Commit 0e7f90f3 authored by Mickaël Salaün's avatar Mickaël Salaün Committed by Kees Cook
Browse files

selftests/landlock: Add tests for execveat + AT_EXECVE_CHECK 



Extend layout1.execute with the new AT_EXECVE_CHECK flag.  The semantic
with AT_EXECVE_CHECK is the same as with a simple execve(2),
LANDLOCK_ACCESS_FS_EXECUTE is enforced the same way.

Cc: Günther Noack <gnoack@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Paul Moore <paul@paul-moore.com>
Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
Link: https://lore.kernel.org/r/20241212174223.389435-5-mic@digikod.net


Signed-off-by: default avatarKees Cook <kees@kernel.org>
parent b083cc81

tools/testing/selftests/landlock/fs_test.c

+27 −0
Original line number Diff line number Diff line
@@ -37,6 +37,10 @@ 
#include <linux/fs.h>

#include <linux/mount.h>



/* Defines AT_EXECVE_CHECK without type conflicts. */

#define _ASM_GENERIC_FCNTL_H

#include <linux/fcntl.h>



#include "common.h"



#ifndef renameat2
@@ -2008,6 +2012,22 @@ static void test_execute(struct __test_metadata *const _metadata, const int err, 
	};

}



static void test_check_exec(struct __test_metadata *const _metadata,

			    const int err, const char *const path)

{

	int ret;

	char *const argv[] = { (char *)path, NULL };



	ret = execveat(AT_FDCWD, path, argv, NULL,

		       AT_EMPTY_PATH | AT_EXECVE_CHECK);

	if (err) {

		EXPECT_EQ(-1, ret);

		EXPECT_EQ(errno, err);

	} else {

		EXPECT_EQ(0, ret);

	}

}



TEST_F_FORK(layout1, execute)

{

	const struct rule rules[] = {
@@ -2025,20 +2045,27 @@ TEST_F_FORK(layout1, execute) 
	copy_binary(_metadata, file1_s1d2);

	copy_binary(_metadata, file1_s1d3);



	/* Checks before file1_s1d1 being denied. */

	test_execute(_metadata, 0, file1_s1d1);

	test_check_exec(_metadata, 0, file1_s1d1);



	enforce_ruleset(_metadata, ruleset_fd);

	ASSERT_EQ(0, close(ruleset_fd));



	ASSERT_EQ(0, test_open(dir_s1d1, O_RDONLY));

	ASSERT_EQ(0, test_open(file1_s1d1, O_RDONLY));

	test_execute(_metadata, EACCES, file1_s1d1);

	test_check_exec(_metadata, EACCES, file1_s1d1);



	ASSERT_EQ(0, test_open(dir_s1d2, O_RDONLY));

	ASSERT_EQ(0, test_open(file1_s1d2, O_RDONLY));

	test_execute(_metadata, 0, file1_s1d2);

	test_check_exec(_metadata, 0, file1_s1d2);



	ASSERT_EQ(0, test_open(dir_s1d3, O_RDONLY));

	ASSERT_EQ(0, test_open(file1_s1d3, O_RDONLY));

	test_execute(_metadata, 0, file1_s1d3);

	test_check_exec(_metadata, 0, file1_s1d3);

}



TEST_F_FORK(layout1, link)