[Devel] [PATCH hci-8.1 6/7] selftests/mm: check that a setuid exec refuses preserved memory

[Konstantin Khorenko <khorenko@virtuozzo.com>]

Copy the test binary, make it setuid root and exec it from an
unprivileged child with a MADV_DOEXEC range: exec must fail with EPERM
and leave the mapping intact, and must succeed once the range is
unmarked with MADV_DONTEXEC. The case needs root and a directory that
is neither private nor mounted nosuid; the current directory, /var/tmp
and /tmp are tried in that order and the case is skipped if none fits.
The copy goes into a new directory that others can enter but not list,
and run setuid it does nothing but report its euid.

https://virtuozzo.atlassian.net/browse/VSTOR-150232

Feature: oracle/mm: MADV_DOEXEC madvise() flag
Assisted-by: LLM
Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
 tools/testing/selftests/mm/doexec.c | 121 ++++++++++++++++++++++++++++++++++--
 1 file changed, 117 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/mm/doexec.c b/tools/testing/selftests/mm/doexec.c
index 33529aa41367b..dfa3da2c43934 100644
--- a/tools/testing/selftests/mm/doexec.c
+++ b/tools/testing/selftests/mm/doexec.c
@@ -3,6 +3,7 @@
 #define _GNU_SOURCE
 #include <errno.h>
 #include <fcntl.h>
+#include <grp.h>
 #include <linux/vhost.h>
 #include <poll.h>
 #include <pthread.h>
@@ -17,6 +18,8 @@
 #include <sys/ioctl.h>
 #include <sys/mman.h>
 #include <sys/resource.h>
+#include <sys/sendfile.h>
+#include <sys/stat.h>
 #include <sys/syscall.h>
 #include <sys/wait.h>
 #include <unistd.h>
@@ -27,6 +30,9 @@
 #ifndef MADV_DOEXEC
 #define MADV_DOEXEC 201
 #endif
+#ifndef MADV_DONTEXEC
+#define MADV_DONTEXEC 202
+#endif
 #ifndef MADV_COLLAPSE
 #define MADV_COLLAPSE 25
 #endif
@@ -283,7 +289,8 @@ static int before_exec(int kind)
 	return KSFT_FAIL;
 }
 
-static int check_exec(char *ram, size_t size, size_t stride, bool reject)
+static int exec_path(const char *exe, char *ram, size_t size, size_t stride,
+		     bool reject)
 {
 	char addr_arg[32], size_arg[32], stride_arg[32];
 
@@ -291,11 +298,16 @@ static int check_exec(char *ram, size_t size, size_t stride, bool reject)
 		 (unsigned long long)(uintptr_t)ram);
 	snprintf(size_arg, sizeof(size_arg), "%zu", size);
 	snprintf(stride_arg, sizeof(stride_arg), "%zu", stride);
-	execl("/proc/self/exe", "doexec", reject ? "--reject" : "--check", addr_arg, size_arg,
+	execl(exe, "doexec", reject ? "--reject" : "--check", addr_arg, size_arg,
 	      stride_arg, NULL);
 	return errno;
 }
 
+static int check_exec(char *ram, size_t size, size_t stride, bool reject)
+{
+	return exec_path("/proc/self/exe", ram, size, stride, reject);
+}
+
 static char *preserved_ram(size_t size)
 {
 	char *ram = mmap(NULL, size, PROT_READ | PROT_WRITE,
@@ -397,6 +409,98 @@ static int vhost_owner_exec(void)
 	return KSFT_FAIL;
 }
 
+static void remove_setuid_copy(char *path)
+{
+	unlink(path);
+	*strrchr(path, '/') = '\0';
+	rmdir(path);
+}
+
+static int make_setuid_copy(const char *dir, char *path, size_t len)
+{
+	ssize_t copied = -1;
+	int in, out;
+	size_t n;
+
+	snprintf(path, len, "%s/doexec-setuid.XXXXXX", dir);
+	/* Others may run the copy but cannot find it. */
+	if (!mkdtemp(path))
+		return -1;
+	if (chmod(path, 0711)) {
+		rmdir(path);
+		return -1;
+	}
+	n = strlen(path);
+	snprintf(path + n, len - n, "/doexec.XXXXXX");
+	out = mkstemp(path);
+	in = open("/proc/self/exe", O_RDONLY);
+	if (in >= 0 && out >= 0)
+		while ((copied = sendfile(out, in, NULL, 1 << 20)) > 0)
+			;
+	if (in >= 0)
+		close(in);
+	if (out >= 0 && !copied && !fchmod(out, S_ISUID | 0755)) {
+		close(out);
+		return 0;
+	}
+	if (out >= 0)
+		close(out);
+	remove_setuid_copy(path);
+	return -1;
+}
+
+static int unprivileged_exec(const char *path, bool preserve)
+{
+	size_t size = sysconf(_SC_PAGESIZE);
+	pid_t pid = fork();
+	char *ram;
+	int err;
+
+	if (pid < 0)
+		return KSFT_FAIL;
+	if (pid)
+		return wait_child(pid);
+	if (setgroups(0, NULL) || setresgid(65534, 65534, 65534) ||
+	    setresuid(65534, 65534, 65534))
+		_exit(KSFT_SKIP);
+	if (!preserve) {
+		execl(path, "doexec", "--euid", NULL);
+		_exit(KSFT_SKIP);
+	}
+	ram = preserved_ram(size);
+	if (!ram)
+		_exit(errno == EINVAL ? KSFT_SKIP : KSFT_FAIL);
+	err = exec_path(path, ram, size, 1, true);
+	/* Exec must return EPERM with the old mapping intact. */
+	if (err != EPERM || check_bytes(ram, size, 0x31))
+		_exit(KSFT_FAIL);
+	if (madvise(ram, size, MADV_DONTEXEC))
+		_exit(KSFT_FAIL);
+	execl(path, "doexec", "--euid", NULL);
+	_exit(KSFT_FAIL);
+}
+
+/* The ELF opt-in must not pull memory into a more privileged image. */
+static int setuid_exec(void)
+{
+	static const char * const dirs[] = { ".", "/var/tmp", "/tmp" };
+	char path[96];
+	int i, ret = KSFT_SKIP;
+
+	if (geteuid())
+		return KSFT_SKIP;
+	for (i = 0; i < 3 && ret == KSFT_SKIP; i++) {
+		if (make_setuid_copy(dirs[i], path, sizeof(path)))
+			continue;
+		/* A nosuid mount or a private directory makes the copy useless. */
+		ret = unprivileged_exec(path, false);
+		if (ret == KSFT_PASS)
+			ret = unprivileged_exec(path, true);
+		remove_setuid_copy(path);
+	}
+	return ret;
+}
+
 static void *exec_thread(void *arg)
 {
 	check_exec(arg, sysconf(_SC_PAGESIZE), 1, false);
@@ -723,6 +827,10 @@ int main(int argc, char **argv)
 	pid_t pid;
 	int kind, ret;
 
+	/* The setuid copy only reports that it runs as root. */
+	if (geteuid() != getuid())
+		return argc == 2 && !strcmp(argv[1], "--euid") && !geteuid() ?
+		       KSFT_PASS : KSFT_FAIL;
 	if (argc == 7 && !strcmp(argv[1], "--exec"))
 		return after_exec(atoi(argv[2]),
 			(char *)(uintptr_t)strtoull(argv[3], NULL, 10),
@@ -732,6 +840,8 @@ int main(int argc, char **argv)
 			strtoull(argv[3], NULL, 10), atoi(argv[4]), atoi(argv[5]));
 	if (argc == 5 && !strcmp(argv[1], "--reject"))
 		return KSFT_FAIL;
+	if (argc == 2 && !strcmp(argv[1], "--euid"))
+		return geteuid() ? KSFT_SKIP : KSFT_PASS;
 	if (argc == 5 && !strcmp(argv[1], "--proc"))
 		return proc_exec((char *)(uintptr_t)strtoull(argv[2], NULL, 10),
 				 strtoull(argv[3], NULL, 10), atoi(argv[4]));
@@ -751,7 +861,7 @@ int main(int argc, char **argv)
 		return KSFT_PASS;
 	}
 	ksft_print_header();
-	ksft_set_plan(NR_TESTS + 8);
+	ksft_set_plan(NR_TESTS + 9);
 	for (kind = 0; kind < NR_TESTS; kind++) {
 		fflush(stdout);
 		pid = fork();
@@ -774,7 +884,7 @@ int main(int argc, char **argv)
 		ksft_test_result_skip("pre-existing COW: DOEXEC unavailable\n");
 	else
 		ksft_test_result(ret == KSFT_PASS, "pre-existing COW preserved\n");
-	for (kind = 0; kind < 7; kind++) {
+	for (kind = 0; kind < 8; kind++) {
 		static const char * const extra_names[] = {
 			"CLONE_VM: recoverable EBUSY and retry",
 			"own threads: preserving exec allowed",
@@ -783,6 +893,7 @@ int main(int argc, char **argv)
 			"non-leader thread: preserving exec allowed",
 			"proc readers: repeated preserving exec allowed",
 			"concurrent CLONE_VM: shared memory is not stolen",
+			"setuid exec: preserving exec refused",
 		};
 
 		fflush(stdout);
@@ -802,6 +913,8 @@ int main(int argc, char **argv)
 				_exit(proc_readers_exec());
 			case 6:
 				_exit(clone_exec_race());
+			case 7:
+				_exit(setuid_exec());
 			}
 		}
 		ret = pid < 0 ? KSFT_FAIL : wait_child(pid);

-- 
2.43.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel