testcases/cve/cve-2016-10044.c

/*
 * Copyright (c) 2017 Richard Palethorpe <rpalethorpe@suse.com>
 * Copyright (c) 2016 Jan Horn <jann@thejh.net>
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */
/*
 * Test for CVE-2016-10044, which was fixed in commit
 * 22f6b4d34fcf039c aio: mark AIO pseudo-fs noexec.
 *
 * The test checks that we can not implicitly mark AIO mappings as
 * executable using the READ_IMPLIES_EXEC personality.
 */

#include <stdio.h>
#include <stdint.h>
#include <string.h>
#include "lapi/syscalls.h"
#include "lapi/personality.h"
#include "tst_test.h"
#include "tst_safe_stdio.h"

static FILE *f;

static void cleanup(void)
{
	if (f)
		SAFE_FCLOSE(f);
}

static void run(void)
{
	uint64_t ctx = 0;
	char perms[8], line[BUFSIZ];

	SAFE_PERSONALITY(READ_IMPLIES_EXEC);
	if (tst_syscall(__NR_io_setup, 1, &ctx))
		tst_brk(TBROK | TERRNO, "Failed to create AIO context");

	f = SAFE_FOPEN("/proc/self/maps", "r");
	while (fgets(line, BUFSIZ, f) != NULL) {
		if (strstr(line, "/[aio]") != NULL)
			goto found_mapping;
	}
	tst_brk(TBROK, "Could not find mapping in /proc/self/maps");

found_mapping:
	if (sscanf(line, "%*x-%*x %s7", perms) < 0)
		tst_brk(TBROK, "failed to find permission string in %s", line);
	if (strchr(perms, (int)'x'))
		tst_res(TFAIL, "AIO mapping is executable: %s!", perms);
	else
		tst_res(TPASS, "AIO mapping is not executable: %s", perms);

	SAFE_FCLOSE(f);
	f = NULL;
}

static struct tst_test test = {
	.test_all = run,
	.cleanup = cleanup,
	.min_kver = "2.6.8",
};