git: bea7b932b9ee - main - hwpmc: add credential-transition exec tests (keep and drop)
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 27 Aug 2026 14:03:20 UTC
The branch main has been updated by netchild:
URL: https://cgit.FreeBSD.org/src/commit/?id=bea7b932b9eeaff39393347e0600b982fd859a92
commit bea7b932b9eeaff39393347e0600b982fd859a92
Author: Alexander Leidinger <netchild@FreeBSD.org>
AuthorDate: 2026-08-25 18:55:25 +0000
Commit: Alexander Leidinger <netchild@FreeBSD.org>
CommitDate: 2026-08-27 14:02:45 +0000
hwpmc: add credential-transition exec tests (keep and drop)
The companion to pmc_exec_test.c, which covers only the drop side of a
credential-changing exec. Three cases cover what the drop must not
overreach into: an exec that changes no credentials keeps the PMC, a
set-id exec whose credential change the kernel suppresses for a traced
target keeps it too, and a set-id fexecve(2) drops it. They exercise
the permission logic FreeBSD-SA-26:56.hwpmc reworked, not the defect
it fixed.
All three pass on a debug (INVARIANTS+WITNESS) kernel. The two
keep-cases were each observed to fail on a kernel mutated to detach
unconditionally.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 4.8)
---
tests/sys/pmc/Makefile | 1 +
tests/sys/pmc/pmc_credexec_test.c | 348 ++++++++++++++++++++++++++++++++++++++
2 files changed, 349 insertions(+)
diff --git a/tests/sys/pmc/Makefile b/tests/sys/pmc/Makefile
index b0b8d2108ff1..7a9bfdeab947 100644
--- a/tests/sys/pmc/Makefile
+++ b/tests/sys/pmc/Makefile
@@ -1,6 +1,7 @@
TESTSDIR= ${TESTSBASE}/sys/pmc
ATF_TESTS_C+= pmc_api_test
+ATF_TESTS_C+= pmc_credexec_test
ATF_TESTS_C+= pmc_detach_test
ATF_TESTS_C+= pmc_exec_test
ATF_TESTS_C+= pmc_lifecycle_test
diff --git a/tests/sys/pmc/pmc_credexec_test.c b/tests/sys/pmc/pmc_credexec_test.c
new file mode 100644
index 000000000000..e080b683f2e9
--- /dev/null
+++ b/tests/sys/pmc/pmc_credexec_test.c
@@ -0,0 +1,348 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2026 Alexander Leidinger <netchild@FreeBSD.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other advertising materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/**
+ * @file
+ * Credential-transition tests for a process-mode PMC across exec(), the
+ * companion to pmc_exec_test.c. Where that file proves the driver drops a
+ * PMC when its target execs into credentials its owner may no longer
+ * trace, these prove the two cases the drop must not overreach into: an
+ * exec that changes no credentials keeps the PMC, and an exec of a set-id
+ * binary whose credential change the kernel then suppresses, because the
+ * target is ptrace(2)d, keeps it too - do_execve() derives the set-id from
+ * the image alone and suppresses it afterwards, clearing P_SUGID and
+ * leaving the ids untouched, so the owner is still entitled. The third
+ * case covers fexecve(2), which reaches the same hook as execve(2).
+ * These exercise what FreeBSD-SA-26:56.hwpmc reworked, not what it fixed.
+ *
+ * As in pmc_exec_test.c the owner must be unprivileged, and the test must
+ * not lower its own privilege: setuid(2) sets P_SUGID, fork(2) passes it
+ * to the target, and p_candebug() then refuses that target to its own
+ * owner. Not covered, because each needs privileged setup a require.user
+ * body cannot build: a set-id exec on a nosuid mount, a set-id #!
+ * interpreter, and the two jail transitions.
+ */
+
+#include <sys/types.h>
+#include <sys/ptrace.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <pmc.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <atf-c.h>
+
+static const char *counting_events[] = {
+ "instructions",
+ "cycles",
+ "branches",
+ "unhalted-core-cycles",
+ "inst_retired.any",
+ "cpu_clk_unhalted.thread",
+ "ls_not_halted_cyc",
+ NULL
+};
+
+/**
+ * @internal
+ * Exec targets. 'setid' is the bit the entry must carry to exercise the
+ * case; the argument vectors are chosen so the program touches nothing.
+ * A target that blocks on stdin stays alive after the exec so that the
+ * still-attached question can be asked; the caller holds the read end open.
+ */
+struct exec_target {
+ const char *path;
+ const char *const argv[5];
+ mode_t setid;
+ int blocks_on_stdin;
+};
+
+/**
+ * @internal
+ * Set-gid, blocks on stdin: stays alive so "still attached?" is answerable.
+ */
+static const struct exec_target setgid_targets[] = {
+ { "/usr/bin/wall", { "wall", NULL }, S_ISGID, 1 },
+ { NULL, { NULL }, 0, 0 }
+};
+
+/** Set-uid, exits at once: for a drop-case, completing without a panic is
+ * @internal
+ * the whole assertion. */
+static const struct exec_target setuid_targets[] = {
+ { "/sbin/ping", { "ping", "-c", "1", "127.0.0.1", NULL }, S_ISUID, 0 },
+ { NULL, { NULL }, 0, 0 }
+};
+
+/** An ordinary, non-set-id target that blocks: sleep ignores stdin but
+ * @internal
+ * stays alive on its own, which is all exec_ordinary_keeps_pmc needs. */
+static const struct exec_target ordinary_targets[] = {
+ { "/bin/sleep", { "sleep", "30", NULL }, 0, 0 },
+ { NULL, { NULL }, 0, 0 }
+};
+
+static const struct exec_target *
+pick_target(const struct exec_target *tab, bool need_setid)
+{
+ struct stat sb;
+ int i;
+
+ for (i = 0; tab[i].path != NULL; i++) {
+ if (stat(tab[i].path, &sb) != 0)
+ continue;
+ if (need_setid && (sb.st_mode & tab[i].setid) == 0)
+ continue;
+ return (&tab[i]);
+ }
+ return (NULL);
+}
+
+static pmc_id_t
+allocate_counting_pmc(void)
+{
+ pmc_id_t id = PMC_ID_INVALID;
+ int i;
+
+ for (i = 0; counting_events[i] != NULL; i++) {
+ if (pmc_allocate(counting_events[i], PMC_MODE_TC, 0,
+ PMC_CPU_ANY, &id, 0) == 0)
+ return (id);
+ }
+ return (PMC_ID_INVALID);
+}
+
+static void
+spin(void)
+{
+ volatile unsigned long s = 0;
+ int i;
+
+ for (i = 0; i < 2000000; i++)
+ s += i;
+}
+
+static void
+require_unprivileged_owner(void)
+{
+
+ if (geteuid() == 0)
+ atf_tc_skip("the PMC owner must be unprivileged: root may "
+ "trace any credentials, so the check under test is never "
+ "reached");
+}
+
+/**
+ * @internal
+ * How the target should behave between fork and the measured exec.
+ */
+enum exec_via {
+ VIA_EXECVE, /* plain execve(2) */
+ VIA_FEXECVE, /* fexecve(2) of an fd opened O_EXEC */
+ VIA_TRACED, /* PT_TRACE_ME first, so the exec is credential-safe */
+};
+
+/**
+ * @internal
+ * Fork a target, attach a running counting PMC, and let it exec. On
+ * return the PMC is released. When 'inspect' is set the target is expected
+ * to stay alive past the exec, and *still_attached reports whether the PMC
+ * survived it; a drop-case passes inspect=0 for a target that exits at once
+ * (it has already torn its own descriptor down, so there is nothing to ask).
+ */
+static void
+run_target(const struct exec_target *t, enum exec_via via, int inspect,
+ int *still_attached)
+{
+ pmc_id_t id;
+ pid_t target;
+ char token;
+ int gopipe[2], inpipe[2], status;
+
+ ATF_REQUIRE(pipe(gopipe) == 0);
+ ATF_REQUIRE(pipe(inpipe) == 0);
+ ATF_REQUIRE((target = fork()) >= 0);
+
+ if (target == 0) {
+ int fd;
+
+ (void)close(gopipe[1]);
+ if (t->blocks_on_stdin)
+ (void)dup2(inpipe[0], STDIN_FILENO);
+ (void)close(inpipe[1]);
+ if (via == VIA_TRACED)
+ (void)ptrace(PT_TRACE_ME, 0, NULL, 0);
+ if (read(gopipe[0], &token, 1) != 1)
+ _exit(1);
+ spin();
+ if (via == VIA_FEXECVE) {
+ if ((fd = open(t->path, O_EXEC)) < 0)
+ _exit(1);
+ (void)fexecve(fd, __DECONST(char **, t->argv), NULL);
+ } else {
+ (void)execv(t->path, __DECONST(char **, t->argv));
+ }
+ _exit(1);
+ }
+ (void)close(gopipe[0]);
+ (void)close(inpipe[0]);
+
+ if (pmc_init() != 0) {
+ (void)kill(target, SIGKILL);
+ (void)waitpid(target, &status, 0);
+ atf_tc_skip("hwpmc(4) is not available");
+ }
+ if ((id = allocate_counting_pmc()) == PMC_ID_INVALID) {
+ (void)kill(target, SIGKILL);
+ (void)waitpid(target, &status, 0);
+ atf_tc_skip("no process-mode counting event is allocatable");
+ }
+
+ ATF_REQUIRE_MSG(pmc_attach(id, target) == 0, "pmc_attach: %s",
+ strerror(errno));
+ ATF_REQUIRE(pmc_start(id) == 0);
+
+ /* Into the exec. */
+ ATF_REQUIRE(write(gopipe[1], "g", 1) == 1);
+ (void)close(gopipe[1]);
+
+ if (via == VIA_TRACED) {
+ /*
+ * The exec of a set-id binary under a tracer stops the
+ * target with SIGTRAP and leaves its credentials unchanged.
+ * Reap that stop and detach the tracer; the hwpmc decision
+ * was already taken at exec time, so from here the target
+ * runs as an ordinary blocked process.
+ */
+ ATF_REQUIRE(waitpid(target, &status, 0) == target);
+ ATF_REQUIRE_MSG(WIFSTOPPED(status),
+ "traced target did not stop at exec (status 0x%x)", status);
+ ATF_REQUIRE_MSG(ptrace(PT_DETACH, target, (caddr_t)1, 0) == 0,
+ "PT_DETACH: %s", strerror(errno));
+ }
+
+ if (inspect) {
+ (void)usleep(400000);
+ errno = 0;
+ *still_attached = pmc_detach(id, target) == 0;
+ if (!*still_attached)
+ ATF_REQUIRE_MSG(errno == ESRCH, "pmc_detach: %s",
+ strerror(errno));
+ (void)kill(target, SIGKILL);
+ } else {
+ *still_attached = 0;
+ }
+ (void)waitpid(target, &status, 0);
+ (void)pmc_release(id);
+}
+
+ATF_TC(exec_ordinary_keeps_pmc);
+ATF_TC_HEAD(exec_ordinary_keeps_pmc, tc)
+{
+
+ atf_tc_set_md_var(tc, "descr",
+ "a process-mode PMC survives an exec that does not change the "
+ "target's credentials");
+ atf_tc_set_md_var(tc, "require.user", "unprivileged");
+}
+ATF_TC_BODY(exec_ordinary_keeps_pmc, tc)
+{
+ const struct exec_target *t;
+ int still_attached;
+
+ require_unprivileged_owner();
+ if ((t = pick_target(ordinary_targets, false)) == NULL)
+ atf_tc_skip("no ordinary exec target available");
+
+ run_target(t, VIA_EXECVE, 1, &still_attached);
+ ATF_REQUIRE_MSG(still_attached,
+ "the PMC was dropped across an exec that changed no credentials");
+}
+
+ATF_TC(exec_setid_traced_keeps_pmc);
+ATF_TC_HEAD(exec_setid_traced_keeps_pmc, tc)
+{
+
+ atf_tc_set_md_var(tc, "descr",
+ "a process-mode PMC survives its target's exec of a set-id binary "
+ "when tracing suppresses the credential change and the owner "
+ "remains entitled");
+ atf_tc_set_md_var(tc, "require.user", "unprivileged");
+}
+ATF_TC_BODY(exec_setid_traced_keeps_pmc, tc)
+{
+ const struct exec_target *t;
+ int still_attached;
+
+ require_unprivileged_owner();
+ if ((t = pick_target(setgid_targets, true)) == NULL)
+ atf_tc_skip("no set-gid exec target available");
+
+ run_target(t, VIA_TRACED, 1, &still_attached);
+ ATF_REQUIRE_MSG(still_attached,
+ "the PMC was dropped although tracing left the target's "
+ "credentials unchanged and its owner still entitled");
+}
+
+ATF_TC(exec_fexecve_setid_drops_pmc);
+ATF_TC_HEAD(exec_fexecve_setid_drops_pmc, tc)
+{
+
+ atf_tc_set_md_var(tc, "descr",
+ "a process-mode PMC is detached when its target reaches a "
+ "credential-changing set-id binary through fexecve(2)");
+ atf_tc_set_md_var(tc, "require.user", "unprivileged");
+}
+ATF_TC_BODY(exec_fexecve_setid_drops_pmc, tc)
+{
+ const struct exec_target *t;
+ int still_attached;
+
+ require_unprivileged_owner();
+ if ((t = pick_target(setuid_targets, true)) == NULL)
+ atf_tc_skip("no set-uid exec target available");
+
+ /* Completing at all is the assertion. */
+ run_target(t, VIA_FEXECVE, 0, &still_attached);
+}
+
+ATF_TP_ADD_TCS(tp)
+{
+
+ ATF_TP_ADD_TC(tp, exec_ordinary_keeps_pmc);
+ ATF_TP_ADD_TC(tp, exec_setid_traced_keeps_pmc);
+ ATF_TP_ADD_TC(tp, exec_fexecve_setid_drops_pmc);
+
+ return (atf_no_error());
+}