Commit 61016db1 authored by Kees Cook's avatar Kees Cook Committed by Shuah Khan
Browse files

selftests/exec: Verify execve of non-regular files fail 



Add a named pipe as an exec target to make sure that non-regular
files are rejected by execve() with EACCES. This can help verify
commit 73601ea5 ("fs/open.c: allow opening only regular files
during execve()").

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarShuah Khan <skhan@linuxfoundation.org>
parent a5f30467

tools/testing/selftests/exec/.gitignore

+1 −0
Original line number Diff line number Diff line
@@ -9,3 +9,4 @@ execveat.ephemeral 
execveat.denatured

/recursion-depth

xxxxxxxx*

pipe

tools/testing/selftests/exec/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -4,7 +4,7 @@ CFLAGS += -Wno-nonnull 
CFLAGS += -D_GNU_SOURCE



TEST_GEN_PROGS := execveat

TEST_GEN_FILES := execveat.symlink execveat.denatured script subdir

TEST_GEN_FILES := execveat.symlink execveat.denatured script subdir pipe

# Makefile is a run-time dependency, since it's accessed by the execveat test

TEST_FILES := Makefile

tools/testing/selftests/exec/execveat.c

+8 −0
Original line number Diff line number Diff line
@@ -5,7 +5,9 @@ 
 * Selftests for execveat(2).

 */



#ifndef _GNU_SOURCE

#define _GNU_SOURCE  /* to get O_PATH, AT_EMPTY_PATH */

#endif

#include <sys/sendfile.h>

#include <sys/stat.h>

#include <sys/syscall.h>
@@ -311,6 +313,10 @@ static int run_tests(void) 
	fail += check_execveat_fail(AT_FDCWD, fullname_symlink,

				    AT_SYMLINK_NOFOLLOW, ELOOP);



	/*  Non-regular file failure */

	fail += check_execveat_fail(dot_dfd, "pipe", 0, EACCES);

	unlink("pipe");



	/* Shell script wrapping executable file: */

	/*   dfd + path */

	fail += check_execveat(subdir_dfd, "../script", 0);
@@ -384,6 +390,8 @@ static void prerequisites(void) 
	fd = open("subdir.ephemeral/script", O_RDWR|O_CREAT|O_TRUNC, 0755);

	write(fd, script, strlen(script));

	close(fd);



	mkfifo("pipe", 0755);

}



int main(int argc, char **argv)

CRA Git | Maintained and supported by SUSTech CRA and CCSE