diff options
| author | Lennart Poettering <lennart@poettering.net> | 2017-02-08 15:14:02 +0100 |
|---|---|---|
| committer | Martin Pitt <martinpitt@users.noreply.github.com> | 2017-02-08 15:14:02 +0100 |
| commit | 8a50cf6957f12dbb1f90411659da9b959a1983ff (patch) | |
| tree | 478a9a32d69f6af15cee06ec346e140d686143a5 /src/test | |
| parent | b6f08ecda90b5ccb6c9c09e5976a627f5918dc0b (diff) | |
seccomp: MemoryDenyWriteExecute= should affect both mmap() and mmap2() (#5254)
On i386 we block the old mmap() call entirely, since we cannot properly
filter it. Thankfully it hasn't been used by glibc since quite some
time.
Fixes: #5240
Diffstat (limited to 'src/test')
| -rw-r--r-- | src/test/test-seccomp.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c index 54e7947c2f..3659238810 100644 --- a/src/test/test-seccomp.c +++ b/src/test/test-seccomp.c @@ -384,11 +384,21 @@ static void test_memory_deny_write_execute(void) { assert_se(p != MAP_FAILED); assert_se(munmap(p, page_size()) >= 0); - seccomp_memory_deny_write_execute(); + p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0); + assert_se(p != MAP_FAILED); + assert_se(munmap(p, page_size()) >= 0); + assert_se(seccomp_memory_deny_write_execute() >= 0); + +#if SECCOMP_MEMORY_DENY_WRITE_EXECUTE_BROKEN + p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0); + assert_se(p != MAP_FAILED); + assert_se(munmap(p, page_size()) >= 0); +#else p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0); assert_se(p == MAP_FAILED); assert_se(errno == EPERM); +#endif p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0); assert_se(p != MAP_FAILED); |