niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

AT_EXECVE_CHECK update for v6.14-rc1 (fix1)

Browse source 
- selftests: Handle old glibc without execveat(2) (Mickaël Salaün)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCZ51DjgAKCRA2KwveOeQk
 u5ahAP9m2RJdQm/oW/SPdhZ3nJynrD0UXKpZPYe733E9D2mccQEAvh0LIAUJGJoK
 FbpLRWSGXOkWxAJ1oabQo8GB5v+8EQs=
 =WVRq
 -----END PGP SIGNATURE-----

Merge tag 'AT_EXECVE_CHECK-v6.14-rc1-fix1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull AT_EXECVE_CHECK selftest fix from Kees Cook:
 "Fixes the AT_EXECVE_CHECK selftests which didn't run on old versions
  of glibc"

* tag 'AT_EXECVE_CHECK-v6.14-rc1-fix1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  selftests: Handle old glibc without execveat(2)
This commit is contained in:
Linus Torvalds 2025-01-31 17:12:31 -08:00
commit bdd4f86c97
3 changed files with 26 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
samples/check-exec/inc.c
View file

@ -21,8 +21,15 @@
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include <sys/prctl.h> #include <sys/prctl.h>
#include <sys/syscall.h>
#include <unistd.h> #include <unistd.h>
static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
char *const envp[], int flags)
{
return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
}
/* Returns 1 on error, 0 otherwise. */ /* Returns 1 on error, 0 otherwise. */
static int interpret_buffer(char *buffer, size_t buffer_size) static int interpret_buffer(char *buffer, size_t buffer_size)
{ {
@ -78,8 +85,8 @@ static int interpret_stream(FILE *script, char *const script_name,
* script execution. We must use the script file descriptor instead of * script execution. We must use the script file descriptor instead of
* the script path name to avoid race conditions. * the script path name to avoid race conditions.
*/ */
err = execveat(fileno(script), "", script_argv, envp, err = sys_execveat(fileno(script), "", script_argv, envp,
AT_EMPTY_PATH | AT_EXECVE_CHECK); AT_EMPTY_PATH | AT_EXECVE_CHECK);
if (err && restrict_stream) { if (err && restrict_stream) {
perror("ERROR: Script execution check"); perror("ERROR: Script execution check");
return 1; return 1;

11
tools/testing/selftests/exec/check-exec.c
View file

@ -22,6 +22,7 @@
#include <sys/prctl.h> #include <sys/prctl.h>
#include <sys/socket.h> #include <sys/socket.h>
#include <sys/stat.h> #include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/sysmacros.h> #include <sys/sysmacros.h>
#include <unistd.h> #include <unistd.h>
@ -31,6 +32,12 @@
#include "../kselftest_harness.h" #include "../kselftest_harness.h"
static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
char *const envp[], int flags)
{
return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
}
static void drop_privileges(struct __test_metadata *const _metadata) static void drop_privileges(struct __test_metadata *const _metadata)
{ {
const unsigned int noroot = SECBIT_NOROOT | SECBIT_NOROOT_LOCKED; const unsigned int noroot = SECBIT_NOROOT | SECBIT_NOROOT_LOCKED;
@ -219,8 +226,8 @@ static void test_exec_fd(struct __test_metadata *_metadata, const int fd,
* test framework as an error. With AT_EXECVE_CHECK, we only check a * test framework as an error. With AT_EXECVE_CHECK, we only check a
* potential successful execution. * potential successful execution.
*/ */
access_ret = access_ret = sys_execveat(fd, "", argv, NULL,
execveat(fd, "", argv, NULL, AT_EMPTY_PATH | AT_EXECVE_CHECK); AT_EMPTY_PATH | AT_EXECVE_CHECK);
access_errno = errno; access_errno = errno;
if (err_code) { if (err_code) {
EXPECT_EQ(-1, access_ret); EXPECT_EQ(-1, access_ret);

10
tools/testing/selftests/landlock/fs_test.c
View file

@ -59,6 +59,12 @@ int open_tree(int dfd, const char *filename, unsigned int flags)
} }
#endif #endif
static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
char *const envp[], int flags)
{
return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
}
#ifndef RENAME_EXCHANGE #ifndef RENAME_EXCHANGE
#define RENAME_EXCHANGE (1 << 1) #define RENAME_EXCHANGE (1 << 1)
#endif #endif
@ -2024,8 +2030,8 @@ static void test_check_exec(struct __test_metadata *const _metadata,
int ret; int ret;
char *const argv[] = { (char *)path, NULL }; char *const argv[] = { (char *)path, NULL };
ret = execveat(AT_FDCWD, path, argv, NULL, ret = sys_execveat(AT_FDCWD, path, argv, NULL,
AT_EMPTY_PATH | AT_EXECVE_CHECK); AT_EMPTY_PATH | AT_EXECVE_CHECK);
if (err) { if (err) {
EXPECT_EQ(-1, ret); EXPECT_EQ(-1, ret);
EXPECT_EQ(errno, err); EXPECT_EQ(errno, err);