1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (C) 2018 MediaTek Inc. All Rights Reserved.
4 * Author: Eddie Horng <eddie.horng@mediatek.com>
5 *
6 * Check if an unlinked executable can run in overlayfs mount.
7 *
8 * The regression is introduced from 8db6c34f1dbc ("Introduce v3
9 * namespaced file capabilities"). in security/commoncap.c,
10 * cap_inode_getsecurity() use d_find_alias() cause unhashed dentry
11 * can't be found. The solution could use d_find_any_alias() instead
12 * of d_find_alias().
13 *
14 * Starting with kernel 4.14, this case fails, execveat shall returns EINVAL.
15 *
16 * This has been fixed by:
17 * 355139a8dba4 ("cap_inode_getsecurity: use d_find_any_alias()
18 * instead of d_find_alias()")
19 */
20
21 #define _GNU_SOURCE
22 #include "config.h"
23
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <sys/stat.h>
27 #include <sys/types.h>
28 #include <errno.h>
29 #include <string.h>
30 #include <sys/syscall.h>
31 #include <sys/mount.h>
32 #include "tst_test.h"
33 #include "lapi/execveat.h"
34 #include "lapi/fcntl.h"
35 #include "execveat.h"
36
37 #define TEST_APP "execveat_child"
38 #define TEST_FILE_PATH OVL_MNT"/"TEST_APP
39
40 static const char mntpoint[] = OVL_BASE_MNTPOINT;
41
do_child(void)42 static void do_child(void)
43 {
44 char *argv[2] = {TEST_FILE_PATH, NULL};
45 int fd;
46
47 SAFE_CP(TEST_APP, TEST_FILE_PATH);
48
49 fd = SAFE_OPEN(TEST_FILE_PATH, O_PATH);
50 SAFE_UNLINK(TEST_FILE_PATH);
51
52 TEST(execveat(fd, "", argv, environ, AT_EMPTY_PATH));
53 tst_res(TFAIL | TTERRNO, "execveat() returned unexpected errno");
54 }
55
verify_execveat(void)56 static void verify_execveat(void)
57 {
58 pid_t pid;
59
60 pid = SAFE_FORK();
61 if (pid == 0)
62 do_child();
63 }
64
setup(void)65 static void setup(void)
66 {
67 check_execveat();
68 }
69
70 static const char *const resource_files[] = {
71 TEST_APP,
72 NULL,
73 };
74
75 static struct tst_test test = {
76 .needs_root = 1,
77 .mount_device = 1,
78 .needs_overlay = 1,
79 .mntpoint = mntpoint,
80 .forks_child = 1,
81 .child_needs_reinit = 1,
82 .setup = setup,
83 .test_all = verify_execveat,
84 .resource_files = resource_files,
85 .tags = (const struct tst_tag[]) {
86 {"linux-git", "8db6c34f1dbc"},
87 {"linux-git", "355139a8dba4"},
88 {}
89 }
90 };
91