1# SPDX-License-Identifier: GPL-2.0 2CFLAGS = -Wall 3CFLAGS += -Wno-nonnull 4CFLAGS += $(KHDR_INCLUDES) 5 6LDLIBS += -lcap 7 8ALIGNS := 0x1000 0x200000 0x1000000 9ALIGN_PIES := $(patsubst %,load_address.%,$(ALIGNS)) 10ALIGN_STATIC_PIES := $(patsubst %,load_address.static.%,$(ALIGNS)) 11ALIGNMENT_TESTS := $(ALIGN_PIES) $(ALIGN_STATIC_PIES) 12 13TEST_PROGS := binfmt_script.py check-exec-tests.sh 14TEST_GEN_PROGS := execveat non-regular $(ALIGNMENT_TESTS) 15TEST_GEN_PROGS_EXTENDED := false inc set-exec script-exec.inc script-noexec.inc 16TEST_GEN_FILES := execveat.symlink execveat.denatured script subdir 17# Makefile is a run-time dependency, since it's accessed by the execveat test 18TEST_FILES := Makefile 19 20TEST_GEN_PROGS += recursion-depth 21TEST_GEN_PROGS += null-argv 22TEST_GEN_PROGS += check-exec 23 24# binfmt_misc must not be reachable as an exec source or as a stacking layer, 25# or an 'F' entry can pin the instance that owns it. Unprivileged, no bpf. 26TEST_GEN_PROGS += binfmt_misc_selfpin 27 28# The interpreters an 'F' or 'B' entry pre-opens are charged against 29# UCOUNT_BINFMT_MISC_INTERPRETERS. Unprivileged, no bpf. 30TEST_GEN_PROGS += binfmt_misc_interplimit 31 32# 'D' (register disabled) binfmt_misc test: an entry that exists but does 33# not dispatch until it is enabled. Static magic entry, no bpf toolchain. 34TEST_GEN_PROGS += binfmt_misc_disabled 35 36# Static ('T' flag) transparent binfmt_misc test; the asserting interpreter 37# is shared with the bpf harness's transparent case. No bpf toolchain needed. 38TEST_GEN_PROGS += binfmt_misc_transparent 39TEST_GEN_FILES += binfmt_transparent_interp 40 41# 'L' (loader substitution) binfmt_misc test: the payload runs as the main 42# image with a copy of the system loader substituted for its PT_INTERP and 43# asserts the native identity from inside; the static build proves the 44# override is dropped for a binary without PT_INTERP. 45TEST_GEN_PROGS += binfmt_misc_loader 46TEST_GEN_FILES += binfmt_loader_payload binfmt_loader_payload_static 47 48# binfmt_misc bpf-backed ('B') handler test: a libbpf harness plus its 49# struct_ops objects and the test interpreter/app it routes between. Only 50# built when clang, bpftool, the vmlinux BTF and libbpf are all present 51# (HAVE_BPF_TOOLCHAIN=y forces it) so the other exec selftests don't grow 52# a bpf toolchain dependency. 53CLANG ?= clang 54BPFTOOL ?= bpftool 55VMLINUX_BTF ?= /sys/kernel/btf/vmlinux 56HAVE_BPF_TOOLCHAIN ?= $(shell command -v $(CLANG) >/dev/null 2>&1 && \ 57 command -v $(BPFTOOL) >/dev/null 2>&1 && \ 58 test -r $(VMLINUX_BTF) && \ 59 pkg-config --exists libbpf 2>/dev/null && echo y) 60ifeq ($(HAVE_BPF_TOOLCHAIN),y) 61TEST_GEN_PROGS += binfmt_misc_bpf 62TEST_GEN_FILES += bpf_interp.bpf.o nix_origin.bpf.o transparent.bpf.o 63TEST_GEN_FILES += loader.bpf.o interp_bind.bpf.o 64TEST_GEN_FILES += binfmt_bpf_interp binfmt_bpf_app binfmt_bind_interp 65else 66$(info exec selftests: skipping binfmt_misc_bpf, needs clang, bpftool, vmlinux BTF and libbpf) 67endif 68 69EXTRA_CLEAN := $(OUTPUT)/subdir.moved $(OUTPUT)/execveat.moved $(OUTPUT)/xxxxx* \ 70 $(OUTPUT)/S_I*.test 71 72LOCAL_HDRS += binfmt_misc_common.h 73 74include ../lib.mk 75 76CHECK_EXEC_SAMPLES := $(top_srcdir)/samples/check-exec 77 78$(OUTPUT)/subdir: 79 mkdir -p $@ 80$(OUTPUT)/script: Makefile 81 echo '#!/bin/bash' > $@ 82 echo 'exit $$*' >> $@ 83 chmod +x $@ 84$(OUTPUT)/execveat.symlink: $(OUTPUT)/execveat 85 cd $(OUTPUT) && ln -s -f $(shell basename $<) $(shell basename $@) 86$(OUTPUT)/execveat.denatured: $(OUTPUT)/execveat 87 cp $< $@ 88 chmod -x $@ 89$(OUTPUT)/load_address.0x%: load_address.c 90 $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=$(lastword $(subst ., ,$@)) \ 91 -fPIE -pie $< -o $@ 92$(OUTPUT)/load_address.static.0x%: load_address.c 93 $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=$(lastword $(subst ., ,$@)) \ 94 -fPIE -static-pie $< -o $@ 95$(OUTPUT)/false: false.c 96 $(CC) $(CFLAGS) $(LDFLAGS) -static $< -o $@ 97$(OUTPUT)/inc: $(CHECK_EXEC_SAMPLES)/inc.c 98 $(CC) $(CFLAGS) $(LDFLAGS) $< -o $@ 99$(OUTPUT)/set-exec: $(CHECK_EXEC_SAMPLES)/set-exec.c 100 $(CC) $(CFLAGS) $(LDFLAGS) $< -o $@ 101$(OUTPUT)/script-exec.inc: $(CHECK_EXEC_SAMPLES)/script-exec.inc 102 cp $< $@ 103$(OUTPUT)/script-noexec.inc: $(CHECK_EXEC_SAMPLES)/script-noexec.inc 104 cp $< $@ 105 106# Reuses setup_userns()/write_file() from the filesystems selftests. Their 107# wrappers.h wants the uapi headers, so ask for them here rather than widening 108# CFLAGS for every program in this directory. 109$(OUTPUT)/binfmt_misc_selfpin: CFLAGS += $(TOOLS_INCLUDES) 110$(OUTPUT)/binfmt_misc_selfpin: ../filesystems/utils.c 111$(OUTPUT)/binfmt_misc_interplimit: CFLAGS += $(TOOLS_INCLUDES) 112$(OUTPUT)/binfmt_misc_interplimit: ../filesystems/utils.c 113 114# --- binfmt_misc bpf ('B') handler test --------------------------------- 115# The struct_ops bpf objects are compiled against the running kernel's BTF. 116# CLANG/BPFTOOL/VMLINUX_BTF are set above next to the toolchain check; 117# override LIBBPF_CFLAGS/LDLIBS to point at a libbpf install. 118BPF_CFLAGS ?= -I$(OUTPUT) 119LIBBPF_CFLAGS ?= 120LIBBPF_LDLIBS ?= -lbpf -lelf -lz 121 122$(OUTPUT)/vmlinux.h: 123 $(BPFTOOL) btf dump file $(VMLINUX_BTF) format c > $@ 124 125# BPF_NO_KFUNC_PROTOTYPES: the programs declare the kfuncs they use themselves. 126$(OUTPUT)/%.bpf.o: %.bpf.c $(OUTPUT)/vmlinux.h 127 $(CLANG) -g -O2 -target bpf -mcpu=v3 -DBPF_NO_KFUNC_PROTOTYPES \ 128 $(BPF_CFLAGS) $(LIBBPF_CFLAGS) -c $< -o $@ 129 130$(OUTPUT)/binfmt_misc_bpf: binfmt_misc_bpf.c binfmt_misc_common.h 131 $(CC) $(CFLAGS) $(LIBBPF_CFLAGS) $(LDFLAGS) $< $(LIBBPF_LDLIBS) -o $@ 132 133$(OUTPUT)/binfmt_bpf_interp: binfmt_bpf_interp.c 134 $(CC) $(CFLAGS) $(LDFLAGS) $< -o $@ 135 136$(OUTPUT)/binfmt_bind_interp: binfmt_bind_interp.c 137 $(CC) $(CFLAGS) $(LDFLAGS) $< -o $@ 138 139$(OUTPUT)/binfmt_loader_payload: binfmt_loader_payload.c binfmt_misc_common.h 140 $(CC) $(CFLAGS) $(LDFLAGS) -fPIE -pie $< -o $@ 141 142$(OUTPUT)/binfmt_loader_payload_static: binfmt_loader_payload.c binfmt_misc_common.h 143 $(CC) $(CFLAGS) $(LDFLAGS) -static $< -o $@ 144 145# PT_INTERP is set to the literal "$ORIGIN/binfmt_bpf_interp"; the nix_origin 146# handler resolves it relative to the binary at run time. 147$(OUTPUT)/binfmt_bpf_app: binfmt_bpf_app.c 148 $(CC) $(CFLAGS) $(LDFLAGS) -Wl,--dynamic-linker,'$$ORIGIN/binfmt_bpf_interp' $< -o $@ 149 150EXTRA_CLEAN += $(OUTPUT)/vmlinux.h $(OUTPUT)/*.bpf.o 151