selftests/landlock: Add tests for execveat + AT_EXECVE_CHECK

Extend layout1.execute with the new AT_EXECVE_CHECK flag.  The semantic
with AT_EXECVE_CHECK is the same as with a simple execve(2),
LANDLOCK_ACCESS_FS_EXECUTE is enforced the same way.

Cc: Günther Noack <gnoack@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Paul Moore <paul@paul-moore.com>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Link: https://lore.kernel.org/r/20241212174223.389435-5-mic@digikod.net
Signed-off-by: Kees Cook <kees@kernel.org>

diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
index 6788762188feac97b531164411ebe53c52e15018..cd66901be612b5a44bec44e194faecb2ac4f9983 100644 (file)
--- a/tools/testing/selftests/landlock/fs_test.c
+++ b/tools/testing/selftests/landlock/fs_test.c
@@ -37,6 +37,10 @@
 #include <linux/fs.h>
 #include <linux/mount.h>
 
+/* Defines AT_EXECVE_CHECK without type conflicts. */
+#define _ASM_GENERIC_FCNTL_H
+#include <linux/fcntl.h>
+
 #include "common.h"
 
 #ifndef renameat2
@@ -2008,6 +2012,22 @@ static void test_execute(struct __test_metadata *const _metadata, const int err,
        };
 }
 
+static void test_check_exec(struct __test_metadata *const _metadata,
+                           const int err, const char *const path)
+{
+       int ret;
+       char *const argv[] = { (char *)path, NULL };
+
+       ret = execveat(AT_FDCWD, path, argv, NULL,
+                      AT_EMPTY_PATH | AT_EXECVE_CHECK);
+       if (err) {
+               EXPECT_EQ(-1, ret);
+               EXPECT_EQ(errno, err);
+       } else {
+               EXPECT_EQ(0, ret);
+       }
+}
+
 TEST_F_FORK(layout1, execute)
 {
        const struct rule rules[] = {
@@ -2025,20 +2045,27 @@ TEST_F_FORK(layout1, execute)
        copy_binary(_metadata, file1_s1d2);
        copy_binary(_metadata, file1_s1d3);
 
+       /* Checks before file1_s1d1 being denied. */
+       test_execute(_metadata, 0, file1_s1d1);
+       test_check_exec(_metadata, 0, file1_s1d1);
+
        enforce_ruleset(_metadata, ruleset_fd);
        ASSERT_EQ(0, close(ruleset_fd));
 
        ASSERT_EQ(0, test_open(dir_s1d1, O_RDONLY));
        ASSERT_EQ(0, test_open(file1_s1d1, O_RDONLY));
        test_execute(_metadata, EACCES, file1_s1d1);
+       test_check_exec(_metadata, EACCES, file1_s1d1);
 
        ASSERT_EQ(0, test_open(dir_s1d2, O_RDONLY));
        ASSERT_EQ(0, test_open(file1_s1d2, O_RDONLY));
        test_execute(_metadata, 0, file1_s1d2);
+       test_check_exec(_metadata, 0, file1_s1d2);
 
        ASSERT_EQ(0, test_open(dir_s1d3, O_RDONLY));
        ASSERT_EQ(0, test_open(file1_s1d3, O_RDONLY));
        test_execute(_metadata, 0, file1_s1d3);
+       test_check_exec(_metadata, 0, file1_s1d3);
 }
 
 TEST_F_FORK(layout1, link)