€•uŒsphinx.addnodes”Œdocument”“”)”}”(Œ rawsource”Œ”Œchildren”]”(Œ translations”Œ LanguagesNode”“”)”}”(hhh]”(hŒ pending_xref”“”)”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…””}”Œparent”hsbaŒ attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ refdomain”Œstd”Œreftype”Œdoc”Œ reftarget”Œ,/translations/zh_CN/userspace-api/check_exec”Œmodname”NŒ classname”NŒ refexplicit”ˆuŒtagname”hhh ubh)”}”(hhh]”hŒChinese (Traditional)”…””}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ,/translations/zh_TW/userspace-api/check_exec”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒItalian”…””}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ,/translations/it_IT/userspace-api/check_exec”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒJapanese”…””}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ,/translations/ja_JP/userspace-api/check_exec”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒKorean”…””}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ,/translations/ko_KR/userspace-api/check_exec”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒPortuguese (Brazilian)”…””}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ,/translations/pt_BR/userspace-api/check_exec”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒSpanish”…””}”hh–sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ,/translations/sp_SP/userspace-api/check_exec”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h hhŒ _document”hŒsource”NŒline”NubhŒcomment”“”)”}”(hŒ SPDX-License-Identifier: GPL-2.0”h]”hŒ SPDX-License-Identifier: GPL-2.0”…””}”hh·sbah}”(h]”h ]”h"]”h$]”h&]”Œ xml:space”Œpreserve”uh1hµhhh²hh³ŒF/var/lib/git/docbuild/linux/Documentation/userspace-api/check_exec.rst”h´Kubh¶)”}”(hŒ'Copyright © 2024 Microsoft Corporation”h]”hŒ'Copyright © 2024 Microsoft Corporation”…””}”hhÈsbah}”(h]”h ]”h"]”h$]”h&]”hÅhÆuh1hµhhh²hh³hÇh´KubhŒsection”“”)”}”(hhh]”(hŒtitle”“”)”}”(hŒExecutability check”h]”hŒExecutability check”…””}”(hhÝh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÛhhØh²hh³hÇh´KubhŒ paragraph”“”)”}”(hX:The ``AT_EXECVE_CHECK`` :manpage:`execveat(2)` flag, and the ``SECBIT_EXEC_RESTRICT_FILE`` and ``SECBIT_EXEC_DENY_INTERACTIVE`` securebits are intended for script interpreters and dynamic linkers to enforce a consistent execution security policy handled by the kernel. See the `samples/check-exec/inc.c`_ example.”h]”(hŒThe ”…””}”(hhíh²hh³Nh´NubhŒliteral”“”)”}”(hŒ``AT_EXECVE_CHECK``”h]”hŒAT_EXECVE_CHECK”…””}”(hh÷h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhhíubhŒ ”…””}”(hhíh²hh³Nh´NubhŒmanpage”“”)”}”(hŒ:manpage:`execveat(2)`”h]”hŒ execveat(2)”…””}”(hj h²hh³Nh´Nubah}”(h]”h ]”j ah"]”h$]”h&]”hÅhÆŒpath”Œ execveat(2)”Œpage”Œexecveat”Œsection”Œ2”uh1j hhíubhŒ flag, and the ”…””}”(hhíh²hh³Nh´Nubhö)”}”(hŒ``SECBIT_EXEC_RESTRICT_FILE``”h]”hŒSECBIT_EXEC_RESTRICT_FILE”…””}”(hj#h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhhíubhŒ and ”…””}”(hhíh²hh³Nh´Nubhö)”}”(hŒ ``SECBIT_EXEC_DENY_INTERACTIVE``”h]”hŒSECBIT_EXEC_DENY_INTERACTIVE”…””}”(hj5h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhhíubhŒ— securebits are intended for script interpreters and dynamic linkers to enforce a consistent execution security policy handled by the kernel. See the ”…””}”(hhíh²hh³Nh´NubhŒ reference”“”)”}”(hŒ`samples/check-exec/inc.c`_”h]”hŒsamples/check-exec/inc.c”…””}”(hjIh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”Œname”Œsamples/check-exec/inc.c”Œrefuri”Œ`https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/samples/check-exec/inc.c”uh1jGhhíŒresolved”KubhŒ example.”…””}”(hhíh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÇh´KhhØh²hubhì)”}”(hXKWhether an interpreter should check these securebits or not depends on the security risk of running malicious scripts with respect to the execution environment, and whether the kernel can check if a script is trustworthy or not. For instance, Python scripts running on a server can use arbitrary syscalls and access arbitrary files. Such interpreters should then be enlighten to use these securebits and let users define their security policy. However, a JavaScript engine running in a web browser should already be sandboxed and then should not be able to harm the user's environment.”h]”hXMWhether an interpreter should check these securebits or not depends on the security risk of running malicious scripts with respect to the execution environment, and whether the kernel can check if a script is trustworthy or not. For instance, Python scripts running on a server can use arbitrary syscalls and access arbitrary files. Such interpreters should then be enlighten to use these securebits and let users define their security policy. However, a JavaScript engine running in a web browser should already be sandboxed and then should not be able to harm the user’s environment.”…””}”(hjfh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÇh´KhhØh²hubhì)”}”(hX™Script interpreters or dynamic linkers built for tailored execution environments (e.g. hardened Linux distributions or hermetic container images) could use ``AT_EXECVE_CHECK`` without checking the related securebits if backward compatibility is handled by something else (e.g. atomic update ensuring that all legitimate libraries are allowed to be executed). It is then recommended for script interpreters and dynamic linkers to check the securebits at run time by default, but also to provide the ability for custom builds to behave like if ``SECBIT_EXEC_RESTRICT_FILE`` or ``SECBIT_EXEC_DENY_INTERACTIVE`` were always set to 1 (i.e. always enforce restrictions).”h]”(hŒœScript interpreters or dynamic linkers built for tailored execution environments (e.g. hardened Linux distributions or hermetic container images) could use ”…””}”(hjth²hh³Nh´Nubhö)”}”(hŒ``AT_EXECVE_CHECK``”h]”hŒAT_EXECVE_CHECK”…””}”(hj|h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhjtubhXp without checking the related securebits if backward compatibility is handled by something else (e.g. atomic update ensuring that all legitimate libraries are allowed to be executed). It is then recommended for script interpreters and dynamic linkers to check the securebits at run time by default, but also to provide the ability for custom builds to behave like if ”…””}”(hjth²hh³Nh´Nubhö)”}”(hŒ``SECBIT_EXEC_RESTRICT_FILE``”h]”hŒSECBIT_EXEC_RESTRICT_FILE”…””}”(hjŽh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhjtubhŒ or ”…””}”(hjth²hh³Nh´Nubhö)”}”(hŒ ``SECBIT_EXEC_DENY_INTERACTIVE``”h]”hŒSECBIT_EXEC_DENY_INTERACTIVE”…””}”(hj h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhjtubhŒ9 were always set to 1 (i.e. always enforce restrictions).”…””}”(hjth²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÇh´KhhØh²hubh×)”}”(hhh]”(hÜ)”}”(hŒAT_EXECVE_CHECK”h]”hŒAT_EXECVE_CHECK”…””}”(hj»h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÛhj¸h²hh³hÇh´K"ubhì)”}”(hXPassing the ``AT_EXECVE_CHECK`` flag to :manpage:`execveat(2)` only performs a check on a regular file and returns 0 if execution of this file would be allowed, ignoring the file format and then the related interpreter dependencies (e.g. ELF libraries, script's shebang).”h]”(hŒ Passing the ”…””}”(hjÉh²hh³Nh´Nubhö)”}”(hŒ``AT_EXECVE_CHECK``”h]”hŒAT_EXECVE_CHECK”…””}”(hjÑh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhjÉubhŒ flag to ”…””}”(hjÉh²hh³Nh´Nubj )”}”(hŒ:manpage:`execveat(2)`”h]”hŒ execveat(2)”…””}”(hjãh²hh³Nh´Nubah}”(h]”h ]”j ah"]”h$]”h&]”hÅhÆjŒ execveat(2)”jŒexecveat”jjuh1j hjÉubhŒÓ only performs a check on a regular file and returns 0 if execution of this file would be allowed, ignoring the file format and then the related interpreter dependencies (e.g. ELF libraries, script’s shebang).”…””}”(hjÉh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÇh´K$hj¸h²hubhì)”}”(hX£Programs should always perform this check to apply kernel-level checks against files that are not directly executed by the kernel but passed to a user space interpreter instead. All files that contain executable code, from the point of view of the interpreter, should be checked. However the result of this check should only be enforced according to ``SECBIT_EXEC_RESTRICT_FILE`` or ``SECBIT_EXEC_DENY_INTERACTIVE.``.”h]”(hX`Programs should always perform this check to apply kernel-level checks against files that are not directly executed by the kernel but passed to a user space interpreter instead. All files that contain executable code, from the point of view of the interpreter, should be checked. However the result of this check should only be enforced according to ”…””}”(hjýh²hh³Nh´Nubhö)”}”(hŒ``SECBIT_EXEC_RESTRICT_FILE``”h]”hŒSECBIT_EXEC_RESTRICT_FILE”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhjýubhŒ or ”…””}”(hjýh²hh³Nh´Nubhö)”}”(hŒ!``SECBIT_EXEC_DENY_INTERACTIVE.``”h]”hŒSECBIT_EXEC_DENY_INTERACTIVE.”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhjýubhŒ.”…””}”(hjýh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÇh´K)hj¸h²hubhì)”}”(hXVThe main purpose of this flag is to improve the security and consistency of an execution environment to ensure that direct file execution (e.g. ``./script.sh``) and indirect file execution (e.g. ``sh script.sh``) lead to the same result. For instance, this can be used to check if a file is trustworthy according to the caller's environment.”h]”(hŒThe main purpose of this flag is to improve the security and consistency of an execution environment to ensure that direct file execution (e.g. ”…””}”(hj/h²hh³Nh´Nubhö)”}”(hŒ``./script.sh``”h]”hŒ ./script.sh”…””}”(hj7h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhj/ubhŒ$) and indirect file execution (e.g. ”…””}”(hj/h²hh³Nh´Nubhö)”}”(hŒ``sh script.sh``”h]”hŒ sh script.sh”…””}”(hjIh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhj/ubhŒ…) lead to the same result. For instance, this can be used to check if a file is trustworthy according to the caller’s environment.”…””}”(hj/h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÇh´K0hj¸h²hubhì)”}”(hXsIn a secure environment, libraries and any executable dependencies should also be checked. For instance, dynamic linking should make sure that all libraries are allowed for execution to avoid trivial bypass (e.g. using ``LD_PRELOAD``). For such secure execution environment to make sense, only trusted code should be executable, which also requires integrity guarantees.”h]”(hŒÜIn a secure environment, libraries and any executable dependencies should also be checked. For instance, dynamic linking should make sure that all libraries are allowed for execution to avoid trivial bypass (e.g. using ”…””}”(hjah²hh³Nh´Nubhö)”}”(hŒ``LD_PRELOAD``”h]”hŒ LD_PRELOAD”…””}”(hjih²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhjaubhŒ‰). For such secure execution environment to make sense, only trusted code should be executable, which also requires integrity guarantees.”…””}”(hjah²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÇh´K6hj¸h²hubhì)”}”(hŒ¸To avoid race conditions leading to time-of-check to time-of-use issues, ``AT_EXECVE_CHECK`` should be used with ``AT_EMPTY_PATH`` to check against a file descriptor instead of a path.”h]”(hŒITo avoid race conditions leading to time-of-check to time-of-use issues, ”…””}”(hjh²hh³Nh´Nubhö)”}”(hŒ``AT_EXECVE_CHECK``”h]”hŒAT_EXECVE_CHECK”…””}”(hj‰h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhjubhŒ should be used with ”…””}”(hjh²hh³Nh´Nubhö)”}”(hŒ``AT_EMPTY_PATH``”h]”hŒ AT_EMPTY_PATH”…””}”(hj›h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hõhjubhŒ6 to check against a file descriptor instead of a path.”…””}”(hjh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hëh³hÇh´K