138 lines
3.0 KiB
C
138 lines
3.0 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
#define _GNU_SOURCE
|
|
#include <sys/mman.h>
|
|
#include <stdint.h>
|
|
#include <asm-generic/unistd.h>
|
|
#include <string.h>
|
|
#include <sys/time.h>
|
|
#include <sys/resource.h>
|
|
#include <stdbool.h>
|
|
#include "../kselftest.h"
|
|
#include <syscall.h>
|
|
#include <errno.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <fcntl.h>
|
|
#include <sys/ioctl.h>
|
|
#include <sys/vfs.h>
|
|
#include <sys/stat.h>
|
|
#include "mseal_helpers.h"
|
|
|
|
/*
|
|
* define sys_xyx to call syscall directly.
|
|
*/
|
|
static int sys_mseal(void *start, size_t len)
|
|
{
|
|
int sret;
|
|
|
|
errno = 0;
|
|
sret = syscall(__NR_mseal, start, len, 0);
|
|
return sret;
|
|
}
|
|
|
|
static inline int sys_mprotect(void *ptr, size_t size, unsigned long prot)
|
|
{
|
|
int sret;
|
|
|
|
errno = 0;
|
|
sret = syscall(__NR_mprotect, ptr, size, prot);
|
|
return sret;
|
|
}
|
|
|
|
static bool seal_support(void)
|
|
{
|
|
int ret;
|
|
void *ptr;
|
|
unsigned long page_size = getpagesize();
|
|
|
|
ptr = mmap(NULL, page_size, PROT_READ, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
|
|
if (ptr == (void *) -1)
|
|
return false;
|
|
|
|
ret = sys_mseal(ptr, page_size);
|
|
if (ret < 0)
|
|
return false;
|
|
|
|
return true;
|
|
}
|
|
|
|
const char somestr[4096] = {"READONLY"};
|
|
|
|
static void test_seal_elf(void)
|
|
{
|
|
int ret;
|
|
FILE *maps;
|
|
char line[512];
|
|
uintptr_t addr_start, addr_end;
|
|
char prot[5];
|
|
char filename[256];
|
|
unsigned long page_size = getpagesize();
|
|
unsigned long long ptr = (unsigned long long) somestr;
|
|
char *somestr2 = (char *)somestr;
|
|
|
|
/*
|
|
* Modify the protection of readonly somestr
|
|
*/
|
|
if (((unsigned long long)ptr % page_size) != 0)
|
|
ptr = (unsigned long long)ptr & ~(page_size - 1);
|
|
|
|
ksft_print_msg("somestr = %s\n", somestr);
|
|
ksft_print_msg("change protection to rw\n");
|
|
ret = sys_mprotect((void *)ptr, page_size, PROT_READ|PROT_WRITE);
|
|
FAIL_TEST_IF_FALSE(!ret);
|
|
*somestr2 = 'A';
|
|
ksft_print_msg("somestr is modified to: %s\n", somestr);
|
|
ret = sys_mprotect((void *)ptr, page_size, PROT_READ);
|
|
FAIL_TEST_IF_FALSE(!ret);
|
|
|
|
maps = fopen("/proc/self/maps", "r");
|
|
FAIL_TEST_IF_FALSE(maps);
|
|
|
|
/*
|
|
* apply sealing to elf binary
|
|
*/
|
|
while (fgets(line, sizeof(line), maps)) {
|
|
if (sscanf(line, "%lx-%lx %4s %*x %*x:%*x %*u %255[^\n]",
|
|
&addr_start, &addr_end, prot, filename) == 4) {
|
|
if (strlen(filename)) {
|
|
/*
|
|
* seal the mapping if read only.
|
|
*/
|
|
if (strstr(prot, "r-")) {
|
|
ret = sys_mseal((void *)addr_start, addr_end - addr_start);
|
|
FAIL_TEST_IF_FALSE(!ret);
|
|
ksft_print_msg("sealed: %lx-%lx %s %s\n",
|
|
addr_start, addr_end, prot, filename);
|
|
if ((uintptr_t) somestr >= addr_start &&
|
|
(uintptr_t) somestr <= addr_end)
|
|
ksft_print_msg("mapping for somestr found\n");
|
|
}
|
|
}
|
|
}
|
|
}
|
|
fclose(maps);
|
|
|
|
ret = sys_mprotect((void *)ptr, page_size, PROT_READ | PROT_WRITE);
|
|
FAIL_TEST_IF_FALSE(ret < 0);
|
|
ksft_print_msg("somestr is sealed, mprotect is rejected\n");
|
|
|
|
REPORT_TEST_PASS();
|
|
}
|
|
|
|
int main(int argc, char **argv)
|
|
{
|
|
bool test_seal = seal_support();
|
|
|
|
ksft_print_header();
|
|
ksft_print_msg("pid=%d\n", getpid());
|
|
|
|
if (!test_seal)
|
|
ksft_exit_skip("sealing not supported, check CONFIG_64BIT\n");
|
|
|
|
ksft_set_plan(1);
|
|
|
|
test_seal_elf();
|
|
|
|
ksft_finished();
|
|
}
|