| Message ID | 20250115144753.311152-1-mic@digikod.net (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [v1] selftests: Handle old glibc without execveat(2) | expand |
On Wed, Jan 15, 2025 at 03:47:50PM +0100, Mickaël Salaün wrote: > Add an execveat(2) wrapper because glibc < 2.34 does not have one. This > fixes the check-exec tests and samples. > > Cc: Günther Noack <gnoack@google.com> > Cc: Jeff Xu <jeffxu@chromium.org> > Cc: Kees Cook <kees@kernel.org> > Cc: Mimi Zohar <zohar@linux.ibm.com> > Cc: Paul Moore <paul@paul-moore.com> > Cc: Roberto Sassu <roberto.sassu@huawei.com> > Cc: Serge Hallyn <serge@hallyn.com> > Cc: Stefan Berger <stefanb@linux.ibm.com> > Cc: Stephen Rothwell <sfr@canb.auug.org.au> > Reported-by: Nathan Chancellor <nathan@kernel.org> > Closes: https://lore.kernel.org/r/20250114205645.GA2825031@ax162 > Signed-off-by: Mickaël Salaün <mic@digikod.net> > --- > > Based on Kees Cook's next/execve branch. > --- > samples/check-exec/inc.c | 11 +++++++++-- > tools/testing/selftests/exec/check-exec.c | 11 +++++++++-- > tools/testing/selftests/landlock/fs_test.c | 10 ++++++++-- > 3 files changed, 26 insertions(+), 6 deletions(-) > > diff --git a/samples/check-exec/inc.c b/samples/check-exec/inc.c > index 94b87569d2a2..7f6ef06a2f06 100644 > --- a/samples/check-exec/inc.c > +++ b/samples/check-exec/inc.c > @@ -21,8 +21,15 @@ > #include <stdlib.h> > #include <string.h> > #include <sys/prctl.h> > +#include <sys/syscall.h> > #include <unistd.h> > > +static int sys_execveat(int dirfd, const char *pathname, char *const argv[], > + char *const envp[], int flags) > +{ > + return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags); > +} > + > /* Returns 1 on error, 0 otherwise. */ > static int interpret_buffer(char *buffer, size_t buffer_size) > { > @@ -78,8 +85,8 @@ static int interpret_stream(FILE *script, char *const script_name, > * script execution. We must use the script file descriptor instead of > * the script path name to avoid race conditions. > */ > - err = execveat(fileno(script), "", script_argv, envp, > - AT_EMPTY_PATH | AT_EXECVE_CHECK); > + err = sys_execveat(fileno(script), "", script_argv, envp, > + AT_EMPTY_PATH | AT_EXECVE_CHECK); > if (err && restrict_stream) { > perror("ERROR: Script execution check"); > return 1; > diff --git a/tools/testing/selftests/exec/check-exec.c b/tools/testing/selftests/exec/check-exec.c > index 4d3f4525e1e1..55bce47e56b7 100644 > --- a/tools/testing/selftests/exec/check-exec.c > +++ b/tools/testing/selftests/exec/check-exec.c > @@ -22,6 +22,7 @@ > #include <sys/prctl.h> > #include <sys/socket.h> > #include <sys/stat.h> > +#include <sys/syscall.h> > #include <sys/sysmacros.h> > #include <unistd.h> > > @@ -31,6 +32,12 @@ > > #include "../kselftest_harness.h" > > +static int sys_execveat(int dirfd, const char *pathname, char *const argv[], > + char *const envp[], int flags) > +{ > + return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags); > +} > + > static void drop_privileges(struct __test_metadata *const _metadata) > { > const unsigned int noroot = SECBIT_NOROOT | SECBIT_NOROOT_LOCKED; > @@ -219,8 +226,8 @@ static void test_exec_fd(struct __test_metadata *_metadata, const int fd, > * test framework as an error. With AT_EXECVE_CHECK, we only check a > * potential successful execution. > */ > - access_ret = > - execveat(fd, "", argv, NULL, AT_EMPTY_PATH | AT_EXECVE_CHECK); > + access_ret = sys_execveat(fd, "", argv, NULL, > + AT_EMPTY_PATH | AT_EXECVE_CHECK); > access_errno = errno; > if (err_code) { > EXPECT_EQ(-1, access_ret); > diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c > index cd66901be612..ac9701c018e0 100644 > --- a/tools/testing/selftests/landlock/fs_test.c > +++ b/tools/testing/selftests/landlock/fs_test.c > @@ -59,6 +59,12 @@ int open_tree(int dfd, const char *filename, unsigned int flags) > } > #endif > > +static int sys_execveat(int dirfd, const char *pathname, char *const argv[], > + char *const envp[], int flags) > +{ > + return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags); > +} > + > #ifndef RENAME_EXCHANGE > #define RENAME_EXCHANGE (1 << 1) > #endif > @@ -2018,8 +2024,8 @@ static void test_check_exec(struct __test_metadata *const _metadata, > int ret; > char *const argv[] = { (char *)path, NULL }; > > - ret = execveat(AT_FDCWD, path, argv, NULL, > - AT_EMPTY_PATH | AT_EXECVE_CHECK); > + ret = sys_execveat(AT_FDCWD, path, argv, NULL, > + AT_EMPTY_PATH | AT_EXECVE_CHECK); > if (err) { > EXPECT_EQ(-1, ret); > EXPECT_EQ(errno, err); > > base-commit: 95b3cdafd7cb74414070893445a9b731793f7b55 > -- > 2.48.1 > Reviewed-by: Günther Noack <gnoack3000@gmail.com> Do you want to add a comment next to these, to remind ourselves do undo this? You are surely not planning to support old versions of glibc indefinitely? –Günther
On Fri, Jan 17, 2025 at 03:42:22PM +0100, Günther Noack wrote: > On Wed, Jan 15, 2025 at 03:47:50PM +0100, Mickaël Salaün wrote: > > Add an execveat(2) wrapper because glibc < 2.34 does not have one. This > > fixes the check-exec tests and samples. > > > > Cc: Günther Noack <gnoack@google.com> > > Cc: Jeff Xu <jeffxu@chromium.org> > > Cc: Kees Cook <kees@kernel.org> > > Cc: Mimi Zohar <zohar@linux.ibm.com> > > Cc: Paul Moore <paul@paul-moore.com> > > Cc: Roberto Sassu <roberto.sassu@huawei.com> > > Cc: Serge Hallyn <serge@hallyn.com> > > Cc: Stefan Berger <stefanb@linux.ibm.com> > > Cc: Stephen Rothwell <sfr@canb.auug.org.au> > > Reported-by: Nathan Chancellor <nathan@kernel.org> > > Closes: https://lore.kernel.org/r/20250114205645.GA2825031@ax162 > > Signed-off-by: Mickaël Salaün <mic@digikod.net> > > --- > > > > Based on Kees Cook's next/execve branch. > > --- > > samples/check-exec/inc.c | 11 +++++++++-- > > tools/testing/selftests/exec/check-exec.c | 11 +++++++++-- > > tools/testing/selftests/landlock/fs_test.c | 10 ++++++++-- > > 3 files changed, 26 insertions(+), 6 deletions(-) > > > > diff --git a/samples/check-exec/inc.c b/samples/check-exec/inc.c > > index 94b87569d2a2..7f6ef06a2f06 100644 > > --- a/samples/check-exec/inc.c > > +++ b/samples/check-exec/inc.c > > @@ -21,8 +21,15 @@ > > #include <stdlib.h> > > #include <string.h> > > #include <sys/prctl.h> > > +#include <sys/syscall.h> > > #include <unistd.h> > > > > +static int sys_execveat(int dirfd, const char *pathname, char *const argv[], > > + char *const envp[], int flags) > > +{ > > + return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags); > > +} > > + > > /* Returns 1 on error, 0 otherwise. */ > > static int interpret_buffer(char *buffer, size_t buffer_size) > > { > > @@ -78,8 +85,8 @@ static int interpret_stream(FILE *script, char *const script_name, > > * script execution. We must use the script file descriptor instead of > > * the script path name to avoid race conditions. > > */ > > - err = execveat(fileno(script), "", script_argv, envp, > > - AT_EMPTY_PATH | AT_EXECVE_CHECK); > > + err = sys_execveat(fileno(script), "", script_argv, envp, > > + AT_EMPTY_PATH | AT_EXECVE_CHECK); > > if (err && restrict_stream) { > > perror("ERROR: Script execution check"); > > return 1; > > diff --git a/tools/testing/selftests/exec/check-exec.c b/tools/testing/selftests/exec/check-exec.c > > index 4d3f4525e1e1..55bce47e56b7 100644 > > --- a/tools/testing/selftests/exec/check-exec.c > > +++ b/tools/testing/selftests/exec/check-exec.c > > @@ -22,6 +22,7 @@ > > #include <sys/prctl.h> > > #include <sys/socket.h> > > #include <sys/stat.h> > > +#include <sys/syscall.h> > > #include <sys/sysmacros.h> > > #include <unistd.h> > > > > @@ -31,6 +32,12 @@ > > > > #include "../kselftest_harness.h" > > > > +static int sys_execveat(int dirfd, const char *pathname, char *const argv[], > > + char *const envp[], int flags) > > +{ > > + return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags); > > +} > > + > > static void drop_privileges(struct __test_metadata *const _metadata) > > { > > const unsigned int noroot = SECBIT_NOROOT | SECBIT_NOROOT_LOCKED; > > @@ -219,8 +226,8 @@ static void test_exec_fd(struct __test_metadata *_metadata, const int fd, > > * test framework as an error. With AT_EXECVE_CHECK, we only check a > > * potential successful execution. > > */ > > - access_ret = > > - execveat(fd, "", argv, NULL, AT_EMPTY_PATH | AT_EXECVE_CHECK); > > + access_ret = sys_execveat(fd, "", argv, NULL, > > + AT_EMPTY_PATH | AT_EXECVE_CHECK); > > access_errno = errno; > > if (err_code) { > > EXPECT_EQ(-1, access_ret); > > diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c > > index cd66901be612..ac9701c018e0 100644 > > --- a/tools/testing/selftests/landlock/fs_test.c > > +++ b/tools/testing/selftests/landlock/fs_test.c > > @@ -59,6 +59,12 @@ int open_tree(int dfd, const char *filename, unsigned int flags) > > } > > #endif > > > > +static int sys_execveat(int dirfd, const char *pathname, char *const argv[], > > + char *const envp[], int flags) > > +{ > > + return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags); > > +} > > + > > #ifndef RENAME_EXCHANGE > > #define RENAME_EXCHANGE (1 << 1) > > #endif > > @@ -2018,8 +2024,8 @@ static void test_check_exec(struct __test_metadata *const _metadata, > > int ret; > > char *const argv[] = { (char *)path, NULL }; > > > > - ret = execveat(AT_FDCWD, path, argv, NULL, > > - AT_EMPTY_PATH | AT_EXECVE_CHECK); > > + ret = sys_execveat(AT_FDCWD, path, argv, NULL, > > + AT_EMPTY_PATH | AT_EXECVE_CHECK); > > if (err) { > > EXPECT_EQ(-1, ret); > > EXPECT_EQ(errno, err); > > > > base-commit: 95b3cdafd7cb74414070893445a9b731793f7b55 > > -- > > 2.48.1 > > > > Reviewed-by: Günther Noack <gnoack3000@gmail.com> > > Do you want to add a comment next to these, to remind ourselves do undo this? > You are surely not planning to support old versions of glibc indefinitely? I don't about glibc. Minimal versions for other tools are documented here though: https://docs.kernel.org/process/changes.html Nathan, Jon, any idea?
On Fri, Jan 17, 2025 at 04:47:05PM +0100, Mickaël Salaün wrote: > On Fri, Jan 17, 2025 at 03:42:22PM +0100, Günther Noack wrote: > > Do you want to add a comment next to these, to remind ourselves do undo this? > > You are surely not planning to support old versions of glibc indefinitely? > > I don't about glibc. Minimal versions for other tools are documented > here though: > https://docs.kernel.org/process/changes.html > > Nathan, Jon, any idea? I do not know if the idea of setting a minimum supported version of a libc has ever come up before (at least I am unaware of one). I suspect most people do a patch like this then move on because it is the maximally compatible option and these samples are not changing much, are they? This is the first build error I can recall seeing as a result of using an older glibc environment. If we would like to seriously consider setting a minimum supported version of glibc, it deserves a conversation with a wider audience since it could impact areas other than the samples, such as host tools (and IMHO, feels like a big hammer). Cheers, Nathan
diff --git a/samples/check-exec/inc.c b/samples/check-exec/inc.c index 94b87569d2a2..7f6ef06a2f06 100644 --- a/samples/check-exec/inc.c +++ b/samples/check-exec/inc.c @@ -21,8 +21,15 @@ #include <stdlib.h> #include <string.h> #include <sys/prctl.h> +#include <sys/syscall.h> #include <unistd.h> +static int sys_execveat(int dirfd, const char *pathname, char *const argv[], + char *const envp[], int flags) +{ + return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags); +} + /* Returns 1 on error, 0 otherwise. */ static int interpret_buffer(char *buffer, size_t buffer_size) { @@ -78,8 +85,8 @@ static int interpret_stream(FILE *script, char *const script_name, * script execution. We must use the script file descriptor instead of * the script path name to avoid race conditions. */ - err = execveat(fileno(script), "", script_argv, envp, - AT_EMPTY_PATH | AT_EXECVE_CHECK); + err = sys_execveat(fileno(script), "", script_argv, envp, + AT_EMPTY_PATH | AT_EXECVE_CHECK); if (err && restrict_stream) { perror("ERROR: Script execution check"); return 1; diff --git a/tools/testing/selftests/exec/check-exec.c b/tools/testing/selftests/exec/check-exec.c index 4d3f4525e1e1..55bce47e56b7 100644 --- a/tools/testing/selftests/exec/check-exec.c +++ b/tools/testing/selftests/exec/check-exec.c @@ -22,6 +22,7 @@ #include <sys/prctl.h> #include <sys/socket.h> #include <sys/stat.h> +#include <sys/syscall.h> #include <sys/sysmacros.h> #include <unistd.h> @@ -31,6 +32,12 @@ #include "../kselftest_harness.h" +static int sys_execveat(int dirfd, const char *pathname, char *const argv[], + char *const envp[], int flags) +{ + return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags); +} + static void drop_privileges(struct __test_metadata *const _metadata) { const unsigned int noroot = SECBIT_NOROOT | SECBIT_NOROOT_LOCKED; @@ -219,8 +226,8 @@ static void test_exec_fd(struct __test_metadata *_metadata, const int fd, * test framework as an error. With AT_EXECVE_CHECK, we only check a * potential successful execution. */ - access_ret = - execveat(fd, "", argv, NULL, AT_EMPTY_PATH | AT_EXECVE_CHECK); + access_ret = sys_execveat(fd, "", argv, NULL, + AT_EMPTY_PATH | AT_EXECVE_CHECK); access_errno = errno; if (err_code) { EXPECT_EQ(-1, access_ret); diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c index cd66901be612..ac9701c018e0 100644 --- a/tools/testing/selftests/landlock/fs_test.c +++ b/tools/testing/selftests/landlock/fs_test.c @@ -59,6 +59,12 @@ int open_tree(int dfd, const char *filename, unsigned int flags) } #endif +static int sys_execveat(int dirfd, const char *pathname, char *const argv[], + char *const envp[], int flags) +{ + return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags); +} + #ifndef RENAME_EXCHANGE #define RENAME_EXCHANGE (1 << 1) #endif @@ -2018,8 +2024,8 @@ static void test_check_exec(struct __test_metadata *const _metadata, int ret; char *const argv[] = { (char *)path, NULL }; - ret = execveat(AT_FDCWD, path, argv, NULL, - AT_EMPTY_PATH | AT_EXECVE_CHECK); + ret = sys_execveat(AT_FDCWD, path, argv, NULL, + AT_EMPTY_PATH | AT_EXECVE_CHECK); if (err) { EXPECT_EQ(-1, ret); EXPECT_EQ(errno, err);
Add an execveat(2) wrapper because glibc < 2.34 does not have one. This fixes the check-exec tests and samples. Cc: Günther Noack <gnoack@google.com> Cc: Jeff Xu <jeffxu@chromium.org> Cc: Kees Cook <kees@kernel.org> Cc: Mimi Zohar <zohar@linux.ibm.com> Cc: Paul Moore <paul@paul-moore.com> Cc: Roberto Sassu <roberto.sassu@huawei.com> Cc: Serge Hallyn <serge@hallyn.com> Cc: Stefan Berger <stefanb@linux.ibm.com> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Reported-by: Nathan Chancellor <nathan@kernel.org> Closes: https://lore.kernel.org/r/20250114205645.GA2825031@ax162 Signed-off-by: Mickaël Salaün <mic@digikod.net> --- Based on Kees Cook's next/execve branch. --- samples/check-exec/inc.c | 11 +++++++++-- tools/testing/selftests/exec/check-exec.c | 11 +++++++++-- tools/testing/selftests/landlock/fs_test.c | 10 ++++++++-- 3 files changed, 26 insertions(+), 6 deletions(-) base-commit: 95b3cdafd7cb74414070893445a9b731793f7b55