/* * Copyright (c) 2017 Richard Palethorpe <rpalethorpe@suse.com> * Copyright (c) 2016 Jan Horn <jann@thejh.net> * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see <http://www.gnu.org/licenses/>. */ /* * Test for CVE-2016-10044, which was fixed in commit * 22f6b4d34fcf039c aio: mark AIO pseudo-fs noexec. * * The test checks that we can not implicitly mark AIO mappings as * executable using the READ_IMPLIES_EXEC personality. */ #include <stdio.h> #include <stdint.h> #include <string.h> #include "lapi/syscalls.h" #include "lapi/personality.h" #include "tst_test.h" #include "tst_safe_stdio.h" static FILE *f; static void cleanup(void) { if (f) SAFE_FCLOSE(f); } static void run(void) { uint64_t ctx = 0; char perms[8], line[BUFSIZ]; SAFE_PERSONALITY(READ_IMPLIES_EXEC); if (tst_syscall(__NR_io_setup, 1, &ctx)) tst_brk(TBROK | TERRNO, "Failed to create AIO context"); f = SAFE_FOPEN("/proc/self/maps", "r"); while (fgets(line, BUFSIZ, f) != NULL) { if (strstr(line, "[aio]") != NULL) goto found_mapping; } tst_brk(TCONF, "Could not find mapping in /proc/self/maps"); found_mapping: if (sscanf(line, "%*x-%*x %s7", perms) < 0) tst_brk(TBROK, "failed to find permission string in %s", line); if (strchr(perms, (int)'x')) tst_res(TFAIL, "AIO mapping is executable: %s!", perms); else tst_res(TPASS, "AIO mapping is not executable: %s", perms); if (tst_syscall(__NR_io_destroy, ctx)) tst_brk(TBROK | TERRNO, "Failed to destroy AIO context"); SAFE_FCLOSE(f); f = NULL; } static struct tst_test test = { .test_all = run, .cleanup = cleanup, .min_kver = "2.6.8", };