Now that sysmap_is_sealed runs with the other mm tests, it also runs on kernels built without CONFIG_MSEAL_SYSTEM_MAPPINGS, where it fails. Userspace can't tell whether the option is enabled, but a sealed [vdso] in a new process means that it is.
So let's use [vdso] as the reference: skip if it isn't sealed, and otherwise expect the other system mappings to be sealed too, and [stack] not to be. Signed-off-by: Chris Down <[email protected]> --- tools/testing/selftests/mm/run_vmtests.sh | 7 +++++- tools/testing/selftests/mm/sysmap_is_sealed.c | 22 +++++++++++++++++++ tools/testing/selftests/mm/vm_util.c | 5 +++++ tools/testing/selftests/mm/vm_util.h | 1 + 4 files changed, 34 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/mm/run_vmtests.sh b/tools/testing/selftests/mm/run_vmtests.sh index 573da5006268..1134a2e82610 100755 --- a/tools/testing/selftests/mm/run_vmtests.sh +++ b/tools/testing/selftests/mm/run_vmtests.sh @@ -307,7 +307,12 @@ fi CATEGORY="mmap" run_test ./map_populate CATEGORY="mmap" run_test ./droppable -CATEGORY="mmap" run_test ./sysmap_is_sealed +if gzip -dcfq /proc/config.gz "/boot/config-$(uname -r)" 2>/dev/null | + grep -q "^CONFIG_MSEAL_SYSTEM_MAPPINGS=y"; then + CATEGORY="mmap" run_test ./sysmap_is_sealed +else + CATEGORY="mmap" run_test ./sysmap_is_sealed -T expect_sealed +fi CATEGORY="mlock" run_test ./mlock-random-test diff --git a/tools/testing/selftests/mm/sysmap_is_sealed.c b/tools/testing/selftests/mm/sysmap_is_sealed.c index cb0ca6ed7ebe..d5ab2b0d8ca7 100644 --- a/tools/testing/selftests/mm/sysmap_is_sealed.c +++ b/tools/testing/selftests/mm/sysmap_is_sealed.c @@ -10,9 +10,11 @@ #include <unistd.h> #include <string.h> #include <stdbool.h> +#include <sys/auxv.h> #include "kselftest.h" #include "kselftest_harness.h" +#include "vm_util.h" #define VMFLAGS "VmFlags:" #define MSEAL_FLAGS "sl" @@ -46,6 +48,23 @@ bool mapping_is_sealed(char *name, FILE *maps) return false; } +static bool sysmaps_sealed(void) +{ + void *vdso = (void *)getauxval(AT_SYSINFO_EHDR); + + return vdso && check_vmflag_sealed(vdso); +} + +/* + * Kernels built without CONFIG_MSEAL_SYSTEM_MAPPINGS don't seal system + * mappings either, so check_sealed skips if they aren't sealed. This fails + * instead, so run_vmtests.sh only runs it when that's set. + */ +TEST(expect_sealed) +{ + EXPECT_TRUE(sysmaps_sealed()); +} + FIXTURE(basic) { FILE *maps; }; @@ -107,6 +126,9 @@ FIXTURE_VARIANT_ADD(basic, stack) { TEST_F(basic, check_sealed) { + if (!sysmaps_sealed()) + SKIP(return, "system mappings are not sealed"); + if (!has_mapping(variant->name, self->maps)) { SKIP(return, "could not find the mapping, %s", variant->name); diff --git a/tools/testing/selftests/mm/vm_util.c b/tools/testing/selftests/mm/vm_util.c index 8ef226107d78..6732f76b7e61 100644 --- a/tools/testing/selftests/mm/vm_util.c +++ b/tools/testing/selftests/mm/vm_util.c @@ -785,6 +785,11 @@ bool check_vmflag_guard(void *addr) return check_vmflag(addr, "gu"); } +bool check_vmflag_sealed(void *addr) +{ + return check_vmflag(addr, "sl"); +} + bool softdirty_supported(void) { char *addr; diff --git a/tools/testing/selftests/mm/vm_util.h b/tools/testing/selftests/mm/vm_util.h index d32cb79d9905..0e94793b0d21 100644 --- a/tools/testing/selftests/mm/vm_util.h +++ b/tools/testing/selftests/mm/vm_util.h @@ -117,6 +117,7 @@ int uffd_register_with_ioctls(int uffd, void *addr, uint64_t len, bool check_vmflag_io(void *addr); bool check_vmflag_pfnmap(void *addr); bool check_vmflag_guard(void *addr); +bool check_vmflag_sealed(void *addr); int open_procmap(pid_t pid, struct procmap_fd *procmap_out); int query_procmap(struct procmap_fd *procmap); bool find_vma_procmap(struct procmap_fd *procmap, void *address); -- 2.54.0
