Re: [PATCH testsuite] tests/overlay: verify that execmem is not checked for the mounter

On Fri, Jul 3, 2026 at 7:54 AM Ondrej Mosnacek <[email protected]> wrote:
>
> Add a test that verifies that the execmem permission is checked only on
> the process mapping/updating the memory region and not against the
> mounter credentials.
>
> Signed-off-by: Ondrej Mosnacek <[email protected]>

Needs to be reformatted via ./tools/check-syntax -f but otherwise:
Acked-by: Stephen Smalley <[email protected]>

> ---
>  policy/test_overlayfs.te   |  4 ++++
>  tests/overlay/map_access.c | 20 ++++++++++++--------
>  tests/overlay/test         | 11 ++++++++++-
>  3 files changed, 26 insertions(+), 9 deletions(-)
>
> diff --git a/policy/test_overlayfs.te b/policy/test_overlayfs.te
> index 787685c..e1e1ebb 100644
> --- a/policy/test_overlayfs.te
> +++ b/policy/test_overlayfs.te
> @@ -122,6 +122,10 @@ can_exec(test_overlay_mounter_t, test_file_t)
>  allow test_overlay_client_t self:dir list_dir_perms;
>  allow test_overlay_client_t self:file read_file_perms;
>
> +# For testing execmem checking (should be checked only on the client,
> +# never on the mounter)
> +allow test_overlay_client_t self:process execmem;
> +
>  mcs_constrained(test_overlay_client_t)
>
>  kernel_read_system_state(test_overlay_client_t)
> diff --git a/tests/overlay/map_access.c b/tests/overlay/map_access.c
> index da1ae36..ccf955e 100644
> --- a/tests/overlay/map_access.c
> +++ b/tests/overlay/map_access.c
> @@ -11,15 +11,20 @@ int main(int argc, const char **argv)
>  {
>         const char *file;
>         void *ptr;
> -       int rdonly, fd, ret;
> +       int rdonly, execmem, flags, prot, fd, ret;
>
> -       if (argc != 3 || (strcmp(argv[2], "R_OK") && strcmp(argv[2], "W_OK"))) {
> -               fprintf(stderr, "Usage %s <file> R_OK|W_OK\n", argv[0]);
> +       if (argc != 3 || (strcmp(argv[2], "R_OK") && strcmp(argv[2], "W_OK") &&
> +                         strcmp(argv[2], "EXECMEM")))
> +       {
> +               fprintf(stderr, "Usage %s <file> R_OK|W_OK|EXECMEM\n", argv[0]);
>                 return EINVAL;
>         }
>
>         file = argv[1];
> -       rdonly = strcmp(argv[2], "R_OK") == 0;
> +       rdonly = strcmp(argv[2], "W_OK") != 0;
> +       execmem = strcmp(argv[2], "EXECMEM") == 0;
> +       flags = execmem ? MAP_PRIVATE : MAP_SHARED;
> +       prot = PROT_READ | (!rdonly || execmem ? PROT_WRITE : 0) | (execmem ? PROT_EXEC : 0);
>
>         fd = open(file, rdonly ? O_RDONLY : O_RDWR);
>         if (fd == -1) {
> @@ -28,8 +33,7 @@ int main(int argc, const char **argv)
>         }
>
>         /* try direct mmap */
> -       ptr = mmap(NULL, 1, rdonly ? PROT_READ : PROT_READ | PROT_WRITE,
> -                  MAP_SHARED, fd, 0);
> +       ptr = mmap(NULL, 1, prot, flags, fd, 0);
>         if (ptr == MAP_FAILED) {
>                 perror("mmap");
>                 return 3;
> @@ -37,13 +41,13 @@ int main(int argc, const char **argv)
>         munmap(ptr, 1);
>
>         /* try mmap with PROT_NONE followed by mprotect with full access */
> -       ptr = mmap(NULL, 1, PROT_NONE, MAP_SHARED, fd, 0);
> +       ptr = mmap(NULL, 1, PROT_NONE, flags, fd, 0);
>         if (ptr == MAP_FAILED) {
>                 perror("mmap PROT_NONE");
>                 return 4;
>         }
>
> -       ret = mprotect(ptr, 1, rdonly ? PROT_READ : PROT_READ | PROT_WRITE);
> +       ret = mprotect(ptr, 1, prot);
>         if (ret == -1) {
>                 perror("mprotect");
>                 return 5;
> diff --git a/tests/overlay/test b/tests/overlay/test
> index 2d0555a..ae8ec33 100755
> --- a/tests/overlay/test
> +++ b/tests/overlay/test
> @@ -19,7 +19,7 @@ BEGIN {
>          plan skip_all => "overlayfs upperdir not supported on NFS";
>      }
>      else {
> -        plan tests => 135;
> +        plan tests => 137;
>      }
>  }
>
> @@ -641,6 +641,13 @@ sub test_68_8_ctx {
>      return;
>  }
>
> +sub test_68_9 {
> +    print "Check execmem map access on mapreadfile, should succeed\n";
> +    $result = mmap( "$basedir/container1/merged/mapreadfile", "EXECMEM" );
> +    ok( $result eq 0 );
> +    return;
> +}
> +
>  sub test_70 {
>      print "Check unlink access on client_nounlinkfile, should fail.\n";
>      $result = system(
> @@ -891,6 +898,7 @@ sub nocontext_test {
>      test_68_6();
>      test_68_7();
>      test_68_8();
> +    test_68_9();
>
>      print "=====================================================\n";
>      print "unlink tests.\n";
> @@ -1033,6 +1041,7 @@ sub context_test {
>      test_68_6();
>      test_68_7_ctx();
>      test_68_8_ctx();
> +    test_68_9();
>
>      print "=====================================================\n";
>      print "unlink tests.\n";
> --
> 2.55.0
>
>