1*49cdfc7eSAndroid Build Coastguard Worker // SPDX-License-Identifier: GPL-2.0-or-later
2*49cdfc7eSAndroid Build Coastguard Worker /*
3*49cdfc7eSAndroid Build Coastguard Worker * Copyright (c) 2017 Richard Palethorpe <[email protected]>
4*49cdfc7eSAndroid Build Coastguard Worker * Copyright (c) Linux Test Project, 2019-2024
5*49cdfc7eSAndroid Build Coastguard Worker */
6*49cdfc7eSAndroid Build Coastguard Worker
7*49cdfc7eSAndroid Build Coastguard Worker /*\
8*49cdfc7eSAndroid Build Coastguard Worker * [Description]
9*49cdfc7eSAndroid Build Coastguard Worker *
10*49cdfc7eSAndroid Build Coastguard Worker * Test for CVE-2016-9604, checks that keys beginning with "." are disallowed.
11*49cdfc7eSAndroid Build Coastguard Worker *
12*49cdfc7eSAndroid Build Coastguard Worker * See commit
13*49cdfc7eSAndroid Build Coastguard Worker * ee8f844e3c5a ("KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings")
14*49cdfc7eSAndroid Build Coastguard Worker */
15*49cdfc7eSAndroid Build Coastguard Worker
16*49cdfc7eSAndroid Build Coastguard Worker #include <errno.h>
17*49cdfc7eSAndroid Build Coastguard Worker #include "tst_test.h"
18*49cdfc7eSAndroid Build Coastguard Worker #include "lapi/keyctl.h"
19*49cdfc7eSAndroid Build Coastguard Worker
run(void)20*49cdfc7eSAndroid Build Coastguard Worker void run(void)
21*49cdfc7eSAndroid Build Coastguard Worker {
22*49cdfc7eSAndroid Build Coastguard Worker if (keyctl_join_session_keyring(".builtin_trusted_keys") == -1) {
23*49cdfc7eSAndroid Build Coastguard Worker if (errno != EPERM) {
24*49cdfc7eSAndroid Build Coastguard Worker tst_brk(TBROK | TERRNO,
25*49cdfc7eSAndroid Build Coastguard Worker "keyctl_join_sessoin_keyring(...)");
26*49cdfc7eSAndroid Build Coastguard Worker }
27*49cdfc7eSAndroid Build Coastguard Worker
28*49cdfc7eSAndroid Build Coastguard Worker tst_res(TPASS, "Denied access to .builtin_trusted_keys");
29*49cdfc7eSAndroid Build Coastguard Worker } else {
30*49cdfc7eSAndroid Build Coastguard Worker tst_res(TFAIL, "Allowed access to .builtin_trusted_keys");
31*49cdfc7eSAndroid Build Coastguard Worker }
32*49cdfc7eSAndroid Build Coastguard Worker }
33*49cdfc7eSAndroid Build Coastguard Worker
34*49cdfc7eSAndroid Build Coastguard Worker static struct tst_test test = {
35*49cdfc7eSAndroid Build Coastguard Worker .test_all = run,
36*49cdfc7eSAndroid Build Coastguard Worker .needs_root = 1,
37*49cdfc7eSAndroid Build Coastguard Worker .tags = (const struct tst_tag[]) {
38*49cdfc7eSAndroid Build Coastguard Worker {"CVE", "2016-9604"},
39*49cdfc7eSAndroid Build Coastguard Worker {"linux-git", "ee8f844e3c5a"},
40*49cdfc7eSAndroid Build Coastguard Worker {}
41*49cdfc7eSAndroid Build Coastguard Worker }
42*49cdfc7eSAndroid Build Coastguard Worker };
43