Commit bdd4f86c authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'AT_EXECVE_CHECK-v6.14-rc1-fix1' of... 

Merge tag 'AT_EXECVE_CHECK-v6.14-rc1-fix1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull AT_EXECVE_CHECK selftest fix from Kees Cook:
 "Fixes the AT_EXECVE_CHECK selftests which didn't run on old versions
  of glibc"

* tag 'AT_EXECVE_CHECK-v6.14-rc1-fix1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  selftests: Handle old glibc without execveat(2)
parents 73512f2a 38567b97

samples/check-exec/inc.c

+9 −2
Original line number Diff line number Diff line
@@ -21,8 +21,15 @@ 
#include <stdlib.h>

#include <string.h>

#include <sys/prctl.h>

#include <sys/syscall.h>

#include <unistd.h>



static int sys_execveat(int dirfd, const char *pathname, char *const argv[],

			char *const envp[], int flags)

{

	return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);

}



/* Returns 1 on error, 0 otherwise. */

static int interpret_buffer(char *buffer, size_t buffer_size)

{
@@ -78,7 +85,7 @@ static int interpret_stream(FILE *script, char *const script_name, 
	 * script execution.  We must use the script file descriptor instead of

	 * the script path name to avoid race conditions.

	 */

	err = execveat(fileno(script), "", script_argv, envp,

	err = sys_execveat(fileno(script), "", script_argv, envp,

			   AT_EMPTY_PATH | AT_EXECVE_CHECK);

	if (err && restrict_stream) {

		perror("ERROR: Script execution check");

tools/testing/selftests/exec/check-exec.c

+9 −2
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ 
#include <sys/prctl.h>

#include <sys/socket.h>

#include <sys/stat.h>

#include <sys/syscall.h>

#include <sys/sysmacros.h>

#include <unistd.h>
@@ -31,6 +32,12 @@ 


#include "../kselftest_harness.h"



static int sys_execveat(int dirfd, const char *pathname, char *const argv[],

			char *const envp[], int flags)

{

	return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);

}



static void drop_privileges(struct __test_metadata *const _metadata)

{

	const unsigned int noroot = SECBIT_NOROOT | SECBIT_NOROOT_LOCKED;
@@ -219,8 +226,8 @@ static void test_exec_fd(struct __test_metadata *_metadata, const int fd, 
	 * test framework as an error.  With AT_EXECVE_CHECK, we only check a

	 * potential successful execution.

	 */

	access_ret =

		execveat(fd, "", argv, NULL, AT_EMPTY_PATH | AT_EXECVE_CHECK);

	access_ret = sys_execveat(fd, "", argv, NULL,

				  AT_EMPTY_PATH | AT_EXECVE_CHECK);

	access_errno = errno;

	if (err_code) {

		EXPECT_EQ(-1, access_ret);

tools/testing/selftests/landlock/fs_test.c

+8 −2
Original line number Diff line number Diff line
@@ -59,6 +59,12 @@ int open_tree(int dfd, const char *filename, unsigned int flags) 
}

#endif



static int sys_execveat(int dirfd, const char *pathname, char *const argv[],

			char *const envp[], int flags)

{

	return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);

}



#ifndef RENAME_EXCHANGE

#define RENAME_EXCHANGE (1 << 1)

#endif
@@ -2024,7 +2030,7 @@ static void test_check_exec(struct __test_metadata *const _metadata, 
	int ret;

	char *const argv[] = { (char *)path, NULL };



	ret = execveat(AT_FDCWD, path, argv, NULL,

	ret = sys_execveat(AT_FDCWD, path, argv, NULL,

			   AT_EMPTY_PATH | AT_EXECVE_CHECK);

	if (err) {

		EXPECT_EQ(-1, ret);