1 /*
2 * Copyright (c) 2017 Richard Palethorpe <rpalethorpe@suse.com>
3 * Copyright (c) 2016 Jan Horn <jann@thejh.net>
4 *
5 * This program is free software: you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation, either version 2 of the License, or
8 * (at your option) any later version.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program. If not, see <http://www.gnu.org/licenses/>.
17 */
18 /*
19 * Test for CVE-2016-10044, which was fixed in commit
20 * 22f6b4d34fcf039c aio: mark AIO pseudo-fs noexec.
21 *
22 * The test checks that we can not implicitly mark AIO mappings as
23 * executable using the READ_IMPLIES_EXEC personality.
24 */
25
26 #include <stdio.h>
27 #include <stdint.h>
28 #include <string.h>
29 #include "lapi/syscalls.h"
30 #include "lapi/personality.h"
31 #include "tst_test.h"
32 #include "tst_safe_stdio.h"
33
34 static FILE *f;
35
cleanup(void)36 static void cleanup(void)
37 {
38 if (f)
39 SAFE_FCLOSE(f);
40 }
41
run(void)42 static void run(void)
43 {
44 void* ctx = 0;
45 char perms[8], line[BUFSIZ];
46
47 SAFE_PERSONALITY(READ_IMPLIES_EXEC);
48 if (tst_syscall(__NR_io_setup, 1, &ctx))
49 tst_brk(TBROK | TERRNO, "Failed to create AIO context");
50
51 f = SAFE_FOPEN("/proc/self/maps", "r");
52 while (fgets(line, BUFSIZ, f) != NULL) {
53 if (strstr(line, "[aio]") != NULL)
54 goto found_mapping;
55 }
56 tst_brk(TCONF, "Could not find mapping in /proc/self/maps");
57
58 found_mapping:
59 if (sscanf(line, "%*x-%*x %s7", perms) < 0)
60 tst_brk(TBROK, "failed to find permission string in %s", line);
61 if (strchr(perms, (int)'x'))
62 tst_res(TFAIL, "AIO mapping is executable: %s!", perms);
63 else
64 tst_res(TPASS, "AIO mapping is not executable: %s", perms);
65
66 if (tst_syscall(__NR_io_destroy, ctx))
67 tst_brk(TBROK | TERRNO, "Failed to destroy AIO context");
68
69 SAFE_FCLOSE(f);
70 f = NULL;
71 }
72
73 static struct tst_test test = {
74 .test_all = run,
75 .cleanup = cleanup,
76 .min_kver = "2.6.8",
77 };
78