selftests: Handle old glibc without execveat(2)

Add an execveat(2) wrapper because glibc < 2.34 does not have one.  This
fixes the check-exec tests and samples.

Cc: Günther Noack <gnoack@google.com>
Cc: Jeff Xu <jeffxu@chromium.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Mimi Zohar <zohar@linux.ibm.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Roberto Sassu <roberto.sassu@huawei.com>
Cc: Serge Hallyn <serge@hallyn.com>
Cc: Stefan Berger <stefanb@linux.ibm.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Reported-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://lore.kernel.org/r/20250114205645.GA2825031@ax162
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20250115144753.311152-1-mic@digikod.net
Signed-off-by: Kees Cook <kees@kernel.org>

diff --git a/samples/check-exec/inc.c b/samples/check-exec/inc.c
index 94b87569d2a2e0ce1c2e95b5d0bfdad9fa8574ed..7f6ef06a2f0672bd11a5ceb85877d5128251a403 100644 (file)
--- a/samples/check-exec/inc.c
+++ b/samples/check-exec/inc.c
@@ -21,8 +21,15 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/prctl.h>
+#include <sys/syscall.h>
 #include <unistd.h>
 
+static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
+                       char *const envp[], int flags)
+{
+       return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
+}
+
 /* Returns 1 on error, 0 otherwise. */
 static int interpret_buffer(char *buffer, size_t buffer_size)
 {
@@ -78,8 +85,8 @@ static int interpret_stream(FILE *script, char *const script_name,
         * script execution.  We must use the script file descriptor instead of
         * the script path name to avoid race conditions.
         */
-       err = execveat(fileno(script), "", script_argv, envp,
-                      AT_EMPTY_PATH | AT_EXECVE_CHECK);
+       err = sys_execveat(fileno(script), "", script_argv, envp,
+                          AT_EMPTY_PATH | AT_EXECVE_CHECK);
        if (err && restrict_stream) {
                perror("ERROR: Script execution check");
                return 1;

diff --git a/tools/testing/selftests/exec/check-exec.c b/tools/testing/selftests/exec/check-exec.c
index 4d3f4525e1e1c835c227d16c1b3f079ef9df1d90..55bce47e56b73d321635185ba5cb927215074d91 100644 (file)
--- a/tools/testing/selftests/exec/check-exec.c
+++ b/tools/testing/selftests/exec/check-exec.c
@@ -22,6 +22,7 @@
 #include <sys/prctl.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
+#include <sys/syscall.h>
 #include <sys/sysmacros.h>
 #include <unistd.h>
 
@@ -31,6 +32,12 @@
 
 #include "../kselftest_harness.h"
 
+static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
+                       char *const envp[], int flags)
+{
+       return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
+}
+
 static void drop_privileges(struct __test_metadata *const _metadata)
 {
        const unsigned int noroot = SECBIT_NOROOT | SECBIT_NOROOT_LOCKED;
@@ -219,8 +226,8 @@ static void test_exec_fd(struct __test_metadata *_metadata, const int fd,
         * test framework as an error.  With AT_EXECVE_CHECK, we only check a
         * potential successful execution.
         */
-       access_ret =
-               execveat(fd, "", argv, NULL, AT_EMPTY_PATH | AT_EXECVE_CHECK);
+       access_ret = sys_execveat(fd, "", argv, NULL,
+                                 AT_EMPTY_PATH | AT_EXECVE_CHECK);
        access_errno = errno;
        if (err_code) {
                EXPECT_EQ(-1, access_ret);

diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
index cd66901be612b5a44bec44e194faecb2ac4f9983..ac9701c018e0daa7164e93f8502c869e9f0be7fd 100644 (file)
--- a/tools/testing/selftests/landlock/fs_test.c
+++ b/tools/testing/selftests/landlock/fs_test.c
@@ -59,6 +59,12 @@ int open_tree(int dfd, const char *filename, unsigned int flags)
 }
 #endif
 
+static int sys_execveat(int dirfd, const char *pathname, char *const argv[],
+                       char *const envp[], int flags)
+{
+       return syscall(__NR_execveat, dirfd, pathname, argv, envp, flags);
+}
+
 #ifndef RENAME_EXCHANGE
 #define RENAME_EXCHANGE (1 << 1)
 #endif
@@ -2018,8 +2024,8 @@ static void test_check_exec(struct __test_metadata *const _metadata,
        int ret;
        char *const argv[] = { (char *)path, NULL };
 
-       ret = execveat(AT_FDCWD, path, argv, NULL,
-                      AT_EMPTY_PATH | AT_EXECVE_CHECK);
+       ret = sys_execveat(AT_FDCWD, path, argv, NULL,
+                          AT_EMPTY_PATH | AT_EXECVE_CHECK);
        if (err) {
                EXPECT_EQ(-1, ret);
                EXPECT_EQ(errno, err);