xref: /aosp_15_r20/external/ltp/testcases/kernel/syscalls/keyctl/keyctl08.c (revision 49cdfc7efb34551c7342be41a7384b9c40d7cab7)
1*49cdfc7eSAndroid Build Coastguard Worker // SPDX-License-Identifier: GPL-2.0-or-later
2*49cdfc7eSAndroid Build Coastguard Worker /*
3*49cdfc7eSAndroid Build Coastguard Worker  * Copyright (c) 2017 Richard Palethorpe <[email protected]>
4*49cdfc7eSAndroid Build Coastguard Worker  * Copyright (c) Linux Test Project, 2019-2024
5*49cdfc7eSAndroid Build Coastguard Worker  */
6*49cdfc7eSAndroid Build Coastguard Worker 
7*49cdfc7eSAndroid Build Coastguard Worker /*\
8*49cdfc7eSAndroid Build Coastguard Worker  * [Description]
9*49cdfc7eSAndroid Build Coastguard Worker  *
10*49cdfc7eSAndroid Build Coastguard Worker  * Test for CVE-2016-9604, checks that keys beginning with "." are disallowed.
11*49cdfc7eSAndroid Build Coastguard Worker  *
12*49cdfc7eSAndroid Build Coastguard Worker  * See commit
13*49cdfc7eSAndroid Build Coastguard Worker  * ee8f844e3c5a ("KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings")
14*49cdfc7eSAndroid Build Coastguard Worker  */
15*49cdfc7eSAndroid Build Coastguard Worker 
16*49cdfc7eSAndroid Build Coastguard Worker #include <errno.h>
17*49cdfc7eSAndroid Build Coastguard Worker #include "tst_test.h"
18*49cdfc7eSAndroid Build Coastguard Worker #include "lapi/keyctl.h"
19*49cdfc7eSAndroid Build Coastguard Worker 
run(void)20*49cdfc7eSAndroid Build Coastguard Worker void run(void)
21*49cdfc7eSAndroid Build Coastguard Worker {
22*49cdfc7eSAndroid Build Coastguard Worker 	if (keyctl_join_session_keyring(".builtin_trusted_keys") == -1) {
23*49cdfc7eSAndroid Build Coastguard Worker 		if (errno != EPERM) {
24*49cdfc7eSAndroid Build Coastguard Worker 			tst_brk(TBROK | TERRNO,
25*49cdfc7eSAndroid Build Coastguard Worker 				"keyctl_join_sessoin_keyring(...)");
26*49cdfc7eSAndroid Build Coastguard Worker 		}
27*49cdfc7eSAndroid Build Coastguard Worker 
28*49cdfc7eSAndroid Build Coastguard Worker 		tst_res(TPASS, "Denied access to .builtin_trusted_keys");
29*49cdfc7eSAndroid Build Coastguard Worker 	} else {
30*49cdfc7eSAndroid Build Coastguard Worker 		tst_res(TFAIL, "Allowed access to .builtin_trusted_keys");
31*49cdfc7eSAndroid Build Coastguard Worker 	}
32*49cdfc7eSAndroid Build Coastguard Worker }
33*49cdfc7eSAndroid Build Coastguard Worker 
34*49cdfc7eSAndroid Build Coastguard Worker static struct tst_test test = {
35*49cdfc7eSAndroid Build Coastguard Worker 	.test_all = run,
36*49cdfc7eSAndroid Build Coastguard Worker 	.needs_root = 1,
37*49cdfc7eSAndroid Build Coastguard Worker 	.tags = (const struct tst_tag[]) {
38*49cdfc7eSAndroid Build Coastguard Worker 		{"CVE", "2016-9604"},
39*49cdfc7eSAndroid Build Coastguard Worker 		{"linux-git", "ee8f844e3c5a"},
40*49cdfc7eSAndroid Build Coastguard Worker 		{}
41*49cdfc7eSAndroid Build Coastguard Worker 	}
42*49cdfc7eSAndroid Build Coastguard Worker };
43