1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2026 Alexander Leidinger <netchild@FreeBSD.org> 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other advertising materials provided with the 14 * distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 /** 30 * @file 31 * Credential-transition tests for a process-mode PMC across exec(), the 32 * companion to pmc_exec_test.c. Where that file proves the driver drops a 33 * PMC when its target execs into credentials its owner may no longer 34 * trace, these prove the two cases the drop must not overreach into: an 35 * exec that changes no credentials keeps the PMC, and an exec of a set-id 36 * binary whose credential change the kernel then suppresses, because the 37 * target is ptrace(2)d, keeps it too - do_execve() derives the set-id from 38 * the image alone and suppresses it afterwards, clearing P_SUGID and 39 * leaving the ids untouched, so the owner is still entitled. The third 40 * case covers fexecve(2), which reaches the same hook as execve(2). 41 * These exercise what FreeBSD-SA-26:56.hwpmc reworked, not what it fixed. 42 * 43 * As in pmc_exec_test.c the owner must be unprivileged, and the test must 44 * not lower its own privilege: setuid(2) sets P_SUGID, fork(2) passes it 45 * to the target, and p_candebug() then refuses that target to its own 46 * owner. Not covered, because each needs privileged setup a require.user 47 * body cannot build: a set-id exec on a nosuid mount, a set-id #! 48 * interpreter, and the two jail transitions. 49 */ 50 51 #include <sys/types.h> 52 #include <sys/ptrace.h> 53 #include <sys/stat.h> 54 #include <sys/wait.h> 55 56 #include <errno.h> 57 #include <fcntl.h> 58 #include <pmc.h> 59 #include <signal.h> 60 #include <stdlib.h> 61 #include <string.h> 62 #include <unistd.h> 63 64 #include <atf-c.h> 65 66 static const char *counting_events[] = { 67 "instructions", 68 "cycles", 69 "branches", 70 "unhalted-core-cycles", 71 "inst_retired.any", 72 "cpu_clk_unhalted.thread", 73 "ls_not_halted_cyc", 74 NULL 75 }; 76 77 /** 78 * @internal 79 * Exec targets. 'setid' is the bit the entry must carry to exercise the 80 * case; the argument vectors are chosen so the program touches nothing. 81 * A target that blocks on stdin stays alive after the exec so that the 82 * still-attached question can be asked; the caller holds the read end open. 83 */ 84 struct exec_target { 85 const char *path; 86 const char *const argv[5]; 87 mode_t setid; 88 int blocks_on_stdin; 89 }; 90 91 /** 92 * @internal 93 * Set-gid, blocks on stdin: stays alive so "still attached?" is answerable. 94 */ 95 static const struct exec_target setgid_targets[] = { 96 { "/usr/bin/wall", { "wall", NULL }, S_ISGID, 1 }, 97 { NULL, { NULL }, 0, 0 } 98 }; 99 100 /** Set-uid, exits at once: for a drop-case, completing without a panic is 101 * @internal 102 * the whole assertion. */ 103 static const struct exec_target setuid_targets[] = { 104 { "/sbin/ping", { "ping", "-c", "1", "127.0.0.1", NULL }, S_ISUID, 0 }, 105 { NULL, { NULL }, 0, 0 } 106 }; 107 108 /** An ordinary, non-set-id target that blocks: sleep ignores stdin but 109 * @internal 110 * stays alive on its own, which is all exec_ordinary_keeps_pmc needs. */ 111 static const struct exec_target ordinary_targets[] = { 112 { "/bin/sleep", { "sleep", "30", NULL }, 0, 0 }, 113 { NULL, { NULL }, 0, 0 } 114 }; 115 116 static const struct exec_target * 117 pick_target(const struct exec_target *tab, bool need_setid) 118 { 119 struct stat sb; 120 int i; 121 122 for (i = 0; tab[i].path != NULL; i++) { 123 if (stat(tab[i].path, &sb) != 0) 124 continue; 125 if (need_setid && (sb.st_mode & tab[i].setid) == 0) 126 continue; 127 return (&tab[i]); 128 } 129 return (NULL); 130 } 131 132 static pmc_id_t 133 allocate_counting_pmc(void) 134 { 135 pmc_id_t id = PMC_ID_INVALID; 136 int i; 137 138 for (i = 0; counting_events[i] != NULL; i++) { 139 if (pmc_allocate(counting_events[i], PMC_MODE_TC, 0, 140 PMC_CPU_ANY, &id, 0) == 0) 141 return (id); 142 } 143 return (PMC_ID_INVALID); 144 } 145 146 static void 147 spin(void) 148 { 149 volatile unsigned long s __unused = 0; 150 int i; 151 152 for (i = 0; i < 2000000; i++) 153 s += i; 154 } 155 156 static void 157 require_unprivileged_owner(void) 158 { 159 160 if (geteuid() == 0) 161 atf_tc_skip("the PMC owner must be unprivileged: root may " 162 "trace any credentials, so the check under test is never " 163 "reached"); 164 } 165 166 /** 167 * @internal 168 * How the target should behave between fork and the measured exec. 169 */ 170 enum exec_via { 171 VIA_EXECVE, /* plain execve(2) */ 172 VIA_FEXECVE, /* fexecve(2) of an fd opened O_EXEC */ 173 VIA_TRACED, /* PT_TRACE_ME first, so the exec is credential-safe */ 174 }; 175 176 /** 177 * @internal 178 * Fork a target, attach a running counting PMC, and let it exec. On 179 * return the PMC is released. When 'inspect' is set the target is expected 180 * to stay alive past the exec, and *still_attached reports whether the PMC 181 * survived it; a drop-case passes inspect=0 for a target that exits at once 182 * (it has already torn its own descriptor down, so there is nothing to ask). 183 */ 184 static void 185 run_target(const struct exec_target *t, enum exec_via via, int inspect, 186 int *still_attached) 187 { 188 pmc_id_t id; 189 pid_t target; 190 char token; 191 int gopipe[2], inpipe[2], status; 192 193 ATF_REQUIRE(pipe(gopipe) == 0); 194 ATF_REQUIRE(pipe(inpipe) == 0); 195 ATF_REQUIRE((target = fork()) >= 0); 196 197 if (target == 0) { 198 int fd; 199 200 (void)close(gopipe[1]); 201 if (t->blocks_on_stdin) 202 (void)dup2(inpipe[0], STDIN_FILENO); 203 (void)close(inpipe[1]); 204 if (via == VIA_TRACED) 205 (void)ptrace(PT_TRACE_ME, 0, NULL, 0); 206 if (read(gopipe[0], &token, 1) != 1) 207 _exit(1); 208 spin(); 209 if (via == VIA_FEXECVE) { 210 if ((fd = open(t->path, O_EXEC)) < 0) 211 _exit(1); 212 (void)fexecve(fd, __DECONST(char **, t->argv), NULL); 213 } else { 214 (void)execv(t->path, __DECONST(char **, t->argv)); 215 } 216 _exit(1); 217 } 218 (void)close(gopipe[0]); 219 (void)close(inpipe[0]); 220 221 if (pmc_init() != 0) { 222 (void)kill(target, SIGKILL); 223 (void)waitpid(target, &status, 0); 224 atf_tc_skip("hwpmc(4) is not available"); 225 } 226 if ((id = allocate_counting_pmc()) == PMC_ID_INVALID) { 227 (void)kill(target, SIGKILL); 228 (void)waitpid(target, &status, 0); 229 atf_tc_skip("no process-mode counting event is allocatable"); 230 } 231 232 ATF_REQUIRE_MSG(pmc_attach(id, target) == 0, "pmc_attach: %s", 233 strerror(errno)); 234 ATF_REQUIRE(pmc_start(id) == 0); 235 236 /* Into the exec. */ 237 ATF_REQUIRE(write(gopipe[1], "g", 1) == 1); 238 (void)close(gopipe[1]); 239 240 if (via == VIA_TRACED) { 241 /* 242 * The exec of a set-id binary under a tracer stops the 243 * target with SIGTRAP and leaves its credentials unchanged. 244 * Reap that stop and detach the tracer; the hwpmc decision 245 * was already taken at exec time, so from here the target 246 * runs as an ordinary blocked process. 247 */ 248 ATF_REQUIRE(waitpid(target, &status, 0) == target); 249 ATF_REQUIRE_MSG(WIFSTOPPED(status), 250 "traced target did not stop at exec (status 0x%x)", status); 251 ATF_REQUIRE_MSG(ptrace(PT_DETACH, target, (caddr_t)1, 0) == 0, 252 "PT_DETACH: %s", strerror(errno)); 253 } 254 255 if (inspect) { 256 (void)usleep(400000); 257 errno = 0; 258 *still_attached = pmc_detach(id, target) == 0; 259 if (!*still_attached) 260 ATF_REQUIRE_MSG(errno == ESRCH, "pmc_detach: %s", 261 strerror(errno)); 262 (void)kill(target, SIGKILL); 263 } else { 264 *still_attached = 0; 265 } 266 (void)waitpid(target, &status, 0); 267 (void)pmc_release(id); 268 } 269 270 ATF_TC(exec_ordinary_keeps_pmc); 271 ATF_TC_HEAD(exec_ordinary_keeps_pmc, tc) 272 { 273 274 atf_tc_set_md_var(tc, "descr", 275 "a process-mode PMC survives an exec that does not change the " 276 "target's credentials"); 277 atf_tc_set_md_var(tc, "require.user", "unprivileged"); 278 } 279 ATF_TC_BODY(exec_ordinary_keeps_pmc, tc) 280 { 281 const struct exec_target *t; 282 int still_attached; 283 284 require_unprivileged_owner(); 285 if ((t = pick_target(ordinary_targets, false)) == NULL) 286 atf_tc_skip("no ordinary exec target available"); 287 288 run_target(t, VIA_EXECVE, 1, &still_attached); 289 ATF_REQUIRE_MSG(still_attached, 290 "the PMC was dropped across an exec that changed no credentials"); 291 } 292 293 ATF_TC(exec_setid_traced_keeps_pmc); 294 ATF_TC_HEAD(exec_setid_traced_keeps_pmc, tc) 295 { 296 297 atf_tc_set_md_var(tc, "descr", 298 "a process-mode PMC survives its target's exec of a set-id binary " 299 "when tracing suppresses the credential change and the owner " 300 "remains entitled"); 301 atf_tc_set_md_var(tc, "require.user", "unprivileged"); 302 } 303 ATF_TC_BODY(exec_setid_traced_keeps_pmc, tc) 304 { 305 const struct exec_target *t; 306 int still_attached; 307 308 require_unprivileged_owner(); 309 if ((t = pick_target(setgid_targets, true)) == NULL) 310 atf_tc_skip("no set-gid exec target available"); 311 312 run_target(t, VIA_TRACED, 1, &still_attached); 313 ATF_REQUIRE_MSG(still_attached, 314 "the PMC was dropped although tracing left the target's " 315 "credentials unchanged and its owner still entitled"); 316 } 317 318 ATF_TC(exec_fexecve_setid_drops_pmc); 319 ATF_TC_HEAD(exec_fexecve_setid_drops_pmc, tc) 320 { 321 322 atf_tc_set_md_var(tc, "descr", 323 "a process-mode PMC is detached when its target reaches a " 324 "credential-changing set-id binary through fexecve(2)"); 325 atf_tc_set_md_var(tc, "require.user", "unprivileged"); 326 } 327 ATF_TC_BODY(exec_fexecve_setid_drops_pmc, tc) 328 { 329 const struct exec_target *t; 330 int still_attached; 331 332 require_unprivileged_owner(); 333 if ((t = pick_target(setuid_targets, true)) == NULL) 334 atf_tc_skip("no set-uid exec target available"); 335 336 /* Completing at all is the assertion. */ 337 run_target(t, VIA_FEXECVE, 0, &still_attached); 338 } 339 340 ATF_TP_ADD_TCS(tp) 341 { 342 343 ATF_TP_ADD_TC(tp, exec_ordinary_keeps_pmc); 344 ATF_TP_ADD_TC(tp, exec_setid_traced_keeps_pmc); 345 ATF_TP_ADD_TC(tp, exec_fexecve_setid_drops_pmc); 346 347 return (atf_no_error()); 348 } 349