linux-kernel - Re: [GIT PULL] AT_EXECVE_CHECK introduction for v6.14-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250120.kab5eeng5Yai@digikod.net>
Date: Mon, 20 Jan 2025 10:03:07 +0100
From: Mickaël Salaün <mic@...ikod.net>
To: Sasha Levin <sashal@...nel.org>
Cc: Kees Cook <kees@...nel.org>, 
	Linus Torvalds <torvalds@...ux-foundation.org>, linux-kernel@...r.kernel.org, Al Viro <viro@...iv.linux.org.uk>, 
	Andy Lutomirski <luto@...capital.net>, Christian Brauner <brauner@...nel.org>, 
	Günther Noack <gnoack@...gle.com>, Jeff Xu <jeffxu@...omium.org>, Kees Cook <keescook@...omium.org>, 
	Mimi Zohar <zohar@...ux.ibm.com>, 
	Nícolas F. R. A. Prado <nfraprado@...labora.com>, Paul Moore <paul@...l-moore.com>, 
	Roberto Sassu <roberto.sassu@...wei.com>, Serge Hallyn <serge@...lyn.com>, 
	Shuah Khan <skhan@...uxfoundation.org>, Stefan Berger <stefanb@...ux.ibm.com>, 
	Nathan Chancellor <nathan@...nel.org>
Subject: Re: [GIT PULL] AT_EXECVE_CHECK introduction for v6.14-rc1

On Sun, Jan 19, 2025 at 07:08:54PM -0500, Sasha Levin wrote:
> On Wed, Jan 15, 2025 at 04:18:07PM -0800, Kees Cook wrote:
> > Hi Linus,
> > 
> > Please pull the AT_EXECVE_CHECK introduction for v6.14-rc1. I split
> > this series from the core execve tree since it's had a life of its own
> > as it has progressed from O_MAY_EXEC. :) This provides userspace with
> > a way to opt in to performing "execability" checks for things that are
> > executable but don't pass through execve(2) (e.g. scripts, dlopen libs,
> > etc). It's seen quite a bit of discussion and review, and has lived in
> > -next for the entire dev cycle. Included is documentation, samples, and
> > extensive selftests.
> > 
> > Thanks!
> > 
> > -Kees
> > 
> > The following changes since commit fac04efc5c793dccbd07e2d59af9f90b7fc0dca4:
> > 
> >  Linux 6.13-rc2 (2024-12-08 14:03:39 -0800)
> > 
> > are available in the Git repository at:
> > 
> >  https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/AT_EXECVE_CHECK-v6.14-rc1
> 
> Hey Kees,
> 
> LKFT has caught a build error with one of the samples:
> 
> /builds/linux/samples/check-exec/inc.c: In function 'interpret_stream':
> /builds/linux/samples/check-exec/inc.c:81:8: warning: implicit declaration of function 'execveat'; did you mean 'execve'? [-Wimplicit-function-declaration]
>   err = execveat(fileno(script), "", script_argv, envp,
>         ^~~~~~~~
>         execve
> 
> The full log is here: https://qa-reports.linaro.org/lkft/sashal-linus-next/build/v6.13-rc7-511-g109a8e0fa9d6/testrun/26809210/suite/build/test/gcc-8-allyesconfig/log

Hi Sasha,

Nathan caught this sample build issue last week too.  The fix is here:
https://lore.kernel.org/r/20250115144753.311152-1-mic@digikod.net