From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-bc09.mail.infomaniak.ch (smtp-bc09.mail.infomaniak.ch [45.157.188.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 410621465B3; Wed, 15 Jan 2025 15:24:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.157.188.9 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736954692; cv=none; b=OFmG7T2KooV/imHHgJMaBGluYfgMXHUw/wTV2XUwVuL+mSSNHzCvMepd+eC83XzpGYvYp3Kw5QokExvJLILV3R50ZkTMeSHDQj7G595prnfC0Ql2mWgVZXHEDH3klHyeU5FOh+EBcVW+buKxKhQ38SiiASrnQtBFeBs0YRk2VX8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736954692; c=relaxed/simple; bh=kOY3vFWLP+FEHx5M1IiPDdVvOJzmSd4CLBlalrm5bTs=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=eVYwjLwci7ETBL+xJiQW//se3nNcVXweMhHGngsuaK6/PUQTYTXQofCZ7HXfEIqGAL2LVHDpf5zUkMU1kCWmdmwpETOGY6aiXcvzDsAJOWlda6yDEpbLZBHasMMkRbIZe4RM/1tV5RLnPTDM2hZZxFmQNObtQTC868smtsBekDY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net; spf=pass smtp.mailfrom=digikod.net; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b=eftFZdAR; arc=none smtp.client-ip=45.157.188.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=digikod.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b="eftFZdAR" Received: from smtp-4-0000.mail.infomaniak.ch (smtp-4-0000.mail.infomaniak.ch [10.7.10.107]) by smtp-4-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4YY8td4YsHzVMr; Wed, 15 Jan 2025 16:24:41 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digikod.net; s=20191114; t=1736954681; bh=OKke/r7WO2oX+n3KadtktTVK+uXU2ESxGj2KaHjaNJQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=eftFZdARawb0lOmamDXKZ8GxSfXruL53Rhh7T90IwPVKUPGqVjddobOiO6hqNVNqE Mo8zFpDcn703TYsLDqeqKTtpk0O9kvmY2ktGgmx5C+vmNV29VYZ/6kCS47gFFUauLS iFQPjWpppKW7Ye7YBY0wqf3aD1EfkI6wP8zJUKEs= Received: from unknown by smtp-4-0000.mail.infomaniak.ch (Postfix) with ESMTPA id 4YY8tV0cZGzCXZ; Wed, 15 Jan 2025 16:24:34 +0100 (CET) Date: Wed, 15 Jan 2025 16:24:33 +0100 From: =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= To: Nathan Chancellor Cc: Al Viro , Christian Brauner , Kees Cook , Paul Moore , Serge Hallyn , Adhemerval Zanella Netto , Alejandro Colomar , Aleksa Sarai , Andrew Morton , Andy Lutomirski , Arnd Bergmann , Casey Schaufler , Christian Heimes , Dmitry Vyukov , Elliott Hughes , Eric Biggers , Eric Chiang , Fan Wu , Florian Weimer , Geert Uytterhoeven , James Morris , Jan Kara , Jann Horn , Jeff Xu , Jonathan Corbet , Jordan R Abrahams , Lakshmi Ramasubramanian , Linus Torvalds , Luca Boccassi , Luis Chamberlain , "Madhavan T . Venkataraman" , Matt Bobrowski , Matthew Garrett , Matthew Wilcox , Miklos Szeredi , Mimi Zohar , Nicolas Bouchinet , Roberto Sassu , Scott Shell , Shuah Khan , Shuah Khan , Stephen Rothwell , Steve Dower , Steve Grubb , Theodore Ts'o , Thibaut Sautereau , Vincent Strubel , Xiaoming Ni , kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: Re: [PATCH v23 7/8] samples/check-exec: Add an enlighten "inc" interpreter and 28 tests Message-ID: <20250115.asu4ueXao3ho@digikod.net> References: <20241212174223.389435-1-mic@digikod.net> <20241212174223.389435-8-mic@digikod.net> <20250114205645.GA2825031@ax162> Precedence: bulk X-Mailing-List: linux-api@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20250114205645.GA2825031@ax162> X-Infomaniak-Routing: alpha On Tue, Jan 14, 2025 at 01:56:45PM -0700, Nathan Chancellor wrote: > Hi Mickaël, > > On Thu, Dec 12, 2024 at 06:42:22PM +0100, Mickaël Salaün wrote: > > Add a very simple script interpreter called "inc" that can evaluate two > > different commands (one per line): > > - "?" to initialize a counter from user's input; > > - "+" to increment the counter (which is set to 0 by default). > > > > It is enlighten to only interpret executable files according to > > AT_EXECVE_CHECK and the related securebits: > > > > # Executing a script with RESTRICT_FILE is only allowed if the script > > # is executable: > > ./set-exec -f -- ./inc script-exec.inc # Allowed > > ./set-exec -f -- ./inc script-noexec.inc # Denied > > > > # Executing stdin with DENY_INTERACTIVE is only allowed if stdin is an > > # executable regular file: > > ./set-exec -i -- ./inc -i < script-exec.inc # Allowed > > ./set-exec -i -- ./inc -i < script-noexec.inc # Denied > > > > # However, a pipe is not executable and it is then denied: > > cat script-noexec.inc | ./set-exec -i -- ./inc -i # Denied > > > > # Executing raw data (e.g. command argument) with DENY_INTERACTIVE is > > # always denied. > > ./set-exec -i -- ./inc -c "+" # Denied > > ./inc -c "$( > > > # To directly execute a script, we can update $PATH (used by `env`): > > PATH="${PATH}:." ./script-exec.inc > > > > # To execute several commands passed as argument: > > > > Add a complete test suite to check the script interpreter against all > > possible execution cases: > > > > make TARGETS=exec kselftest-install > > ./tools/testing/selftests/kselftest_install/run_kselftest.sh > > > > Cc: Al Viro > > Cc: Christian Brauner > > Cc: Kees Cook > > Cc: Paul Moore > > Cc: Serge Hallyn > > Signed-off-by: Mickaël Salaün > > Link: https://lore.kernel.org/r/20241212174223.389435-8-mic@digikod.net > ... > > diff --git a/samples/check-exec/inc.c b/samples/check-exec/inc.c > > new file mode 100644 > > index 000000000000..94b87569d2a2 > > --- /dev/null > > +++ b/samples/check-exec/inc.c > ... > > +/* Returns 1 on error, 0 otherwise. */ > > +static int interpret_stream(FILE *script, char *const script_name, > > + char *const *const envp, const bool restrict_stream) > > +{ > > + int err; > > + char *const script_argv[] = { script_name, NULL }; > > + char buf[128] = {}; > > + size_t buf_size = sizeof(buf); > > + > > + /* > > + * We pass a valid argv and envp to the kernel to emulate a native > > + * script execution. We must use the script file descriptor instead of > > + * the script path name to avoid race conditions. > > + */ > > + err = execveat(fileno(script), "", script_argv, envp, > > + AT_EMPTY_PATH | AT_EXECVE_CHECK); > > + if (err && restrict_stream) { > > + perror("ERROR: Script execution check"); > > + return 1; > > + } > > + > > + /* Reads script. */ > > + buf_size = fread(buf, 1, buf_size - 1, script); > > + return interpret_buffer(buf, buf_size); > > +} > > The use of execveat() in this test case breaks the build when glibc is > less than 2.34, as that is the earliest version that has the execveat() > wrapper: > > https://sourceware.org/git/?p=glibc.git;a=commit;h=19d83270fcd993cc349570164e21b06d57036704 > > $ ldd --version | head -1 > ldd (Debian GLIBC 2.31-13+deb11u11) 2.31 > > $ make -skj"$(nproc)" ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- mrproper allmodconfig samples/ > ... > samples/check-exec/inc.c:81:8: error: call to undeclared function 'execveat'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] > 81 | err = execveat(fileno(script), "", script_argv, envp, > | ^ > samples/check-exec/inc.c:81:8: note: did you mean 'execve'? > /usr/include/unistd.h:551:12: note: 'execve' declared here > 551 | extern int execve (const char *__path, char *const __argv[], > | ^ > 1 error generated. > ... > > Should this just use the syscall directly? Thanks for the report, I sent a fix: https://lore.kernel.org/r/20250115144753.311152-1-mic@digikod.net > > Cheers, > Nathan