Re: [GIT PULL] AT_EXECVE_CHECK introduction for v6.14-rc1

[Kees Cook <kees@kernel.org>]

On Mon, Jan 20, 2025 at 10:03:07AM +0100, Mickaël Salaün wrote:
> On Sun, Jan 19, 2025 at 07:08:54PM -0500, Sasha Levin wrote:
> > On Wed, Jan 15, 2025 at 04:18:07PM -0800, Kees Cook wrote:
> > > Hi Linus,
> > > 
> > > Please pull the AT_EXECVE_CHECK introduction for v6.14-rc1. I split
> > > this series from the core execve tree since it's had a life of its own
> > > as it has progressed from O_MAY_EXEC. :) This provides userspace with
> > > a way to opt in to performing "execability" checks for things that are
> > > executable but don't pass through execve(2) (e.g. scripts, dlopen libs,
> > > etc). It's seen quite a bit of discussion and review, and has lived in
> > > -next for the entire dev cycle. Included is documentation, samples, and
> > > extensive selftests.
> > > 
> > > Thanks!
> > > 
> > > -Kees
> > > 
> > > The following changes since commit fac04efc5c793dccbd07e2d59af9f90b7fc0dca4:
> > > 
> > >  Linux 6.13-rc2 (2024-12-08 14:03:39 -0800)
> > > 
> > > are available in the Git repository at:
> > > 
> > >  https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/AT_EXECVE_CHECK-v6.14-rc1
> > 
> > Hey Kees,
> > 
> > LKFT has caught a build error with one of the samples:
> > 
> > /builds/linux/samples/check-exec/inc.c: In function 'interpret_stream':
> > /builds/linux/samples/check-exec/inc.c:81:8: warning: implicit declaration of function 'execveat'; did you mean 'execve'? [-Wimplicit-function-declaration]
> >   err = execveat(fileno(script), "", script_argv, envp,
> >         ^~~~~~~~
> >         execve
> > 
> > The full log is here: https://qa-reports.linaro.org/lkft/sashal-linus-next/build/v6.13-rc7-511-g109a8e0fa9d6/testrun/26809210/suite/build/test/gcc-8-allyesconfig/log
> 
> Hi Sasha,
> 
> Nathan caught this sample build issue last week too.  The fix is here:
> https://lore.kernel.org/r/20250115144753.311152-1-mic@digikod.net

I intend to get the fix to Linus as soon as he looks at the original PR. I
don't want to create churn here. If it gets pulled, I'll send the fix. If
it gets dropped, we can add the fix to the tree and see where we stand.

-- 
Kees Cook