[PATCH v1] selftests: Handle old glibc without execveat(2)

[PATCH v1] selftests: Handle old glibc without execveat(2)

[Mickaël Salaün]

Add an execveat(2) wrapper because glibc < 2.34 does not have one.  This
fixes the check-exec tests and samples.

Cc: Günther Noack <gnoack@google.com>
Cc: Jeff Xu <jeffxu@chromium.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Mimi Zohar <zohar@linux.ibm.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Roberto Sassu <roberto.sassu@huawei.com>
Cc: Serge Hallyn <serge@hallyn.com>
Cc: Stefan Berger <stefanb@linux.ibm.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Reported-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://lore.kernel.org/r/20250114205645.GA2825031@ax162
Signed-off-by: Mickaël Salaün <mic@digikod.net>
---

Based on Kees Cook's next/execve branch.
---
 samples/check-exec/inc.c                   | 11 +++++++++--
 tools/testing/selftests/exec/check-exec.c  | 11 +++++++++--
 tools/testing/selftests/landlock/fs_test.c | 10 ++++++++--
 3 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/samples/check-exec/inc.c b/samples/check-exec/inc.c
index 94b87569d2a2..7f6ef06a2f06 100644
--- a/samples/check-exec/inc.c
+++ b/samples/check-exec/inc.c
@@ -21,8 +21,15 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/prctl.h>
+#include <sys/syscall.h>
 #include <unistd.h>
 
+static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
+			char *const envp[], int flags)
+{
+	return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
+}
+
 /* Returns 1 on error, 0 otherwise. */
 static int interpret_buffer(char *buffer, size_t buffer_size)
 {
@@ -78,8 +85,8 @@ static int interpret_stream(FILE *script, char *const script_name,
 	 * script execution.  We must use the script file descriptor instead of
 	 * the script path name to avoid race conditions.
 	 */
-	err = execveat(fileno(script), "", script_argv, envp,
-		       AT_EMPTY_PATH | AT_EXECVE_CHECK);
+	err = sys_execveat(fileno(script), "", script_argv, envp,
+			   AT_EMPTY_PATH | AT_EXECVE_CHECK);
 	if (err && restrict_stream) {
 		perror("ERROR: Script execution check");
 		return 1;
diff --git a/tools/testing/selftests/exec/check-exec.c b/tools/testing/selftests/exec/check-exec.c
index 4d3f4525e1e1..55bce47e56b7 100644
--- a/tools/testing/selftests/exec/check-exec.c
+++ b/tools/testing/selftests/exec/check-exec.c
@@ -22,6 +22,7 @@
 #include <sys/prctl.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
+#include <sys/syscall.h>
 #include <sys/sysmacros.h>
 #include <unistd.h>
 
@@ -31,6 +32,12 @@
 
 #include "../kselftest_harness.h"
 
+static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
+			char *const envp[], int flags)
+{
+	return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
+}
+
 static void drop_privileges(struct __test_metadata *const _metadata)
 {
 	const unsigned int noroot = SECBIT_NOROOT | SECBIT_NOROOT_LOCKED;
@@ -219,8 +226,8 @@ static void test_exec_fd(struct __test_metadata *_metadata, const int fd,
 	 * test framework as an error.  With AT_EXECVE_CHECK, we only check a
 	 * potential successful execution.
 	 */
-	access_ret =
-		execveat(fd, "", argv, NULL, AT_EMPTY_PATH | AT_EXECVE_CHECK);
+	access_ret = sys_execveat(fd, "", argv, NULL,
+				  AT_EMPTY_PATH | AT_EXECVE_CHECK);
 	access_errno = errno;
 	if (err_code) {
 		EXPECT_EQ(-1, access_ret);
diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
index cd66901be612..ac9701c018e0 100644
--- a/tools/testing/selftests/landlock/fs_test.c
+++ b/tools/testing/selftests/landlock/fs_test.c
@@ -59,6 +59,12 @@ int open_tree(int dfd, const char *filename, unsigned int flags)
 }
 #endif
 
+static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
+			char *const envp[], int flags)
+{
+	return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
+}
+
 #ifndef RENAME_EXCHANGE
 #define RENAME_EXCHANGE (1 << 1)
 #endif
@@ -2018,8 +2024,8 @@ static void test_check_exec(struct __test_metadata *const _metadata,
 	int ret;
 	char *const argv[] = { (char *)path, NULL };
 
-	ret = execveat(AT_FDCWD, path, argv, NULL,
-		       AT_EMPTY_PATH | AT_EXECVE_CHECK);
+	ret = sys_execveat(AT_FDCWD, path, argv, NULL,
+			   AT_EMPTY_PATH | AT_EXECVE_CHECK);
 	if (err) {
 		EXPECT_EQ(-1, ret);
 		EXPECT_EQ(errno, err);

base-commit: 95b3cdafd7cb74414070893445a9b731793f7b55
-- 
2.48.1

Re: [PATCH v1] selftests: Handle old glibc without execveat(2)

[Günther Noack]

On Wed, Jan 15, 2025 at 03:47:50PM +0100, Mickaël Salaün wrote:
> Add an execveat(2) wrapper because glibc < 2.34 does not have one.  This
> fixes the check-exec tests and samples.
> 
> Cc: Günther Noack <gnoack@google.com>
> Cc: Jeff Xu <jeffxu@chromium.org>
> Cc: Kees Cook <kees@kernel.org>
> Cc: Mimi Zohar <zohar@linux.ibm.com>
> Cc: Paul Moore <paul@paul-moore.com>
> Cc: Roberto Sassu <roberto.sassu@huawei.com>
> Cc: Serge Hallyn <serge@hallyn.com>
> Cc: Stefan Berger <stefanb@linux.ibm.com>
> Cc: Stephen Rothwell <sfr@canb.auug.org.au>
> Reported-by: Nathan Chancellor <nathan@kernel.org>
> Closes: https://lore.kernel.org/r/20250114205645.GA2825031@ax162
> Signed-off-by: Mickaël Salaün <mic@digikod.net>
> ---
> 
> Based on Kees Cook's next/execve branch.
> ---
>  samples/check-exec/inc.c                   | 11 +++++++++--
>  tools/testing/selftests/exec/check-exec.c  | 11 +++++++++--
>  tools/testing/selftests/landlock/fs_test.c | 10 ++++++++--
>  3 files changed, 26 insertions(+), 6 deletions(-)
> 
> diff --git a/samples/check-exec/inc.c b/samples/check-exec/inc.c
> index 94b87569d2a2..7f6ef06a2f06 100644
> --- a/samples/check-exec/inc.c
> +++ b/samples/check-exec/inc.c
> @@ -21,8 +21,15 @@
>  #include <stdlib.h>
>  #include <string.h>
>  #include <sys/prctl.h>
> +#include <sys/syscall.h>
>  #include <unistd.h>
>  
> +static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
> +			char *const envp[], int flags)
> +{
> +	return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
> +}
> +
>  /* Returns 1 on error, 0 otherwise. */
>  static int interpret_buffer(char *buffer, size_t buffer_size)
>  {
> @@ -78,8 +85,8 @@ static int interpret_stream(FILE *script, char *const script_name,
>  	 * script execution.  We must use the script file descriptor instead of
>  	 * the script path name to avoid race conditions.
>  	 */
> -	err = execveat(fileno(script), "", script_argv, envp,
> -		       AT_EMPTY_PATH | AT_EXECVE_CHECK);
> +	err = sys_execveat(fileno(script), "", script_argv, envp,
> +			   AT_EMPTY_PATH | AT_EXECVE_CHECK);
>  	if (err && restrict_stream) {
>  		perror("ERROR: Script execution check");
>  		return 1;
> diff --git a/tools/testing/selftests/exec/check-exec.c b/tools/testing/selftests/exec/check-exec.c
> index 4d3f4525e1e1..55bce47e56b7 100644
> --- a/tools/testing/selftests/exec/check-exec.c
> +++ b/tools/testing/selftests/exec/check-exec.c
> @@ -22,6 +22,7 @@
>  #include <sys/prctl.h>
>  #include <sys/socket.h>
>  #include <sys/stat.h>
> +#include <sys/syscall.h>
>  #include <sys/sysmacros.h>
>  #include <unistd.h>
>  
> @@ -31,6 +32,12 @@
>  
>  #include "../kselftest_harness.h"
>  
> +static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
> +			char *const envp[], int flags)
> +{
> +	return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
> +}
> +
>  static void drop_privileges(struct __test_metadata *const _metadata)
>  {
>  	const unsigned int noroot = SECBIT_NOROOT | SECBIT_NOROOT_LOCKED;
> @@ -219,8 +226,8 @@ static void test_exec_fd(struct __test_metadata *_metadata, const int fd,
>  	 * test framework as an error.  With AT_EXECVE_CHECK, we only check a
>  	 * potential successful execution.
>  	 */
> -	access_ret =
> -		execveat(fd, "", argv, NULL, AT_EMPTY_PATH | AT_EXECVE_CHECK);
> +	access_ret = sys_execveat(fd, "", argv, NULL,
> +				  AT_EMPTY_PATH | AT_EXECVE_CHECK);
>  	access_errno = errno;
>  	if (err_code) {
>  		EXPECT_EQ(-1, access_ret);
> diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
> index cd66901be612..ac9701c018e0 100644
> --- a/tools/testing/selftests/landlock/fs_test.c
> +++ b/tools/testing/selftests/landlock/fs_test.c
> @@ -59,6 +59,12 @@ int open_tree(int dfd, const char *filename, unsigned int flags)
>  }
>  #endif
>  
> +static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
> +			char *const envp[], int flags)
> +{
> +	return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
> +}
> +
>  #ifndef RENAME_EXCHANGE
>  #define RENAME_EXCHANGE (1 << 1)
>  #endif
> @@ -2018,8 +2024,8 @@ static void test_check_exec(struct __test_metadata *const _metadata,
>  	int ret;
>  	char *const argv[] = { (char *)path, NULL };
>  
> -	ret = execveat(AT_FDCWD, path, argv, NULL,
> -		       AT_EMPTY_PATH | AT_EXECVE_CHECK);
> +	ret = sys_execveat(AT_FDCWD, path, argv, NULL,
> +			   AT_EMPTY_PATH | AT_EXECVE_CHECK);
>  	if (err) {
>  		EXPECT_EQ(-1, ret);
>  		EXPECT_EQ(errno, err);
> 
> base-commit: 95b3cdafd7cb74414070893445a9b731793f7b55
> -- 
> 2.48.1
> 

Reviewed-by: Günther Noack <gnoack3000@gmail.com>

Do you want to add a comment next to these, to remind ourselves do undo this?
You are surely not planning to support old versions of glibc indefinitely?

–Günther

Re: [PATCH v1] selftests: Handle old glibc without execveat(2)

[Mickaël Salaün]

On Fri, Jan 17, 2025 at 03:42:22PM +0100, Günther Noack wrote:
> On Wed, Jan 15, 2025 at 03:47:50PM +0100, Mickaël Salaün wrote:
> > Add an execveat(2) wrapper because glibc < 2.34 does not have one.  This
> > fixes the check-exec tests and samples.
> > 
> > Cc: Günther Noack <gnoack@google.com>
> > Cc: Jeff Xu <jeffxu@chromium.org>
> > Cc: Kees Cook <kees@kernel.org>
> > Cc: Mimi Zohar <zohar@linux.ibm.com>
> > Cc: Paul Moore <paul@paul-moore.com>
> > Cc: Roberto Sassu <roberto.sassu@huawei.com>
> > Cc: Serge Hallyn <serge@hallyn.com>
> > Cc: Stefan Berger <stefanb@linux.ibm.com>
> > Cc: Stephen Rothwell <sfr@canb.auug.org.au>
> > Reported-by: Nathan Chancellor <nathan@kernel.org>
> > Closes: https://lore.kernel.org/r/20250114205645.GA2825031@ax162
> > Signed-off-by: Mickaël Salaün <mic@digikod.net>
> > ---
> > 
> > Based on Kees Cook's next/execve branch.
> > ---
> >  samples/check-exec/inc.c                   | 11 +++++++++--
> >  tools/testing/selftests/exec/check-exec.c  | 11 +++++++++--
> >  tools/testing/selftests/landlock/fs_test.c | 10 ++++++++--
> >  3 files changed, 26 insertions(+), 6 deletions(-)
> > 
> > diff --git a/samples/check-exec/inc.c b/samples/check-exec/inc.c
> > index 94b87569d2a2..7f6ef06a2f06 100644
> > --- a/samples/check-exec/inc.c
> > +++ b/samples/check-exec/inc.c
> > @@ -21,8 +21,15 @@
> >  #include <stdlib.h>
> >  #include <string.h>
> >  #include <sys/prctl.h>
> > +#include <sys/syscall.h>
> >  #include <unistd.h>
> >  
> > +static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
> > +			char *const envp[], int flags)
> > +{
> > +	return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
> > +}
> > +
> >  /* Returns 1 on error, 0 otherwise. */
> >  static int interpret_buffer(char *buffer, size_t buffer_size)
> >  {
> > @@ -78,8 +85,8 @@ static int interpret_stream(FILE *script, char *const script_name,
> >  	 * script execution.  We must use the script file descriptor instead of
> >  	 * the script path name to avoid race conditions.
> >  	 */
> > -	err = execveat(fileno(script), "", script_argv, envp,
> > -		       AT_EMPTY_PATH | AT_EXECVE_CHECK);
> > +	err = sys_execveat(fileno(script), "", script_argv, envp,
> > +			   AT_EMPTY_PATH | AT_EXECVE_CHECK);
> >  	if (err && restrict_stream) {
> >  		perror("ERROR: Script execution check");
> >  		return 1;
> > diff --git a/tools/testing/selftests/exec/check-exec.c b/tools/testing/selftests/exec/check-exec.c
> > index 4d3f4525e1e1..55bce47e56b7 100644
> > --- a/tools/testing/selftests/exec/check-exec.c
> > +++ b/tools/testing/selftests/exec/check-exec.c
> > @@ -22,6 +22,7 @@
> >  #include <sys/prctl.h>
> >  #include <sys/socket.h>
> >  #include <sys/stat.h>
> > +#include <sys/syscall.h>
> >  #include <sys/sysmacros.h>
> >  #include <unistd.h>
> >  
> > @@ -31,6 +32,12 @@
> >  
> >  #include "../kselftest_harness.h"
> >  
> > +static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
> > +			char *const envp[], int flags)
> > +{
> > +	return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
> > +}
> > +
> >  static void drop_privileges(struct __test_metadata *const _metadata)
> >  {
> >  	const unsigned int noroot = SECBIT_NOROOT | SECBIT_NOROOT_LOCKED;
> > @@ -219,8 +226,8 @@ static void test_exec_fd(struct __test_metadata *_metadata, const int fd,
> >  	 * test framework as an error.  With AT_EXECVE_CHECK, we only check a
> >  	 * potential successful execution.
> >  	 */
> > -	access_ret =
> > -		execveat(fd, "", argv, NULL, AT_EMPTY_PATH | AT_EXECVE_CHECK);
> > +	access_ret = sys_execveat(fd, "", argv, NULL,
> > +				  AT_EMPTY_PATH | AT_EXECVE_CHECK);
> >  	access_errno = errno;
> >  	if (err_code) {
> >  		EXPECT_EQ(-1, access_ret);
> > diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
> > index cd66901be612..ac9701c018e0 100644
> > --- a/tools/testing/selftests/landlock/fs_test.c
> > +++ b/tools/testing/selftests/landlock/fs_test.c
> > @@ -59,6 +59,12 @@ int open_tree(int dfd, const char *filename, unsigned int flags)
> >  }
> >  #endif
> >  
> > +static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
> > +			char *const envp[], int flags)
> > +{
> > +	return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
> > +}
> > +
> >  #ifndef RENAME_EXCHANGE
> >  #define RENAME_EXCHANGE (1 << 1)
> >  #endif
> > @@ -2018,8 +2024,8 @@ static void test_check_exec(struct __test_metadata *const _metadata,
> >  	int ret;
> >  	char *const argv[] = { (char *)path, NULL };
> >  
> > -	ret = execveat(AT_FDCWD, path, argv, NULL,
> > -		       AT_EMPTY_PATH | AT_EXECVE_CHECK);
> > +	ret = sys_execveat(AT_FDCWD, path, argv, NULL,
> > +			   AT_EMPTY_PATH | AT_EXECVE_CHECK);
> >  	if (err) {
> >  		EXPECT_EQ(-1, ret);
> >  		EXPECT_EQ(errno, err);
> > 
> > base-commit: 95b3cdafd7cb74414070893445a9b731793f7b55
> > -- 
> > 2.48.1
> > 
> 
> Reviewed-by: Günther Noack <gnoack3000@gmail.com>
> 
> Do you want to add a comment next to these, to remind ourselves do undo this?
> You are surely not planning to support old versions of glibc indefinitely?

I don't about glibc.  Minimal versions for other tools are documented
here though:
https://docs.kernel.org/process/changes.html

Nathan, Jon, any idea?

Re: [PATCH v1] selftests: Handle old glibc without execveat(2)

[Nathan Chancellor]

On Fri, Jan 17, 2025 at 04:47:05PM +0100, Mickaël Salaün wrote:
> On Fri, Jan 17, 2025 at 03:42:22PM +0100, Günther Noack wrote:
> > Do you want to add a comment next to these, to remind ourselves do undo this?
> > You are surely not planning to support old versions of glibc indefinitely?
> 
> I don't about glibc.  Minimal versions for other tools are documented
> here though:
> https://docs.kernel.org/process/changes.html
> 
> Nathan, Jon, any idea?

I do not know if the idea of setting a minimum supported version of a
libc has ever come up before (at least I am unaware of one). I suspect
most people do a patch like this then move on because it is the
maximally compatible option and these samples are not changing much, are
they? This is the first build error I can recall seeing as a result of
using an older glibc environment. If we would like to seriously consider
setting a minimum supported version of glibc, it deserves a conversation
with a wider audience since it could impact areas other than the
samples, such as host tools (and IMHO, feels like a big hammer).

Cheers,
Nathan

Re: [PATCH v1] selftests: Handle old glibc without execveat(2)

[Kees Cook]

On Wed, 15 Jan 2025 15:47:50 +0100, Mickaël Salaün wrote:
> Add an execveat(2) wrapper because glibc < 2.34 does not have one.  This
> fixes the check-exec tests and samples.
> 
> 

Applied to for-next/topic/execve/AT_EXECVE_CHECK, thanks!

[1/1] selftests: Handle old glibc without execveat(2)
      https://git.kernel.org/kees/c/38567b972a22

Take care,

-- 
Kees Cook