From: Martin Doucha <mdoucha@suse.cz>
To: ltp@lists.linux.it
Subject: [LTP] [PATCH 3/3] Add lockdown checks to init_module* and finit_module* tests
Date: Tue, 20 Jul 2021 14:36:10 +0200 [thread overview]
Message-ID: <e6033278-8e27-eed5-5f36-1dd09e68bf5a@suse.cz> (raw)
In-Reply-To: <YPa7bSB8pNPrBDn8@yuki>
On 20. 07. 21 14:02, Cyril Hrubis wrote:
> Hi!
>> +static void lockdown_setup(struct tcase *tc)
>> +{
>> + if (kernel_lockdown)
>> + tc->exp_errno = EPERM;
>> +}
>> +
>> static struct tcase tcases[] = {
>> {"invalid-fd", &fd_invalid, "", O_RDONLY | O_CLOEXEC, 0, 0, 0, bad_fd_setup},
>> {"zero-fd", &fd_zero, "", O_RDONLY | O_CLOEXEC, 0, 0, EINVAL, NULL},
>> - {"null-param", &fd, NULL, O_RDONLY | O_CLOEXEC, 0, 0, EFAULT, NULL},
>> - {"invalid-param", &fd, "status=invalid", O_RDONLY | O_CLOEXEC, 0, 0, EINVAL, NULL},
>> + {"null-param", &fd, NULL, O_RDONLY | O_CLOEXEC, 0, 0, EFAULT,
>> + lockdown_setup},
>> + {"invalid-param", &fd, "status=invalid", O_RDONLY | O_CLOEXEC, 0, 0,
>> + EINVAL, lockdown_setup},
>> {"invalid-flags", &fd, "", O_RDONLY | O_CLOEXEC, -1, 0, EINVAL, NULL},
>> {"no-perm", &fd, "", O_RDONLY | O_CLOEXEC, 0, 1, EPERM, NULL},
>> {"module-exists", &fd, "", O_RDONLY | O_CLOEXEC, 0, 0, EEXIST, NULL},
>
> I'm slightly afraid that the order of checks may change over the time
> and we will get EPERM in all these cases, but maybe I'm just overly
> cautious. Other than this the code looks good.
I don't think we need to worry about that. With root privileges, the
EPERM error is returned when a kernel module does not have a valid
signature. How would something that is not even a valid kernel module in
the first place fail that check?
The only subtests that actually try to load a valid kernel module are
null-param, invalid-param and module-exists. All three of them now
handle lockdown correctly.
--
Martin Doucha mdoucha@suse.cz
QA Engineer for Software Maintenance
SUSE LINUX, s.r.o.
CORSO IIa
Krizikova 148/34
186 00 Prague 8
Czech Republic
next prev parent reply other threads:[~2021-07-20 12:36 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-20 10:39 [LTP] [PATCH 1/3] Add skip_in_lockdown flag to struct tst_test Martin Doucha
2021-07-20 10:39 ` [LTP] [PATCH 2/3] Replace existing lockdown checks with skip_in_lockdown Martin Doucha
2021-07-20 11:59 ` Cyril Hrubis
2021-07-20 10:39 ` [LTP] [PATCH 3/3] Add lockdown checks to init_module* and finit_module* tests Martin Doucha
2021-07-20 12:02 ` Cyril Hrubis
2021-07-20 12:36 ` Martin Doucha [this message]
2021-07-20 12:45 ` Cyril Hrubis
2021-07-26 6:05 ` Petr Vorel
2021-07-20 11:59 ` [LTP] [PATCH 1/3] Add skip_in_lockdown flag to struct tst_test Cyril Hrubis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e6033278-8e27-eed5-5f36-1dd09e68bf5a@suse.cz \
--to=mdoucha@suse.cz \
--cc=ltp@lists.linux.it \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.