- /* Create with NOEXEC and ALLOW_SEALING */
- fd = mfd_assert_new("kern_memfd_noexec",
- mfd_def_size,
- MFD_CLOEXEC | MFD_ALLOW_SEALING | MFD_NOEXEC);
Don't we need to check fd here?
mfd_assert_new will abort() if fd is not valid, so we don't check fd here.
Jeff
On Thu, Jul 28, 2022 at 11:15 PM Jeff Xu jeffxu@google.com wrote:
From: Daniel Verkamp dverkamp@chromium.org
Tests that ensure MFD_NOEXEC memfds have the appropriate mode bits and cannot be chmod-ed into being executable.
Co-developed-by: Jeff Xu jeffxu@google.com Signed-off-by: Jeff Xu jeffxu@google.com Signed-off-by: Daniel Verkamp dverkamp@chromium.org
tools/testing/selftests/memfd/memfd_test.c | 34 ++++++++++++++++++++++ 1 file changed, 34 insertions(+)
diff --git a/tools/testing/selftests/memfd/memfd_test.c b/tools/testing/selftests/memfd/memfd_test.c index 1d7e7b36bbdd..4906f778564e 100644 --- a/tools/testing/selftests/memfd/memfd_test.c +++ b/tools/testing/selftests/memfd/memfd_test.c @@ -36,6 +36,10 @@ #define MAX_PATH 256 #endif
+#ifndef MFD_NOEXEC +#define MFD_NOEXEC 0x0008U +#endif
/*
- Default is not to test hugetlbfs
*/ @@ -1006,6 +1010,35 @@ static void test_seal_exec(void) close(fd); }
+/*
- Test memfd_create with MFD_NOEXEC flag
- Test that MFD_NOEXEC applies F_SEAL_EXEC and prevents change of exec bits
- */
+static void test_noexec(void) +{
int fd;printf("%s NOEXEC\n", memfd_str);/* Create with NOEXEC and ALLOW_SEALING */fd = mfd_assert_new("kern_memfd_noexec",mfd_def_size,MFD_CLOEXEC | MFD_ALLOW_SEALING | MFD_NOEXEC);mfd_assert_mode(fd, 0666);mfd_assert_has_seals(fd, F_SEAL_EXEC);mfd_fail_chmod(fd, 0777);close(fd);/* Create with NOEXEC but without ALLOW_SEALING */fd = mfd_assert_new("kern_memfd_noexec",mfd_def_size,MFD_CLOEXEC | MFD_NOEXEC);mfd_assert_mode(fd, 0666);mfd_assert_has_seals(fd, F_SEAL_EXEC | F_SEAL_SEAL);mfd_fail_chmod(fd, 0777);close(fd);+}
/*
- Test sharing via dup()
- Test that seals are shared between dupped FDs and they're all equal.
@@ -1179,6 +1212,7 @@ int main(int argc, char **argv)
test_create(); test_basic();
test_noexec(); test_seal_write(); test_seal_future_write();-- 2.37.1.455.g008518b4e5-goog