selftest: test system mappings are sealed

Add sysmap_is_sealed.c to test system mappings are sealed.

Note: CONFIG_MSEAL_SYSTEM_MAPPINGS must be set, as indicated in
config file.

Link: https://lkml.kernel.org/r/20250305021711.3867874-8-jeffxu@google.com
Signed-off-by: Jeff Xu <jeffxu@chromium.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Cc: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Cc: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrei Vagin <avagin@gmail.com>
Cc: Anna-Maria Behnsen <anna-maria@linutronix.de>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Benjamin Berg <benjamin@sipsolutions.net>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Rientjes <rientjes@google.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Elliot Hughes <enh@google.com>
Cc: Florian Faineli <f.fainelli@gmail.com>
Cc: Greg Ungerer <gerg@kernel.org>
Cc: Guenter Roeck <groeck@chromium.org>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Helge Deller <deller@gmx.de>
Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Jason A. Donenfeld <jason@zx2c4.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Jorge Lucangeli Obes <jorgelo@chromium.org>
Cc: Liam R. Howlett <Liam.Howlett@oracle.com>
Cc: Linus Waleij <linus.walleij@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Matthew Wilcow (Oracle) <willy@infradead.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Miguel Ojeda <ojeda@kernel.org>
Cc: Mike Rapoport <mike.rapoport@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Stephen Röttger <sroettger@google.com>
Cc: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 2694344274bf2bd79f9bb4ef6371e14096dd1ef4..c77c8c8e3d9bdd8047c9cb7722c3830447e504e5 100644 (file)
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -62,6 +62,7 @@ TARGETS += mount
 TARGETS += mount_setattr
 TARGETS += move_mount_set_group
 TARGETS += mqueue
+TARGETS += mseal_system_mappings
 TARGETS += nci
 TARGETS += net
 TARGETS += net/af_unix

diff --git a/tools/testing/selftests/mseal_system_mappings/.gitignore b/tools/testing/selftests/mseal_system_mappings/.gitignore
new file mode 100644 (file)
index 0000000..319c497
--- /dev/null
+++ b/tools/testing/selftests/mseal_system_mappings/.gitignore
@@ -0,0 +1,2 @@
+# SPDX-License-Identifier: GPL-2.0-only
+sysmap_is_sealed

diff --git a/tools/testing/selftests/mseal_system_mappings/Makefile b/tools/testing/selftests/mseal_system_mappings/Makefile
new file mode 100644 (file)
index 0000000..2b4504e
--- /dev/null
+++ b/tools/testing/selftests/mseal_system_mappings/Makefile
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0-only
+CFLAGS += -std=c99 -pthread -Wall $(KHDR_INCLUDES)
+
+TEST_GEN_PROGS := sysmap_is_sealed
+
+include ../lib.mk

diff --git a/tools/testing/selftests/mseal_system_mappings/config b/tools/testing/selftests/mseal_system_mappings/config
new file mode 100644 (file)
index 0000000..675cb9f
--- /dev/null
+++ b/tools/testing/selftests/mseal_system_mappings/config
@@ -0,0 +1 @@
+CONFIG_MSEAL_SYSTEM_MAPPINGS=y

diff --git a/tools/testing/selftests/mseal_system_mappings/sysmap_is_sealed.c b/tools/testing/selftests/mseal_system_mappings/sysmap_is_sealed.c
new file mode 100644 (file)
index 0000000..0d2af30
--- /dev/null
+++ b/tools/testing/selftests/mseal_system_mappings/sysmap_is_sealed.c
@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * test system mappings are sealed when
+ * KCONFIG_MSEAL_SYSTEM_MAPPINGS=y
+ */
+
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdbool.h>
+
+#include "../kselftest.h"
+#include "../kselftest_harness.h"
+
+#define VMFLAGS "VmFlags:"
+#define MSEAL_FLAGS "sl"
+#define MAX_LINE_LEN 512
+
+bool has_mapping(char *name, FILE *maps)
+{
+       char line[MAX_LINE_LEN];
+
+       while (fgets(line, sizeof(line), maps)) {
+               if (strstr(line, name))
+                       return true;
+       }
+
+       return false;
+}
+
+bool mapping_is_sealed(char *name, FILE *maps)
+{
+       char line[MAX_LINE_LEN];
+
+       while (fgets(line, sizeof(line), maps)) {
+               if (!strncmp(line, VMFLAGS, strlen(VMFLAGS))) {
+                       if (strstr(line, MSEAL_FLAGS))
+                               return true;
+
+                       return false;
+               }
+       }
+
+       return false;
+}
+
+FIXTURE(basic) {
+       FILE *maps;
+};
+
+FIXTURE_SETUP(basic)
+{
+       self->maps = fopen("/proc/self/smaps", "r");
+       if (!self->maps)
+               SKIP(return, "Could not open /proc/self/smap, errno=%d",
+                       errno);
+};
+
+FIXTURE_TEARDOWN(basic)
+{
+       if (self->maps)
+               fclose(self->maps);
+};
+
+FIXTURE_VARIANT(basic)
+{
+       char *name;
+       bool sealed;
+};
+
+FIXTURE_VARIANT_ADD(basic, vdso) {
+       .name = "[vdso]",
+       .sealed = true,
+};
+
+FIXTURE_VARIANT_ADD(basic, vvar) {
+       .name = "[vvar]",
+       .sealed = true,
+};
+
+FIXTURE_VARIANT_ADD(basic, vvar_vclock) {
+       .name = "[vvar_vclock]",
+       .sealed = true,
+};
+
+FIXTURE_VARIANT_ADD(basic, sigpage) {
+       .name = "[sigpage]",
+       .sealed = true,
+};
+
+FIXTURE_VARIANT_ADD(basic, vectors) {
+       .name = "[vectors]",
+       .sealed = true,
+};
+
+FIXTURE_VARIANT_ADD(basic, uprobes) {
+       .name = "[uprobes]",
+       .sealed = true,
+};
+
+FIXTURE_VARIANT_ADD(basic, stack) {
+       .name = "[stack]",
+       .sealed = false,
+};
+
+TEST_F(basic, check_sealed)
+{
+       if (!has_mapping(variant->name, self->maps)) {
+               SKIP(return, "could not find the mapping, %s",
+                       variant->name);
+       }
+
+       EXPECT_EQ(variant->sealed,
+               mapping_is_sealed(variant->name, self->maps));
+};
+
+TEST_HARNESS_MAIN