1 /*
2 * Copyright (c) 2017 Google, Inc.
3 *
4 * This program is free software: you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, either version 2 of the License, or
7 * (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program, if not, see <http://www.gnu.org/licenses/>.
16 */
17
18 /*
19 * Regression test for commit c9f838d104fe ("KEYS: fix
20 * keyctl_set_reqkey_keyring() to not leak thread keyrings"), a.k.a.
21 * CVE-2017-7472. This bug could be used to exhaust kernel memory, though it
22 * would take a while to do that and it would grind the test suite to a halt.
23 * Instead we do a quick check for whether the existing thread keyring is
24 * replaced when the default request-key destination is set to the thread
25 * keyring. It shouldn't be, but before the fix it was (and the old thread
26 * keyring was leaked).
27 */
28
29 #include <errno.h>
30
31 #include "tst_test.h"
32 #include "lapi/keyctl.h"
33
do_test(void)34 static void do_test(void)
35 {
36 key_serial_t tid_keyring;
37
38 TEST(keyctl(KEYCTL_GET_KEYRING_ID, KEY_SPEC_THREAD_KEYRING, 1));
39 if (TEST_RETURN < 0)
40 tst_brk(TBROK | TTERRNO, "failed to create thread keyring");
41 tid_keyring = TEST_RETURN;
42
43 TEST(keyctl(KEYCTL_SET_REQKEY_KEYRING, KEY_REQKEY_DEFL_THREAD_KEYRING));
44 if (TEST_RETURN < 0)
45 tst_brk(TBROK | TTERRNO, "failed to set reqkey keyring");
46
47 TEST(keyctl(KEYCTL_GET_KEYRING_ID, KEY_SPEC_THREAD_KEYRING, 0));
48 if (TEST_RETURN < 0)
49 tst_brk(TBROK | TTERRNO, "failed to get thread keyring ID");
50 if (TEST_RETURN == tid_keyring)
51 tst_res(TPASS, "thread keyring was not leaked");
52 else
53 tst_res(TFAIL, "thread keyring was leaked!");
54 }
55
56 static struct tst_test test = {
57 .test_all = do_test,
58 };
59