Changes in Makefile

2a69962b - samples/check-exec: Add an enlighten "inc" interpreter and 28 tests

Thu, 12 Dec 2024 17:42:22 +0000

samples/check-exec: Add an enlighten "inc" interpreter and 28 testsAdd a very simple script interpreter called "inc" that can evaluate twodifferent commands (one per line):- "?" to initialize a counter from user's input;- "+" to increment the counter (which is set to 0 by default).It is enlighten to only interpret executable files according toAT_EXECVE_CHECK and the related securebits: # Executing a script with RESTRICT_FILE is only allowed if the script # is executable: ./set-exec -f -- ./inc script-exec.inc # Allowed ./set-exec -f -- ./inc script-noexec.inc # Denied # Executing stdin with DENY_INTERACTIVE is only allowed if stdin is an # executable regular file: ./set-exec -i -- ./inc -i < script-exec.inc # Allowed ./set-exec -i -- ./inc -i < script-noexec.inc # Denied # However, a pipe is not executable and it is then denied: cat script-noexec.inc | ./set-exec -i -- ./inc -i # Denied # Executing raw data (e.g. command argument) with DENY_INTERACTIVE is # always denied. ./set-exec -i -- ./inc -c "+" # Denied ./inc -c "$(Cc: Christian Brauner Cc: Kees Cook Cc: Paul Moore Cc: Serge Hallyn Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20241212174223.389435-8-mic@digikod.netSigned-off-by: Kees Cook List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

b083cc81 - selftests/exec: Add 32 tests for AT_EXECVE_CHECK and exec securebits

Thu, 12 Dec 2024 17:42:18 +0000

selftests/exec: Add 32 tests for AT_EXECVE_CHECK and exec securebitsTest that checks performed by execveat(..., AT_EXECVE_CHECK) areconsistent with noexec mount points and file execute permissions.Test that SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE areinherited by child processes and that they can be pinned with theappropriate SECBIT_EXEC_RESTRICT_FILE_LOCKED andSECBIT_EXEC_DENY_INTERACTIVE_LOCKED bits.Cc: Al Viro Cc: Christian Brauner Cc: Kees Cook Cc: Paul Moore Cc: Serge Hallyn Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20241212174223.389435-4-mic@digikod.netSigned-off-by: Kees Cook List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

cc937dad - selftests: centralize -D_GNU_SOURCE= to CFLAGS in lib.mk

Tue, 25 Jun 2024 22:34:45 +0000

selftests: centralize -D_GNU_SOURCE= to CFLAGS in lib.mkCentralize the _GNU_SOURCE definition to CFLAGS in lib.mk. Removeredundant defines from Makefiles that import lib.mk. Convert any usage of"#define _GNU_SOURCE 1" to "#define _GNU_SOURCE".This uses the form "-D_GNU_SOURCE=", which is equivalent to"#define _GNU_SOURCE".Otherwise using "-D_GNU_SOURCE" is equivalent to "-D_GNU_SOURCE=1" and"#define _GNU_SOURCE 1", which is less commonly seen in source code andwould require many changes in selftests to avoid redefinition warnings.Link: https://lkml.kernel.org/r/20240625223454.1586259-2-edliaw@google.comSigned-off-by: Edward Liaw Suggested-by: John Hubbard Acked-by: Shuah Khan Reviewed-by: Muhammad Usama Anjum Cc: Albert Ou Cc: André Almeida Cc: Darren Hart Cc: Dave Hansen Cc: Davidlohr Bueso Cc: David S. Miller Cc: Eric Dumazet Cc: Eric W. Biederman Cc: Fenghua Yu Cc: Ingo Molnar Cc: Jakub Kicinski Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Kees Cook Cc: Kevin Tian Cc: Palmer Dabbelt Cc: Paolo Abeni Cc: Paolo Bonzini Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Reinette Chatre Cc: Sean Christopherson Cc: Thomas Gleixner Signed-off-by: Andrew Morton List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

3545deff - binfmt_elf: Honor PT_LOAD alignment for static PIE

Wed, 08 May 2024 17:31:48 +0000

binfmt_elf: Honor PT_LOAD alignment for static PIEThe p_align values in PT_LOAD were ignored for static PIE executables(i.e. ET_DYN without PT_INTERP). This is because there is no way torequest a non-fixed mmap region with a specific alignment. ET_DYN withPT_INTERP uses a separate base address (ELF_ET_DYN_BASE) and binfmt_elfperforms the ASLR itself, which means it can also apply alignment. Forthe mmap region, the address selection happens deep within the vm_mmap()implementation (when the requested address is 0).The earlier attempt to implement this: commit 9630f0d60fec ("fs/binfmt_elf: use PT_LOAD p_align values for static PIE") commit 925346c129da ("fs/binfmt_elf: fix PT_LOAD p_align values for loaders")did not take into account the different base address origins, and wereeventually reverted: aeb7923733d1 ("revert "fs/binfmt_elf: use PT_LOAD p_align values for static PIE"")In order to get the correct alignment from an mmap base, binfmt_elf mustperform a 0-address load first, then tear down the mapping and performalignment on the resulting address. Since this is slightly more overhead,only do this when it is needed (i.e. the alignment is not the defaultELF alignment). This does, however, have the benefit of being able touse MAP_FIXED_NOREPLACE, to avoid potential collisions.With this fixed, enable the static PIE self tests again.Reported-by: H.J. Lu Closes: https://bugzilla.kernel.org/show_bug.cgi?id=215275Link: https://lore.kernel.org/r/20240508173149.677910-3-keescook@chromium.orgSigned-off-by: Kees Cook List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

b57a2907 - selftests/exec: Build both static and non-static load_address tests

Wed, 08 May 2024 17:31:46 +0000

selftests/exec: Build both static and non-static load_address testsAfter commit 4d1cd3b2c5c1 ("tools/testing/selftests/exec: fix linkerror"), the load address alignment tests tried to build statically.This was silently ignored in some cases. However, after attempting tofurther fix the build by switching to "-static-pie", the test startedfailing. This appears to be due to non-PT_INTERP ET_DYN execs ("staticPIE") not doing alignment correctly, which remains unfixed[1]. See commitaeb7923733d1 ("revert "fs/binfmt_elf: use PT_LOAD p_align values forstatic PIE"") for more details.Provide rules to build both static and non-static PIE binaries, improvedebug reporting, and perform several test steps instead of a singleall-or-nothing test. However, do not actually enable static-pie tests;alignment specification is only supported for ET_DYN with PT_INTERP("regular PIE").Link: https://bugzilla.kernel.org/show_bug.cgi?id=215275 [1]Link: https://lore.kernel.org/r/20240508173149.677910-1-keescook@chromium.orgSigned-off-by: Kees Cook List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

472874cf - selftests/exec: Convert remaining /bin/sh to /bin/bash

Fri, 15 Mar 2024 18:26:35 +0000

selftests/exec: Convert remaining /bin/sh to /bin/bashAs was intended with commit 17107429947b ("selftests/exec: Perform scriptchecks with /bin/bash"), convert the other instance of /bin/sh to/bin/bash. It appears that at least Debian Bookworm's /bin/sh (dash)does not conform to POSIX's "return 127 when script not found"requirement.Fixes: 17107429947b ("selftests/exec: Perform script checks with /bin/bash")Reported-by: Muhammad Usama Anjum Closes: https://lore.kernel.org/lkml/02c8bf8e-1934-44ab-a886-e065b37366a7@collabora.com/Signed-off-by: Kees Cook List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

9132c394 - selftests/exec: Test for empty string on NULL argv

Tue, 01 Feb 2022 01:16:37 +0000

selftests/exec: Test for empty string on NULL argvTest for the NULL argv argument producing a single empty string on exec.Cc: Eric Biederman Cc: Shuah Khan Cc: Yang Yingliang Cc: Andrew Morton Cc: linux-kselftest@vger.kernel.orgSigned-off-by: Kees Cook Link: https://lore.kernel.org/lkml/20220201011637.2457646-1-keescook@chromium.org List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

4893992b - selftests/exec: Rename file binfmt_script to binfmt_script.py

Thu, 10 Feb 2022 22:23:19 +0000

selftests/exec: Rename file binfmt_script to binfmt_script.pyRename file for readability purpose. Update its usage and references.Signed-off-by: Muhammad Usama Anjum Reviewed-by: Kees Cook Signed-off-by: Shuah Khan List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

a7e793a8 - selftests/exec: Add non-regular to TEST_GEN_PROGS

Thu, 10 Feb 2022 17:13:23 +0000

selftests/exec: Add non-regular to TEST_GEN_PROGSnon-regular file needs to be compiled and then copied to the outputdirectory. Remove it from TEST_PROGS and add it to TEST_GEN_PROGS. Thisremoves error thrown by rsync when non-regular object isn't found:rsync: [sender] link_stat "/linux/tools/testing/selftests/exec/non-regular" failed: No such file or directory (2)rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1333) [sender=3.2.3]Fixes: 0f71241a8e32 ("selftests/exec: add file type errno tests")Reported-by: "kernelci.org bot" Signed-off-by: Muhammad Usama Anjum Reviewed-by: Shuah Khan Reviewed-by: Kees Cook Signed-off-by: Shuah Khan List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

908a26e1 - selftests/exec: Remove pipe from TEST_GEN_FILES

Thu, 27 Jan 2022 16:33:45 +0000

selftests/exec: Remove pipe from TEST_GEN_FILESpipe named FIFO special file is being created in execveat.c to performsome tests. Makefile doesn't need to do anything with the pipe. When itisn't found, Makefile generates the following build error:make: *** No rule to make target'../tools/testing/selftests/exec/pipe', needed by 'all'. Stop.pipe is created and removed during test run-time.Amended change log to add pipe remove info:Shuah Khan Fixes: 61016db15b8e ("selftests/exec: Verify execve of non-regular files fail")Signed-off-by: Muhammad Usama Anjum Reviewed-by: Shuah Khan Signed-off-by: Shuah Khan List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

4d1cd3b2 - tools/testing/selftests/exec: fix link error

Sun, 23 May 2021 00:41:53 +0000

tools/testing/selftests/exec: fix link errorFix the link error by adding '-static': gcc -Wall -Wl,-z,max-page-size=0x1000 -pie load_address.c -o /home/yang/linux/tools/testing/selftests/exec/load_address_4096 /usr/bin/ld: /tmp/ccopEGun.o: relocation R_AARCH64_ADR_PREL_PG_HI21 against symbol `stderr@@GLIBC_2.17' which may bind externally can not be used when making a shared object; recompile with -fPIC /usr/bin/ld: /tmp/ccopEGun.o(.text+0x158): unresolvable R_AARCH64_ADR_PREL_PG_HI21 relocation against symbol `stderr@@GLIBC_2.17' /usr/bin/ld: final link failed: bad value collect2: error: ld returned 1 exit status make: *** [Makefile:25: tools/testing/selftests/exec/load_address_4096] Error 1Link: https://lkml.kernel.org/r/20210514092422.2367367-1-yangyingliang@huawei.comFixes: 206e22f01941 ("tools/testing/selftests: add self-test for verifying load alignment")Signed-off-by: Yang Yingliang Cc: Chris Kennelly Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

206e22f0 - tools/testing/selftests: add self-test for verifying load alignment

Fri, 16 Oct 2020 03:12:36 +0000

tools/testing/selftests: add self-test for verifying load alignmentThis produces a PIE binary with a variety of p_align requirements,suitable for verifying that the load address meets that alignmentrequirement.Signed-off-by: Chris Kennelly Signed-off-by: Andrew Morton Cc: Shuah Khan Cc: Alexander Viro Cc: Alexey Dobriyan Cc: David Rientjes Cc: Fangrui Song Cc: Hugh Dickens Cc: Ian Rogers Cc: "Kirill A. Shutemov" Cc: Mike Kravetz Cc: Nick Desaulniers Cc: Sandeep Patil Cc: Song Liu Cc: Suren Baghdasaryan Link: https://lkml.kernel.org/r/20200820170541.1132271-3-ckennelly@google.comLink: https://lkml.kernel.org/r/20200821233848.3904680-3-ckennelly@google.comSigned-off-by: Linus Torvalds List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

0f71241a - selftests/exec: add file type errno tests

Sat, 15 Aug 2020 00:30:17 +0000

selftests/exec: add file type errno testsMake sure execve() returns the expected errno values for non-regularfiles.Signed-off-by: Kees Cook Signed-off-by: Andrew Morton Cc: Marc Zyngier Link: http://lkml.kernel.org/r/20200813231723.2725102-3-keescook@chromium.orgSigned-off-by: Linus Torvalds List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

61016db1 - selftests/exec: Verify execve of non-regular files fail

Mon, 18 May 2020 04:47:43 +0000

selftests/exec: Verify execve of non-regular files failAdd a named pipe as an exec target to make sure that non-regularfiles are rejected by execve() with EACCES. This can help verifycommit 73601ea5b7b1 ("fs/open.c: allow opening only regular filesduring execve()").Signed-off-by: Kees Cook Signed-off-by: Shuah Khan List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

b081320f - selftests/exec: Add binfmt_script regression test

Wed, 20 May 2020 09:05:56 +0000

selftests/exec: Add binfmt_script regression testWhile working on commit b5372fe5dc84 ("exec: load_script: Do not exectruncated interpreter path"), I wrote a series of test scripts to verifycorner cases. However, soon after, commit 6eb3c3d0a52d ("exec: increaseBINPRM_BUF_SIZE to 256") landed, resulting in the tests needing to berefactored for the larger BINPRM_BUF_SIZE, which got lost on my TODOlist. During the recent exec refactoring work[1], the need for these testsresurfaced, so I've finished them up for addition to the kernel selftests.[1] https://lore.kernel.org/lkml/202005191144.E3112135@keescook/Link: https://lkml.kernel.org/r/202005200204.D07DF079@keescookSigned-off-by: Kees Cook Signed-off-by: Eric W. Biederman List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

4e7301e6 - exec selftests: test ->recursion_depth

Tue, 14 May 2019 22:44:43 +0000

exec selftests: test ->recursion_depthTest that trivially recursing script onto itself doesn't work.Note: this is different test from ELOOP tests in execveat.c Those testthat execveat(2) doesn't follow symlinks when told to do so.Link: http://lkml.kernel.org/r/20190423192720.GA21433@avx2Signed-off-by: Alexey Dobriyan Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

b2441318 - License cleanup: add SPDX GPL-2.0 license identifier to files with no license

Wed, 01 Nov 2017 14:07:57 +0000

License cleanup: add SPDX GPL-2.0 license identifier to files with no licenseMany source files in the tree are missing licensing information, whichmakes it harder for compliance tools to determine the correct license.By default all files without license information are under the defaultlicense of the kernel, which is GPL version 2.Update the files which contain no license information with the 'GPL-2.0'SPDX license identifier. The SPDX identifier is a legally bindingshorthand, which can be used instead of the full boiler plate text.This patch is based on work done by Thomas Gleixner and Kate Stewart andPhilippe Ombredanne.How this work was done:Patches were generated and checked against linux-4.14-rc6 for a subset ofthe use cases: - file had no licensing information it it. - file was a */uapi/* one with no licensing information in it, - file was a */uapi/* one with existing licensing information,Further patches will be generated in subsequent months to fix up caseswhere non-standard license headers were used, and references to licensehad to be inferred by heuristics based on keywords.The analysis to determine which SPDX License Identifier to be applied toa file was done in a spreadsheet of side by side results from of theoutput of two independent scanners (ScanCode & Windriver) producing SPDXtag:value files created by Philippe Ombredanne. Philippe prepared thebase worksheet, and did an initial spot review of a few 1000 files.The 4.13 kernel was the starting point of the analysis with 60,537 filesassessed. Kate Stewart did a file by file comparison of the scannerresults in the spreadsheet to determine which SPDX license identifier(s)to be applied to the file. She confirmed any determination that was notimmediately clear with lawyers working with the Linux Foundation.Criteria used to select files for SPDX license identifier tagging was: - Files considered eligible had to be source code files. - Make and config files were included as candidates if they contained >5 lines of source - File already had some variant of a license header in it (even if <5 lines).All documentation files were explicitly excluded.The following heuristics were used to determine which SPDX licenseidentifiers to apply. - when both scanners couldn't find any license traces, file was considered to have no license information in it, and the top level COPYING file license applied. For non */uapi/* files that summary was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 11139 and resulted in the first patch in this series. If that file was a */uapi/* path one, it was "GPL-2.0 WITH Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 WITH Linux-syscall-note 930 and resulted in the second patch in this series. - if a file had some form of licensing information in it, and was one of the */uapi/* ones, it was denoted with the Linux-syscall-note if any GPL family license was found in the file or had no licensing in it (per prior point). Results summary: SPDX license identifier # files ---------------------------------------------------|------ GPL-2.0 WITH Linux-syscall-note 270 GPL-2.0+ WITH Linux-syscall-note 169 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17 LGPL-2.1+ WITH Linux-syscall-note 15 GPL-1.0+ WITH Linux-syscall-note 14 ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5 LGPL-2.0+ WITH Linux-syscall-note 4 LGPL-2.1 WITH Linux-syscall-note 3 ((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3 ((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1 and that resulted in the third patch in this series. - when the two scanners agreed on the detected license(s), that became the concluded license(s). - when there was disagreement between the two scanners (one detected a license but the other didn't, or they both detected different licenses) a manual inspection of the file occurred. - In most cases a manual inspection of the information in the file resulted in a clear resolution of the license that should apply (and which scanner probably needed to revisit its heuristics). - When it was not immediately clear, the license identifier was confirmed with lawyers working with the Linux Foundation. - If there was any question as to the appropriate license identifier, the file was flagged for further research and to be revisited later in time.In total, over 70 hours of logged manual review was done on thespreadsheet to determine the SPDX license identifiers to apply to thesource files by Kate, Philippe, Thomas and, in some cases, confirmationby lawyers working with the Linux Foundation.Kate also obtained a third independent scan of the 4.13 code base fromFOSSology, and compared selected files where the other two scannersdisagreed against that SPDX file, to see if there was new insights. TheWindriver scanner is based on an older version of FOSSology in part, sothey are related.Thomas did random spot checks in about 500 files from the spreadsheetsfor the uapi headers and agreed with SPDX license identifier in thefiles he inspected. For the non-uapi files Thomas did random spot checksin about 15000 files.In initial set of patches against 4.14-rc6, 3 files were found to havecopy/paste license identifier errors, and have been fixed to reflect thecorrect identifier.Additionally Philippe spent 10 hours this week doing a detailed manualinspection and review of the 12,461 patched files from the initial patchversion early this week with: - a full scancode scan run, collecting the matched texts, detected license ids and scores - reviewing anything where there was a license detected (about 500+ files) to ensure that the applied SPDX license was correct - reviewing anything where there was no detection but the patch license was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied SPDX license was correctThis produced a worksheet with 20 files needing minor correction. Thisworksheet was then exported into 3 different .csv files for thedifferent types of files to be modified.These .csv files were then reviewed by Greg. Thomas wrote a script toparse the csv files and add the proper SPDX tag to the file, in theformat that the file expected. This script was further refined by Gregbased on the output to detect more types of files automatically and todistinguish between header and source .c files (which need differentcomment types.) Finally Greg ran the script using the .csv files togenerate the patches.Reviewed-by: Kate Stewart Reviewed-by: Philippe Ombredanne Reviewed-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

a8ba798b - selftests: enable O and KBUILD_OUTPUT

Tue, 29 Nov 2016 11:55:52 +0000

selftests: enable O and KBUILD_OUTPUTEnable O and KBUILD_OUTPUT for kselftest. User could compile kselftestto another directory by passing O or KBUILD_OUTPUT. And O is highpriority than KBUILD_OUTPUT.Signed-off-by: Bamvor Jian Zhang Signed-off-by: Shuah Khan List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

80d443e8 - selftests: add EXTRA_CLEAN for clean target

Tue, 29 Nov 2016 11:55:51 +0000

selftests: add EXTRA_CLEAN for clean targetSome testcases need the clean extra data after running. This patchintroduce the "EXTRA_CLEAN" variable to address this requirement.After KBUILD_OUTPUT is enabled in later patch, it will be easy todecide to if we need do the cleanup in the KBUILD_OUTPUT path(if thetestcase ran immediately after compiled).Signed-off-by: Bamvor Jian Zhang Signed-off-by: Shuah Khan List of files: /linux-6.15/tools/testing/selftests/exec/Makefile

7d758af2 - selftests: add default rules for c source file

Tue, 29 Nov 2016 11:55:49 +0000

selftests: add default rules for c source fileThere are difference rules for compiling c source file in differenttestcases. In order to enable KBUILD_OUTPUT support in later patch,this patch introduce the default rules in"tools/testing/selftest/lib.mk" and remove the existing rules in eachtestcase.Acked-by: Michael Ellerman Signed-off-by: Bamvor Jian Zhang Signed-off-by: Shuah Khan List of files: /linux-6.15/tools/testing/selftests/exec/Makefile