From: Shuah Khan <skhan@linuxfoundation.org>
To: Daniel Verkamp <dverkamp@chromium.org>, linux-mm@kvack.org
Cc: linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
Andrew Morton <akpm@linux-foundation.org>,
Hugh Dickins <hughd@google.com>,
Mattias Nissler <mnissler@chromium.org>,
Dmitry Torokhov <dmitry.torokhov@gmail.com>,
Kees Cook <keescook@chromium.org>,
Shuah Khan <skhan@linuxfoundation.org>
Subject: Re: [PATCH 4/4] selftests/memfd: add tests for MFD_NOEXEC
Date: Thu, 7 Apr 2022 14:03:18 -0600 [thread overview]
Message-ID: <c8114977-a757-60d0-d6b7-9d3f91568019@linuxfoundation.org> (raw)
In-Reply-To: <20220401220834.307660-5-dverkamp@chromium.org>
On 4/1/22 4:08 PM, Daniel Verkamp wrote:
> Tests that ensure MFD_NOEXEC memfds have the appropriate mode bits and
> cannot be chmod-ed into being executable.
>
> Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
> ---
> tools/testing/selftests/memfd/memfd_test.c | 34 ++++++++++++++++++++++
> 1 file changed, 34 insertions(+)
>
> diff --git a/tools/testing/selftests/memfd/memfd_test.c b/tools/testing/selftests/memfd/memfd_test.c
> index fdb0e46e9df9..a79567161cdf 100644
> --- a/tools/testing/selftests/memfd/memfd_test.c
> +++ b/tools/testing/selftests/memfd/memfd_test.c
> @@ -32,6 +32,10 @@
> #define F_SEAL_EXEC 0x0020
> #endif
>
> +#ifndef MFD_NOEXEC
> +#define MFD_NOEXEC 0x0008U
> +#endif
> +
> /*
> * Default is not to test hugetlbfs
> */
> @@ -959,6 +963,35 @@ static void test_seal_exec(void)
> close(fd);
> }
>
> +/*
> + * Test memfd_create with MFD_NOEXEC flag
> + * Test that MFD_NOEXEC applies F_SEAL_EXEC and prevents change of exec bits
> + */
> +static void test_noexec(void)
> +{
> + int fd;
> +
> + printf("%s NOEXEC\n", memfd_str);
> +
> + /* Create with NOEXEC and ALLOW_SEALING */
> + fd = mfd_assert_new("kern_memfd_noexec",
> + mfd_def_size,
> + MFD_CLOEXEC | MFD_ALLOW_SEALING | MFD_NOEXEC);
Don't we need to check fd here?
> + mfd_assert_mode(fd, 0666);
> + mfd_assert_has_seals(fd, F_SEAL_EXEC);
> + mfd_fail_chmod(fd, 0777);
> + close(fd);
> +
> + /* Create with NOEXEC but without ALLOW_SEALING */
> + fd = mfd_assert_new("kern_memfd_noexec",
> + mfd_def_size,
> + MFD_CLOEXEC | MFD_NOEXEC);
What happens when mfd_assert_new() fails - don't we need to check fd?
> + mfd_assert_mode(fd, 0666);
> + mfd_assert_has_seals(fd, F_SEAL_EXEC | F_SEAL_SEAL);
> + mfd_fail_chmod(fd, 0777);
> + close(fd);
> +}
> +
> /*
> * Test sharing via dup()
> * Test that seals are shared between dupped FDs and they're all equal.
> @@ -1132,6 +1165,7 @@ int main(int argc, char **argv)
>
> test_create();
> test_basic();
> + test_noexec();
>
> test_seal_write();
> test_seal_future_write();
>
fd isn't checked in the other test F_SEAL_EXEC in the 3/4 patch.
thanks,
-- Shuah
next prev parent reply other threads:[~2022-04-07 20:03 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20220401220834.307660-1-dverkamp@chromium.org>
2022-04-01 22:08 ` [PATCH 4/4] selftests/memfd: add tests for MFD_NOEXEC Daniel Verkamp
2022-04-07 20:03 ` Shuah Khan [this message]
[not found] ` <20220401220834.307660-4-dverkamp@chromium.org>
2022-04-07 20:00 ` [PATCH 3/4] selftests/memfd: add tests for F_SEAL_EXEC Shuah Khan
2022-07-29 6:15 ` Jeff Xu
2022-07-29 6:15 ` [PATCH 4/4] selftests/memfd: add tests for MFD_NOEXEC Jeff Xu
2022-07-29 6:29 ` Jeff Xu
2022-07-29 21:24 ` [PATCH 3/4] selftests/memfd: add tests for F_SEAL_EXEC Jeff Xu
2022-07-29 22:00 ` Jeff Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c8114977-a757-60d0-d6b7-9d3f91568019@linuxfoundation.org \
--to=skhan@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=dmitry.torokhov@gmail.com \
--cc=dverkamp@chromium.org \
--cc=hughd@google.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mnissler@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).