KEYCTL_GET_PERSISTENT creates and registers a persistent keyring before linking it into the caller's destination keyring. If the destination is restricted, the link returns -EPERM. Verify that the keyring's configured expiry is still applied after the failed link.
Register the test in kselftest and document direct and QEMU/GDB execution. The failure case is intended for a disposable VM: an unexpired persistent keyring may remain registered until its user namespace is torn down. Tested: make -C tools/testing/selftests/keys QEMU guest with fixed kernel: TAP pass 1/1 Signed-off-by: Sahaj Chaudhari <[email protected]> --- tools/testing/selftests/Makefile | 1 + tools/testing/selftests/keys/.gitignore | 2 + tools/testing/selftests/keys/Makefile | 6 + tools/testing/selftests/keys/README | 50 +++ .../testing/selftests/keys/initramfs-init.sh | 10 + .../keys/persistent_keyring_expiry.c | 367 ++++++++++++++++++ tools/testing/selftests/keys/run_qemu.sh | 64 +++ 7 files changed, 500 insertions(+) create mode 100644 tools/testing/selftests/keys/.gitignore create mode 100644 tools/testing/selftests/keys/Makefile create mode 100644 tools/testing/selftests/keys/README create mode 100755 tools/testing/selftests/keys/initramfs-init.sh create mode 100644 tools/testing/selftests/keys/persistent_keyring_expiry.c create mode 100755 tools/testing/selftests/keys/run_qemu.sh diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile index 273853937c25..d74ad9370bd1 100644 --- a/tools/testing/selftests/Makefile +++ b/tools/testing/selftests/Makefile @@ -62,6 +62,7 @@ TARGETS += ipc TARGETS += ir TARGETS += kcmp TARGETS += kexec +TARGETS += keys TARGETS += kselftest_harness TARGETS += kvm TARGETS += landlock diff --git a/tools/testing/selftests/keys/.gitignore b/tools/testing/selftests/keys/.gitignore new file mode 100644 index 000000000000..48c2900d780e --- /dev/null +++ b/tools/testing/selftests/keys/.gitignore @@ -0,0 +1,2 @@ +# SPDX-License-Identifier: GPL-2.0-only +persistent_keyring_expiry diff --git a/tools/testing/selftests/keys/Makefile b/tools/testing/selftests/keys/Makefile new file mode 100644 index 000000000000..33984d1eceb3 --- /dev/null +++ b/tools/testing/selftests/keys/Makefile @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: GPL-2.0 +CFLAGS += -g -Wall $(KHDR_INCLUDES) + +TEST_GEN_PROGS := persistent_keyring_expiry + +include ../lib.mk diff --git a/tools/testing/selftests/keys/README b/tools/testing/selftests/keys/README new file mode 100644 index 000000000000..dd92abc1ddfe --- /dev/null +++ b/tools/testing/selftests/keys/README @@ -0,0 +1,50 @@ +The persistent_keyring_expiry selftest verifies that a failed link from +KEYCTL_GET_PERSISTENT still gives a newly created persistent keyring its +configured expiry. It requires CONFIG_KEYS, CONFIG_PERSISTENT_KEYRINGS, +CONFIG_PROC_FS, procfs, and root privileges. The test temporarily changes +/proc/sys/kernel/keys/persistent_keyring_expiry and restores its original value. + +Build and run it against a kernel containing the fix with: + + make -C tools/testing/selftests/keys + sudo tools/testing/selftests/keys/persistent_keyring_expiry + +The QEMU/GDB instructions assume a configured Linux source tree with an +existing `.config` and the standard kernel build toolchain. The QEMU runner +requires `cpio`, `qemu-system-x86_64`, `busybox`, and `ldd`; GDB is required +for the interactive debugging steps. + +For a QEMU/GDB run, build an x86 kernel with debug symbols and +CONFIG_PERSISTENT_KEYRINGS=y. Starting from an existing `.config`, enable +the required options and build `bzImage` and `vmlinux`: + + scripts/config --enable KEYS --enable PERSISTENT_KEYRINGS \ + --enable PROC_FS --enable DEVTMPFS --enable DEVTMPFS_MOUNT \ + --disable DEBUG_INFO_NONE --enable DEBUG_INFO \ + --enable DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT \ + --enable GDB_SCRIPTS --enable FRAME_POINTER + make olddefconfig + make -j2 bzImage + +Then run: + + tools/testing/selftests/keys/run_qemu.sh path/to/bzImage path/to/vmlinux + +In another terminal, attach GDB and continue the paused guest: + + gdb path/to/vmlinux + (gdb) target remote localhost:1234 + (gdb) break key_get_persistent + (gdb) break key_set_timeout + (gdb) continue + +At `key_get_persistent`, inspect `uid` with `info args`. Continue until +`key_set_timeout` is hit, check `timeout` with `print timeout` (300 seconds), +then continue to let the test finish. The result is printed on the QEMU serial +console. + +To reproduce the bug, run this test against a kernel built from the parent of +commit 25bf14f81716. It reports a permanent ("perm") expiry. With the fix, the +restricted link returns -EPERM and the new keyring has a finite expiry. +The pre-fix bug can leave a permanent keyring in the test's user namespace +until that namespace is torn down, so run this reproduction in a disposable VM. diff --git a/tools/testing/selftests/keys/initramfs-init.sh b/tools/testing/selftests/keys/initramfs-init.sh new file mode 100755 index 000000000000..47cbfcb68d64 --- /dev/null +++ b/tools/testing/selftests/keys/initramfs-init.sh @@ -0,0 +1,10 @@ +#!/bin/busybox sh +# SPDX-License-Identifier: GPL-2.0 +# shellcheck shell=dash + +/bin/busybox mount -t proc procfs /proc +/keys/persistent_keyring_expiry +status=$? +/bin/busybox echo "keyring expiry selftest exit status: $status" +/bin/busybox poweroff -f +exit "$status" diff --git a/tools/testing/selftests/keys/persistent_keyring_expiry.c b/tools/testing/selftests/keys/persistent_keyring_expiry.c new file mode 100644 index 000000000000..55dbd8ce74ec --- /dev/null +++ b/tools/testing/selftests/keys/persistent_keyring_expiry.c @@ -0,0 +1,367 @@ +// SPDX-License-Identifier: GPL-2.0 +#define _GNU_SOURCE + +#include <errno.h> +#include <fcntl.h> +#include <linux/keyctl.h> +#include <limits.h> +#include <stdarg.h> +#include <stdbool.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <sys/syscall.h> +#include <sys/types.h> +#include <unistd.h> + +#include "../kselftest.h" + +#define EXPIRY_PATH "/proc/sys/kernel/keys/persistent_keyring_expiry" +#define TEST_EXPIRY 300 + +static int read_expiry(unsigned int *expiry) +{ + char buf[32]; + char *end; + unsigned long value; + ssize_t len; + int fd; + + fd = open(EXPIRY_PATH, O_RDONLY); + if (fd < 0) + return -1; + + len = read(fd, buf, sizeof(buf) - 1); + close(fd); + if (len <= 0) + return -1; + + buf[len] = '\0'; + errno = 0; + value = strtoul(buf, &end, 10); + if (errno || end == buf || (*end != '\n' && *end != '\0') || + value > UINT_MAX) { + errno = EINVAL; + return -1; + } + + *expiry = value; + return 0; +} + +static int write_expiry(unsigned int expiry) +{ + char buf[32]; + size_t len; + ssize_t written; + int fd; + + len = snprintf(buf, sizeof(buf), "%u\n", expiry); + fd = open(EXPIRY_PATH, O_WRONLY); + if (fd < 0) + return -1; + + written = write(fd, buf, len); + if (written != len) { + int saved_errno = errno; + + close(fd); + errno = written >= 0 ? EIO : saved_errno; + return -1; + } + if (close(fd) < 0) + return -1; + + return 0; +} + +static long add_keyring(const char *description) +{ + return syscall(SYS_add_key, "keyring", description, NULL, 0, + KEY_SPEC_SESSION_KEYRING); +} + +static int unlink_key(int key, int keyring) +{ + return syscall(SYS_keyctl, KEYCTL_UNLINK, key, keyring, 0, 0); +} + +static int find_persistent_expiry(uid_t uid, char *expiry, size_t expiry_len) +{ + char description[32]; + char *line = NULL; + size_t line_len = 0; + ssize_t len; + FILE *keys; + int found = 0; + + snprintf(description, sizeof(description), "_persistent.%u", uid); + keys = fopen("/proc/keys", "r"); + if (!keys) + return -1; + + while ((len = getline(&line, &line_len, keys)) >= 0) { + char *fields[9]; + char *saveptr; + char *field; + unsigned int n = 0; + size_t description_len = strlen(description); + + for (field = strtok_r(line, " \t\n", &saveptr); + field && n < ARRAY_SIZE(fields); + field = strtok_r(NULL, " \t\n", &saveptr)) + fields[n++] = field; + + if (n == ARRAY_SIZE(fields) && + strncmp(fields[8], description, description_len) == 0 && + (fields[8][description_len] == '\0' || + fields[8][description_len] == ':')) { + snprintf(expiry, expiry_len, "%s", fields[3]); + found = 1; + break; + } + } + + free(line); + fclose(keys); + return found; +} + +static void dump_persistent_keys(void) +{ + char *line = NULL; + size_t line_len = 0; + FILE *keys = fopen("/proc/keys", "r"); + + if (!keys) + return; + + while (getline(&line, &line_len, keys) >= 0) { + if (strstr(line, "_persistent.")) + ksft_print_msg("visible key: %s", line); + } + + free(line); + fclose(keys); +} + +static void set_failure(char *reason, size_t reason_len, const char *fmt, ...) +{ + va_list args; + + va_start(args, fmt); + vsnprintf(reason, reason_len, fmt, args); + va_end(args); +} + +static void report_skip(const char *reason) +{ + ksft_test_result_skip("%s\n", reason); + ksft_finished(); +} + +int main(void) +{ + char expiry[32] = {}; + char reason[256] = {}; + unsigned int saved_expiry; + uid_t test_uid = getuid(); + int destination = -1; + int cleanup_destination = -1; + int linked_persistent = -1; + int cleanup_persistent = -1; + long ret; + bool restore_expiry = false; + bool passed = false; + bool skipped = false; + int get_persistent_errno; + int attempt; + int found; + + ksft_print_header(); + ksft_set_plan(1); + + if (geteuid() != 0) + report_skip("requires root to set persistent_keyring_expiry"); + + if (read_expiry(&saved_expiry) < 0) + report_skip("CONFIG_PERSISTENT_KEYRINGS or procfs is unavailable"); + + found = find_persistent_expiry(test_uid, expiry, sizeof(expiry)); + if (found < 0) + report_skip("/proc/keys is unavailable"); + if (found) { + test_uid = 50000 + (getpid() % 10000); + for (attempt = 0; attempt < 128; attempt++) { + found = find_persistent_expiry(test_uid, expiry, + sizeof(expiry)); + if (found < 0) + report_skip("cannot read /proc/keys"); + if (!found) + break; + test_uid++; + } + if (attempt == 128) + report_skip("could not find an unused persistent keyring UID"); + } + + /* The inherited session keyring may have been revoked. */ + ret = syscall(SYS_keyctl, KEYCTL_JOIN_SESSION_KEYRING, NULL, 0, 0, 0); + if (ret < 0) { + set_failure(reason, sizeof(reason), + "KEYCTL_JOIN_SESSION_KEYRING failed: %s", + strerror(errno)); + goto out; + } + + if (write_expiry(TEST_EXPIRY) < 0) { + if (write_expiry(saved_expiry) < 0) + ksft_exit_fail_msg("failed to restore persistent keyring expiry: %s\n", + strerror(errno)); + report_skip("cannot change persistent_keyring_expiry"); + } + restore_expiry = true; + + { + char description[64]; + + snprintf(description, sizeof(description), "keyring-expiry-test-%d", + getpid()); + ret = add_keyring(description); + } + if (ret < 0) { + set_failure(reason, sizeof(reason), "add_key(keyring) failed: %s", + strerror(errno)); + goto out; + } + destination = ret; + + ret = syscall(SYS_keyctl, KEYCTL_RESTRICT_KEYRING, destination, + 0, 0, 0); + if (ret < 0) { + set_failure(reason, sizeof(reason), + "KEYCTL_RESTRICT_KEYRING failed: %s", strerror(errno)); + goto out; + } + + ret = syscall(SYS_keyctl, KEYCTL_GET_PERSISTENT, test_uid, + destination, 0, 0); + get_persistent_errno = errno; + ksft_print_msg("GET_PERSISTENT returned %ld (%s)\n", ret, + ret < 0 ? strerror(get_persistent_errno) : "success"); + if (ret >= 0) { + linked_persistent = ret; + set_failure(reason, sizeof(reason), + "GET_PERSISTENT unexpectedly linked key %ld", ret); + goto out; + } + if (get_persistent_errno != EPERM) { + set_failure(reason, sizeof(reason), + "GET_PERSISTENT failed with %s instead of EPERM", + strerror(get_persistent_errno)); + goto out; + } + + ret = find_persistent_expiry(test_uid, expiry, sizeof(expiry)); + if (ret < 0) { + set_failure(reason, sizeof(reason), "cannot read /proc/keys"); + goto out; + } + if (!ret) { + dump_persistent_keys(); + set_failure(reason, sizeof(reason), + "GET_PERSISTENT did not create the requested keyring"); + skipped = true; + goto out; + } + if (!strcmp(expiry, "perm") || !strcmp(expiry, "expd")) { + set_failure(reason, sizeof(reason), + "failed link left _persistent.%u with expiry %s", + test_uid, expiry); + { + char description[64]; + + snprintf(description, sizeof(description), + "keyring-expiry-cleanup-%d", getpid()); + ret = add_keyring(description); + } + if (ret >= 0) { + cleanup_destination = ret; + ret = syscall(SYS_keyctl, KEYCTL_GET_PERSISTENT, test_uid, + cleanup_destination, 0, 0); + if (ret >= 0) { + cleanup_persistent = ret; + if (unlink_key(cleanup_persistent, + cleanup_destination) < 0) { + ksft_print_msg("warning: unlink temporary key: %s\n", + strerror(errno)); + } else { + cleanup_persistent = -1; + } + } else { + ksft_print_msg("warning: expiry cleanup failed: %s\n", + strerror(errno)); + } + } else { + ksft_print_msg("warning: unable to create cleanup keyring: %s\n", + strerror(errno)); + } + goto out; + } + + passed = true; + +out: + if (linked_persistent > 0 && + unlink_key(linked_persistent, destination) < 0) { + ksft_print_msg("warning: unable to unlink persistent key from test keyring: %s\n", + strerror(errno)); + if (passed) + set_failure(reason, sizeof(reason), + "unable to clean up linked persistent key: %s", + strerror(errno)); + passed = false; + } + if (cleanup_persistent > 0 && cleanup_destination > 0 && + unlink_key(cleanup_persistent, cleanup_destination) < 0) { + ksft_print_msg("warning: unable to unlink temporary persistent key: %s\n", + strerror(errno)); + } + if (cleanup_destination > 0 && + unlink_key(cleanup_destination, KEY_SPEC_SESSION_KEYRING) < 0) { + ksft_print_msg("warning: unable to unlink cleanup keyring: %s\n", + strerror(errno)); + if (passed) + set_failure(reason, sizeof(reason), + "unable to clean up temporary keyring: %s", + strerror(errno)); + passed = false; + } + if (destination > 0 && + unlink_key(destination, KEY_SPEC_SESSION_KEYRING) < 0) { + ksft_print_msg("warning: unable to unlink test keyring: %s\n", + strerror(errno)); + if (passed) + set_failure(reason, sizeof(reason), + "unable to clean up test keyring: %s", + strerror(errno)); + passed = false; + } + if (restore_expiry && write_expiry(saved_expiry) < 0) { + set_failure(reason, sizeof(reason), + "failed to restore persistent_keyring_expiry: %s", + strerror(errno)); + passed = false; + } + + if (passed) { + ksft_print_msg("restricted link returned EPERM; _persistent.%u expires in %s\n", + test_uid, expiry); + ksft_test_result_pass("failed link still applies persistent keyring expiry\n"); + } else if (skipped) { + ksft_test_result_skip("%s\n", reason); + } else { + ksft_test_result_fail("%s\n", reason); + } + ksft_finished(); +} diff --git a/tools/testing/selftests/keys/run_qemu.sh b/tools/testing/selftests/keys/run_qemu.sh new file mode 100755 index 000000000000..522cc8495ca2 --- /dev/null +++ b/tools/testing/selftests/keys/run_qemu.sh @@ -0,0 +1,64 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0 +set -eu + +script_dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd) +repo_root=$(CDPATH='' cd -- "$script_dir/../../../.." && pwd) +kernel_image=${1:-"$repo_root/arch/x86/boot/bzImage"} +vmlinux=${2:-"$repo_root/vmlinux"} +test_binary="$script_dir/persistent_keyring_expiry" + +for tool in cpio qemu-system-x86_64 busybox ldd; do + if ! command -v "$tool" >/dev/null 2>&1; then + echo "required tool not found: $tool" >&2 + exit 1 + fi +done + +make -C "$script_dir" +if [ ! -r "$kernel_image" ] || [ ! -r "$vmlinux" ]; then + echo "usage: $0 [bzImage] [vmlinux]" >&2 + exit 1 +fi + +tmpdir=$(mktemp -d) +trap 'rm -rf "$tmpdir"' EXIT HUP INT TERM +rootfs="$tmpdir/rootfs" +initrd="$tmpdir/initramfs.cpio" +mkdir -p "$rootfs/bin" "$rootfs/dev" "$rootfs/proc" "$rootfs/keys" + +copy_binary() +{ + source=$1 + destination=$2 + install -D "$source" "$rootfs$destination" + + ldd "$source" 2>/dev/null | + awk '$2 == "=>" && $3 ~ /^\// { print $3 } + $1 ~ /^\// { print $1 }' | + sort -u | + while IFS= read -r library; do + [ -f "$library" ] || continue + cp -L --parents "$library" "$rootfs" + done +} + +copy_binary "$(command -v busybox)" /bin/busybox +copy_binary "$test_binary" /keys/persistent_keyring_expiry +install -m 755 "$script_dir/initramfs-init.sh" "$rootfs/init" + +( + cd "$rootfs" + find . -print0 | cpio --null -o --format=newc +) > "$initrd" + +echo "QEMU is paused at startup; attach GDB to localhost:1234 and continue." +qemu-system-x86_64 \ + -kernel "$kernel_image" \ + -initrd "$initrd" \ + -append "console=ttyS0 nokaslr rdinit=/init" \ + -display none \ + -serial stdio \ + -monitor none \ + -gdb tcp::1234 \ + -S -- 2.43.0
