757953
        '/run/netns': {'type': ['tmpfs'], 'options': standard_rw_options},
        '/sys/fs/cgroup': {
            'type': ['tmpfs'],
            'options': standard_rw_options + ['mode=755']},
        '/sys/fs/cgroup/cpu': {
            'type': ['cgroup'],
            'options': standard_rw_options},
        '/sys/fs/cgroup/cpuacct': {
            'type': ['cgroup'],
            'options': standard_rw_options},
        '/sys/fs/cgroup/cpuset': {
            'type': ['cgroup'],
            'options': standard_rw_options},
        '/sys/fs/cgroup/devices': {
            'type': ['cgroup'],
            'options': standard_rw_options},
        '/sys/fs/cgroup/freezer': {
            'type': ['cgroup'],
            'options': standard_rw_options},
        '/sys/fs/cgroup/schedtune': {
            'type': ['cgroup'],
            'options': standard_rw_options},
        '/sys/fs/fuse/connections': {
            'type': ['fusectl'],
            'options': standard_rw_options},
        '/sys/fs/selinux': {
            'type': ['selinuxfs'],
            'options': ['rw', 'nosuid', 'noexec']},
        '/sys/kernel/config': {
            'type': ['configfs'],
            'options': standard_rw_options},
        '/sys/kernel/debug': {
            'type': ['debugfs'],
            'options': standard_rw_options},
        '/sys/kernel/debug/tracing': {
            'type': ['tracefs'],
            'options': standard_rw_options},
        '/sys/kernel/security': {
            'type': ['securityfs'],
            'options': standard_rw_options},
        '/tmp': {'type': ['tmpfs'], 'options': standard_rw_options},
        '/var': {'type': ['ext4'], 'options': standard_rw_options},
        '/usr/share/oem': {
            'type': ['ext4'],
            'options': standard_ro_options},
        '/run/imageloader': {
            'type': ['tmpfs'],
            'options': standard_rw_options},
    }

    # /var/run and /var/lock are bind mounts of /run and /run/lock,
    # respectively. Duplicate the entries accordingly.
    expected_mount_options['/var/run'] = expected_mount_options['/run']
    expected_mount_options['/var/lock'] = expected_mount_options['/run/lock']

    # Base for of {/run,/etc}/daemon-store/<daemon-name> directories.
    run_daemon_store_base = "/run/daemon-store/"
    etc_daemon_store_base = "/etc/daemon-store/"
    expected_daemon_store_mount_options = {
        'type': ['tmpfs'],
        'options': standard_rw_options + ['mode=755']
    }

    # This lists mount points that host mounts created in developer mode, after
    # regular mount operations taking place during boot have completed. These
    # are ignored when checking mounts present in the live system.
    testmode_modded_fses = set(
        ['/home', '/tmp', '/usr/local', '/var/db/pkg', '/var/lib/portage'])

    def checkid(self, fs, userid):
        """
        Check that the uid and gid for |fs| match |userid|.

        @param fs: string, directory or file path.
        @param userid: userid to check for.
        Returns:
            int, the number errors (non-matches) detected.
        """
        errors = 0

        if not os.access(fs, os.F_OK):
            # The path does not exist, so exit early.
            return errors

        uid = os.stat(fs)[stat.ST_UID]
        gid = os.stat(fs)[stat.ST_GID]

        if userid != uid:
            logging.error('Wrong uid in filesystem "%s"', fs)
            errors += 1
        if userid != gid:
            logging.error('Wrong gid in filesystem "%s"', fs)
            errors += 1

        return errors

    def get_perm(self, fs):
        """
        Check the file permissions of a filesystem.

        @param fs: string, mount point for filesystem to check.
        Returns:
            int, equivalent to unix permissions.
        """
        MASK = 0777

        if not os.access(fs, os.F_OK):
            # The path does not exist, so exit early.
            return None

        fstat = os.stat(fs)
        mode = fstat[stat.ST_MODE]

        fperm = oct(mode & MASK)
        return fperm

    def read_mtab(self, mtab_path='/etc/mtab'):
        """
        Helper function to read the mtab file into a dict

        @param mtab_path: path to '/etc/mtab'
        Returns:
          dict, mount points as keys, and another dict with
          options list, device and type as values.
        """
        file_handle = open(mtab_path, 'r')
        lines = file_handle.readlines()
        file_handle.close()

        # Save mtab to the results dir to diagnose failures.
        shutil.copyfile(mtab_path,
                        os.path.join(self.resultsdir,
                                     os.path.basename(mtab_path)))

        comment_re = re.compile("#.*$")
        mounts = {}
        for line in lines:
            # remove any comments first
            line = comment_re.sub("", line)
            fields = line.split()
            # ignore malformed lines
            if len(fields) < 4:
                continue
            # Don't include rootfs in the list, because it maps to the
            # same location as /dev/root: '/' (and we don't care about
            # its options at the moment).
            if fields[0] == 'rootfs':
                continue
            # For ARC, normalize some container paths.
            fields[1] = re.sub(r'^/run/containers/android_[^/]{6}/',
                               r'/run/containers/android/',
                               fields[1])
            mounts[fields[1]] = {'device': fields[0],
                                 'type': fields[2],
                                 'options': fields[3].split(',')}
        return mounts

    def try_write(self, fs):
        """
        Try to write a file in the given filesystem.

        @param fs: string, file system to use.
        Returns:
            int, number of errors encountered:
            0 = write successful,
            >0 = write not successful.
        """

        TEXT = 'This is filler text for a test file.\n'

        tempfile = os.path.join(fs, 'test')
        try:
            fh = open(tempfile, 'w')
            fh.write(TEXT)
            fh.close()
        except OSError:  # This error will occur with read only filesystem.
            return 1
        except IOError, e:
            return 1

        if os.path.exists(tempfile):
            os.remove(tempfile)

        return 0

    def check_mounted_read_only(self, filesystem):
        """
        Check the permissions of a filesystem according to /etc/mtab.

        @param filesystem: string, file system device to check.
        Returns:
            1 if rw or not in mtab, 0 if ro
        """

        errors = 0
        mtab = self.read_mtab()
        if not (filesystem in mtab.keys()):
            logging.error('Could not find filesystem "%s" in mtab', filesystem)
            errors += 1
            return errors  # no point in continuing this test.
        if not ('ro' in mtab[filesystem]['options']):
            logging.error('Filesystem "%s" is not mounted read-only',
                          filesystem)
            errors += 1
        return errors

    def check_daemon_store_directory(self, daemon_name):
        """
        Check whether /run/daemon-store/<daemon-name> is root-owned and there is
        a corresponding /etc/daemon-store/<daemon-name> folder.

        @param daemon_name: The last part of /run/daemon-store/<daemon-name>.
        Returns:
            int, the number errors detected.
        """
        errors = 0

        run_daemon_store = self.run_daemon_store_base + daemon_name
        errors += self.checkid(run_daemon_store, 0)

        etc_daemon_store = self.etc_daemon_store_base + daemon_name
        if not os.path.exists(etc_daemon_store):
            logging.error(
                'Daemon store "%s" does not have a corresponding "%s" '
                'directory', run_daemon_store, etc_daemon_store)
            errors += 1

        return errors

    def check_mount_options(self):
        """
        Check the permissions of all non-rootfs filesystems to make
        sure they have the right mount options. In order to do this,
        both the live system state, and a log-snapshot of what the system
        looked like prior to dev-mode/test-mode modifications were applied,
        are validated.

        Note that since this test is not a UITest, and takes place
        while the system waits at a login screen, mount options are
        not checked for a mounted cryptohome or guestfs. Consult the
        security_ProfilePermissions test for those checks.

        Args:
            (none)
        Returns:
            int, the number of errors identified in mount options.
        """
        errors = 0
        # Perform mount-option checks of both mount options as
        # captured during boot, and, the live system state.  After the
        # first pass (where we process mount_options.log), grow the
        # list of ignored filesystems to include all those we know are
        # tweaked by devmode/mod-for-test mode. This properly sets
        # expectations for the second pass.
        mtabs = ['/var/log/mount_options.log', '/etc/mtab']
        ignored_fses = set(['/'])
        # nsfs is ignored because it's a kernel filesystem used with
        # network namespaces, and is not a traditional filesystem where
        # arbitrary files may be created and executed.
        ignored_types = set(['ecryptfs', 'nsfs'])
        for mtab_path in mtabs:
            mtab = self.read_mtab(mtab_path=mtab_path)
            for fs in mtab.keys():
                if fs in ignored_fses:
                    continue

                fs_type = mtab[fs]['type']
                if fs_type in ignored_types:
                    logging.warning('Ignoring filesystem "%s" with type "%s"',
                                    fs, fs_type)
                    continue

                if fs in self.expected_mount_options:
                    mount_options = self.expected_mount_options[fs]
                elif fs.startswith(self.run_daemon_store_base):
                    # Handle mounts inside /run/daemon-store as a special case.
                    daemon_name = fs[len(self.run_daemon_store_base):]
                    errors += self.check_daemon_store_directory(daemon_name)
                    mount_options = self.expected_daemon_store_mount_options
                else:
                    logging.error(
                            'No expectations entry for "%s" with info "%s"',
                            fs, mtab[fs])
                    errors += 1
                    continue

                if fs_type not in mount_options['type']:
                    logging.error(
                            '[%s] "%s" has type "%s", expected type "%s"',
                            mtab_path, fs, fs_type, mount_options['type'])
                    errors += 1

                device_type = mtab[fs]['device']
                if ('device' in mount_options) and (
                    re.match(mount_options['device'], device_type) is None):
                    logging.error(
                            '[%s] "%s" is device "%s", expected device "%s"',
                            mtab_path, fs, device_type, mount_options['device'])
                    errors += 1

                # For options, require the specified options to be present.
                # Do not consider it an error if extra options are present.
                # (This makes it easy to deal with options we don't wish
                # to track closely, like devtmpfs's nr_inodes= for example.)
                seen = set(mtab[fs]['options'])
                expected = set(mount_options['options'])
                missing = expected - seen
                if (missing):
                    logging.error('[%s] "%s" is missing options "%s"',
                                  mtab_path, fs, missing)
                    errors += 1

            ignored_fses.update(self.testmode_modded_fses)

        return errors

    def run_once(self):
        """
        Main testing routine for platform_FilePerms.
        """
        errors = 0

        # Root owned directories with expected permissions.
        root_dirs = {'/': ['0755'],
                     '/bin': ['0755'],
                     '/boot': ['0755'],
                     '/dev': ['0755'],
                     '/etc': ['0755'],
                     '/home': ['0755'],
                     '/lib': ['0755'],
                     '/media': ['0777'],
                     '/mnt': ['0755'],
                     '/mnt/stateful_partition': ['0755'],
                     '/opt': ['0755'],
                     '/proc': ['0555'],
                     '/run': ['0755'],
                     '/sbin': ['0755'],
                     '/sys': ['0555', '0755'],
                     '/tmp': ['0777'],
                     '/usr': ['0755'],
                     '/usr/bin': ['0755'],
                     '/usr/lib': ['0755'],
                     '/usr/local': ['0755'],
                     '/usr/sbin': ['0755'],
                     '/usr/share': ['0755'],
                     '/var': ['0755'],
                     '/var/cache': ['0755']}

        # Read-only directories
        ro_dirs = ['/', '/bin', '/boot', '/etc', '/lib', '/mnt',
                   '/opt', '/sbin', '/usr', '/usr/bin', '/usr/lib',
                   '/usr/sbin', '/usr/share']

        # Root directories writable by root
        root_rw_dirs = ['/run', '/var', '/var/lib', '/var/cache', '/var/log',
                        '/usr/local']

        # Ensure you cannot write files in read only directories.
        for dir in ro_dirs:
            if self.try_write(dir) == 0:
                logging.error('Root can write to read-only dir "%s"', dir)
                errors += 1

        # Ensure the uid and gid are correct for root owned directories.
        for dir in root_dirs:
            errors += self.checkid(dir, 0)

        # Ensure root can write into root dirs with rw access.
        for dir in root_rw_dirs:
            if self.try_write(dir) > 0:
                errors += 1

        # Check permissions on root owned directories.
        for dir in root_dirs:
            fperms = self.get_perm(dir)
            if fperms is not None and fperms not in root_dirs[dir]:
                logging.error('"%s" has "%s" permissions', dir, fperms)
                errors += 1

        errors += self.check_mounted_read_only('/')

        # Check mount options on mount points.
        errors += self.check_mount_options()

        # If errors is not zero, there were errors.
        if errors > 0:
            raise error.TestFail('Found %d permission errors' % errors)