mdwx: block memfd_create

Some profiles may need adjusting if app uses memfd_create(2) and
memory-deny-write-execute was enabled.

4 files changed, 40 insertions, 0 deletions

diff --git a/test/filters/memwrexe b/test/filters/memwrexe
index 3a079672c..669f0d320 100755
--- a/test/filters/memwrexe
+++ b/test/filters/memwrexe
diff --git a/test/filters/memwrexe-32.exp b/test/filters/memwrexe-32.exp
index bd6a191f9..d012ada55 100755
--- a/test/filters/memwrexe-32.exp
+++ b/test/filters/memwrexe-32.exp
@@ -29,6 +29,18 @@ expect {
         "mprotect successful" {puts "TESTING ERROR 12\n";exit}
         "Parent is shutting down"
 }
+after 100
+
+send --  "firejail --memory-deny-write-execute ./memwrexe-32 memfd_create\r"
+expect {
+        timeout {puts "TESTING ERROR 20\n";exit}
+        "Child process initialized"
+}
+expect {
+        timeout {puts "TESTING ERROR 21\n";exit}
+        "memfd_create successful" {puts "TESTING ERROR 22\n";exit}
+        "Parent is shutting down"
+}
 
 after 100
 puts "\nall done\n"
diff --git a/test/filters/memwrexe.c b/test/filters/memwrexe.c
index b43b232d1..12787f3a5 100644
--- a/test/filters/memwrexe.c
+++ b/test/filters/memwrexe.c
@@ -6,12 +6,14 @@
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <sys/mman.h>
+#include <sys/syscall.h>
 
 static void usage(void) {
         printf("memwrexe options\n");
         printf("where options is:\n");
         printf("\tmmap - mmap test\n");
         printf("\tmprotect - mprotect test\n");
+        printf("\tmemfd_create - memfd_create test\n");
 }
 
 int main(int argc, char **argv) {
@@ -72,4 +74,18 @@ int main(int argc, char **argv) {
 
                 return 0;
         }
+
+        else if (strcmp(argv[1], "memfd_create") == 0) {
+                int fd = syscall(SYS_memfd_create, "memfd_create", 0);
+                if (fd == -1) {
+                        fprintf(stderr, "TESTING ERROR: cannot run memfd_create test\n");
+                        return 1;
+                }
+                printf("memfd_create successful\n");
+
+                // wait for expect to timeout
+                sleep(100);
+
+                return 0;
+        }
 }
diff --git a/test/filters/memwrexe.exp b/test/filters/memwrexe.exp
index da68b3b5f..d437d1ac5 100755
--- a/test/filters/memwrexe.exp
+++ b/test/filters/memwrexe.exp
@@ -29,6 +29,18 @@ expect {
         "mprotect successful" {puts "TESTING ERROR 12\n";exit}
         "Parent is shutting down"
 }
+after 100
+
+send --  "firejail --memory-deny-write-execute ./memwrexe memfd_create\r"
+expect {
+        timeout {puts "TESTING ERROR 20\n";exit}
+        "Child process initialized"
+}
+expect {
+        timeout {puts "TESTING ERROR 21\n";exit}
+        "memfd_create successful" {puts "TESTING ERROR 22\n";exit}
+        "Parent is shutting down"
+}
 
 after 100
 puts "\nall done\n"