From: Daniel Verkamp <dverkamp@chromium.org>
To: linux-mm@kvack.org
Cc: linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
Andrew Morton <akpm@linux-foundation.org>,
Hugh Dickins <hughd@google.com>,
Mattias Nissler <mnissler@chromium.org>,
Dmitry Torokhov <dmitry.torokhov@gmail.com>,
Kees Cook <keescook@chromium.org>,
Daniel Verkamp <dverkamp@chromium.org>
Subject: [PATCH 4/4] selftests/memfd: add tests for MFD_NOEXEC
Date: Fri, 1 Apr 2022 15:08:34 -0700 [thread overview]
Message-ID: <20220401220834.307660-5-dverkamp@chromium.org> (raw)
In-Reply-To: <20220401220834.307660-1-dverkamp@chromium.org>
Tests that ensure MFD_NOEXEC memfds have the appropriate mode bits and
cannot be chmod-ed into being executable.
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
---
tools/testing/selftests/memfd/memfd_test.c | 34 ++++++++++++++++++++++
1 file changed, 34 insertions(+)
diff --git a/tools/testing/selftests/memfd/memfd_test.c b/tools/testing/selftests/memfd/memfd_test.c
index fdb0e46e9df9..a79567161cdf 100644
--- a/tools/testing/selftests/memfd/memfd_test.c
+++ b/tools/testing/selftests/memfd/memfd_test.c
@@ -32,6 +32,10 @@
#define F_SEAL_EXEC 0x0020
#endif
+#ifndef MFD_NOEXEC
+#define MFD_NOEXEC 0x0008U
+#endif
+
/*
* Default is not to test hugetlbfs
*/
@@ -959,6 +963,35 @@ static void test_seal_exec(void)
close(fd);
}
+/*
+ * Test memfd_create with MFD_NOEXEC flag
+ * Test that MFD_NOEXEC applies F_SEAL_EXEC and prevents change of exec bits
+ */
+static void test_noexec(void)
+{
+ int fd;
+
+ printf("%s NOEXEC\n", memfd_str);
+
+ /* Create with NOEXEC and ALLOW_SEALING */
+ fd = mfd_assert_new("kern_memfd_noexec",
+ mfd_def_size,
+ MFD_CLOEXEC | MFD_ALLOW_SEALING | MFD_NOEXEC);
+ mfd_assert_mode(fd, 0666);
+ mfd_assert_has_seals(fd, F_SEAL_EXEC);
+ mfd_fail_chmod(fd, 0777);
+ close(fd);
+
+ /* Create with NOEXEC but without ALLOW_SEALING */
+ fd = mfd_assert_new("kern_memfd_noexec",
+ mfd_def_size,
+ MFD_CLOEXEC | MFD_NOEXEC);
+ mfd_assert_mode(fd, 0666);
+ mfd_assert_has_seals(fd, F_SEAL_EXEC | F_SEAL_SEAL);
+ mfd_fail_chmod(fd, 0777);
+ close(fd);
+}
+
/*
* Test sharing via dup()
* Test that seals are shared between dupped FDs and they're all equal.
@@ -1132,6 +1165,7 @@ int main(int argc, char **argv)
test_create();
test_basic();
+ test_noexec();
test_seal_write();
test_seal_future_write();
--
2.35.1.1094.g7c7d902a7c-goog
next parent reply other threads:[~2022-04-01 22:09 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20220401220834.307660-1-dverkamp@chromium.org>
2022-04-01 22:08 ` Daniel Verkamp [this message]
2022-04-07 20:03 ` [PATCH 4/4] selftests/memfd: add tests for MFD_NOEXEC Shuah Khan
[not found] ` <20220401220834.307660-4-dverkamp@chromium.org>
2022-04-07 20:00 ` [PATCH 3/4] selftests/memfd: add tests for F_SEAL_EXEC Shuah Khan
2022-07-29 6:15 ` Jeff Xu
2022-07-29 6:15 ` [PATCH 4/4] selftests/memfd: add tests for MFD_NOEXEC Jeff Xu
2022-07-29 6:29 ` Jeff Xu
2022-07-29 21:24 ` [PATCH 3/4] selftests/memfd: add tests for F_SEAL_EXEC Jeff Xu
2022-07-29 22:00 ` Jeff Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220401220834.307660-5-dverkamp@chromium.org \
--to=dverkamp@chromium.org \
--cc=akpm@linux-foundation.org \
--cc=dmitry.torokhov@gmail.com \
--cc=hughd@google.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mnissler@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).