• Aleksa Sarai's avatar
    selftests: add openat2(2) selftests · b28a10ae
    Aleksa Sarai authored
    Test all of the various openat2(2) flags. A small stress-test of a
    symlink-rename attack is included to show that the protections against
    ".."-based attacks are sufficient.
    
    The main things these self-tests are enforcing are:
    
      * The struct+usize ABI for openat2(2) and copy_struct_from_user() to
        ensure that upgrades will be handled gracefully (in addition,
        ensuring that misaligned structures are also handled correctly).
    
      * The -EINVAL checks for openat2(2) are all correctly handled to avoid
        userspace passing unknown or conflicting flag sets (most
        importantly, ensuring that invalid flag combinations are checked).
    
      * All of the RESOLVE_* semantics (including errno values) are
        correctly handled with various combinations of paths and flags.
    
      * RESOLVE_IN_ROOT correctly protects against the symlink rename(2)
        attack that has been responsible for several CVEs (and likely will
        be responsible for several more).
    
    Cc: Shuah Khan <shuah@kernel.org>
    Signed-off-by: default avatarAleksa Sarai <cyphar@cyphar.com>
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    b28a10ae
resolve_test.c 20.8 KB