mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-21 06:50:25 +00:00
2a69962be4
Add a very simple script interpreter called "inc" that can evaluate two
different commands (one per line):
- "?" to initialize a counter from user's input;
- "+" to increment the counter (which is set to 0 by default).
It is enlighten to only interpret executable files according to
AT_EXECVE_CHECK and the related securebits:
# Executing a script with RESTRICT_FILE is only allowed if the script
# is executable:
./set-exec -f -- ./inc script-exec.inc # Allowed
./set-exec -f -- ./inc script-noexec.inc # Denied
# Executing stdin with DENY_INTERACTIVE is only allowed if stdin is an
# executable regular file:
./set-exec -i -- ./inc -i < script-exec.inc # Allowed
./set-exec -i -- ./inc -i < script-noexec.inc # Denied
# However, a pipe is not executable and it is then denied:
cat script-noexec.inc | ./set-exec -i -- ./inc -i # Denied
# Executing raw data (e.g. command argument) with DENY_INTERACTIVE is
# always denied.
./set-exec -i -- ./inc -c "+" # Denied
./inc -c "$(<script-ask.inc)" # Allowed
# To directly execute a script, we can update $PATH (used by `env`):
PATH="${PATH}:." ./script-exec.inc
# To execute several commands passed as argument:
Add a complete test suite to check the script interpreter against all
possible execution cases:
make TARGETS=exec kselftest-install
./tools/testing/selftests/kselftest_install/run_kselftest.sh
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Link: https://lore.kernel.org/r/20241212174223.389435-8-mic@digikod.net
Signed-off-by: Kees Cook <kees@kernel.org>
57 lines
1.9 KiB
Makefile
57 lines
1.9 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
CFLAGS = -Wall
|
|
CFLAGS += -Wno-nonnull
|
|
CFLAGS += $(KHDR_INCLUDES)
|
|
|
|
LDLIBS += -lcap
|
|
|
|
ALIGNS := 0x1000 0x200000 0x1000000
|
|
ALIGN_PIES := $(patsubst %,load_address.%,$(ALIGNS))
|
|
ALIGN_STATIC_PIES := $(patsubst %,load_address.static.%,$(ALIGNS))
|
|
ALIGNMENT_TESTS := $(ALIGN_PIES) $(ALIGN_STATIC_PIES)
|
|
|
|
TEST_PROGS := binfmt_script.py check-exec-tests.sh
|
|
TEST_GEN_PROGS := execveat non-regular $(ALIGNMENT_TESTS)
|
|
TEST_GEN_PROGS_EXTENDED := false inc set-exec script-exec.inc script-noexec.inc
|
|
TEST_GEN_FILES := execveat.symlink execveat.denatured script subdir
|
|
# Makefile is a run-time dependency, since it's accessed by the execveat test
|
|
TEST_FILES := Makefile
|
|
|
|
TEST_GEN_PROGS += recursion-depth
|
|
TEST_GEN_PROGS += null-argv
|
|
TEST_GEN_PROGS += check-exec
|
|
|
|
EXTRA_CLEAN := $(OUTPUT)/subdir.moved $(OUTPUT)/execveat.moved $(OUTPUT)/xxxxx* \
|
|
$(OUTPUT)/S_I*.test
|
|
|
|
include ../lib.mk
|
|
|
|
CHECK_EXEC_SAMPLES := $(top_srcdir)/samples/check-exec
|
|
|
|
$(OUTPUT)/subdir:
|
|
mkdir -p $@
|
|
$(OUTPUT)/script: Makefile
|
|
echo '#!/bin/bash' > $@
|
|
echo 'exit $$*' >> $@
|
|
chmod +x $@
|
|
$(OUTPUT)/execveat.symlink: $(OUTPUT)/execveat
|
|
cd $(OUTPUT) && ln -s -f $(shell basename $<) $(shell basename $@)
|
|
$(OUTPUT)/execveat.denatured: $(OUTPUT)/execveat
|
|
cp $< $@
|
|
chmod -x $@
|
|
$(OUTPUT)/load_address.0x%: load_address.c
|
|
$(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=$(lastword $(subst ., ,$@)) \
|
|
-fPIE -pie $< -o $@
|
|
$(OUTPUT)/load_address.static.0x%: load_address.c
|
|
$(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=$(lastword $(subst ., ,$@)) \
|
|
-fPIE -static-pie $< -o $@
|
|
$(OUTPUT)/false: false.c
|
|
$(CC) $(CFLAGS) $(LDFLAGS) -static $< -o $@
|
|
$(OUTPUT)/inc: $(CHECK_EXEC_SAMPLES)/inc.c
|
|
$(CC) $(CFLAGS) $(LDFLAGS) $< -o $@
|
|
$(OUTPUT)/set-exec: $(CHECK_EXEC_SAMPLES)/set-exec.c
|
|
$(CC) $(CFLAGS) $(LDFLAGS) $< -o $@
|
|
$(OUTPUT)/script-exec.inc: $(CHECK_EXEC_SAMPLES)/script-exec.inc
|
|
cp $< $@
|
|
$(OUTPUT)/script-noexec.inc: $(CHECK_EXEC_SAMPLES)/script-noexec.inc
|
|
cp $< $@
|