提交 61016db1 编写于 作者: K Kees Cook 提交者: Shuah Khan

selftests/exec: Verify execve of non-regular files fail

Add a named pipe as an exec target to make sure that non-regular
files are rejected by execve() with EACCES. This can help verify
commit 73601ea5 ("fs/open.c: allow opening only regular files
during execve()").
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NShuah Khan <skhan@linuxfoundation.org>
上级 a5f30467
...@@ -9,3 +9,4 @@ execveat.ephemeral ...@@ -9,3 +9,4 @@ execveat.ephemeral
execveat.denatured execveat.denatured
/recursion-depth /recursion-depth
xxxxxxxx* xxxxxxxx*
pipe
...@@ -4,7 +4,7 @@ CFLAGS += -Wno-nonnull ...@@ -4,7 +4,7 @@ CFLAGS += -Wno-nonnull
CFLAGS += -D_GNU_SOURCE CFLAGS += -D_GNU_SOURCE
TEST_GEN_PROGS := execveat TEST_GEN_PROGS := execveat
TEST_GEN_FILES := execveat.symlink execveat.denatured script subdir TEST_GEN_FILES := execveat.symlink execveat.denatured script subdir pipe
# Makefile is a run-time dependency, since it's accessed by the execveat test # Makefile is a run-time dependency, since it's accessed by the execveat test
TEST_FILES := Makefile TEST_FILES := Makefile
......
...@@ -5,7 +5,9 @@ ...@@ -5,7 +5,9 @@
* Selftests for execveat(2). * Selftests for execveat(2).
*/ */
#ifndef _GNU_SOURCE
#define _GNU_SOURCE /* to get O_PATH, AT_EMPTY_PATH */ #define _GNU_SOURCE /* to get O_PATH, AT_EMPTY_PATH */
#endif
#include <sys/sendfile.h> #include <sys/sendfile.h>
#include <sys/stat.h> #include <sys/stat.h>
#include <sys/syscall.h> #include <sys/syscall.h>
...@@ -311,6 +313,10 @@ static int run_tests(void) ...@@ -311,6 +313,10 @@ static int run_tests(void)
fail += check_execveat_fail(AT_FDCWD, fullname_symlink, fail += check_execveat_fail(AT_FDCWD, fullname_symlink,
AT_SYMLINK_NOFOLLOW, ELOOP); AT_SYMLINK_NOFOLLOW, ELOOP);
/* Non-regular file failure */
fail += check_execveat_fail(dot_dfd, "pipe", 0, EACCES);
unlink("pipe");
/* Shell script wrapping executable file: */ /* Shell script wrapping executable file: */
/* dfd + path */ /* dfd + path */
fail += check_execveat(subdir_dfd, "../script", 0); fail += check_execveat(subdir_dfd, "../script", 0);
...@@ -384,6 +390,8 @@ static void prerequisites(void) ...@@ -384,6 +390,8 @@ static void prerequisites(void)
fd = open("subdir.ephemeral/script", O_RDWR|O_CREAT|O_TRUNC, 0755); fd = open("subdir.ephemeral/script", O_RDWR|O_CREAT|O_TRUNC, 0755);
write(fd, script, strlen(script)); write(fd, script, strlen(script));
close(fd); close(fd);
mkfifo("pipe", 0755);
} }
int main(int argc, char **argv) int main(int argc, char **argv)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册