1 // SPDX-License-Identifier: GPL-2.0
3 #define __EXPORTED_HEADERS__
8 #include <linux/falloc.h>
10 #include <linux/memfd.h>
18 #include <sys/syscall.h>
25 #define MEMFD_STR "memfd:"
26 #define MEMFD_HUGE_STR "memfd-hugetlb:"
27 #define SHARED_FT_STR "(shared file-table)"
29 #define MFD_DEF_SIZE 8192
30 #define STACK_SIZE 65536
32 #define F_SEAL_EXEC 0x0020
34 #define F_WX_SEALS (F_SEAL_SHRINK | \
37 F_SEAL_FUTURE_WRITE | \
40 #define MFD_NOEXEC_SEAL 0x0008U
43 * Default is not to test hugetlbfs
45 static size_t mfd_def_size = MFD_DEF_SIZE;
46 static const char *memfd_str = MEMFD_STR;
48 static ssize_t fd2name(int fd, char *buf, size_t bufsize)
54 size = snprintf(buf1, PATH_MAX, "/proc/self/fd/%d", fd);
56 printf("snprintf(%d) failed on %m\n", fd);
61 * reserver one byte for string termination.
63 nbytes = readlink(buf1, buf, bufsize-1);
65 printf("readlink(%s) failed %m\n", buf1);
72 static int mfd_assert_new(const char *name, loff_t sz, unsigned int flags)
76 fd = sys_memfd_create(name, flags);
78 printf("memfd_create(\"%s\", %u) failed: %m\n",
83 r = ftruncate(fd, sz);
85 printf("ftruncate(%llu) failed: %m\n", (unsigned long long)sz);
92 static void sysctl_assert_write(const char *val)
94 int fd = open("/proc/sys/vm/memfd_noexec", O_WRONLY | O_CLOEXEC);
97 printf("open sysctl failed: %m\n");
101 if (write(fd, val, strlen(val)) < 0) {
102 printf("write sysctl %s failed: %m\n", val);
107 static void sysctl_fail_write(const char *val)
109 int fd = open("/proc/sys/vm/memfd_noexec", O_WRONLY | O_CLOEXEC);
112 printf("open sysctl failed: %m\n");
116 if (write(fd, val, strlen(val)) >= 0) {
117 printf("write sysctl %s succeeded, but failure expected\n",
123 static void sysctl_assert_equal(const char *val)
125 char *p, buf[128] = {};
126 int fd = open("/proc/sys/vm/memfd_noexec", O_RDONLY | O_CLOEXEC);
129 printf("open sysctl failed: %m\n");
133 if (read(fd, buf, sizeof(buf)) < 0) {
134 printf("read sysctl failed: %m\n");
138 /* Strip trailing whitespace. */
144 if (strcmp(buf, val) != 0) {
145 printf("unexpected sysctl value: expected %s, got %s\n", val, buf);
150 static int mfd_assert_reopen_fd(int fd_in)
155 sprintf(path, "/proc/self/fd/%d", fd_in);
157 fd = open(path, O_RDWR);
159 printf("re-open of existing fd %d failed\n", fd_in);
166 static void mfd_fail_new(const char *name, unsigned int flags)
170 r = sys_memfd_create(name, flags);
172 printf("memfd_create(\"%s\", %u) succeeded, but failure expected\n",
179 static unsigned int mfd_assert_get_seals(int fd)
183 r = fcntl(fd, F_GET_SEALS);
185 printf("GET_SEALS(%d) failed: %m\n", fd);
189 return (unsigned int)r;
192 static void mfd_assert_has_seals(int fd, unsigned int seals)
196 fd2name(fd, buf, PATH_MAX);
198 s = mfd_assert_get_seals(fd);
200 printf("%u != %u = GET_SEALS(%s)\n", seals, s, buf);
205 static void mfd_assert_add_seals(int fd, unsigned int seals)
210 s = mfd_assert_get_seals(fd);
211 r = fcntl(fd, F_ADD_SEALS, seals);
213 printf("ADD_SEALS(%d, %u -> %u) failed: %m\n", fd, s, seals);
218 static void mfd_fail_add_seals(int fd, unsigned int seals)
223 r = fcntl(fd, F_GET_SEALS);
229 r = fcntl(fd, F_ADD_SEALS, seals);
231 printf("ADD_SEALS(%d, %u -> %u) didn't fail as expected\n",
237 static void mfd_assert_size(int fd, size_t size)
244 printf("fstat(%d) failed: %m\n", fd);
246 } else if (st.st_size != size) {
247 printf("wrong file size %lld, but expected %lld\n",
248 (long long)st.st_size, (long long)size);
253 static int mfd_assert_dup(int fd)
259 printf("dup(%d) failed: %m\n", fd);
266 static void *mfd_assert_mmap_shared(int fd)
272 PROT_READ | PROT_WRITE,
276 if (p == MAP_FAILED) {
277 printf("mmap() failed: %m\n");
284 static void *mfd_assert_mmap_private(int fd)
294 if (p == MAP_FAILED) {
295 printf("mmap() failed: %m\n");
302 static int mfd_assert_open(int fd, int flags, mode_t mode)
307 sprintf(buf, "/proc/self/fd/%d", fd);
308 r = open(buf, flags, mode);
310 printf("open(%s) failed: %m\n", buf);
317 static void mfd_fail_open(int fd, int flags, mode_t mode)
322 sprintf(buf, "/proc/self/fd/%d", fd);
323 r = open(buf, flags, mode);
325 printf("open(%s) didn't fail as expected\n", buf);
330 static void mfd_assert_read(int fd)
336 l = read(fd, buf, sizeof(buf));
337 if (l != sizeof(buf)) {
338 printf("read() failed: %m\n");
342 /* verify PROT_READ *is* allowed */
349 if (p == MAP_FAILED) {
350 printf("mmap() failed: %m\n");
353 munmap(p, mfd_def_size);
355 /* verify MAP_PRIVATE is *always* allowed (even writable) */
358 PROT_READ | PROT_WRITE,
362 if (p == MAP_FAILED) {
363 printf("mmap() failed: %m\n");
366 munmap(p, mfd_def_size);
369 /* Test that PROT_READ + MAP_SHARED mappings work. */
370 static void mfd_assert_read_shared(int fd)
374 /* verify PROT_READ and MAP_SHARED *is* allowed */
381 if (p == MAP_FAILED) {
382 printf("mmap() failed: %m\n");
385 munmap(p, mfd_def_size);
388 static void mfd_assert_fork_private_write(int fd)
395 PROT_READ | PROT_WRITE,
399 if (p == MAP_FAILED) {
400 printf("mmap() failed: %m\n");
411 waitpid(pid, NULL, 0);
414 printf("MAP_PRIVATE copy-on-write failed: %m\n");
419 munmap(p, mfd_def_size);
422 static void mfd_assert_write(int fd)
429 * huegtlbfs does not support write, but we want to
430 * verify everything else here.
432 if (!hugetlbfs_test) {
433 /* verify write() succeeds */
434 l = write(fd, "\0\0\0\0", 4);
436 printf("write() failed: %m\n");
441 /* verify PROT_READ | PROT_WRITE is allowed */
444 PROT_READ | PROT_WRITE,
448 if (p == MAP_FAILED) {
449 printf("mmap() failed: %m\n");
453 munmap(p, mfd_def_size);
455 /* verify PROT_WRITE is allowed */
462 if (p == MAP_FAILED) {
463 printf("mmap() failed: %m\n");
467 munmap(p, mfd_def_size);
469 /* verify PROT_READ with MAP_SHARED is allowed and a following
470 * mprotect(PROT_WRITE) allows writing */
477 if (p == MAP_FAILED) {
478 printf("mmap() failed: %m\n");
482 r = mprotect(p, mfd_def_size, PROT_READ | PROT_WRITE);
484 printf("mprotect() failed: %m\n");
489 munmap(p, mfd_def_size);
491 /* verify PUNCH_HOLE works */
493 FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
497 printf("fallocate(PUNCH_HOLE) failed: %m\n");
502 static void mfd_fail_write(int fd)
508 /* verify write() fails */
509 l = write(fd, "data", 4);
511 printf("expected EPERM on write(), but got %d: %m\n", (int)l);
515 /* verify PROT_READ | PROT_WRITE is not allowed */
518 PROT_READ | PROT_WRITE,
522 if (p != MAP_FAILED) {
523 printf("mmap() didn't fail as expected\n");
527 /* verify PROT_WRITE is not allowed */
534 if (p != MAP_FAILED) {
535 printf("mmap() didn't fail as expected\n");
539 /* Verify PROT_READ with MAP_SHARED with a following mprotect is not
540 * allowed. Note that for r/w the kernel already prevents the mmap. */
547 if (p != MAP_FAILED) {
548 r = mprotect(p, mfd_def_size, PROT_READ | PROT_WRITE);
550 printf("mmap()+mprotect() didn't fail as expected\n");
553 munmap(p, mfd_def_size);
556 /* verify PUNCH_HOLE fails */
558 FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
562 printf("fallocate(PUNCH_HOLE) didn't fail as expected\n");
567 static void mfd_assert_shrink(int fd)
571 r = ftruncate(fd, mfd_def_size / 2);
573 printf("ftruncate(SHRINK) failed: %m\n");
577 mfd_assert_size(fd, mfd_def_size / 2);
579 fd2 = mfd_assert_open(fd,
580 O_RDWR | O_CREAT | O_TRUNC,
584 mfd_assert_size(fd, 0);
587 static void mfd_fail_shrink(int fd)
591 r = ftruncate(fd, mfd_def_size / 2);
593 printf("ftruncate(SHRINK) didn't fail as expected\n");
598 O_RDWR | O_CREAT | O_TRUNC,
602 static void mfd_assert_grow(int fd)
606 r = ftruncate(fd, mfd_def_size * 2);
608 printf("ftruncate(GROW) failed: %m\n");
612 mfd_assert_size(fd, mfd_def_size * 2);
619 printf("fallocate(ALLOC) failed: %m\n");
623 mfd_assert_size(fd, mfd_def_size * 4);
626 static void mfd_fail_grow(int fd)
630 r = ftruncate(fd, mfd_def_size * 2);
632 printf("ftruncate(GROW) didn't fail as expected\n");
641 printf("fallocate(ALLOC) didn't fail as expected\n");
646 static void mfd_assert_grow_write(int fd)
651 /* hugetlbfs does not support write */
655 buf = malloc(mfd_def_size * 8);
657 printf("malloc(%zu) failed: %m\n", mfd_def_size * 8);
661 l = pwrite(fd, buf, mfd_def_size * 8, 0);
662 if (l != (mfd_def_size * 8)) {
663 printf("pwrite() failed: %m\n");
667 mfd_assert_size(fd, mfd_def_size * 8);
670 static void mfd_fail_grow_write(int fd)
675 /* hugetlbfs does not support write */
679 buf = malloc(mfd_def_size * 8);
681 printf("malloc(%zu) failed: %m\n", mfd_def_size * 8);
685 l = pwrite(fd, buf, mfd_def_size * 8, 0);
686 if (l == (mfd_def_size * 8)) {
687 printf("pwrite() didn't fail as expected\n");
692 static void mfd_assert_mode(int fd, int mode)
697 fd2name(fd, buf, PATH_MAX);
699 if (fstat(fd, &st) < 0) {
700 printf("fstat(%s) failed: %m\n", buf);
704 if ((st.st_mode & 07777) != mode) {
705 printf("fstat(%s) wrong file mode 0%04o, but expected 0%04o\n",
706 buf, (int)st.st_mode & 07777, mode);
711 static void mfd_assert_chmod(int fd, int mode)
715 fd2name(fd, buf, PATH_MAX);
717 if (fchmod(fd, mode) < 0) {
718 printf("fchmod(%s, 0%04o) failed: %m\n", buf, mode);
722 mfd_assert_mode(fd, mode);
725 static void mfd_fail_chmod(int fd, int mode)
730 fd2name(fd, buf, PATH_MAX);
732 if (fstat(fd, &st) < 0) {
733 printf("fstat(%s) failed: %m\n", buf);
737 if (fchmod(fd, mode) == 0) {
738 printf("fchmod(%s, 0%04o) didn't fail as expected\n",
743 /* verify that file mode bits did not change */
744 mfd_assert_mode(fd, st.st_mode & 07777);
747 static int idle_thread_fn(void *arg)
752 /* dummy waiter; SIGTERM terminates us anyway */
754 sigaddset(&set, SIGTERM);
760 static pid_t spawn_thread(unsigned int flags, int (*fn)(void *), void *arg)
765 stack = malloc(STACK_SIZE);
767 printf("malloc(STACK_SIZE) failed: %m\n");
771 pid = clone(fn, stack + STACK_SIZE, SIGCHLD | flags, arg);
773 printf("clone() failed: %m\n");
780 static void join_thread(pid_t pid)
784 if (waitpid(pid, &wstatus, 0) < 0) {
785 printf("newpid thread: waitpid() failed: %m\n");
789 if (WIFEXITED(wstatus) && WEXITSTATUS(wstatus) != 0) {
790 printf("newpid thread: exited with non-zero error code %d\n",
791 WEXITSTATUS(wstatus));
795 if (WIFSIGNALED(wstatus)) {
796 printf("newpid thread: killed by signal %d\n",
802 static pid_t spawn_idle_thread(unsigned int flags)
804 return spawn_thread(flags, idle_thread_fn, NULL);
807 static void join_idle_thread(pid_t pid)
810 waitpid(pid, NULL, 0);
814 * Test memfd_create() syscall
815 * Verify syscall-argument validation, including name checks, flag validation
818 static void test_create(void)
823 printf("%s CREATE\n", memfd_str);
826 mfd_fail_new(NULL, 0);
828 /* test over-long name (not zero-terminated) */
829 memset(buf, 0xff, sizeof(buf));
830 mfd_fail_new(buf, 0);
832 /* test over-long zero-terminated name */
833 memset(buf, 0xff, sizeof(buf));
834 buf[sizeof(buf) - 1] = 0;
835 mfd_fail_new(buf, 0);
837 /* verify "" is a valid name */
838 fd = mfd_assert_new("", 0, 0);
841 /* verify invalid O_* open flags */
842 mfd_fail_new("", 0x0100);
843 mfd_fail_new("", ~MFD_CLOEXEC);
844 mfd_fail_new("", ~MFD_ALLOW_SEALING);
845 mfd_fail_new("", ~0);
846 mfd_fail_new("", 0x80000000U);
848 /* verify EXEC and NOEXEC_SEAL can't both be set */
849 mfd_fail_new("", MFD_EXEC | MFD_NOEXEC_SEAL);
851 /* verify MFD_CLOEXEC is allowed */
852 fd = mfd_assert_new("", 0, MFD_CLOEXEC);
855 /* verify MFD_ALLOW_SEALING is allowed */
856 fd = mfd_assert_new("", 0, MFD_ALLOW_SEALING);
859 /* verify MFD_ALLOW_SEALING | MFD_CLOEXEC is allowed */
860 fd = mfd_assert_new("", 0, MFD_ALLOW_SEALING | MFD_CLOEXEC);
866 * A very basic sealing test to see whether setting/retrieving seals works.
868 static void test_basic(void)
872 printf("%s BASIC\n", memfd_str);
874 fd = mfd_assert_new("kern_memfd_basic",
876 MFD_CLOEXEC | MFD_ALLOW_SEALING);
878 /* add basic seals */
879 mfd_assert_has_seals(fd, 0);
880 mfd_assert_add_seals(fd, F_SEAL_SHRINK |
882 mfd_assert_has_seals(fd, F_SEAL_SHRINK |
886 mfd_assert_add_seals(fd, F_SEAL_SHRINK |
888 mfd_assert_has_seals(fd, F_SEAL_SHRINK |
891 /* add more seals and seal against sealing */
892 mfd_assert_add_seals(fd, F_SEAL_GROW | F_SEAL_SEAL);
893 mfd_assert_has_seals(fd, F_SEAL_SHRINK |
898 /* verify that sealing no longer works */
899 mfd_fail_add_seals(fd, F_SEAL_GROW);
900 mfd_fail_add_seals(fd, 0);
904 /* verify sealing does not work without MFD_ALLOW_SEALING */
905 fd = mfd_assert_new("kern_memfd_basic",
908 mfd_assert_has_seals(fd, F_SEAL_SEAL);
909 mfd_fail_add_seals(fd, F_SEAL_SHRINK |
912 mfd_assert_has_seals(fd, F_SEAL_SEAL);
918 * Test whether SEAL_WRITE actually prevents modifications.
920 static void test_seal_write(void)
924 printf("%s SEAL-WRITE\n", memfd_str);
926 fd = mfd_assert_new("kern_memfd_seal_write",
928 MFD_CLOEXEC | MFD_ALLOW_SEALING);
929 mfd_assert_has_seals(fd, 0);
930 mfd_assert_add_seals(fd, F_SEAL_WRITE);
931 mfd_assert_has_seals(fd, F_SEAL_WRITE);
935 mfd_assert_shrink(fd);
937 mfd_fail_grow_write(fd);
943 * Test SEAL_FUTURE_WRITE
944 * Test whether SEAL_FUTURE_WRITE actually prevents modifications.
946 static void test_seal_future_write(void)
951 printf("%s SEAL-FUTURE-WRITE\n", memfd_str);
953 fd = mfd_assert_new("kern_memfd_seal_future_write",
955 MFD_CLOEXEC | MFD_ALLOW_SEALING);
957 p = mfd_assert_mmap_shared(fd);
959 mfd_assert_has_seals(fd, 0);
961 mfd_assert_add_seals(fd, F_SEAL_FUTURE_WRITE);
962 mfd_assert_has_seals(fd, F_SEAL_FUTURE_WRITE);
964 /* read should pass, writes should fail */
966 mfd_assert_read_shared(fd);
969 fd2 = mfd_assert_reopen_fd(fd);
970 /* read should pass, writes should still fail */
971 mfd_assert_read(fd2);
972 mfd_assert_read_shared(fd2);
975 mfd_assert_fork_private_write(fd);
977 munmap(p, mfd_def_size);
984 * Test whether SEAL_SHRINK actually prevents shrinking
986 static void test_seal_shrink(void)
990 printf("%s SEAL-SHRINK\n", memfd_str);
992 fd = mfd_assert_new("kern_memfd_seal_shrink",
994 MFD_CLOEXEC | MFD_ALLOW_SEALING);
995 mfd_assert_has_seals(fd, 0);
996 mfd_assert_add_seals(fd, F_SEAL_SHRINK);
997 mfd_assert_has_seals(fd, F_SEAL_SHRINK);
1000 mfd_assert_write(fd);
1001 mfd_fail_shrink(fd);
1002 mfd_assert_grow(fd);
1003 mfd_assert_grow_write(fd);
1010 * Test whether SEAL_GROW actually prevents growing
1012 static void test_seal_grow(void)
1016 printf("%s SEAL-GROW\n", memfd_str);
1018 fd = mfd_assert_new("kern_memfd_seal_grow",
1020 MFD_CLOEXEC | MFD_ALLOW_SEALING);
1021 mfd_assert_has_seals(fd, 0);
1022 mfd_assert_add_seals(fd, F_SEAL_GROW);
1023 mfd_assert_has_seals(fd, F_SEAL_GROW);
1025 mfd_assert_read(fd);
1026 mfd_assert_write(fd);
1027 mfd_assert_shrink(fd);
1029 mfd_fail_grow_write(fd);
1035 * Test SEAL_SHRINK | SEAL_GROW
1036 * Test whether SEAL_SHRINK | SEAL_GROW actually prevents resizing
1038 static void test_seal_resize(void)
1042 printf("%s SEAL-RESIZE\n", memfd_str);
1044 fd = mfd_assert_new("kern_memfd_seal_resize",
1046 MFD_CLOEXEC | MFD_ALLOW_SEALING);
1047 mfd_assert_has_seals(fd, 0);
1048 mfd_assert_add_seals(fd, F_SEAL_SHRINK | F_SEAL_GROW);
1049 mfd_assert_has_seals(fd, F_SEAL_SHRINK | F_SEAL_GROW);
1051 mfd_assert_read(fd);
1052 mfd_assert_write(fd);
1053 mfd_fail_shrink(fd);
1055 mfd_fail_grow_write(fd);
1062 * Test fd is created with exec and allow sealing.
1063 * chmod() cannot change x bits after sealing.
1065 static void test_exec_seal(void)
1069 printf("%s SEAL-EXEC\n", memfd_str);
1071 printf("%s Apply SEAL_EXEC\n", memfd_str);
1072 fd = mfd_assert_new("kern_memfd_seal_exec",
1074 MFD_CLOEXEC | MFD_ALLOW_SEALING | MFD_EXEC);
1076 mfd_assert_mode(fd, 0777);
1077 mfd_assert_chmod(fd, 0644);
1079 mfd_assert_has_seals(fd, 0);
1080 mfd_assert_add_seals(fd, F_SEAL_EXEC);
1081 mfd_assert_has_seals(fd, F_SEAL_EXEC);
1083 mfd_assert_chmod(fd, 0600);
1084 mfd_fail_chmod(fd, 0777);
1085 mfd_fail_chmod(fd, 0670);
1086 mfd_fail_chmod(fd, 0605);
1087 mfd_fail_chmod(fd, 0700);
1088 mfd_fail_chmod(fd, 0100);
1089 mfd_assert_chmod(fd, 0666);
1090 mfd_assert_write(fd);
1093 printf("%s Apply ALL_SEALS\n", memfd_str);
1094 fd = mfd_assert_new("kern_memfd_seal_exec",
1096 MFD_CLOEXEC | MFD_ALLOW_SEALING | MFD_EXEC);
1098 mfd_assert_mode(fd, 0777);
1099 mfd_assert_chmod(fd, 0700);
1101 mfd_assert_has_seals(fd, 0);
1102 mfd_assert_add_seals(fd, F_SEAL_EXEC);
1103 mfd_assert_has_seals(fd, F_WX_SEALS);
1105 mfd_fail_chmod(fd, 0711);
1106 mfd_fail_chmod(fd, 0600);
1113 * Test fd is created with exec and not allow sealing.
1115 static void test_exec_no_seal(void)
1119 printf("%s EXEC_NO_SEAL\n", memfd_str);
1121 /* Create with EXEC but without ALLOW_SEALING */
1122 fd = mfd_assert_new("kern_memfd_exec_no_sealing",
1124 MFD_CLOEXEC | MFD_EXEC);
1125 mfd_assert_mode(fd, 0777);
1126 mfd_assert_has_seals(fd, F_SEAL_SEAL);
1127 mfd_assert_chmod(fd, 0666);
1132 * Test memfd_create with MFD_NOEXEC flag
1134 static void test_noexec_seal(void)
1138 printf("%s NOEXEC_SEAL\n", memfd_str);
1140 /* Create with NOEXEC and ALLOW_SEALING */
1141 fd = mfd_assert_new("kern_memfd_noexec",
1143 MFD_CLOEXEC | MFD_ALLOW_SEALING | MFD_NOEXEC_SEAL);
1144 mfd_assert_mode(fd, 0666);
1145 mfd_assert_has_seals(fd, F_SEAL_EXEC);
1146 mfd_fail_chmod(fd, 0777);
1149 /* Create with NOEXEC but without ALLOW_SEALING */
1150 fd = mfd_assert_new("kern_memfd_noexec",
1152 MFD_CLOEXEC | MFD_NOEXEC_SEAL);
1153 mfd_assert_mode(fd, 0666);
1154 mfd_assert_has_seals(fd, F_SEAL_EXEC);
1155 mfd_fail_chmod(fd, 0777);
1159 static void test_sysctl_sysctl0(void)
1163 sysctl_assert_equal("0");
1165 fd = mfd_assert_new("kern_memfd_sysctl_0_dfl",
1167 MFD_CLOEXEC | MFD_ALLOW_SEALING);
1168 mfd_assert_mode(fd, 0777);
1169 mfd_assert_has_seals(fd, 0);
1170 mfd_assert_chmod(fd, 0644);
1174 static void test_sysctl_set_sysctl0(void)
1176 sysctl_assert_write("0");
1177 test_sysctl_sysctl0();
1180 static void test_sysctl_sysctl1(void)
1184 sysctl_assert_equal("1");
1186 fd = mfd_assert_new("kern_memfd_sysctl_1_dfl",
1188 MFD_CLOEXEC | MFD_ALLOW_SEALING);
1189 mfd_assert_mode(fd, 0666);
1190 mfd_assert_has_seals(fd, F_SEAL_EXEC);
1191 mfd_fail_chmod(fd, 0777);
1194 fd = mfd_assert_new("kern_memfd_sysctl_1_exec",
1196 MFD_CLOEXEC | MFD_EXEC | MFD_ALLOW_SEALING);
1197 mfd_assert_mode(fd, 0777);
1198 mfd_assert_has_seals(fd, 0);
1199 mfd_assert_chmod(fd, 0644);
1202 fd = mfd_assert_new("kern_memfd_sysctl_1_noexec",
1204 MFD_CLOEXEC | MFD_NOEXEC_SEAL | MFD_ALLOW_SEALING);
1205 mfd_assert_mode(fd, 0666);
1206 mfd_assert_has_seals(fd, F_SEAL_EXEC);
1207 mfd_fail_chmod(fd, 0777);
1211 static void test_sysctl_set_sysctl1(void)
1213 sysctl_assert_write("1");
1214 test_sysctl_sysctl1();
1217 static void test_sysctl_sysctl2(void)
1221 sysctl_assert_equal("2");
1223 fd = mfd_assert_new("kern_memfd_sysctl_2_dfl",
1225 MFD_CLOEXEC | MFD_ALLOW_SEALING);
1226 mfd_assert_mode(fd, 0666);
1227 mfd_assert_has_seals(fd, F_SEAL_EXEC);
1228 mfd_fail_chmod(fd, 0777);
1231 mfd_fail_new("kern_memfd_sysctl_2_exec",
1232 MFD_CLOEXEC | MFD_EXEC | MFD_ALLOW_SEALING);
1234 fd = mfd_assert_new("kern_memfd_sysctl_2_noexec",
1236 MFD_CLOEXEC | MFD_NOEXEC_SEAL | MFD_ALLOW_SEALING);
1237 mfd_assert_mode(fd, 0666);
1238 mfd_assert_has_seals(fd, F_SEAL_EXEC);
1239 mfd_fail_chmod(fd, 0777);
1243 static void test_sysctl_set_sysctl2(void)
1245 sysctl_assert_write("2");
1246 test_sysctl_sysctl2();
1249 static int sysctl_simple_child(void *arg)
1251 printf("%s sysctl 0\n", memfd_str);
1252 test_sysctl_set_sysctl0();
1254 printf("%s sysctl 1\n", memfd_str);
1255 test_sysctl_set_sysctl1();
1257 printf("%s sysctl 0\n", memfd_str);
1258 test_sysctl_set_sysctl0();
1260 printf("%s sysctl 2\n", memfd_str);
1261 test_sysctl_set_sysctl2();
1263 printf("%s sysctl 1\n", memfd_str);
1264 test_sysctl_set_sysctl1();
1266 printf("%s sysctl 0\n", memfd_str);
1267 test_sysctl_set_sysctl0();
1274 * A very basic test to make sure the core sysctl semantics work.
1276 static void test_sysctl_simple(void)
1278 int pid = spawn_thread(CLONE_NEWPID, sysctl_simple_child, NULL);
1283 static int sysctl_nested(void *arg)
1285 void (*fn)(void) = arg;
1291 static int sysctl_nested_wait(void *arg)
1293 /* Wait for a SIGCONT. */
1294 kill(getpid(), SIGSTOP);
1295 return sysctl_nested(arg);
1298 static void test_sysctl_sysctl1_failset(void)
1300 sysctl_fail_write("0");
1301 test_sysctl_sysctl1();
1304 static void test_sysctl_sysctl2_failset(void)
1306 sysctl_fail_write("1");
1307 test_sysctl_sysctl2();
1309 sysctl_fail_write("0");
1310 test_sysctl_sysctl2();
1313 static int sysctl_nested_child(void *arg)
1317 printf("%s nested sysctl 0\n", memfd_str);
1318 sysctl_assert_write("0");
1319 /* A further nested pidns works the same. */
1320 pid = spawn_thread(CLONE_NEWPID, sysctl_simple_child, NULL);
1323 printf("%s nested sysctl 1\n", memfd_str);
1324 sysctl_assert_write("1");
1325 /* Child inherits our setting. */
1326 pid = spawn_thread(CLONE_NEWPID, sysctl_nested, test_sysctl_sysctl1);
1328 /* Child cannot raise the setting. */
1329 pid = spawn_thread(CLONE_NEWPID, sysctl_nested,
1330 test_sysctl_sysctl1_failset);
1332 /* Child can lower the setting. */
1333 pid = spawn_thread(CLONE_NEWPID, sysctl_nested,
1334 test_sysctl_set_sysctl2);
1336 /* Child lowering the setting has no effect on our setting. */
1337 test_sysctl_sysctl1();
1339 printf("%s nested sysctl 2\n", memfd_str);
1340 sysctl_assert_write("2");
1341 /* Child inherits our setting. */
1342 pid = spawn_thread(CLONE_NEWPID, sysctl_nested, test_sysctl_sysctl2);
1344 /* Child cannot raise the setting. */
1345 pid = spawn_thread(CLONE_NEWPID, sysctl_nested,
1346 test_sysctl_sysctl2_failset);
1349 /* Verify that the rules are actually inherited after fork. */
1350 printf("%s nested sysctl 0 -> 1 after fork\n", memfd_str);
1351 sysctl_assert_write("0");
1353 pid = spawn_thread(CLONE_NEWPID, sysctl_nested_wait,
1354 test_sysctl_sysctl1_failset);
1355 sysctl_assert_write("1");
1359 printf("%s nested sysctl 0 -> 2 after fork\n", memfd_str);
1360 sysctl_assert_write("0");
1362 pid = spawn_thread(CLONE_NEWPID, sysctl_nested_wait,
1363 test_sysctl_sysctl2_failset);
1364 sysctl_assert_write("2");
1369 * Verify that the current effective setting is saved on fork, meaning
1370 * that the parent lowering the sysctl doesn't affect already-forked
1373 printf("%s nested sysctl 2 -> 1 after fork\n", memfd_str);
1374 sysctl_assert_write("2");
1375 pid = spawn_thread(CLONE_NEWPID, sysctl_nested_wait,
1376 test_sysctl_sysctl2);
1377 sysctl_assert_write("1");
1381 printf("%s nested sysctl 2 -> 0 after fork\n", memfd_str);
1382 sysctl_assert_write("2");
1383 pid = spawn_thread(CLONE_NEWPID, sysctl_nested_wait,
1384 test_sysctl_sysctl2);
1385 sysctl_assert_write("0");
1389 printf("%s nested sysctl 1 -> 0 after fork\n", memfd_str);
1390 sysctl_assert_write("1");
1391 pid = spawn_thread(CLONE_NEWPID, sysctl_nested_wait,
1392 test_sysctl_sysctl1);
1393 sysctl_assert_write("0");
1401 * Test sysctl with nested pid namespaces
1402 * Make sure that the sysctl nesting semantics work correctly.
1404 static void test_sysctl_nested(void)
1406 int pid = spawn_thread(CLONE_NEWPID, sysctl_nested_child, NULL);
1412 * Test sharing via dup()
1413 * Test that seals are shared between dupped FDs and they're all equal.
1415 static void test_share_dup(char *banner, char *b_suffix)
1419 printf("%s %s %s\n", memfd_str, banner, b_suffix);
1421 fd = mfd_assert_new("kern_memfd_share_dup",
1423 MFD_CLOEXEC | MFD_ALLOW_SEALING);
1424 mfd_assert_has_seals(fd, 0);
1426 fd2 = mfd_assert_dup(fd);
1427 mfd_assert_has_seals(fd2, 0);
1429 mfd_assert_add_seals(fd, F_SEAL_WRITE);
1430 mfd_assert_has_seals(fd, F_SEAL_WRITE);
1431 mfd_assert_has_seals(fd2, F_SEAL_WRITE);
1433 mfd_assert_add_seals(fd2, F_SEAL_SHRINK);
1434 mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
1435 mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK);
1437 mfd_assert_add_seals(fd, F_SEAL_SEAL);
1438 mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_SEAL);
1439 mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_SEAL);
1441 mfd_fail_add_seals(fd, F_SEAL_GROW);
1442 mfd_fail_add_seals(fd2, F_SEAL_GROW);
1443 mfd_fail_add_seals(fd, F_SEAL_SEAL);
1444 mfd_fail_add_seals(fd2, F_SEAL_SEAL);
1448 mfd_fail_add_seals(fd, F_SEAL_GROW);
1453 * Test sealing with active mmap()s
1454 * Modifying seals is only allowed if no other mmap() refs exist.
1456 static void test_share_mmap(char *banner, char *b_suffix)
1461 printf("%s %s %s\n", memfd_str, banner, b_suffix);
1463 fd = mfd_assert_new("kern_memfd_share_mmap",
1465 MFD_CLOEXEC | MFD_ALLOW_SEALING);
1466 mfd_assert_has_seals(fd, 0);
1468 /* shared/writable ref prevents sealing WRITE, but allows others */
1469 p = mfd_assert_mmap_shared(fd);
1470 mfd_fail_add_seals(fd, F_SEAL_WRITE);
1471 mfd_assert_has_seals(fd, 0);
1472 mfd_assert_add_seals(fd, F_SEAL_SHRINK);
1473 mfd_assert_has_seals(fd, F_SEAL_SHRINK);
1474 munmap(p, mfd_def_size);
1476 /* readable ref allows sealing */
1477 p = mfd_assert_mmap_private(fd);
1478 mfd_assert_add_seals(fd, F_SEAL_WRITE);
1479 mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
1480 munmap(p, mfd_def_size);
1486 * Test sealing with open(/proc/self/fd/%d)
1487 * Via /proc we can get access to a separate file-context for the same memfd.
1488 * This is *not* like dup(), but like a real separate open(). Make sure the
1489 * semantics are as expected and we correctly check for RDONLY / WRONLY / RDWR.
1491 static void test_share_open(char *banner, char *b_suffix)
1495 printf("%s %s %s\n", memfd_str, banner, b_suffix);
1497 fd = mfd_assert_new("kern_memfd_share_open",
1499 MFD_CLOEXEC | MFD_ALLOW_SEALING);
1500 mfd_assert_has_seals(fd, 0);
1502 fd2 = mfd_assert_open(fd, O_RDWR, 0);
1503 mfd_assert_add_seals(fd, F_SEAL_WRITE);
1504 mfd_assert_has_seals(fd, F_SEAL_WRITE);
1505 mfd_assert_has_seals(fd2, F_SEAL_WRITE);
1507 mfd_assert_add_seals(fd2, F_SEAL_SHRINK);
1508 mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
1509 mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK);
1512 fd = mfd_assert_open(fd2, O_RDONLY, 0);
1514 mfd_fail_add_seals(fd, F_SEAL_SEAL);
1515 mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK);
1516 mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK);
1519 fd2 = mfd_assert_open(fd, O_RDWR, 0);
1521 mfd_assert_add_seals(fd2, F_SEAL_SEAL);
1522 mfd_assert_has_seals(fd, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_SEAL);
1523 mfd_assert_has_seals(fd2, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_SEAL);
1530 * Test sharing via fork()
1531 * Test whether seal-modifications work as expected with forked childs.
1533 static void test_share_fork(char *banner, char *b_suffix)
1538 printf("%s %s %s\n", memfd_str, banner, b_suffix);
1540 fd = mfd_assert_new("kern_memfd_share_fork",
1542 MFD_CLOEXEC | MFD_ALLOW_SEALING);
1543 mfd_assert_has_seals(fd, 0);
1545 pid = spawn_idle_thread(0);
1546 mfd_assert_add_seals(fd, F_SEAL_SEAL);
1547 mfd_assert_has_seals(fd, F_SEAL_SEAL);
1549 mfd_fail_add_seals(fd, F_SEAL_WRITE);
1550 mfd_assert_has_seals(fd, F_SEAL_SEAL);
1552 join_idle_thread(pid);
1554 mfd_fail_add_seals(fd, F_SEAL_WRITE);
1555 mfd_assert_has_seals(fd, F_SEAL_SEAL);
1560 int main(int argc, char **argv)
1565 if (!strcmp(argv[1], "hugetlbfs")) {
1566 unsigned long hpage_size = default_huge_page_size();
1569 printf("Unable to determine huge page size\n");
1574 memfd_str = MEMFD_HUGE_STR;
1575 mfd_def_size = hpage_size * 2;
1577 printf("Unknown option: %s\n", argv[1]);
1585 test_exec_no_seal();
1589 test_seal_future_write();
1594 test_sysctl_simple();
1595 test_sysctl_nested();
1597 test_share_dup("SHARE-DUP", "");
1598 test_share_mmap("SHARE-MMAP", "");
1599 test_share_open("SHARE-OPEN", "");
1600 test_share_fork("SHARE-FORK", "");
1602 /* Run test-suite in a multi-threaded environment with a shared
1604 pid = spawn_idle_thread(CLONE_FILES | CLONE_FS | CLONE_VM);
1605 test_share_dup("SHARE-DUP", SHARED_FT_STR);
1606 test_share_mmap("SHARE-MMAP", SHARED_FT_STR);
1607 test_share_open("SHARE-OPEN", SHARED_FT_STR);
1608 test_share_fork("SHARE-FORK", SHARED_FT_STR);
1609 join_idle_thread(pid);
1611 printf("memfd: DONE\n");