mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
2a69962be4
Add a very simple script interpreter called "inc" that can evaluate two
different commands (one per line):
- "?" to initialize a counter from user's input;
- "+" to increment the counter (which is set to 0 by default).
It is enlighten to only interpret executable files according to
AT_EXECVE_CHECK and the related securebits:
# Executing a script with RESTRICT_FILE is only allowed if the script
# is executable:
./set-exec -f -- ./inc script-exec.inc # Allowed
./set-exec -f -- ./inc script-noexec.inc # Denied
# Executing stdin with DENY_INTERACTIVE is only allowed if stdin is an
# executable regular file:
./set-exec -i -- ./inc -i < script-exec.inc # Allowed
./set-exec -i -- ./inc -i < script-noexec.inc # Denied
# However, a pipe is not executable and it is then denied:
cat script-noexec.inc | ./set-exec -i -- ./inc -i # Denied
# Executing raw data (e.g. command argument) with DENY_INTERACTIVE is
# always denied.
./set-exec -i -- ./inc -c "+" # Denied
./inc -c "$(<script-ask.inc)" # Allowed
# To directly execute a script, we can update $PATH (used by `env`):
PATH="${PATH}:." ./script-exec.inc
# To execute several commands passed as argument:
Add a complete test suite to check the script interpreter against all
possible execution cases:
make TARGETS=exec kselftest-install
./tools/testing/selftests/kselftest_install/run_kselftest.sh
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Link: https://lore.kernel.org/r/20241212174223.389435-8-mic@digikod.net
Signed-off-by: Kees Cook <kees@kernel.org>
205 lines
6.4 KiB
Bash
Executable file
205 lines
6.4 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# Test the "inc" interpreter.
|
|
#
|
|
# See include/uapi/linux/securebits.h, include/uapi/linux/fcntl.h and
|
|
# samples/check-exec/inc.c
|
|
#
|
|
# Copyright © 2024 Microsoft Corporation
|
|
|
|
set -u -e -o pipefail
|
|
|
|
EXPECTED_OUTPUT="1"
|
|
exec 2>/dev/null
|
|
|
|
DIR="$(dirname $(readlink -f "$0"))"
|
|
source "${DIR}"/../kselftest/ktap_helpers.sh
|
|
|
|
exec_direct() {
|
|
local expect="$1"
|
|
local script="$2"
|
|
shift 2
|
|
local ret=0
|
|
local out
|
|
|
|
# Updates PATH for `env` to execute the `inc` interpreter.
|
|
out="$(PATH="." "$@" "${script}")" || ret=$?
|
|
|
|
if [[ ${ret} -ne ${expect} ]]; then
|
|
echo "ERROR: Wrong expectation for direct file execution: ${ret}"
|
|
return 1
|
|
fi
|
|
if [[ ${ret} -eq 0 && "${out}" != "${EXPECTED_OUTPUT}" ]]; then
|
|
echo "ERROR: Wrong output for direct file execution: ${out}"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
exec_indirect() {
|
|
local expect="$1"
|
|
local script="$2"
|
|
shift 2
|
|
local ret=0
|
|
local out
|
|
|
|
# Script passed as argument.
|
|
out="$("$@" ./inc "${script}")" || ret=$?
|
|
|
|
if [[ ${ret} -ne ${expect} ]]; then
|
|
echo "ERROR: Wrong expectation for indirect file execution: ${ret}"
|
|
return 1
|
|
fi
|
|
if [[ ${ret} -eq 0 && "${out}" != "${EXPECTED_OUTPUT}" ]]; then
|
|
echo "ERROR: Wrong output for indirect file execution: ${out}"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
exec_stdin_reg() {
|
|
local expect="$1"
|
|
local script="$2"
|
|
shift 2
|
|
local ret=0
|
|
local out
|
|
|
|
# Executing stdin must be allowed if the related file is executable.
|
|
out="$("$@" ./inc -i < "${script}")" || ret=$?
|
|
|
|
if [[ ${ret} -ne ${expect} ]]; then
|
|
echo "ERROR: Wrong expectation for stdin regular file execution: ${ret}"
|
|
return 1
|
|
fi
|
|
if [[ ${ret} -eq 0 && "${out}" != "${EXPECTED_OUTPUT}" ]]; then
|
|
echo "ERROR: Wrong output for stdin regular file execution: ${out}"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
exec_stdin_pipe() {
|
|
local expect="$1"
|
|
shift
|
|
local ret=0
|
|
local out
|
|
|
|
# A pipe is not executable.
|
|
out="$(cat script-exec.inc | "$@" ./inc -i)" || ret=$?
|
|
|
|
if [[ ${ret} -ne ${expect} ]]; then
|
|
echo "ERROR: Wrong expectation for stdin pipe execution: ${ret}"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
exec_argument() {
|
|
local expect="$1"
|
|
local ret=0
|
|
shift
|
|
local out
|
|
|
|
# Script not coming from a file must not be executed.
|
|
out="$("$@" ./inc -c "$(< script-exec.inc)")" || ret=$?
|
|
|
|
if [[ ${ret} -ne ${expect} ]]; then
|
|
echo "ERROR: Wrong expectation for arbitrary argument execution: ${ret}"
|
|
return 1
|
|
fi
|
|
if [[ ${ret} -eq 0 && "${out}" != "${EXPECTED_OUTPUT}" ]]; then
|
|
echo "ERROR: Wrong output for arbitrary argument execution: ${out}"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
exec_interactive() {
|
|
exec_stdin_pipe "$@"
|
|
exec_argument "$@"
|
|
}
|
|
|
|
ktap_test() {
|
|
ktap_test_result "$*" "$@"
|
|
}
|
|
|
|
ktap_print_header
|
|
ktap_set_plan 28
|
|
|
|
# Without secbit configuration, nothing is changed.
|
|
|
|
ktap_print_msg "By default, executable scripts are allowed to be interpreted and executed."
|
|
ktap_test exec_direct 0 script-exec.inc
|
|
ktap_test exec_indirect 0 script-exec.inc
|
|
|
|
ktap_print_msg "By default, executable stdin is allowed to be interpreted."
|
|
ktap_test exec_stdin_reg 0 script-exec.inc
|
|
|
|
ktap_print_msg "By default, non-executable scripts are allowed to be interpreted, but not directly executed."
|
|
# We get 126 because of direct execution by Bash.
|
|
ktap_test exec_direct 126 script-noexec.inc
|
|
ktap_test exec_indirect 0 script-noexec.inc
|
|
|
|
ktap_print_msg "By default, non-executable stdin is allowed to be interpreted."
|
|
ktap_test exec_stdin_reg 0 script-noexec.inc
|
|
|
|
ktap_print_msg "By default, interactive commands are allowed to be interpreted."
|
|
ktap_test exec_interactive 0
|
|
|
|
# With only file restriction: protect non-malicious users from inadvertent errors (e.g. python ~/Downloads/*.py).
|
|
|
|
ktap_print_msg "With -f, executable scripts are allowed to be interpreted and executed."
|
|
ktap_test exec_direct 0 script-exec.inc ./set-exec -f --
|
|
ktap_test exec_indirect 0 script-exec.inc ./set-exec -f --
|
|
|
|
ktap_print_msg "With -f, executable stdin is allowed to be interpreted."
|
|
ktap_test exec_stdin_reg 0 script-exec.inc ./set-exec -f --
|
|
|
|
ktap_print_msg "With -f, non-executable scripts are not allowed to be executed nor interpreted."
|
|
# Direct execution of non-executable script is alwayse denied by the kernel.
|
|
ktap_test exec_direct 1 script-noexec.inc ./set-exec -f --
|
|
ktap_test exec_indirect 1 script-noexec.inc ./set-exec -f --
|
|
|
|
ktap_print_msg "With -f, non-executable stdin is allowed to be interpreted."
|
|
ktap_test exec_stdin_reg 0 script-noexec.inc ./set-exec -f --
|
|
|
|
ktap_print_msg "With -f, interactive commands are allowed to be interpreted."
|
|
ktap_test exec_interactive 0 ./set-exec -f --
|
|
|
|
# With only denied interactive commands: check or monitor script content (e.g. with LSM).
|
|
|
|
ktap_print_msg "With -i, executable scripts are allowed to be interpreted and executed."
|
|
ktap_test exec_direct 0 script-exec.inc ./set-exec -i --
|
|
ktap_test exec_indirect 0 script-exec.inc ./set-exec -i --
|
|
|
|
ktap_print_msg "With -i, executable stdin is allowed to be interpreted."
|
|
ktap_test exec_stdin_reg 0 script-exec.inc ./set-exec -i --
|
|
|
|
ktap_print_msg "With -i, non-executable scripts are allowed to be interpreted, but not directly executed."
|
|
# Direct execution of non-executable script is alwayse denied by the kernel.
|
|
ktap_test exec_direct 1 script-noexec.inc ./set-exec -i --
|
|
ktap_test exec_indirect 0 script-noexec.inc ./set-exec -i --
|
|
|
|
ktap_print_msg "With -i, non-executable stdin is not allowed to be interpreted."
|
|
ktap_test exec_stdin_reg 1 script-noexec.inc ./set-exec -i --
|
|
|
|
ktap_print_msg "With -i, interactive commands are not allowed to be interpreted."
|
|
ktap_test exec_interactive 1 ./set-exec -i --
|
|
|
|
# With both file restriction and denied interactive commands: only allow executable scripts.
|
|
|
|
ktap_print_msg "With -fi, executable scripts are allowed to be interpreted and executed."
|
|
ktap_test exec_direct 0 script-exec.inc ./set-exec -fi --
|
|
ktap_test exec_indirect 0 script-exec.inc ./set-exec -fi --
|
|
|
|
ktap_print_msg "With -fi, executable stdin is allowed to be interpreted."
|
|
ktap_test exec_stdin_reg 0 script-exec.inc ./set-exec -fi --
|
|
|
|
ktap_print_msg "With -fi, non-executable scripts are not allowed to be interpreted nor executed."
|
|
# Direct execution of non-executable script is alwayse denied by the kernel.
|
|
ktap_test exec_direct 1 script-noexec.inc ./set-exec -fi --
|
|
ktap_test exec_indirect 1 script-noexec.inc ./set-exec -fi --
|
|
|
|
ktap_print_msg "With -fi, non-executable stdin is not allowed to be interpreted."
|
|
ktap_test exec_stdin_reg 1 script-noexec.inc ./set-exec -fi --
|
|
|
|
ktap_print_msg "With -fi, interactive commands are not allowed to be interpreted."
|
|
ktap_test exec_interactive 1 ./set-exec -fi --
|
|
|
|
ktap_finished
|