kselftest: vm: add tests for no-inherit memory-deny-write-execute

Add some tests to cover the new PR_MDWE_NO_INHERIT flag of the
PR_SET_MDWE prctl.

Check that:
- it can't be set without PR_SET_MDWE
- MDWE flags can't be unset
- when set, PR_SET_MDWE doesn't propagate to children

Link: https://lkml.kernel.org/r/20230828150858.393570-7-revest@chromium.org
Signed-off-by: Florent Revest <revest@chromium.org>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: Alexey Izbyshev <izbyshev@ispras.ru>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Ayush Jain <ayush.jain3@amd.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Greg Thelen <gthelen@google.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: KP Singh <kpsingh@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Szabolcs Nagy <Szabolcs.Nagy@arm.com>
Cc: Topi Miettinen <toiwoton@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/tools/testing/selftests/mm/mdwe_test.c b/tools/testing/selftests/mm/mdwe_test.c
index 1b84cf8e1bbe2b001c25825ae796bd8731a96bf9..200bedcdc32e9cf0fd834ad39bd0cab435743987 100644 (file)
--- a/tools/testing/selftests/mm/mdwe_test.c
+++ b/tools/testing/selftests/mm/mdwe_test.c
@@ -22,6 +22,9 @@
 
 TEST(prctl_flags)
 {
+       EXPECT_LT(prctl(PR_SET_MDWE, PR_MDWE_NO_INHERIT, 0L, 0L, 7L), 0);
+       EXPECT_EQ(errno, EINVAL);
+
        EXPECT_LT(prctl(PR_SET_MDWE, 7L, 0L, 0L, 0L), 0);
        EXPECT_EQ(errno, EINVAL);
        EXPECT_LT(prctl(PR_SET_MDWE, 0L, 7L, 0L, 0L), 0);
@@ -41,6 +44,84 @@ TEST(prctl_flags)
        EXPECT_EQ(errno, EINVAL);
 }
 
+FIXTURE(consecutive_prctl_flags) {};
+FIXTURE_SETUP(consecutive_prctl_flags) {}
+FIXTURE_TEARDOWN(consecutive_prctl_flags) {}
+
+FIXTURE_VARIANT(consecutive_prctl_flags)
+{
+       unsigned long first_flags;
+       unsigned long second_flags;
+       bool should_work;
+};
+
+FIXTURE_VARIANT_ADD(consecutive_prctl_flags, can_keep_no_flags)
+{
+       .first_flags = 0,
+       .second_flags = 0,
+       .should_work = true,
+};
+
+FIXTURE_VARIANT_ADD(consecutive_prctl_flags, can_keep_exec_gain)
+{
+       .first_flags = PR_MDWE_REFUSE_EXEC_GAIN,
+       .second_flags = PR_MDWE_REFUSE_EXEC_GAIN,
+       .should_work = true,
+};
+
+FIXTURE_VARIANT_ADD(consecutive_prctl_flags, can_keep_both_flags)
+{
+       .first_flags = PR_MDWE_REFUSE_EXEC_GAIN | PR_MDWE_NO_INHERIT,
+       .second_flags = PR_MDWE_REFUSE_EXEC_GAIN | PR_MDWE_NO_INHERIT,
+       .should_work = true,
+};
+
+FIXTURE_VARIANT_ADD(consecutive_prctl_flags, cant_disable_mdwe)
+{
+       .first_flags = PR_MDWE_REFUSE_EXEC_GAIN,
+       .second_flags = 0,
+       .should_work = false,
+};
+
+FIXTURE_VARIANT_ADD(consecutive_prctl_flags, cant_disable_mdwe_no_inherit)
+{
+       .first_flags = PR_MDWE_REFUSE_EXEC_GAIN | PR_MDWE_NO_INHERIT,
+       .second_flags = 0,
+       .should_work = false,
+};
+
+FIXTURE_VARIANT_ADD(consecutive_prctl_flags, cant_disable_no_inherit)
+{
+       .first_flags = PR_MDWE_REFUSE_EXEC_GAIN | PR_MDWE_NO_INHERIT,
+       .second_flags = PR_MDWE_REFUSE_EXEC_GAIN,
+       .should_work = false,
+};
+
+FIXTURE_VARIANT_ADD(consecutive_prctl_flags, cant_enable_no_inherit)
+{
+       .first_flags = PR_MDWE_REFUSE_EXEC_GAIN,
+       .second_flags = PR_MDWE_REFUSE_EXEC_GAIN | PR_MDWE_NO_INHERIT,
+       .should_work = false,
+};
+
+TEST_F(consecutive_prctl_flags, two_prctls)
+{
+       int ret;
+
+       EXPECT_EQ(prctl(PR_SET_MDWE, variant->first_flags, 0L, 0L, 0L), 0);
+
+       ret = prctl(PR_SET_MDWE, variant->second_flags, 0L, 0L, 0L);
+       if (variant->should_work) {
+               EXPECT_EQ(ret, 0);
+
+               ret = prctl(PR_GET_MDWE, 0L, 0L, 0L, 0L);
+               ASSERT_EQ(ret, variant->second_flags);
+       } else {
+               EXPECT_NE(ret, 0);
+               ASSERT_EQ(errno, EPERM);
+       }
+}
+
 FIXTURE(mdwe)
 {
        void *p;
@@ -53,28 +134,45 @@ FIXTURE_VARIANT(mdwe)
 {
        bool enabled;
        bool forked;
+       bool inherit;
 };
 
 FIXTURE_VARIANT_ADD(mdwe, stock)
 {
        .enabled = false,
        .forked = false,
+       .inherit = false,
 };
 
 FIXTURE_VARIANT_ADD(mdwe, enabled)
 {
        .enabled = true,
        .forked = false,
+       .inherit = true,
 };
 
-FIXTURE_VARIANT_ADD(mdwe, forked)
+FIXTURE_VARIANT_ADD(mdwe, inherited)
 {
        .enabled = true,
        .forked = true,
+       .inherit = true,
 };
 
+FIXTURE_VARIANT_ADD(mdwe, not_inherited)
+{
+       .enabled = true,
+       .forked = true,
+       .inherit = false,
+};
+
+static bool executable_map_should_fail(const FIXTURE_VARIANT(mdwe) *variant)
+{
+       return variant->enabled && (!variant->forked || variant->inherit);
+}
+
 FIXTURE_SETUP(mdwe)
 {
+       unsigned long mdwe_flags;
        int ret, status;
 
        self->p = NULL;
@@ -84,13 +182,17 @@ FIXTURE_SETUP(mdwe)
        if (!variant->enabled)
                return;
 
-       ret = prctl(PR_SET_MDWE, PR_MDWE_REFUSE_EXEC_GAIN, 0L, 0L, 0L);
+       mdwe_flags = PR_MDWE_REFUSE_EXEC_GAIN;
+       if (!variant->inherit)
+               mdwe_flags |= PR_MDWE_NO_INHERIT;
+
+       ret = prctl(PR_SET_MDWE, mdwe_flags, 0L, 0L, 0L);
        ASSERT_EQ(ret, 0) {
                TH_LOG("PR_SET_MDWE failed or unsupported");
        }
 
        ret = prctl(PR_GET_MDWE, 0L, 0L, 0L, 0L);
-       ASSERT_EQ(ret, 1);
+       ASSERT_EQ(ret, mdwe_flags);
 
        if (variant->forked) {
                self->pid = fork();
@@ -121,7 +223,7 @@ TEST_F(mdwe, mmap_READ_EXEC)
 TEST_F(mdwe, mmap_WRITE_EXEC)
 {
        self->p = mmap(NULL, self->size, PROT_WRITE | PROT_EXEC, self->flags, 0, 0);
-       if (variant->enabled) {
+       if (executable_map_should_fail(variant)) {
                EXPECT_EQ(self->p, MAP_FAILED);
        } else {
                EXPECT_NE(self->p, MAP_FAILED);
@@ -147,7 +249,7 @@ TEST_F(mdwe, mprotect_add_EXEC)
        ASSERT_NE(self->p, MAP_FAILED);
 
        ret = mprotect(self->p, self->size, PROT_READ | PROT_EXEC);
-       if (variant->enabled) {
+       if (executable_map_should_fail(variant)) {
                EXPECT_LT(ret, 0);
        } else {
                EXPECT_EQ(ret, 0);
@@ -162,7 +264,7 @@ TEST_F(mdwe, mprotect_WRITE_EXEC)
        ASSERT_NE(self->p, MAP_FAILED);
 
        ret = mprotect(self->p, self->size, PROT_WRITE | PROT_EXEC);
-       if (variant->enabled) {
+       if (executable_map_should_fail(variant)) {
                EXPECT_LT(ret, 0);
        } else {
                EXPECT_EQ(ret, 0);