• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (c) 2017 Richard Palethorpe <rpalethorpe@suse.com>
3  * Copyright (c) 2016 Jan Horn <jann@thejh.net>
4  *
5  * This program is free software: you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License as published by
7  * the Free Software Foundation, either version 2 of the License, or
8  * (at your option) any later version.
9  *
10  * This program is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  * GNU General Public License for more details.
14  *
15  * You should have received a copy of the GNU General Public License
16  * along with this program. If not, see <http://www.gnu.org/licenses/>.
17  */
18 /*
19  * Test for CVE-2016-10044, which was fixed in commit
20  * 22f6b4d34fcf039c aio: mark AIO pseudo-fs noexec.
21  *
22  * The test checks that we can not implicitly mark AIO mappings as
23  * executable using the READ_IMPLIES_EXEC personality.
24  */
25 
26 #include <stdio.h>
27 #include <stdint.h>
28 #include <string.h>
29 #include "lapi/syscalls.h"
30 #include "lapi/personality.h"
31 #include "tst_test.h"
32 #include "tst_safe_stdio.h"
33 
34 static FILE *f;
35 
cleanup(void)36 static void cleanup(void)
37 {
38 	if (f)
39 		SAFE_FCLOSE(f);
40 }
41 
run(void)42 static void run(void)
43 {
44 	uint64_t ctx = 0;
45 	char perms[8], line[BUFSIZ];
46 
47 	SAFE_PERSONALITY(READ_IMPLIES_EXEC);
48 	if (tst_syscall(__NR_io_setup, 1, &ctx))
49 		tst_brk(TBROK | TERRNO, "Failed to create AIO context");
50 
51 	f = SAFE_FOPEN("/proc/self/maps", "r");
52 	while (fgets(line, BUFSIZ, f) != NULL) {
53 		if (strstr(line, "[aio]") != NULL)
54 			goto found_mapping;
55 	}
56 	tst_brk(TCONF, "Could not find mapping in /proc/self/maps");
57 
58 found_mapping:
59 	if (sscanf(line, "%*x-%*x %s7", perms) < 0)
60 		tst_brk(TBROK, "failed to find permission string in %s", line);
61 	if (strchr(perms, (int)'x'))
62 		tst_res(TFAIL, "AIO mapping is executable: %s!", perms);
63 	else
64 		tst_res(TPASS, "AIO mapping is not executable: %s", perms);
65 
66 	if (tst_syscall(__NR_io_destroy, ctx))
67 		tst_brk(TBROK | TERRNO, "Failed to destroy AIO context");
68 
69 	SAFE_FCLOSE(f);
70 	f = NULL;
71 }
72 
73 static struct tst_test test = {
74 	.test_all = run,
75 	.cleanup = cleanup,
76 	.min_kver = "2.6.8",
77 };
78