linux-kernel - Re: [GIT PULL] AT_EXECVE_CHECK introduction for v6.14-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z42UFh7BThHtotDA@lappy>
Date: Sun, 19 Jan 2025 19:08:54 -0500
From: Sasha Levin <sashal@...nel.org>
To: Kees Cook <kees@...nel.org>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, Al Viro <viro@...iv.linux.org.uk>,
	Andy Lutomirski <luto@...capital.net>,
	Christian Brauner <brauner@...nel.org>,
	Günther Noack <gnoack@...gle.com>,
	Jeff Xu <jeffxu@...omium.org>, Kees Cook <keescook@...omium.org>,
	Mickaël Salaün <mic@...ikod.net>,
	Mimi Zohar <zohar@...ux.ibm.com>,
	Nícolas F. R. A. Prado <nfraprado@...labora.com>,
	Paul Moore <paul@...l-moore.com>,
	Roberto Sassu <roberto.sassu@...wei.com>,
	Serge Hallyn <serge@...lyn.com>,
	Shuah Khan <skhan@...uxfoundation.org>,
	Stefan Berger <stefanb@...ux.ibm.com>
Subject: Re: [GIT PULL] AT_EXECVE_CHECK introduction for v6.14-rc1

On Wed, Jan 15, 2025 at 04:18:07PM -0800, Kees Cook wrote:
>Hi Linus,
>
>Please pull the AT_EXECVE_CHECK introduction for v6.14-rc1. I split
>this series from the core execve tree since it's had a life of its own
>as it has progressed from O_MAY_EXEC. :) This provides userspace with
>a way to opt in to performing "execability" checks for things that are
>executable but don't pass through execve(2) (e.g. scripts, dlopen libs,
>etc). It's seen quite a bit of discussion and review, and has lived in
>-next for the entire dev cycle. Included is documentation, samples, and
>extensive selftests.
>
>Thanks!
>
>-Kees
>
>The following changes since commit fac04efc5c793dccbd07e2d59af9f90b7fc0dca4:
>
>  Linux 6.13-rc2 (2024-12-08 14:03:39 -0800)
>
>are available in the Git repository at:
>
>  https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/AT_EXECVE_CHECK-v6.14-rc1

Hey Kees,

LKFT has caught a build error with one of the samples:

/builds/linux/samples/check-exec/inc.c: In function 'interpret_stream':
/builds/linux/samples/check-exec/inc.c:81:8: warning: implicit declaration of function 'execveat'; did you mean 'execve'? [-Wimplicit-function-declaration]
   err = execveat(fileno(script), "", script_argv, envp,
         ^~~~~~~~
         execve

The full log is here: https://qa-reports.linaro.org/lkft/sashal-linus-next/build/v6.13-rc7-511-g109a8e0fa9d6/testrun/26809210/suite/build/test/gcc-8-allyesconfig/log

-- 
Thanks,
Sasha