Commit | Line | Data |
---|---|---|
e500db3f | 1 | // SPDX-License-Identifier: GPL-2.0-only |
c99ee51a KC |
2 | /* |
3 | * Copyright (c) 2012 The Chromium OS Authors. All rights reserved. | |
c99ee51a KC |
4 | * |
5 | * Test code for seccomp bpf. | |
6 | */ | |
7 | ||
6a21cc50 | 8 | #define _GNU_SOURCE |
0ce105bf | 9 | #include <sys/types.h> |
10859f38 KC |
10 | |
11 | /* | |
12 | * glibc 2.26 and later have SIGSYS in siginfo_t. Before that, | |
13 | * we need to use the kernel's siginfo.h file and trick glibc | |
14 | * into accepting it. | |
15 | */ | |
16 | #if !__GLIBC_PREREQ(2, 26) | |
17 | # include <asm/siginfo.h> | |
18 | # define __have_siginfo_t 1 | |
19 | # define __have_sigval_t 1 | |
20 | # define __have_sigevent_t 1 | |
21 | #endif | |
c99ee51a KC |
22 | |
23 | #include <errno.h> | |
24 | #include <linux/filter.h> | |
25 | #include <sys/prctl.h> | |
26 | #include <sys/ptrace.h> | |
27 | #include <sys/user.h> | |
28 | #include <linux/prctl.h> | |
29 | #include <linux/ptrace.h> | |
30 | #include <linux/seccomp.h> | |
c99ee51a KC |
31 | #include <pthread.h> |
32 | #include <semaphore.h> | |
33 | #include <signal.h> | |
34 | #include <stddef.h> | |
35 | #include <stdbool.h> | |
36 | #include <string.h> | |
256d0afb | 37 | #include <time.h> |
223e660b | 38 | #include <limits.h> |
c99ee51a KC |
39 | #include <linux/elf.h> |
40 | #include <sys/uio.h> | |
256d0afb | 41 | #include <sys/utsname.h> |
fd88d16c RS |
42 | #include <sys/fcntl.h> |
43 | #include <sys/mman.h> | |
44 | #include <sys/times.h> | |
6a21cc50 TA |
45 | #include <sys/socket.h> |
46 | #include <sys/ioctl.h> | |
0eebfed2 | 47 | #include <linux/kcmp.h> |
c99ee51a | 48 | |
c99ee51a KC |
49 | #include <unistd.h> |
50 | #include <sys/syscall.h> | |
6a21cc50 | 51 | #include <poll.h> |
c99ee51a | 52 | |
0b40808a | 53 | #include "../kselftest_harness.h" |
ad568218 | 54 | #include "../clone3/clone3_selftests.h" |
c99ee51a | 55 | |
8b1bc88c KC |
56 | /* Attempt to de-conflict with the selftests tree. */ |
57 | #ifndef SKIP | |
58 | #define SKIP(s, ...) XFAIL(s, ##__VA_ARGS__) | |
59 | #endif | |
60 | ||
c99ee51a KC |
61 | #ifndef PR_SET_PTRACER |
62 | # define PR_SET_PTRACER 0x59616d61 | |
63 | #endif | |
64 | ||
65 | #ifndef PR_SET_NO_NEW_PRIVS | |
66 | #define PR_SET_NO_NEW_PRIVS 38 | |
67 | #define PR_GET_NO_NEW_PRIVS 39 | |
68 | #endif | |
69 | ||
70 | #ifndef PR_SECCOMP_EXT | |
71 | #define PR_SECCOMP_EXT 43 | |
72 | #endif | |
73 | ||
74 | #ifndef SECCOMP_EXT_ACT | |
75 | #define SECCOMP_EXT_ACT 1 | |
76 | #endif | |
77 | ||
78 | #ifndef SECCOMP_EXT_ACT_TSYNC | |
79 | #define SECCOMP_EXT_ACT_TSYNC 1 | |
80 | #endif | |
81 | ||
82 | #ifndef SECCOMP_MODE_STRICT | |
83 | #define SECCOMP_MODE_STRICT 1 | |
84 | #endif | |
85 | ||
86 | #ifndef SECCOMP_MODE_FILTER | |
87 | #define SECCOMP_MODE_FILTER 2 | |
88 | #endif | |
89 | ||
f3e1821d | 90 | #ifndef SECCOMP_RET_ALLOW |
c99ee51a KC |
91 | struct seccomp_data { |
92 | int nr; | |
93 | __u32 arch; | |
94 | __u64 instruction_pointer; | |
95 | __u64 args[6]; | |
96 | }; | |
97 | #endif | |
98 | ||
f3e1821d KC |
99 | #ifndef SECCOMP_RET_KILL_PROCESS |
100 | #define SECCOMP_RET_KILL_PROCESS 0x80000000U /* kill the process */ | |
fd76875c KC |
101 | #define SECCOMP_RET_KILL_THREAD 0x00000000U /* kill the thread */ |
102 | #endif | |
c99ee51a | 103 | #ifndef SECCOMP_RET_KILL |
fd76875c KC |
104 | #define SECCOMP_RET_KILL SECCOMP_RET_KILL_THREAD |
105 | #define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */ | |
106 | #define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */ | |
107 | #define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */ | |
108 | #define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */ | |
59f5cf44 TH |
109 | #endif |
110 | #ifndef SECCOMP_RET_LOG | |
fd76875c | 111 | #define SECCOMP_RET_LOG 0x7ffc0000U /* allow after logging */ |
59f5cf44 | 112 | #endif |
c99ee51a | 113 | |
f3e1821d KC |
114 | #ifndef __NR_seccomp |
115 | # if defined(__i386__) | |
116 | # define __NR_seccomp 354 | |
117 | # elif defined(__x86_64__) | |
118 | # define __NR_seccomp 317 | |
119 | # elif defined(__arm__) | |
120 | # define __NR_seccomp 383 | |
121 | # elif defined(__aarch64__) | |
122 | # define __NR_seccomp 277 | |
5340627e DA |
123 | # elif defined(__riscv) |
124 | # define __NR_seccomp 277 | |
f3e1821d KC |
125 | # elif defined(__hppa__) |
126 | # define __NR_seccomp 338 | |
127 | # elif defined(__powerpc__) | |
128 | # define __NR_seccomp 358 | |
129 | # elif defined(__s390__) | |
130 | # define __NR_seccomp 348 | |
131 | # else | |
132 | # warning "seccomp syscall number unknown for this architecture" | |
133 | # define __NR_seccomp 0xffff | |
134 | # endif | |
135 | #endif | |
c99ee51a | 136 | |
f3e1821d KC |
137 | #ifndef SECCOMP_SET_MODE_STRICT |
138 | #define SECCOMP_SET_MODE_STRICT 0 | |
139 | #endif | |
140 | ||
141 | #ifndef SECCOMP_SET_MODE_FILTER | |
142 | #define SECCOMP_SET_MODE_FILTER 1 | |
143 | #endif | |
144 | ||
145 | #ifndef SECCOMP_GET_ACTION_AVAIL | |
146 | #define SECCOMP_GET_ACTION_AVAIL 2 | |
147 | #endif | |
148 | ||
6a21cc50 TA |
149 | #ifndef SECCOMP_GET_NOTIF_SIZES |
150 | #define SECCOMP_GET_NOTIF_SIZES 3 | |
151 | #endif | |
152 | ||
f3e1821d | 153 | #ifndef SECCOMP_FILTER_FLAG_TSYNC |
00a02d0c | 154 | #define SECCOMP_FILTER_FLAG_TSYNC (1UL << 0) |
f3e1821d KC |
155 | #endif |
156 | ||
157 | #ifndef SECCOMP_FILTER_FLAG_LOG | |
00a02d0c KC |
158 | #define SECCOMP_FILTER_FLAG_LOG (1UL << 1) |
159 | #endif | |
160 | ||
161 | #ifndef SECCOMP_FILTER_FLAG_SPEC_ALLOW | |
162 | #define SECCOMP_FILTER_FLAG_SPEC_ALLOW (1UL << 2) | |
f3e1821d KC |
163 | #endif |
164 | ||
d057dc4e TA |
165 | #ifndef PTRACE_SECCOMP_GET_METADATA |
166 | #define PTRACE_SECCOMP_GET_METADATA 0x420d | |
167 | ||
168 | struct seccomp_metadata { | |
169 | __u64 filter_off; /* Input: which filter */ | |
170 | __u64 flags; /* Output: filter's flags */ | |
171 | }; | |
172 | #endif | |
173 | ||
6a21cc50 TA |
174 | #ifndef SECCOMP_FILTER_FLAG_NEW_LISTENER |
175 | #define SECCOMP_FILTER_FLAG_NEW_LISTENER (1UL << 3) | |
176 | ||
177 | #define SECCOMP_RET_USER_NOTIF 0x7fc00000U | |
178 | ||
179 | #define SECCOMP_IOC_MAGIC '!' | |
180 | #define SECCOMP_IO(nr) _IO(SECCOMP_IOC_MAGIC, nr) | |
181 | #define SECCOMP_IOR(nr, type) _IOR(SECCOMP_IOC_MAGIC, nr, type) | |
182 | #define SECCOMP_IOW(nr, type) _IOW(SECCOMP_IOC_MAGIC, nr, type) | |
183 | #define SECCOMP_IOWR(nr, type) _IOWR(SECCOMP_IOC_MAGIC, nr, type) | |
184 | ||
185 | /* Flags for seccomp notification fd ioctl. */ | |
186 | #define SECCOMP_IOCTL_NOTIF_RECV SECCOMP_IOWR(0, struct seccomp_notif) | |
187 | #define SECCOMP_IOCTL_NOTIF_SEND SECCOMP_IOWR(1, \ | |
188 | struct seccomp_notif_resp) | |
47e33c05 | 189 | #define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOW(2, __u64) |
6a21cc50 TA |
190 | |
191 | struct seccomp_notif { | |
192 | __u64 id; | |
193 | __u32 pid; | |
194 | __u32 flags; | |
195 | struct seccomp_data data; | |
196 | }; | |
197 | ||
198 | struct seccomp_notif_resp { | |
199 | __u64 id; | |
200 | __s64 val; | |
201 | __s32 error; | |
202 | __u32 flags; | |
203 | }; | |
204 | ||
205 | struct seccomp_notif_sizes { | |
206 | __u16 seccomp_notif; | |
207 | __u16 seccomp_notif_resp; | |
208 | __u16 seccomp_data; | |
209 | }; | |
210 | #endif | |
211 | ||
88282297 TA |
212 | #ifndef PTRACE_EVENTMSG_SYSCALL_ENTRY |
213 | #define PTRACE_EVENTMSG_SYSCALL_ENTRY 1 | |
214 | #define PTRACE_EVENTMSG_SYSCALL_EXIT 2 | |
215 | #endif | |
216 | ||
2aa8d8d0 CB |
217 | #ifndef SECCOMP_USER_NOTIF_FLAG_CONTINUE |
218 | #define SECCOMP_USER_NOTIF_FLAG_CONTINUE 0x00000001 | |
219 | #endif | |
220 | ||
51891498 TA |
221 | #ifndef SECCOMP_FILTER_FLAG_TSYNC_ESRCH |
222 | #define SECCOMP_FILTER_FLAG_TSYNC_ESRCH (1UL << 4) | |
223 | #endif | |
224 | ||
f3e1821d KC |
225 | #ifndef seccomp |
226 | int seccomp(unsigned int op, unsigned int flags, void *args) | |
227 | { | |
228 | errno = 0; | |
229 | return syscall(__NR_seccomp, op, flags, args); | |
230 | } | |
c99ee51a KC |
231 | #endif |
232 | ||
c385d0db | 233 | #if __BYTE_ORDER == __LITTLE_ENDIAN |
c99ee51a | 234 | #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n])) |
c385d0db ME |
235 | #elif __BYTE_ORDER == __BIG_ENDIAN |
236 | #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]) + sizeof(__u32)) | |
237 | #else | |
238 | #error "wut? Unknown __BYTE_ORDER?!" | |
239 | #endif | |
c99ee51a KC |
240 | |
241 | #define SIBLING_EXIT_UNKILLED 0xbadbeef | |
242 | #define SIBLING_EXIT_FAILURE 0xbadface | |
243 | #define SIBLING_EXIT_NEWPRIVS 0xbadfeed | |
244 | ||
cf8918db KC |
245 | static int __filecmp(pid_t pid1, pid_t pid2, int fd1, int fd2) |
246 | { | |
247 | #ifdef __NR_kcmp | |
248 | errno = 0; | |
249 | return syscall(__NR_kcmp, pid1, pid2, KCMP_FILE, fd1, fd2); | |
250 | #else | |
251 | errno = ENOSYS; | |
252 | return -1; | |
253 | #endif | |
254 | } | |
255 | ||
256 | /* Have TH_LOG report actual location filecmp() is used. */ | |
257 | #define filecmp(pid1, pid2, fd1, fd2) ({ \ | |
258 | int _ret; \ | |
259 | \ | |
260 | _ret = __filecmp(pid1, pid2, fd1, fd2); \ | |
261 | if (_ret != 0) { \ | |
262 | if (_ret < 0 && errno == ENOSYS) { \ | |
263 | TH_LOG("kcmp() syscall missing (test is less accurate)");\ | |
264 | _ret = 0; \ | |
265 | } \ | |
266 | } \ | |
267 | _ret; }) | |
268 | ||
269 | TEST(kcmp) | |
270 | { | |
271 | int ret; | |
272 | ||
273 | ret = __filecmp(getpid(), getpid(), 1, 1); | |
274 | EXPECT_EQ(ret, 0); | |
275 | if (ret != 0 && errno == ENOSYS) | |
276 | SKIP(return, "Kernel does not support kcmp() (missing CONFIG_CHECKPOINT_RESTORE?)"); | |
277 | } | |
278 | ||
c99ee51a KC |
279 | TEST(mode_strict_support) |
280 | { | |
281 | long ret; | |
282 | ||
283 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL); | |
284 | ASSERT_EQ(0, ret) { | |
285 | TH_LOG("Kernel does not support CONFIG_SECCOMP"); | |
286 | } | |
369130b6 | 287 | syscall(__NR_exit, 0); |
c99ee51a KC |
288 | } |
289 | ||
290 | TEST_SIGNAL(mode_strict_cannot_call_prctl, SIGKILL) | |
291 | { | |
292 | long ret; | |
293 | ||
294 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL); | |
295 | ASSERT_EQ(0, ret) { | |
296 | TH_LOG("Kernel does not support CONFIG_SECCOMP"); | |
297 | } | |
298 | syscall(__NR_prctl, PR_SET_SECCOMP, SECCOMP_MODE_FILTER, | |
299 | NULL, NULL, NULL); | |
300 | EXPECT_FALSE(true) { | |
301 | TH_LOG("Unreachable!"); | |
302 | } | |
303 | } | |
304 | ||
305 | /* Note! This doesn't test no new privs behavior */ | |
306 | TEST(no_new_privs_support) | |
307 | { | |
308 | long ret; | |
309 | ||
310 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
311 | EXPECT_EQ(0, ret) { | |
312 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
313 | } | |
314 | } | |
315 | ||
f3f6e306 | 316 | /* Tests kernel support by checking for a copy_from_user() fault on NULL. */ |
c99ee51a KC |
317 | TEST(mode_filter_support) |
318 | { | |
319 | long ret; | |
320 | ||
321 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0); | |
322 | ASSERT_EQ(0, ret) { | |
323 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
324 | } | |
325 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, NULL, NULL); | |
326 | EXPECT_EQ(-1, ret); | |
327 | EXPECT_EQ(EFAULT, errno) { | |
328 | TH_LOG("Kernel does not support CONFIG_SECCOMP_FILTER!"); | |
329 | } | |
330 | } | |
331 | ||
332 | TEST(mode_filter_without_nnp) | |
333 | { | |
334 | struct sock_filter filter[] = { | |
335 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
336 | }; | |
337 | struct sock_fprog prog = { | |
338 | .len = (unsigned short)ARRAY_SIZE(filter), | |
339 | .filter = filter, | |
340 | }; | |
341 | long ret; | |
342 | ||
343 | ret = prctl(PR_GET_NO_NEW_PRIVS, 0, NULL, 0, 0); | |
344 | ASSERT_LE(0, ret) { | |
345 | TH_LOG("Expected 0 or unsupported for NO_NEW_PRIVS"); | |
346 | } | |
347 | errno = 0; | |
348 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
349 | /* Succeeds with CAP_SYS_ADMIN, fails without */ | |
350 | /* TODO(wad) check caps not euid */ | |
351 | if (geteuid()) { | |
352 | EXPECT_EQ(-1, ret); | |
353 | EXPECT_EQ(EACCES, errno); | |
354 | } else { | |
355 | EXPECT_EQ(0, ret); | |
356 | } | |
357 | } | |
358 | ||
359 | #define MAX_INSNS_PER_PATH 32768 | |
360 | ||
361 | TEST(filter_size_limits) | |
362 | { | |
363 | int i; | |
364 | int count = BPF_MAXINSNS + 1; | |
365 | struct sock_filter allow[] = { | |
366 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
367 | }; | |
368 | struct sock_filter *filter; | |
369 | struct sock_fprog prog = { }; | |
370 | long ret; | |
371 | ||
372 | filter = calloc(count, sizeof(*filter)); | |
373 | ASSERT_NE(NULL, filter); | |
374 | ||
375 | for (i = 0; i < count; i++) | |
376 | filter[i] = allow[0]; | |
377 | ||
378 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
379 | ASSERT_EQ(0, ret); | |
380 | ||
381 | prog.filter = filter; | |
382 | prog.len = count; | |
383 | ||
384 | /* Too many filter instructions in a single filter. */ | |
385 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
386 | ASSERT_NE(0, ret) { | |
387 | TH_LOG("Installing %d insn filter was allowed", prog.len); | |
388 | } | |
389 | ||
390 | /* One less is okay, though. */ | |
391 | prog.len -= 1; | |
392 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
393 | ASSERT_EQ(0, ret) { | |
394 | TH_LOG("Installing %d insn filter wasn't allowed", prog.len); | |
395 | } | |
396 | } | |
397 | ||
398 | TEST(filter_chain_limits) | |
399 | { | |
400 | int i; | |
401 | int count = BPF_MAXINSNS; | |
402 | struct sock_filter allow[] = { | |
403 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
404 | }; | |
405 | struct sock_filter *filter; | |
406 | struct sock_fprog prog = { }; | |
407 | long ret; | |
408 | ||
409 | filter = calloc(count, sizeof(*filter)); | |
410 | ASSERT_NE(NULL, filter); | |
411 | ||
412 | for (i = 0; i < count; i++) | |
413 | filter[i] = allow[0]; | |
414 | ||
415 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
416 | ASSERT_EQ(0, ret); | |
417 | ||
418 | prog.filter = filter; | |
419 | prog.len = 1; | |
420 | ||
421 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
422 | ASSERT_EQ(0, ret); | |
423 | ||
424 | prog.len = count; | |
425 | ||
426 | /* Too many total filter instructions. */ | |
427 | for (i = 0; i < MAX_INSNS_PER_PATH; i++) { | |
428 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
429 | if (ret != 0) | |
430 | break; | |
431 | } | |
432 | ASSERT_NE(0, ret) { | |
433 | TH_LOG("Allowed %d %d-insn filters (total with penalties:%d)", | |
434 | i, count, i * (count + 4)); | |
435 | } | |
436 | } | |
437 | ||
438 | TEST(mode_filter_cannot_move_to_strict) | |
439 | { | |
440 | struct sock_filter filter[] = { | |
441 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
442 | }; | |
443 | struct sock_fprog prog = { | |
444 | .len = (unsigned short)ARRAY_SIZE(filter), | |
445 | .filter = filter, | |
446 | }; | |
447 | long ret; | |
448 | ||
449 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
450 | ASSERT_EQ(0, ret); | |
451 | ||
452 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
453 | ASSERT_EQ(0, ret); | |
454 | ||
455 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, 0, 0); | |
456 | EXPECT_EQ(-1, ret); | |
457 | EXPECT_EQ(EINVAL, errno); | |
458 | } | |
459 | ||
460 | ||
461 | TEST(mode_filter_get_seccomp) | |
462 | { | |
463 | struct sock_filter filter[] = { | |
464 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
465 | }; | |
466 | struct sock_fprog prog = { | |
467 | .len = (unsigned short)ARRAY_SIZE(filter), | |
468 | .filter = filter, | |
469 | }; | |
470 | long ret; | |
471 | ||
472 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
473 | ASSERT_EQ(0, ret); | |
474 | ||
475 | ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0); | |
476 | EXPECT_EQ(0, ret); | |
477 | ||
478 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
479 | ASSERT_EQ(0, ret); | |
480 | ||
481 | ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0); | |
482 | EXPECT_EQ(2, ret); | |
483 | } | |
484 | ||
485 | ||
486 | TEST(ALLOW_all) | |
487 | { | |
488 | struct sock_filter filter[] = { | |
489 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
490 | }; | |
491 | struct sock_fprog prog = { | |
492 | .len = (unsigned short)ARRAY_SIZE(filter), | |
493 | .filter = filter, | |
494 | }; | |
495 | long ret; | |
496 | ||
497 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
498 | ASSERT_EQ(0, ret); | |
499 | ||
500 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
501 | ASSERT_EQ(0, ret); | |
502 | } | |
503 | ||
504 | TEST(empty_prog) | |
505 | { | |
506 | struct sock_filter filter[] = { | |
507 | }; | |
508 | struct sock_fprog prog = { | |
509 | .len = (unsigned short)ARRAY_SIZE(filter), | |
510 | .filter = filter, | |
511 | }; | |
512 | long ret; | |
513 | ||
514 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
515 | ASSERT_EQ(0, ret); | |
516 | ||
517 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
518 | EXPECT_EQ(-1, ret); | |
519 | EXPECT_EQ(EINVAL, errno); | |
520 | } | |
521 | ||
59f5cf44 TH |
522 | TEST(log_all) |
523 | { | |
524 | struct sock_filter filter[] = { | |
525 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG), | |
526 | }; | |
527 | struct sock_fprog prog = { | |
528 | .len = (unsigned short)ARRAY_SIZE(filter), | |
529 | .filter = filter, | |
530 | }; | |
531 | long ret; | |
532 | pid_t parent = getppid(); | |
533 | ||
534 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
535 | ASSERT_EQ(0, ret); | |
536 | ||
537 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
538 | ASSERT_EQ(0, ret); | |
539 | ||
540 | /* getppid() should succeed and be logged (no check for logging) */ | |
541 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
542 | } | |
543 | ||
c99ee51a KC |
544 | TEST_SIGNAL(unknown_ret_is_kill_inside, SIGSYS) |
545 | { | |
546 | struct sock_filter filter[] = { | |
547 | BPF_STMT(BPF_RET|BPF_K, 0x10000000U), | |
548 | }; | |
549 | struct sock_fprog prog = { | |
550 | .len = (unsigned short)ARRAY_SIZE(filter), | |
551 | .filter = filter, | |
552 | }; | |
553 | long ret; | |
554 | ||
555 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
556 | ASSERT_EQ(0, ret); | |
557 | ||
558 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
559 | ASSERT_EQ(0, ret); | |
560 | EXPECT_EQ(0, syscall(__NR_getpid)) { | |
561 | TH_LOG("getpid() shouldn't ever return"); | |
562 | } | |
563 | } | |
564 | ||
565 | /* return code >= 0x80000000 is unused. */ | |
566 | TEST_SIGNAL(unknown_ret_is_kill_above_allow, SIGSYS) | |
567 | { | |
568 | struct sock_filter filter[] = { | |
569 | BPF_STMT(BPF_RET|BPF_K, 0x90000000U), | |
570 | }; | |
571 | struct sock_fprog prog = { | |
572 | .len = (unsigned short)ARRAY_SIZE(filter), | |
573 | .filter = filter, | |
574 | }; | |
575 | long ret; | |
576 | ||
577 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
578 | ASSERT_EQ(0, ret); | |
579 | ||
580 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
581 | ASSERT_EQ(0, ret); | |
582 | EXPECT_EQ(0, syscall(__NR_getpid)) { | |
583 | TH_LOG("getpid() shouldn't ever return"); | |
584 | } | |
585 | } | |
586 | ||
587 | TEST_SIGNAL(KILL_all, SIGSYS) | |
588 | { | |
589 | struct sock_filter filter[] = { | |
590 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
591 | }; | |
592 | struct sock_fprog prog = { | |
593 | .len = (unsigned short)ARRAY_SIZE(filter), | |
594 | .filter = filter, | |
595 | }; | |
596 | long ret; | |
597 | ||
598 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
599 | ASSERT_EQ(0, ret); | |
600 | ||
601 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
602 | ASSERT_EQ(0, ret); | |
603 | } | |
604 | ||
605 | TEST_SIGNAL(KILL_one, SIGSYS) | |
606 | { | |
607 | struct sock_filter filter[] = { | |
608 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
609 | offsetof(struct seccomp_data, nr)), | |
610 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), | |
611 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
612 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
613 | }; | |
614 | struct sock_fprog prog = { | |
615 | .len = (unsigned short)ARRAY_SIZE(filter), | |
616 | .filter = filter, | |
617 | }; | |
618 | long ret; | |
619 | pid_t parent = getppid(); | |
620 | ||
621 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
622 | ASSERT_EQ(0, ret); | |
623 | ||
624 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
625 | ASSERT_EQ(0, ret); | |
626 | ||
627 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
628 | /* getpid() should never return. */ | |
629 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
630 | } | |
631 | ||
632 | TEST_SIGNAL(KILL_one_arg_one, SIGSYS) | |
633 | { | |
fd88d16c | 634 | void *fatal_address; |
c99ee51a KC |
635 | struct sock_filter filter[] = { |
636 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
637 | offsetof(struct seccomp_data, nr)), | |
fd88d16c | 638 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_times, 1, 0), |
c99ee51a KC |
639 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), |
640 | /* Only both with lower 32-bit for now. */ | |
641 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(0)), | |
fd88d16c RS |
642 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, |
643 | (unsigned long)&fatal_address, 0, 1), | |
c99ee51a KC |
644 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), |
645 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
646 | }; | |
647 | struct sock_fprog prog = { | |
648 | .len = (unsigned short)ARRAY_SIZE(filter), | |
649 | .filter = filter, | |
650 | }; | |
651 | long ret; | |
652 | pid_t parent = getppid(); | |
fd88d16c RS |
653 | struct tms timebuf; |
654 | clock_t clock = times(&timebuf); | |
c99ee51a KC |
655 | |
656 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
657 | ASSERT_EQ(0, ret); | |
658 | ||
659 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
660 | ASSERT_EQ(0, ret); | |
661 | ||
662 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
fd88d16c RS |
663 | EXPECT_LE(clock, syscall(__NR_times, &timebuf)); |
664 | /* times() should never return. */ | |
665 | EXPECT_EQ(0, syscall(__NR_times, &fatal_address)); | |
c99ee51a KC |
666 | } |
667 | ||
668 | TEST_SIGNAL(KILL_one_arg_six, SIGSYS) | |
669 | { | |
fd88d16c RS |
670 | #ifndef __NR_mmap2 |
671 | int sysno = __NR_mmap; | |
672 | #else | |
673 | int sysno = __NR_mmap2; | |
674 | #endif | |
c99ee51a KC |
675 | struct sock_filter filter[] = { |
676 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
677 | offsetof(struct seccomp_data, nr)), | |
fd88d16c | 678 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, sysno, 1, 0), |
c99ee51a KC |
679 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), |
680 | /* Only both with lower 32-bit for now. */ | |
681 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(5)), | |
682 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 0x0C0FFEE, 0, 1), | |
683 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
684 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
685 | }; | |
686 | struct sock_fprog prog = { | |
687 | .len = (unsigned short)ARRAY_SIZE(filter), | |
688 | .filter = filter, | |
689 | }; | |
690 | long ret; | |
691 | pid_t parent = getppid(); | |
fd88d16c RS |
692 | int fd; |
693 | void *map1, *map2; | |
2ce47b44 BJZ |
694 | int page_size = sysconf(_SC_PAGESIZE); |
695 | ||
696 | ASSERT_LT(0, page_size); | |
c99ee51a KC |
697 | |
698 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
699 | ASSERT_EQ(0, ret); | |
700 | ||
701 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
702 | ASSERT_EQ(0, ret); | |
703 | ||
fd88d16c RS |
704 | fd = open("/dev/zero", O_RDONLY); |
705 | ASSERT_NE(-1, fd); | |
706 | ||
c99ee51a | 707 | EXPECT_EQ(parent, syscall(__NR_getppid)); |
fd88d16c | 708 | map1 = (void *)syscall(sysno, |
2ce47b44 | 709 | NULL, page_size, PROT_READ, MAP_PRIVATE, fd, page_size); |
fd88d16c RS |
710 | EXPECT_NE(MAP_FAILED, map1); |
711 | /* mmap2() should never return. */ | |
712 | map2 = (void *)syscall(sysno, | |
2ce47b44 | 713 | NULL, page_size, PROT_READ, MAP_PRIVATE, fd, 0x0C0FFEE); |
fd88d16c RS |
714 | EXPECT_EQ(MAP_FAILED, map2); |
715 | ||
716 | /* The test failed, so clean up the resources. */ | |
2ce47b44 BJZ |
717 | munmap(map1, page_size); |
718 | munmap(map2, page_size); | |
fd88d16c | 719 | close(fd); |
c99ee51a KC |
720 | } |
721 | ||
f3e1821d KC |
722 | /* This is a thread task to die via seccomp filter violation. */ |
723 | void *kill_thread(void *data) | |
724 | { | |
725 | bool die = (bool)data; | |
726 | ||
727 | if (die) { | |
728 | prctl(PR_GET_SECCOMP, 0, 0, 0, 0); | |
729 | return (void *)SIBLING_EXIT_FAILURE; | |
730 | } | |
731 | ||
732 | return (void *)SIBLING_EXIT_UNKILLED; | |
733 | } | |
734 | ||
735 | /* Prepare a thread that will kill itself or both of us. */ | |
736 | void kill_thread_or_group(struct __test_metadata *_metadata, bool kill_process) | |
737 | { | |
738 | pthread_t thread; | |
739 | void *status; | |
740 | /* Kill only when calling __NR_prctl. */ | |
741 | struct sock_filter filter_thread[] = { | |
742 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
743 | offsetof(struct seccomp_data, nr)), | |
744 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1), | |
745 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_THREAD), | |
746 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
747 | }; | |
748 | struct sock_fprog prog_thread = { | |
749 | .len = (unsigned short)ARRAY_SIZE(filter_thread), | |
750 | .filter = filter_thread, | |
751 | }; | |
752 | struct sock_filter filter_process[] = { | |
753 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
754 | offsetof(struct seccomp_data, nr)), | |
755 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1), | |
756 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_PROCESS), | |
757 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
758 | }; | |
759 | struct sock_fprog prog_process = { | |
760 | .len = (unsigned short)ARRAY_SIZE(filter_process), | |
761 | .filter = filter_process, | |
762 | }; | |
763 | ||
764 | ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
765 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
766 | } | |
767 | ||
768 | ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, | |
769 | kill_process ? &prog_process : &prog_thread)); | |
770 | ||
771 | /* | |
772 | * Add the KILL_THREAD rule again to make sure that the KILL_PROCESS | |
773 | * flag cannot be downgraded by a new filter. | |
774 | */ | |
775 | ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread)); | |
776 | ||
777 | /* Start a thread that will exit immediately. */ | |
778 | ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)false)); | |
779 | ASSERT_EQ(0, pthread_join(thread, &status)); | |
780 | ASSERT_EQ(SIBLING_EXIT_UNKILLED, (unsigned long)status); | |
781 | ||
782 | /* Start a thread that will die immediately. */ | |
783 | ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)true)); | |
784 | ASSERT_EQ(0, pthread_join(thread, &status)); | |
785 | ASSERT_NE(SIBLING_EXIT_FAILURE, (unsigned long)status); | |
786 | ||
787 | /* | |
788 | * If we get here, only the spawned thread died. Let the parent know | |
789 | * the whole process didn't die (i.e. this thread, the spawner, | |
790 | * stayed running). | |
791 | */ | |
792 | exit(42); | |
793 | } | |
794 | ||
795 | TEST(KILL_thread) | |
796 | { | |
797 | int status; | |
798 | pid_t child_pid; | |
799 | ||
800 | child_pid = fork(); | |
801 | ASSERT_LE(0, child_pid); | |
802 | if (child_pid == 0) { | |
803 | kill_thread_or_group(_metadata, false); | |
804 | _exit(38); | |
805 | } | |
806 | ||
807 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); | |
808 | ||
809 | /* If only the thread was killed, we'll see exit 42. */ | |
810 | ASSERT_TRUE(WIFEXITED(status)); | |
811 | ASSERT_EQ(42, WEXITSTATUS(status)); | |
812 | } | |
813 | ||
814 | TEST(KILL_process) | |
815 | { | |
816 | int status; | |
817 | pid_t child_pid; | |
818 | ||
819 | child_pid = fork(); | |
820 | ASSERT_LE(0, child_pid); | |
821 | if (child_pid == 0) { | |
822 | kill_thread_or_group(_metadata, true); | |
823 | _exit(38); | |
824 | } | |
825 | ||
826 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); | |
827 | ||
828 | /* If the entire process was killed, we'll see SIGSYS. */ | |
829 | ASSERT_TRUE(WIFSIGNALED(status)); | |
830 | ASSERT_EQ(SIGSYS, WTERMSIG(status)); | |
831 | } | |
832 | ||
c99ee51a KC |
833 | /* TODO(wad) add 64-bit versus 32-bit arg tests. */ |
834 | TEST(arg_out_of_range) | |
835 | { | |
836 | struct sock_filter filter[] = { | |
837 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(6)), | |
838 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
839 | }; | |
840 | struct sock_fprog prog = { | |
841 | .len = (unsigned short)ARRAY_SIZE(filter), | |
842 | .filter = filter, | |
843 | }; | |
844 | long ret; | |
845 | ||
846 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
847 | ASSERT_EQ(0, ret); | |
848 | ||
849 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
850 | EXPECT_EQ(-1, ret); | |
851 | EXPECT_EQ(EINVAL, errno); | |
852 | } | |
853 | ||
f3f6e306 KC |
854 | #define ERRNO_FILTER(name, errno) \ |
855 | struct sock_filter _read_filter_##name[] = { \ | |
856 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, \ | |
857 | offsetof(struct seccomp_data, nr)), \ | |
858 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1), \ | |
859 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | errno), \ | |
860 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), \ | |
861 | }; \ | |
862 | struct sock_fprog prog_##name = { \ | |
863 | .len = (unsigned short)ARRAY_SIZE(_read_filter_##name), \ | |
864 | .filter = _read_filter_##name, \ | |
865 | } | |
866 | ||
867 | /* Make sure basic errno values are correctly passed through a filter. */ | |
c99ee51a KC |
868 | TEST(ERRNO_valid) |
869 | { | |
f3f6e306 | 870 | ERRNO_FILTER(valid, E2BIG); |
c99ee51a KC |
871 | long ret; |
872 | pid_t parent = getppid(); | |
873 | ||
874 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
875 | ASSERT_EQ(0, ret); | |
876 | ||
f3f6e306 | 877 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_valid); |
c99ee51a KC |
878 | ASSERT_EQ(0, ret); |
879 | ||
880 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
881 | EXPECT_EQ(-1, read(0, NULL, 0)); | |
882 | EXPECT_EQ(E2BIG, errno); | |
883 | } | |
884 | ||
f3f6e306 | 885 | /* Make sure an errno of zero is correctly handled by the arch code. */ |
c99ee51a KC |
886 | TEST(ERRNO_zero) |
887 | { | |
f3f6e306 | 888 | ERRNO_FILTER(zero, 0); |
c99ee51a KC |
889 | long ret; |
890 | pid_t parent = getppid(); | |
891 | ||
892 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
893 | ASSERT_EQ(0, ret); | |
894 | ||
f3f6e306 | 895 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_zero); |
c99ee51a KC |
896 | ASSERT_EQ(0, ret); |
897 | ||
898 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
899 | /* "errno" of 0 is ok. */ | |
900 | EXPECT_EQ(0, read(0, NULL, 0)); | |
901 | } | |
902 | ||
f3f6e306 KC |
903 | /* |
904 | * The SECCOMP_RET_DATA mask is 16 bits wide, but errno is smaller. | |
905 | * This tests that the errno value gets capped correctly, fixed by | |
906 | * 580c57f10768 ("seccomp: cap SECCOMP_RET_ERRNO data to MAX_ERRNO"). | |
907 | */ | |
c99ee51a KC |
908 | TEST(ERRNO_capped) |
909 | { | |
f3f6e306 | 910 | ERRNO_FILTER(capped, 4096); |
c99ee51a KC |
911 | long ret; |
912 | pid_t parent = getppid(); | |
913 | ||
914 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
915 | ASSERT_EQ(0, ret); | |
916 | ||
f3f6e306 | 917 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_capped); |
c99ee51a KC |
918 | ASSERT_EQ(0, ret); |
919 | ||
920 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
921 | EXPECT_EQ(-1, read(0, NULL, 0)); | |
922 | EXPECT_EQ(4095, errno); | |
923 | } | |
924 | ||
f3f6e306 KC |
925 | /* |
926 | * Filters are processed in reverse order: last applied is executed first. | |
927 | * Since only the SECCOMP_RET_ACTION mask is tested for return values, the | |
928 | * SECCOMP_RET_DATA mask results will follow the most recently applied | |
929 | * matching filter return (and not the lowest or highest value). | |
930 | */ | |
931 | TEST(ERRNO_order) | |
932 | { | |
933 | ERRNO_FILTER(first, 11); | |
934 | ERRNO_FILTER(second, 13); | |
935 | ERRNO_FILTER(third, 12); | |
936 | long ret; | |
937 | pid_t parent = getppid(); | |
938 | ||
939 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
940 | ASSERT_EQ(0, ret); | |
941 | ||
942 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_first); | |
943 | ASSERT_EQ(0, ret); | |
944 | ||
945 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_second); | |
946 | ASSERT_EQ(0, ret); | |
947 | ||
948 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_third); | |
949 | ASSERT_EQ(0, ret); | |
950 | ||
951 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
952 | EXPECT_EQ(-1, read(0, NULL, 0)); | |
953 | EXPECT_EQ(12, errno); | |
954 | } | |
955 | ||
1ae81d78 | 956 | FIXTURE(TRAP) { |
c99ee51a KC |
957 | struct sock_fprog prog; |
958 | }; | |
959 | ||
960 | FIXTURE_SETUP(TRAP) | |
961 | { | |
962 | struct sock_filter filter[] = { | |
963 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
964 | offsetof(struct seccomp_data, nr)), | |
965 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), | |
966 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP), | |
967 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
968 | }; | |
969 | ||
970 | memset(&self->prog, 0, sizeof(self->prog)); | |
971 | self->prog.filter = malloc(sizeof(filter)); | |
972 | ASSERT_NE(NULL, self->prog.filter); | |
973 | memcpy(self->prog.filter, filter, sizeof(filter)); | |
974 | self->prog.len = (unsigned short)ARRAY_SIZE(filter); | |
975 | } | |
976 | ||
977 | FIXTURE_TEARDOWN(TRAP) | |
978 | { | |
979 | if (self->prog.filter) | |
980 | free(self->prog.filter); | |
981 | } | |
982 | ||
983 | TEST_F_SIGNAL(TRAP, dfl, SIGSYS) | |
984 | { | |
985 | long ret; | |
986 | ||
987 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
988 | ASSERT_EQ(0, ret); | |
989 | ||
990 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog); | |
991 | ASSERT_EQ(0, ret); | |
992 | syscall(__NR_getpid); | |
993 | } | |
994 | ||
995 | /* Ensure that SIGSYS overrides SIG_IGN */ | |
996 | TEST_F_SIGNAL(TRAP, ign, SIGSYS) | |
997 | { | |
998 | long ret; | |
999 | ||
1000 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1001 | ASSERT_EQ(0, ret); | |
1002 | ||
1003 | signal(SIGSYS, SIG_IGN); | |
1004 | ||
1005 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog); | |
1006 | ASSERT_EQ(0, ret); | |
1007 | syscall(__NR_getpid); | |
1008 | } | |
1009 | ||
10859f38 | 1010 | static siginfo_t TRAP_info; |
c99ee51a KC |
1011 | static volatile int TRAP_nr; |
1012 | static void TRAP_action(int nr, siginfo_t *info, void *void_context) | |
1013 | { | |
1014 | memcpy(&TRAP_info, info, sizeof(TRAP_info)); | |
1015 | TRAP_nr = nr; | |
1016 | } | |
1017 | ||
1018 | TEST_F(TRAP, handler) | |
1019 | { | |
1020 | int ret, test; | |
1021 | struct sigaction act; | |
1022 | sigset_t mask; | |
1023 | ||
1024 | memset(&act, 0, sizeof(act)); | |
1025 | sigemptyset(&mask); | |
1026 | sigaddset(&mask, SIGSYS); | |
1027 | ||
1028 | act.sa_sigaction = &TRAP_action; | |
1029 | act.sa_flags = SA_SIGINFO; | |
1030 | ret = sigaction(SIGSYS, &act, NULL); | |
1031 | ASSERT_EQ(0, ret) { | |
1032 | TH_LOG("sigaction failed"); | |
1033 | } | |
1034 | ret = sigprocmask(SIG_UNBLOCK, &mask, NULL); | |
1035 | ASSERT_EQ(0, ret) { | |
1036 | TH_LOG("sigprocmask failed"); | |
1037 | } | |
1038 | ||
1039 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1040 | ASSERT_EQ(0, ret); | |
1041 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog); | |
1042 | ASSERT_EQ(0, ret); | |
1043 | TRAP_nr = 0; | |
1044 | memset(&TRAP_info, 0, sizeof(TRAP_info)); | |
1045 | /* Expect the registers to be rolled back. (nr = error) may vary | |
1046 | * based on arch. */ | |
1047 | ret = syscall(__NR_getpid); | |
1048 | /* Silence gcc warning about volatile. */ | |
1049 | test = TRAP_nr; | |
1050 | EXPECT_EQ(SIGSYS, test); | |
1051 | struct local_sigsys { | |
1052 | void *_call_addr; /* calling user insn */ | |
1053 | int _syscall; /* triggering system call number */ | |
1054 | unsigned int _arch; /* AUDIT_ARCH_* of syscall */ | |
1055 | } *sigsys = (struct local_sigsys *) | |
1056 | #ifdef si_syscall | |
1057 | &(TRAP_info.si_call_addr); | |
1058 | #else | |
1059 | &TRAP_info.si_pid; | |
1060 | #endif | |
1061 | EXPECT_EQ(__NR_getpid, sigsys->_syscall); | |
1062 | /* Make sure arch is non-zero. */ | |
1063 | EXPECT_NE(0, sigsys->_arch); | |
1064 | EXPECT_NE(0, (unsigned long)sigsys->_call_addr); | |
1065 | } | |
1066 | ||
1ae81d78 | 1067 | FIXTURE(precedence) { |
c99ee51a | 1068 | struct sock_fprog allow; |
59f5cf44 | 1069 | struct sock_fprog log; |
c99ee51a KC |
1070 | struct sock_fprog trace; |
1071 | struct sock_fprog error; | |
1072 | struct sock_fprog trap; | |
1073 | struct sock_fprog kill; | |
1074 | }; | |
1075 | ||
1076 | FIXTURE_SETUP(precedence) | |
1077 | { | |
1078 | struct sock_filter allow_insns[] = { | |
1079 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1080 | }; | |
59f5cf44 TH |
1081 | struct sock_filter log_insns[] = { |
1082 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
1083 | offsetof(struct seccomp_data, nr)), | |
1084 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), | |
1085 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1086 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG), | |
1087 | }; | |
c99ee51a KC |
1088 | struct sock_filter trace_insns[] = { |
1089 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
1090 | offsetof(struct seccomp_data, nr)), | |
1091 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), | |
1092 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1093 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE), | |
1094 | }; | |
1095 | struct sock_filter error_insns[] = { | |
1096 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
1097 | offsetof(struct seccomp_data, nr)), | |
1098 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), | |
1099 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1100 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO), | |
1101 | }; | |
1102 | struct sock_filter trap_insns[] = { | |
1103 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
1104 | offsetof(struct seccomp_data, nr)), | |
1105 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), | |
1106 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1107 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP), | |
1108 | }; | |
1109 | struct sock_filter kill_insns[] = { | |
1110 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
1111 | offsetof(struct seccomp_data, nr)), | |
1112 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), | |
1113 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1114 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
1115 | }; | |
1116 | ||
1117 | memset(self, 0, sizeof(*self)); | |
1118 | #define FILTER_ALLOC(_x) \ | |
1119 | self->_x.filter = malloc(sizeof(_x##_insns)); \ | |
1120 | ASSERT_NE(NULL, self->_x.filter); \ | |
1121 | memcpy(self->_x.filter, &_x##_insns, sizeof(_x##_insns)); \ | |
1122 | self->_x.len = (unsigned short)ARRAY_SIZE(_x##_insns) | |
1123 | FILTER_ALLOC(allow); | |
59f5cf44 | 1124 | FILTER_ALLOC(log); |
c99ee51a KC |
1125 | FILTER_ALLOC(trace); |
1126 | FILTER_ALLOC(error); | |
1127 | FILTER_ALLOC(trap); | |
1128 | FILTER_ALLOC(kill); | |
1129 | } | |
1130 | ||
1131 | FIXTURE_TEARDOWN(precedence) | |
1132 | { | |
1133 | #define FILTER_FREE(_x) if (self->_x.filter) free(self->_x.filter) | |
1134 | FILTER_FREE(allow); | |
59f5cf44 | 1135 | FILTER_FREE(log); |
c99ee51a KC |
1136 | FILTER_FREE(trace); |
1137 | FILTER_FREE(error); | |
1138 | FILTER_FREE(trap); | |
1139 | FILTER_FREE(kill); | |
1140 | } | |
1141 | ||
1142 | TEST_F(precedence, allow_ok) | |
1143 | { | |
1144 | pid_t parent, res = 0; | |
1145 | long ret; | |
1146 | ||
1147 | parent = getppid(); | |
1148 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1149 | ASSERT_EQ(0, ret); | |
1150 | ||
1151 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1152 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
1153 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
1154 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1155 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
1156 | ASSERT_EQ(0, ret); | |
1157 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); | |
1158 | ASSERT_EQ(0, ret); | |
1159 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); | |
1160 | ASSERT_EQ(0, ret); | |
1161 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill); | |
1162 | ASSERT_EQ(0, ret); | |
1163 | /* Should work just fine. */ | |
1164 | res = syscall(__NR_getppid); | |
1165 | EXPECT_EQ(parent, res); | |
1166 | } | |
1167 | ||
1168 | TEST_F_SIGNAL(precedence, kill_is_highest, SIGSYS) | |
1169 | { | |
1170 | pid_t parent, res = 0; | |
1171 | long ret; | |
1172 | ||
1173 | parent = getppid(); | |
1174 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1175 | ASSERT_EQ(0, ret); | |
1176 | ||
1177 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1178 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
1179 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
1180 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1181 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
1182 | ASSERT_EQ(0, ret); | |
1183 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); | |
1184 | ASSERT_EQ(0, ret); | |
1185 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); | |
1186 | ASSERT_EQ(0, ret); | |
1187 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill); | |
1188 | ASSERT_EQ(0, ret); | |
1189 | /* Should work just fine. */ | |
1190 | res = syscall(__NR_getppid); | |
1191 | EXPECT_EQ(parent, res); | |
1192 | /* getpid() should never return. */ | |
1193 | res = syscall(__NR_getpid); | |
1194 | EXPECT_EQ(0, res); | |
1195 | } | |
1196 | ||
1197 | TEST_F_SIGNAL(precedence, kill_is_highest_in_any_order, SIGSYS) | |
1198 | { | |
1199 | pid_t parent; | |
1200 | long ret; | |
1201 | ||
1202 | parent = getppid(); | |
1203 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1204 | ASSERT_EQ(0, ret); | |
1205 | ||
1206 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1207 | ASSERT_EQ(0, ret); | |
1208 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill); | |
1209 | ASSERT_EQ(0, ret); | |
1210 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); | |
1211 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
1212 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
1213 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1214 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
1215 | ASSERT_EQ(0, ret); | |
1216 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); | |
1217 | ASSERT_EQ(0, ret); | |
1218 | /* Should work just fine. */ | |
1219 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1220 | /* getpid() should never return. */ | |
1221 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
1222 | } | |
1223 | ||
1224 | TEST_F_SIGNAL(precedence, trap_is_second, SIGSYS) | |
1225 | { | |
1226 | pid_t parent; | |
1227 | long ret; | |
1228 | ||
1229 | parent = getppid(); | |
1230 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1231 | ASSERT_EQ(0, ret); | |
1232 | ||
1233 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1234 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
1235 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
1236 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1237 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
1238 | ASSERT_EQ(0, ret); | |
1239 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); | |
1240 | ASSERT_EQ(0, ret); | |
1241 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); | |
1242 | ASSERT_EQ(0, ret); | |
1243 | /* Should work just fine. */ | |
1244 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1245 | /* getpid() should never return. */ | |
1246 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
1247 | } | |
1248 | ||
1249 | TEST_F_SIGNAL(precedence, trap_is_second_in_any_order, SIGSYS) | |
1250 | { | |
1251 | pid_t parent; | |
1252 | long ret; | |
1253 | ||
1254 | parent = getppid(); | |
1255 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1256 | ASSERT_EQ(0, ret); | |
1257 | ||
1258 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1259 | ASSERT_EQ(0, ret); | |
1260 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); | |
1261 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
1262 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
1263 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1264 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
1265 | ASSERT_EQ(0, ret); | |
1266 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); | |
1267 | ASSERT_EQ(0, ret); | |
1268 | /* Should work just fine. */ | |
1269 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1270 | /* getpid() should never return. */ | |
1271 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
1272 | } | |
1273 | ||
1274 | TEST_F(precedence, errno_is_third) | |
1275 | { | |
1276 | pid_t parent; | |
1277 | long ret; | |
1278 | ||
1279 | parent = getppid(); | |
1280 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1281 | ASSERT_EQ(0, ret); | |
1282 | ||
1283 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1284 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
1285 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
1286 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1287 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
1288 | ASSERT_EQ(0, ret); | |
1289 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); | |
1290 | ASSERT_EQ(0, ret); | |
1291 | /* Should work just fine. */ | |
1292 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1293 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
1294 | } | |
1295 | ||
1296 | TEST_F(precedence, errno_is_third_in_any_order) | |
1297 | { | |
1298 | pid_t parent; | |
1299 | long ret; | |
1300 | ||
1301 | parent = getppid(); | |
1302 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1303 | ASSERT_EQ(0, ret); | |
1304 | ||
59f5cf44 TH |
1305 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
1306 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1307 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); |
1308 | ASSERT_EQ(0, ret); | |
1309 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); | |
1310 | ASSERT_EQ(0, ret); | |
1311 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1312 | ASSERT_EQ(0, ret); | |
1313 | /* Should work just fine. */ | |
1314 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1315 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
1316 | } | |
1317 | ||
1318 | TEST_F(precedence, trace_is_fourth) | |
1319 | { | |
1320 | pid_t parent; | |
1321 | long ret; | |
1322 | ||
1323 | parent = getppid(); | |
1324 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1325 | ASSERT_EQ(0, ret); | |
1326 | ||
1327 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1328 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
1329 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
1330 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1331 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
1332 | ASSERT_EQ(0, ret); | |
1333 | /* Should work just fine. */ | |
1334 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1335 | /* No ptracer */ | |
1336 | EXPECT_EQ(-1, syscall(__NR_getpid)); | |
1337 | } | |
1338 | ||
1339 | TEST_F(precedence, trace_is_fourth_in_any_order) | |
1340 | { | |
1341 | pid_t parent; | |
1342 | long ret; | |
1343 | ||
1344 | parent = getppid(); | |
1345 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1346 | ASSERT_EQ(0, ret); | |
1347 | ||
1348 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); | |
1349 | ASSERT_EQ(0, ret); | |
1350 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1351 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
1352 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
1353 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1354 | /* Should work just fine. */ |
1355 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1356 | /* No ptracer */ | |
1357 | EXPECT_EQ(-1, syscall(__NR_getpid)); | |
1358 | } | |
1359 | ||
59f5cf44 TH |
1360 | TEST_F(precedence, log_is_fifth) |
1361 | { | |
1362 | pid_t mypid, parent; | |
1363 | long ret; | |
1364 | ||
1365 | mypid = getpid(); | |
1366 | parent = getppid(); | |
1367 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1368 | ASSERT_EQ(0, ret); | |
1369 | ||
1370 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1371 | ASSERT_EQ(0, ret); | |
1372 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); | |
1373 | ASSERT_EQ(0, ret); | |
1374 | /* Should work just fine. */ | |
1375 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1376 | /* Should also work just fine */ | |
1377 | EXPECT_EQ(mypid, syscall(__NR_getpid)); | |
1378 | } | |
1379 | ||
1380 | TEST_F(precedence, log_is_fifth_in_any_order) | |
1381 | { | |
1382 | pid_t mypid, parent; | |
1383 | long ret; | |
1384 | ||
1385 | mypid = getpid(); | |
1386 | parent = getppid(); | |
1387 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1388 | ASSERT_EQ(0, ret); | |
1389 | ||
1390 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); | |
1391 | ASSERT_EQ(0, ret); | |
1392 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1393 | ASSERT_EQ(0, ret); | |
1394 | /* Should work just fine. */ | |
1395 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1396 | /* Should also work just fine */ | |
1397 | EXPECT_EQ(mypid, syscall(__NR_getpid)); | |
1398 | } | |
1399 | ||
c99ee51a KC |
1400 | #ifndef PTRACE_O_TRACESECCOMP |
1401 | #define PTRACE_O_TRACESECCOMP 0x00000080 | |
1402 | #endif | |
1403 | ||
1404 | /* Catch the Ubuntu 12.04 value error. */ | |
1405 | #if PTRACE_EVENT_SECCOMP != 7 | |
1406 | #undef PTRACE_EVENT_SECCOMP | |
1407 | #endif | |
1408 | ||
1409 | #ifndef PTRACE_EVENT_SECCOMP | |
1410 | #define PTRACE_EVENT_SECCOMP 7 | |
1411 | #endif | |
1412 | ||
1413 | #define IS_SECCOMP_EVENT(status) ((status >> 16) == PTRACE_EVENT_SECCOMP) | |
1414 | bool tracer_running; | |
1415 | void tracer_stop(int sig) | |
1416 | { | |
1417 | tracer_running = false; | |
1418 | } | |
1419 | ||
1420 | typedef void tracer_func_t(struct __test_metadata *_metadata, | |
1421 | pid_t tracee, int status, void *args); | |
1422 | ||
58d0a862 KC |
1423 | void start_tracer(struct __test_metadata *_metadata, int fd, pid_t tracee, |
1424 | tracer_func_t tracer_func, void *args, bool ptrace_syscall) | |
c99ee51a KC |
1425 | { |
1426 | int ret = -1; | |
1427 | struct sigaction action = { | |
1428 | .sa_handler = tracer_stop, | |
1429 | }; | |
1430 | ||
1431 | /* Allow external shutdown. */ | |
1432 | tracer_running = true; | |
1433 | ASSERT_EQ(0, sigaction(SIGUSR1, &action, NULL)); | |
1434 | ||
1435 | errno = 0; | |
1436 | while (ret == -1 && errno != EINVAL) | |
1437 | ret = ptrace(PTRACE_ATTACH, tracee, NULL, 0); | |
1438 | ASSERT_EQ(0, ret) { | |
1439 | kill(tracee, SIGKILL); | |
1440 | } | |
1441 | /* Wait for attach stop */ | |
1442 | wait(NULL); | |
1443 | ||
58d0a862 KC |
1444 | ret = ptrace(PTRACE_SETOPTIONS, tracee, NULL, ptrace_syscall ? |
1445 | PTRACE_O_TRACESYSGOOD : | |
1446 | PTRACE_O_TRACESECCOMP); | |
c99ee51a KC |
1447 | ASSERT_EQ(0, ret) { |
1448 | TH_LOG("Failed to set PTRACE_O_TRACESECCOMP"); | |
1449 | kill(tracee, SIGKILL); | |
1450 | } | |
58d0a862 KC |
1451 | ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT, |
1452 | tracee, NULL, 0); | |
1453 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1454 | |
1455 | /* Unblock the tracee */ | |
1456 | ASSERT_EQ(1, write(fd, "A", 1)); | |
1457 | ASSERT_EQ(0, close(fd)); | |
1458 | ||
1459 | /* Run until we're shut down. Must assert to stop execution. */ | |
1460 | while (tracer_running) { | |
1461 | int status; | |
1462 | ||
1463 | if (wait(&status) != tracee) | |
1464 | continue; | |
1465 | if (WIFSIGNALED(status) || WIFEXITED(status)) | |
1466 | /* Child is dead. Time to go. */ | |
1467 | return; | |
1468 | ||
58d0a862 KC |
1469 | /* Check if this is a seccomp event. */ |
1470 | ASSERT_EQ(!ptrace_syscall, IS_SECCOMP_EVENT(status)); | |
c99ee51a KC |
1471 | |
1472 | tracer_func(_metadata, tracee, status, args); | |
1473 | ||
58d0a862 KC |
1474 | ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT, |
1475 | tracee, NULL, 0); | |
c99ee51a KC |
1476 | ASSERT_EQ(0, ret); |
1477 | } | |
1478 | /* Directly report the status of our test harness results. */ | |
1479 | syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE); | |
1480 | } | |
1481 | ||
1482 | /* Common tracer setup/teardown functions. */ | |
1483 | void cont_handler(int num) | |
1484 | { } | |
1485 | pid_t setup_trace_fixture(struct __test_metadata *_metadata, | |
58d0a862 | 1486 | tracer_func_t func, void *args, bool ptrace_syscall) |
c99ee51a KC |
1487 | { |
1488 | char sync; | |
1489 | int pipefd[2]; | |
1490 | pid_t tracer_pid; | |
1491 | pid_t tracee = getpid(); | |
1492 | ||
1493 | /* Setup a pipe for clean synchronization. */ | |
1494 | ASSERT_EQ(0, pipe(pipefd)); | |
1495 | ||
1496 | /* Fork a child which we'll promote to tracer */ | |
1497 | tracer_pid = fork(); | |
1498 | ASSERT_LE(0, tracer_pid); | |
1499 | signal(SIGALRM, cont_handler); | |
1500 | if (tracer_pid == 0) { | |
1501 | close(pipefd[0]); | |
58d0a862 KC |
1502 | start_tracer(_metadata, pipefd[1], tracee, func, args, |
1503 | ptrace_syscall); | |
c99ee51a KC |
1504 | syscall(__NR_exit, 0); |
1505 | } | |
1506 | close(pipefd[1]); | |
1507 | prctl(PR_SET_PTRACER, tracer_pid, 0, 0, 0); | |
1508 | read(pipefd[0], &sync, 1); | |
1509 | close(pipefd[0]); | |
1510 | ||
1511 | return tracer_pid; | |
1512 | } | |
1513 | void teardown_trace_fixture(struct __test_metadata *_metadata, | |
1514 | pid_t tracer) | |
1515 | { | |
1516 | if (tracer) { | |
1517 | int status; | |
1518 | /* | |
1519 | * Extract the exit code from the other process and | |
1520 | * adopt it for ourselves in case its asserts failed. | |
1521 | */ | |
1522 | ASSERT_EQ(0, kill(tracer, SIGUSR1)); | |
1523 | ASSERT_EQ(tracer, waitpid(tracer, &status, 0)); | |
1524 | if (WEXITSTATUS(status)) | |
1525 | _metadata->passed = 0; | |
1526 | } | |
1527 | } | |
1528 | ||
1529 | /* "poke" tracer arguments and function. */ | |
1530 | struct tracer_args_poke_t { | |
1531 | unsigned long poke_addr; | |
1532 | }; | |
1533 | ||
1534 | void tracer_poke(struct __test_metadata *_metadata, pid_t tracee, int status, | |
1535 | void *args) | |
1536 | { | |
1537 | int ret; | |
1538 | unsigned long msg; | |
1539 | struct tracer_args_poke_t *info = (struct tracer_args_poke_t *)args; | |
1540 | ||
1541 | ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg); | |
1542 | EXPECT_EQ(0, ret); | |
1543 | /* If this fails, don't try to recover. */ | |
1544 | ASSERT_EQ(0x1001, msg) { | |
1545 | kill(tracee, SIGKILL); | |
1546 | } | |
1547 | /* | |
1548 | * Poke in the message. | |
1549 | * Registers are not touched to try to keep this relatively arch | |
1550 | * agnostic. | |
1551 | */ | |
1552 | ret = ptrace(PTRACE_POKEDATA, tracee, info->poke_addr, 0x1001); | |
1553 | EXPECT_EQ(0, ret); | |
1554 | } | |
1555 | ||
1ae81d78 | 1556 | FIXTURE(TRACE_poke) { |
c99ee51a KC |
1557 | struct sock_fprog prog; |
1558 | pid_t tracer; | |
1559 | long poked; | |
1560 | struct tracer_args_poke_t tracer_args; | |
1561 | }; | |
1562 | ||
1563 | FIXTURE_SETUP(TRACE_poke) | |
1564 | { | |
1565 | struct sock_filter filter[] = { | |
1566 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
1567 | offsetof(struct seccomp_data, nr)), | |
1568 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1), | |
1569 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1001), | |
1570 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1571 | }; | |
1572 | ||
1573 | self->poked = 0; | |
1574 | memset(&self->prog, 0, sizeof(self->prog)); | |
1575 | self->prog.filter = malloc(sizeof(filter)); | |
1576 | ASSERT_NE(NULL, self->prog.filter); | |
1577 | memcpy(self->prog.filter, filter, sizeof(filter)); | |
1578 | self->prog.len = (unsigned short)ARRAY_SIZE(filter); | |
1579 | ||
1580 | /* Set up tracer args. */ | |
1581 | self->tracer_args.poke_addr = (unsigned long)&self->poked; | |
1582 | ||
1583 | /* Launch tracer. */ | |
1584 | self->tracer = setup_trace_fixture(_metadata, tracer_poke, | |
58d0a862 | 1585 | &self->tracer_args, false); |
c99ee51a KC |
1586 | } |
1587 | ||
1588 | FIXTURE_TEARDOWN(TRACE_poke) | |
1589 | { | |
1590 | teardown_trace_fixture(_metadata, self->tracer); | |
1591 | if (self->prog.filter) | |
1592 | free(self->prog.filter); | |
1593 | } | |
1594 | ||
1595 | TEST_F(TRACE_poke, read_has_side_effects) | |
1596 | { | |
1597 | ssize_t ret; | |
1598 | ||
1599 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1600 | ASSERT_EQ(0, ret); | |
1601 | ||
1602 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
1603 | ASSERT_EQ(0, ret); | |
1604 | ||
1605 | EXPECT_EQ(0, self->poked); | |
1606 | ret = read(-1, NULL, 0); | |
1607 | EXPECT_EQ(-1, ret); | |
1608 | EXPECT_EQ(0x1001, self->poked); | |
1609 | } | |
1610 | ||
1611 | TEST_F(TRACE_poke, getpid_runs_normally) | |
1612 | { | |
1613 | long ret; | |
1614 | ||
1615 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1616 | ASSERT_EQ(0, ret); | |
1617 | ||
1618 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
1619 | ASSERT_EQ(0, ret); | |
1620 | ||
1621 | EXPECT_EQ(0, self->poked); | |
1622 | EXPECT_NE(0, syscall(__NR_getpid)); | |
1623 | EXPECT_EQ(0, self->poked); | |
1624 | } | |
1625 | ||
1626 | #if defined(__x86_64__) | |
1627 | # define ARCH_REGS struct user_regs_struct | |
1628 | # define SYSCALL_NUM orig_rax | |
1629 | # define SYSCALL_RET rax | |
1630 | #elif defined(__i386__) | |
1631 | # define ARCH_REGS struct user_regs_struct | |
1632 | # define SYSCALL_NUM orig_eax | |
1633 | # define SYSCALL_RET eax | |
1634 | #elif defined(__arm__) | |
1635 | # define ARCH_REGS struct pt_regs | |
1636 | # define SYSCALL_NUM ARM_r7 | |
1637 | # define SYSCALL_RET ARM_r0 | |
1638 | #elif defined(__aarch64__) | |
1639 | # define ARCH_REGS struct user_pt_regs | |
1640 | # define SYSCALL_NUM regs[8] | |
1641 | # define SYSCALL_RET regs[0] | |
5340627e DA |
1642 | #elif defined(__riscv) && __riscv_xlen == 64 |
1643 | # define ARCH_REGS struct user_regs_struct | |
1644 | # define SYSCALL_NUM a7 | |
1645 | # define SYSCALL_RET a0 | |
64e2a42b HD |
1646 | #elif defined(__hppa__) |
1647 | # define ARCH_REGS struct user_regs_struct | |
1648 | # define SYSCALL_NUM gr[20] | |
1649 | # define SYSCALL_RET gr[28] | |
5d83c2b3 ME |
1650 | #elif defined(__powerpc__) |
1651 | # define ARCH_REGS struct pt_regs | |
1652 | # define SYSCALL_NUM gpr[0] | |
1653 | # define SYSCALL_RET gpr[3] | |
b623c4da KC |
1654 | #elif defined(__s390__) |
1655 | # define ARCH_REGS s390_regs | |
1656 | # define SYSCALL_NUM gprs[2] | |
1657 | # define SYSCALL_RET gprs[2] | |
0ce105bf MR |
1658 | #elif defined(__mips__) |
1659 | # define ARCH_REGS struct pt_regs | |
1660 | # define SYSCALL_NUM regs[2] | |
1661 | # define SYSCALL_SYSCALL_NUM regs[4] | |
1662 | # define SYSCALL_RET regs[2] | |
1663 | # define SYSCALL_NUM_RET_SHARE_REG | |
c99ee51a KC |
1664 | #else |
1665 | # error "Do not know how to find your architecture's registers and syscalls" | |
1666 | #endif | |
1667 | ||
a33b2d03 KC |
1668 | /* When the syscall return can't be changed, stub out the tests for it. */ |
1669 | #ifdef SYSCALL_NUM_RET_SHARE_REG | |
1670 | # define EXPECT_SYSCALL_RETURN(val, action) EXPECT_EQ(-1, action) | |
1671 | #else | |
ed5f1326 KC |
1672 | # define EXPECT_SYSCALL_RETURN(val, action) \ |
1673 | do { \ | |
1674 | errno = 0; \ | |
1675 | if (val < 0) { \ | |
1676 | EXPECT_EQ(-1, action); \ | |
1677 | EXPECT_EQ(-(val), errno); \ | |
1678 | } else { \ | |
1679 | EXPECT_EQ(val, action); \ | |
1680 | } \ | |
1681 | } while (0) | |
a33b2d03 KC |
1682 | #endif |
1683 | ||
4a0b8807 MS |
1684 | /* Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for |
1685 | * architectures without HAVE_ARCH_TRACEHOOK (e.g. User-mode Linux). | |
1686 | */ | |
0ce105bf | 1687 | #if defined(__x86_64__) || defined(__i386__) || defined(__mips__) |
4a0b8807 MS |
1688 | #define HAVE_GETREGS |
1689 | #endif | |
1690 | ||
c99ee51a KC |
1691 | /* Architecture-specific syscall fetching routine. */ |
1692 | int get_syscall(struct __test_metadata *_metadata, pid_t tracee) | |
1693 | { | |
c99ee51a | 1694 | ARCH_REGS regs; |
4a0b8807 MS |
1695 | #ifdef HAVE_GETREGS |
1696 | EXPECT_EQ(0, ptrace(PTRACE_GETREGS, tracee, 0, ®s)) { | |
1697 | TH_LOG("PTRACE_GETREGS failed"); | |
1698 | return -1; | |
1699 | } | |
1700 | #else | |
1701 | struct iovec iov; | |
c99ee51a KC |
1702 | |
1703 | iov.iov_base = ®s; | |
1704 | iov.iov_len = sizeof(regs); | |
1705 | EXPECT_EQ(0, ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &iov)) { | |
1706 | TH_LOG("PTRACE_GETREGSET failed"); | |
1707 | return -1; | |
1708 | } | |
4a0b8807 | 1709 | #endif |
c99ee51a | 1710 | |
0ce105bf MR |
1711 | #if defined(__mips__) |
1712 | if (regs.SYSCALL_NUM == __NR_O32_Linux) | |
1713 | return regs.SYSCALL_SYSCALL_NUM; | |
1714 | #endif | |
c99ee51a KC |
1715 | return regs.SYSCALL_NUM; |
1716 | } | |
1717 | ||
1718 | /* Architecture-specific syscall changing routine. */ | |
1719 | void change_syscall(struct __test_metadata *_metadata, | |
ed5f1326 | 1720 | pid_t tracee, int syscall, int result) |
c99ee51a | 1721 | { |
c99ee51a KC |
1722 | int ret; |
1723 | ARCH_REGS regs; | |
4a0b8807 MS |
1724 | #ifdef HAVE_GETREGS |
1725 | ret = ptrace(PTRACE_GETREGS, tracee, 0, ®s); | |
1726 | #else | |
1727 | struct iovec iov; | |
c99ee51a KC |
1728 | iov.iov_base = ®s; |
1729 | iov.iov_len = sizeof(regs); | |
1730 | ret = ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &iov); | |
4a0b8807 | 1731 | #endif |
34a048cc | 1732 | EXPECT_EQ(0, ret) {} |
c99ee51a | 1733 | |
256d0afb | 1734 | #if defined(__x86_64__) || defined(__i386__) || defined(__powerpc__) || \ |
5340627e | 1735 | defined(__s390__) || defined(__hppa__) || defined(__riscv) |
c99ee51a KC |
1736 | { |
1737 | regs.SYSCALL_NUM = syscall; | |
1738 | } | |
0ce105bf MR |
1739 | #elif defined(__mips__) |
1740 | { | |
1741 | if (regs.SYSCALL_NUM == __NR_O32_Linux) | |
1742 | regs.SYSCALL_SYSCALL_NUM = syscall; | |
1743 | else | |
1744 | regs.SYSCALL_NUM = syscall; | |
1745 | } | |
c99ee51a KC |
1746 | |
1747 | #elif defined(__arm__) | |
1748 | # ifndef PTRACE_SET_SYSCALL | |
1749 | # define PTRACE_SET_SYSCALL 23 | |
1750 | # endif | |
1751 | { | |
1752 | ret = ptrace(PTRACE_SET_SYSCALL, tracee, NULL, syscall); | |
1753 | EXPECT_EQ(0, ret); | |
1754 | } | |
1755 | ||
256d0afb KC |
1756 | #elif defined(__aarch64__) |
1757 | # ifndef NT_ARM_SYSTEM_CALL | |
1758 | # define NT_ARM_SYSTEM_CALL 0x404 | |
1759 | # endif | |
1760 | { | |
1761 | iov.iov_base = &syscall; | |
1762 | iov.iov_len = sizeof(syscall); | |
1763 | ret = ptrace(PTRACE_SETREGSET, tracee, NT_ARM_SYSTEM_CALL, | |
1764 | &iov); | |
1765 | EXPECT_EQ(0, ret); | |
1766 | } | |
1767 | ||
c99ee51a KC |
1768 | #else |
1769 | ASSERT_EQ(1, 0) { | |
1770 | TH_LOG("How is the syscall changed on this architecture?"); | |
1771 | } | |
1772 | #endif | |
1773 | ||
1774 | /* If syscall is skipped, change return value. */ | |
1775 | if (syscall == -1) | |
0ce105bf MR |
1776 | #ifdef SYSCALL_NUM_RET_SHARE_REG |
1777 | TH_LOG("Can't modify syscall return on this architecture"); | |
1778 | #else | |
ed5f1326 | 1779 | regs.SYSCALL_RET = result; |
0ce105bf | 1780 | #endif |
c99ee51a | 1781 | |
4a0b8807 MS |
1782 | #ifdef HAVE_GETREGS |
1783 | ret = ptrace(PTRACE_SETREGS, tracee, 0, ®s); | |
1784 | #else | |
256d0afb KC |
1785 | iov.iov_base = ®s; |
1786 | iov.iov_len = sizeof(regs); | |
c99ee51a | 1787 | ret = ptrace(PTRACE_SETREGSET, tracee, NT_PRSTATUS, &iov); |
4a0b8807 | 1788 | #endif |
c99ee51a KC |
1789 | EXPECT_EQ(0, ret); |
1790 | } | |
1791 | ||
1792 | void tracer_syscall(struct __test_metadata *_metadata, pid_t tracee, | |
1793 | int status, void *args) | |
1794 | { | |
1795 | int ret; | |
1796 | unsigned long msg; | |
1797 | ||
1798 | /* Make sure we got the right message. */ | |
1799 | ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg); | |
1800 | EXPECT_EQ(0, ret); | |
1801 | ||
b623c4da | 1802 | /* Validate and take action on expected syscalls. */ |
c99ee51a KC |
1803 | switch (msg) { |
1804 | case 0x1002: | |
1805 | /* change getpid to getppid. */ | |
b623c4da | 1806 | EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee)); |
ed5f1326 | 1807 | change_syscall(_metadata, tracee, __NR_getppid, 0); |
c99ee51a KC |
1808 | break; |
1809 | case 0x1003: | |
ed5f1326 | 1810 | /* skip gettid with valid return code. */ |
b623c4da | 1811 | EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee)); |
ed5f1326 | 1812 | change_syscall(_metadata, tracee, -1, 45000); |
c99ee51a KC |
1813 | break; |
1814 | case 0x1004: | |
ed5f1326 KC |
1815 | /* skip openat with error. */ |
1816 | EXPECT_EQ(__NR_openat, get_syscall(_metadata, tracee)); | |
1817 | change_syscall(_metadata, tracee, -1, -ESRCH); | |
1818 | break; | |
1819 | case 0x1005: | |
c99ee51a | 1820 | /* do nothing (allow getppid) */ |
b623c4da | 1821 | EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee)); |
c99ee51a KC |
1822 | break; |
1823 | default: | |
1824 | EXPECT_EQ(0, msg) { | |
1825 | TH_LOG("Unknown PTRACE_GETEVENTMSG: 0x%lx", msg); | |
1826 | kill(tracee, SIGKILL); | |
1827 | } | |
1828 | } | |
1829 | ||
1830 | } | |
1831 | ||
58d0a862 KC |
1832 | void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee, |
1833 | int status, void *args) | |
1834 | { | |
1835 | int ret, nr; | |
1836 | unsigned long msg; | |
1837 | static bool entry; | |
1838 | ||
201766a2 EK |
1839 | /* |
1840 | * The traditional way to tell PTRACE_SYSCALL entry/exit | |
1841 | * is by counting. | |
1842 | */ | |
1843 | entry = !entry; | |
1844 | ||
1845 | /* Make sure we got an appropriate message. */ | |
58d0a862 KC |
1846 | ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg); |
1847 | EXPECT_EQ(0, ret); | |
201766a2 EK |
1848 | EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY |
1849 | : PTRACE_EVENTMSG_SYSCALL_EXIT, msg); | |
58d0a862 | 1850 | |
58d0a862 KC |
1851 | if (!entry) |
1852 | return; | |
1853 | ||
1854 | nr = get_syscall(_metadata, tracee); | |
1855 | ||
1856 | if (nr == __NR_getpid) | |
ed5f1326 KC |
1857 | change_syscall(_metadata, tracee, __NR_getppid, 0); |
1858 | if (nr == __NR_gettid) | |
1859 | change_syscall(_metadata, tracee, -1, 45000); | |
912ec316 | 1860 | if (nr == __NR_openat) |
ed5f1326 | 1861 | change_syscall(_metadata, tracee, -1, -ESRCH); |
58d0a862 KC |
1862 | } |
1863 | ||
1ae81d78 | 1864 | FIXTURE(TRACE_syscall) { |
c99ee51a KC |
1865 | struct sock_fprog prog; |
1866 | pid_t tracer, mytid, mypid, parent; | |
1867 | }; | |
1868 | ||
1869 | FIXTURE_SETUP(TRACE_syscall) | |
1870 | { | |
1871 | struct sock_filter filter[] = { | |
1872 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
1873 | offsetof(struct seccomp_data, nr)), | |
1874 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), | |
1875 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002), | |
1876 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1), | |
1877 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003), | |
ed5f1326 | 1878 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_openat, 0, 1), |
c99ee51a | 1879 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004), |
ed5f1326 KC |
1880 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1), |
1881 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1005), | |
c99ee51a KC |
1882 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), |
1883 | }; | |
1884 | ||
1885 | memset(&self->prog, 0, sizeof(self->prog)); | |
1886 | self->prog.filter = malloc(sizeof(filter)); | |
1887 | ASSERT_NE(NULL, self->prog.filter); | |
1888 | memcpy(self->prog.filter, filter, sizeof(filter)); | |
1889 | self->prog.len = (unsigned short)ARRAY_SIZE(filter); | |
1890 | ||
1891 | /* Prepare some testable syscall results. */ | |
1892 | self->mytid = syscall(__NR_gettid); | |
1893 | ASSERT_GT(self->mytid, 0); | |
1894 | ASSERT_NE(self->mytid, 1) { | |
1895 | TH_LOG("Running this test as init is not supported. :)"); | |
1896 | } | |
1897 | ||
1898 | self->mypid = getpid(); | |
1899 | ASSERT_GT(self->mypid, 0); | |
1900 | ASSERT_EQ(self->mytid, self->mypid); | |
1901 | ||
1902 | self->parent = getppid(); | |
1903 | ASSERT_GT(self->parent, 0); | |
1904 | ASSERT_NE(self->parent, self->mypid); | |
1905 | ||
1906 | /* Launch tracer. */ | |
58d0a862 KC |
1907 | self->tracer = setup_trace_fixture(_metadata, tracer_syscall, NULL, |
1908 | false); | |
c99ee51a KC |
1909 | } |
1910 | ||
1911 | FIXTURE_TEARDOWN(TRACE_syscall) | |
1912 | { | |
1913 | teardown_trace_fixture(_metadata, self->tracer); | |
1914 | if (self->prog.filter) | |
1915 | free(self->prog.filter); | |
1916 | } | |
1917 | ||
a33b2d03 KC |
1918 | TEST_F(TRACE_syscall, ptrace_syscall_redirected) |
1919 | { | |
1920 | /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */ | |
1921 | teardown_trace_fixture(_metadata, self->tracer); | |
1922 | self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL, | |
1923 | true); | |
1924 | ||
1925 | /* Tracer will redirect getpid to getppid. */ | |
1926 | EXPECT_NE(self->mypid, syscall(__NR_getpid)); | |
1927 | } | |
1928 | ||
ed5f1326 KC |
1929 | TEST_F(TRACE_syscall, ptrace_syscall_errno) |
1930 | { | |
1931 | /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */ | |
1932 | teardown_trace_fixture(_metadata, self->tracer); | |
1933 | self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL, | |
1934 | true); | |
1935 | ||
1936 | /* Tracer should skip the open syscall, resulting in ESRCH. */ | |
1937 | EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat)); | |
1938 | } | |
1939 | ||
1940 | TEST_F(TRACE_syscall, ptrace_syscall_faked) | |
a33b2d03 KC |
1941 | { |
1942 | /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */ | |
1943 | teardown_trace_fixture(_metadata, self->tracer); | |
1944 | self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL, | |
1945 | true); | |
1946 | ||
ed5f1326 KC |
1947 | /* Tracer should skip the gettid syscall, resulting fake pid. */ |
1948 | EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid)); | |
a33b2d03 KC |
1949 | } |
1950 | ||
c99ee51a KC |
1951 | TEST_F(TRACE_syscall, syscall_allowed) |
1952 | { | |
1953 | long ret; | |
1954 | ||
1955 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1956 | ASSERT_EQ(0, ret); | |
1957 | ||
1958 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
1959 | ASSERT_EQ(0, ret); | |
1960 | ||
1961 | /* getppid works as expected (no changes). */ | |
1962 | EXPECT_EQ(self->parent, syscall(__NR_getppid)); | |
1963 | EXPECT_NE(self->mypid, syscall(__NR_getppid)); | |
1964 | } | |
1965 | ||
1966 | TEST_F(TRACE_syscall, syscall_redirected) | |
1967 | { | |
1968 | long ret; | |
1969 | ||
1970 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1971 | ASSERT_EQ(0, ret); | |
1972 | ||
1973 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
1974 | ASSERT_EQ(0, ret); | |
1975 | ||
1976 | /* getpid has been redirected to getppid as expected. */ | |
1977 | EXPECT_EQ(self->parent, syscall(__NR_getpid)); | |
1978 | EXPECT_NE(self->mypid, syscall(__NR_getpid)); | |
1979 | } | |
1980 | ||
ed5f1326 KC |
1981 | TEST_F(TRACE_syscall, syscall_errno) |
1982 | { | |
1983 | long ret; | |
1984 | ||
1985 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1986 | ASSERT_EQ(0, ret); | |
1987 | ||
1988 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
1989 | ASSERT_EQ(0, ret); | |
1990 | ||
1991 | /* openat has been skipped and an errno return. */ | |
1992 | EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat)); | |
1993 | } | |
1994 | ||
1995 | TEST_F(TRACE_syscall, syscall_faked) | |
c99ee51a KC |
1996 | { |
1997 | long ret; | |
1998 | ||
1999 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
2000 | ASSERT_EQ(0, ret); | |
2001 | ||
2002 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
2003 | ASSERT_EQ(0, ret); | |
2004 | ||
2005 | /* gettid has been skipped and an altered return value stored. */ | |
ed5f1326 | 2006 | EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid)); |
c99ee51a KC |
2007 | } |
2008 | ||
58d0a862 KC |
2009 | TEST_F(TRACE_syscall, skip_after_RET_TRACE) |
2010 | { | |
2011 | struct sock_filter filter[] = { | |
2012 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
2013 | offsetof(struct seccomp_data, nr)), | |
2014 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1), | |
2015 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EPERM), | |
2016 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2017 | }; | |
2018 | struct sock_fprog prog = { | |
2019 | .len = (unsigned short)ARRAY_SIZE(filter), | |
2020 | .filter = filter, | |
2021 | }; | |
2022 | long ret; | |
2023 | ||
2024 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
2025 | ASSERT_EQ(0, ret); | |
2026 | ||
2027 | /* Install fixture filter. */ | |
2028 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
2029 | ASSERT_EQ(0, ret); | |
2030 | ||
2031 | /* Install "errno on getppid" filter. */ | |
2032 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
2033 | ASSERT_EQ(0, ret); | |
2034 | ||
2035 | /* Tracer will redirect getpid to getppid, and we should see EPERM. */ | |
a33b2d03 | 2036 | errno = 0; |
58d0a862 KC |
2037 | EXPECT_EQ(-1, syscall(__NR_getpid)); |
2038 | EXPECT_EQ(EPERM, errno); | |
2039 | } | |
2040 | ||
2041 | TEST_F_SIGNAL(TRACE_syscall, kill_after_RET_TRACE, SIGSYS) | |
2042 | { | |
2043 | struct sock_filter filter[] = { | |
2044 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
2045 | offsetof(struct seccomp_data, nr)), | |
2046 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1), | |
2047 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
2048 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2049 | }; | |
2050 | struct sock_fprog prog = { | |
2051 | .len = (unsigned short)ARRAY_SIZE(filter), | |
2052 | .filter = filter, | |
2053 | }; | |
2054 | long ret; | |
2055 | ||
2056 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
2057 | ASSERT_EQ(0, ret); | |
2058 | ||
2059 | /* Install fixture filter. */ | |
2060 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
2061 | ASSERT_EQ(0, ret); | |
2062 | ||
2063 | /* Install "death on getppid" filter. */ | |
2064 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
2065 | ASSERT_EQ(0, ret); | |
2066 | ||
2067 | /* Tracer will redirect getpid to getppid, and we should die. */ | |
2068 | EXPECT_NE(self->mypid, syscall(__NR_getpid)); | |
2069 | } | |
2070 | ||
2071 | TEST_F(TRACE_syscall, skip_after_ptrace) | |
2072 | { | |
2073 | struct sock_filter filter[] = { | |
2074 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
2075 | offsetof(struct seccomp_data, nr)), | |
2076 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1), | |
2077 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EPERM), | |
2078 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2079 | }; | |
2080 | struct sock_fprog prog = { | |
2081 | .len = (unsigned short)ARRAY_SIZE(filter), | |
2082 | .filter = filter, | |
2083 | }; | |
2084 | long ret; | |
2085 | ||
2086 | /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */ | |
2087 | teardown_trace_fixture(_metadata, self->tracer); | |
2088 | self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL, | |
2089 | true); | |
2090 | ||
2091 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
2092 | ASSERT_EQ(0, ret); | |
2093 | ||
2094 | /* Install "errno on getppid" filter. */ | |
2095 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
2096 | ASSERT_EQ(0, ret); | |
2097 | ||
2098 | /* Tracer will redirect getpid to getppid, and we should see EPERM. */ | |
2099 | EXPECT_EQ(-1, syscall(__NR_getpid)); | |
2100 | EXPECT_EQ(EPERM, errno); | |
2101 | } | |
2102 | ||
2103 | TEST_F_SIGNAL(TRACE_syscall, kill_after_ptrace, SIGSYS) | |
2104 | { | |
2105 | struct sock_filter filter[] = { | |
2106 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
2107 | offsetof(struct seccomp_data, nr)), | |
2108 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1), | |
2109 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
2110 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2111 | }; | |
2112 | struct sock_fprog prog = { | |
2113 | .len = (unsigned short)ARRAY_SIZE(filter), | |
2114 | .filter = filter, | |
2115 | }; | |
2116 | long ret; | |
2117 | ||
2118 | /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */ | |
2119 | teardown_trace_fixture(_metadata, self->tracer); | |
2120 | self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL, | |
2121 | true); | |
2122 | ||
2123 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
2124 | ASSERT_EQ(0, ret); | |
2125 | ||
2126 | /* Install "death on getppid" filter. */ | |
2127 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
2128 | ASSERT_EQ(0, ret); | |
2129 | ||
2130 | /* Tracer will redirect getpid to getppid, and we should die. */ | |
2131 | EXPECT_NE(self->mypid, syscall(__NR_getpid)); | |
2132 | } | |
2133 | ||
c99ee51a KC |
2134 | TEST(seccomp_syscall) |
2135 | { | |
2136 | struct sock_filter filter[] = { | |
2137 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2138 | }; | |
2139 | struct sock_fprog prog = { | |
2140 | .len = (unsigned short)ARRAY_SIZE(filter), | |
2141 | .filter = filter, | |
2142 | }; | |
2143 | long ret; | |
2144 | ||
2145 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
2146 | ASSERT_EQ(0, ret) { | |
2147 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2148 | } | |
2149 | ||
2150 | /* Reject insane operation. */ | |
2151 | ret = seccomp(-1, 0, &prog); | |
b623c4da KC |
2152 | ASSERT_NE(ENOSYS, errno) { |
2153 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2154 | } | |
c99ee51a KC |
2155 | EXPECT_EQ(EINVAL, errno) { |
2156 | TH_LOG("Did not reject crazy op value!"); | |
2157 | } | |
2158 | ||
2159 | /* Reject strict with flags or pointer. */ | |
2160 | ret = seccomp(SECCOMP_SET_MODE_STRICT, -1, NULL); | |
2161 | EXPECT_EQ(EINVAL, errno) { | |
2162 | TH_LOG("Did not reject mode strict with flags!"); | |
2163 | } | |
2164 | ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, &prog); | |
2165 | EXPECT_EQ(EINVAL, errno) { | |
2166 | TH_LOG("Did not reject mode strict with uargs!"); | |
2167 | } | |
2168 | ||
2169 | /* Reject insane args for filter. */ | |
2170 | ret = seccomp(SECCOMP_SET_MODE_FILTER, -1, &prog); | |
2171 | EXPECT_EQ(EINVAL, errno) { | |
2172 | TH_LOG("Did not reject crazy filter flags!"); | |
2173 | } | |
2174 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, NULL); | |
2175 | EXPECT_EQ(EFAULT, errno) { | |
2176 | TH_LOG("Did not reject NULL filter!"); | |
2177 | } | |
2178 | ||
2179 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog); | |
2180 | EXPECT_EQ(0, errno) { | |
2181 | TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER: %s", | |
2182 | strerror(errno)); | |
2183 | } | |
2184 | } | |
2185 | ||
2186 | TEST(seccomp_syscall_mode_lock) | |
2187 | { | |
2188 | struct sock_filter filter[] = { | |
2189 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2190 | }; | |
2191 | struct sock_fprog prog = { | |
2192 | .len = (unsigned short)ARRAY_SIZE(filter), | |
2193 | .filter = filter, | |
2194 | }; | |
2195 | long ret; | |
2196 | ||
2197 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0); | |
2198 | ASSERT_EQ(0, ret) { | |
2199 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2200 | } | |
2201 | ||
2202 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog); | |
b623c4da KC |
2203 | ASSERT_NE(ENOSYS, errno) { |
2204 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2205 | } | |
c99ee51a KC |
2206 | EXPECT_EQ(0, ret) { |
2207 | TH_LOG("Could not install filter!"); | |
2208 | } | |
2209 | ||
2210 | /* Make sure neither entry point will switch to strict. */ | |
2211 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, 0, 0, 0); | |
2212 | EXPECT_EQ(EINVAL, errno) { | |
2213 | TH_LOG("Switched to mode strict!"); | |
2214 | } | |
2215 | ||
2216 | ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, NULL); | |
2217 | EXPECT_EQ(EINVAL, errno) { | |
2218 | TH_LOG("Switched to mode strict!"); | |
2219 | } | |
2220 | } | |
2221 | ||
2b7ea5b5 TH |
2222 | /* |
2223 | * Test detection of known and unknown filter flags. Userspace needs to be able | |
2224 | * to check if a filter flag is supported by the current kernel and a good way | |
2225 | * of doing that is by attempting to enter filter mode, with the flag bit in | |
2226 | * question set, and a NULL pointer for the _args_ parameter. EFAULT indicates | |
2227 | * that the flag is valid and EINVAL indicates that the flag is invalid. | |
2228 | */ | |
2229 | TEST(detect_seccomp_filter_flags) | |
2230 | { | |
e66a3997 | 2231 | unsigned int flags[] = { SECCOMP_FILTER_FLAG_TSYNC, |
00a02d0c | 2232 | SECCOMP_FILTER_FLAG_LOG, |
6a21cc50 | 2233 | SECCOMP_FILTER_FLAG_SPEC_ALLOW, |
51891498 TA |
2234 | SECCOMP_FILTER_FLAG_NEW_LISTENER, |
2235 | SECCOMP_FILTER_FLAG_TSYNC_ESRCH }; | |
4ee07767 KC |
2236 | unsigned int exclusive[] = { |
2237 | SECCOMP_FILTER_FLAG_TSYNC, | |
2238 | SECCOMP_FILTER_FLAG_NEW_LISTENER }; | |
2239 | unsigned int flag, all_flags, exclusive_mask; | |
2b7ea5b5 TH |
2240 | int i; |
2241 | long ret; | |
2242 | ||
4ee07767 | 2243 | /* Test detection of individual known-good filter flags */ |
2b7ea5b5 | 2244 | for (i = 0, all_flags = 0; i < ARRAY_SIZE(flags); i++) { |
00a02d0c KC |
2245 | int bits = 0; |
2246 | ||
2b7ea5b5 | 2247 | flag = flags[i]; |
00a02d0c KC |
2248 | /* Make sure the flag is a single bit! */ |
2249 | while (flag) { | |
2250 | if (flag & 0x1) | |
2251 | bits ++; | |
2252 | flag >>= 1; | |
2253 | } | |
2254 | ASSERT_EQ(1, bits); | |
2255 | flag = flags[i]; | |
2256 | ||
2b7ea5b5 TH |
2257 | ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); |
2258 | ASSERT_NE(ENOSYS, errno) { | |
2259 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2260 | } | |
2261 | EXPECT_EQ(-1, ret); | |
2262 | EXPECT_EQ(EFAULT, errno) { | |
2263 | TH_LOG("Failed to detect that a known-good filter flag (0x%X) is supported!", | |
2264 | flag); | |
2265 | } | |
2266 | ||
2267 | all_flags |= flag; | |
2268 | } | |
2269 | ||
4ee07767 KC |
2270 | /* |
2271 | * Test detection of all known-good filter flags combined. But | |
2272 | * for the exclusive flags we need to mask them out and try them | |
2273 | * individually for the "all flags" testing. | |
2274 | */ | |
2275 | exclusive_mask = 0; | |
2276 | for (i = 0; i < ARRAY_SIZE(exclusive); i++) | |
2277 | exclusive_mask |= exclusive[i]; | |
2278 | for (i = 0; i < ARRAY_SIZE(exclusive); i++) { | |
2279 | flag = all_flags & ~exclusive_mask; | |
2280 | flag |= exclusive[i]; | |
2281 | ||
2282 | ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); | |
2283 | EXPECT_EQ(-1, ret); | |
2284 | EXPECT_EQ(EFAULT, errno) { | |
2285 | TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!", | |
2286 | flag); | |
2287 | } | |
2b7ea5b5 TH |
2288 | } |
2289 | ||
4ee07767 | 2290 | /* Test detection of an unknown filter flags, without exclusives. */ |
2b7ea5b5 | 2291 | flag = -1; |
4ee07767 | 2292 | flag &= ~exclusive_mask; |
2b7ea5b5 TH |
2293 | ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); |
2294 | EXPECT_EQ(-1, ret); | |
2295 | EXPECT_EQ(EINVAL, errno) { | |
2296 | TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported!", | |
2297 | flag); | |
2298 | } | |
2299 | ||
2300 | /* | |
2301 | * Test detection of an unknown filter flag that may simply need to be | |
2302 | * added to this test | |
2303 | */ | |
2304 | flag = flags[ARRAY_SIZE(flags) - 1] << 1; | |
2305 | ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); | |
2306 | EXPECT_EQ(-1, ret); | |
2307 | EXPECT_EQ(EINVAL, errno) { | |
2308 | TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported! Does a new flag need to be added to this test?", | |
2309 | flag); | |
2310 | } | |
2311 | } | |
2312 | ||
c99ee51a KC |
2313 | TEST(TSYNC_first) |
2314 | { | |
2315 | struct sock_filter filter[] = { | |
2316 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2317 | }; | |
2318 | struct sock_fprog prog = { | |
2319 | .len = (unsigned short)ARRAY_SIZE(filter), | |
2320 | .filter = filter, | |
2321 | }; | |
2322 | long ret; | |
2323 | ||
2324 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0); | |
2325 | ASSERT_EQ(0, ret) { | |
2326 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2327 | } | |
2328 | ||
6c045d07 | 2329 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a | 2330 | &prog); |
b623c4da KC |
2331 | ASSERT_NE(ENOSYS, errno) { |
2332 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2333 | } | |
c99ee51a KC |
2334 | EXPECT_EQ(0, ret) { |
2335 | TH_LOG("Could not install initial filter with TSYNC!"); | |
2336 | } | |
2337 | } | |
2338 | ||
2339 | #define TSYNC_SIBLINGS 2 | |
2340 | struct tsync_sibling { | |
2341 | pthread_t tid; | |
2342 | pid_t system_tid; | |
2343 | sem_t *started; | |
2344 | pthread_cond_t *cond; | |
2345 | pthread_mutex_t *mutex; | |
2346 | int diverge; | |
2347 | int num_waits; | |
2348 | struct sock_fprog *prog; | |
2349 | struct __test_metadata *metadata; | |
2350 | }; | |
2351 | ||
93bd70e3 KC |
2352 | /* |
2353 | * To avoid joining joined threads (which is not allowed by Bionic), | |
2354 | * make sure we both successfully join and clear the tid to skip a | |
2355 | * later join attempt during fixture teardown. Any remaining threads | |
2356 | * will be directly killed during teardown. | |
2357 | */ | |
2358 | #define PTHREAD_JOIN(tid, status) \ | |
2359 | do { \ | |
2360 | int _rc = pthread_join(tid, status); \ | |
2361 | if (_rc) { \ | |
2362 | TH_LOG("pthread_join of tid %u failed: %d\n", \ | |
2363 | (unsigned int)tid, _rc); \ | |
2364 | } else { \ | |
2365 | tid = 0; \ | |
2366 | } \ | |
2367 | } while (0) | |
2368 | ||
1ae81d78 | 2369 | FIXTURE(TSYNC) { |
c99ee51a KC |
2370 | struct sock_fprog root_prog, apply_prog; |
2371 | struct tsync_sibling sibling[TSYNC_SIBLINGS]; | |
2372 | sem_t started; | |
2373 | pthread_cond_t cond; | |
2374 | pthread_mutex_t mutex; | |
2375 | int sibling_count; | |
2376 | }; | |
2377 | ||
2378 | FIXTURE_SETUP(TSYNC) | |
2379 | { | |
2380 | struct sock_filter root_filter[] = { | |
2381 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2382 | }; | |
2383 | struct sock_filter apply_filter[] = { | |
2384 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
2385 | offsetof(struct seccomp_data, nr)), | |
2386 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1), | |
2387 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
2388 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2389 | }; | |
2390 | ||
2391 | memset(&self->root_prog, 0, sizeof(self->root_prog)); | |
2392 | memset(&self->apply_prog, 0, sizeof(self->apply_prog)); | |
2393 | memset(&self->sibling, 0, sizeof(self->sibling)); | |
2394 | self->root_prog.filter = malloc(sizeof(root_filter)); | |
2395 | ASSERT_NE(NULL, self->root_prog.filter); | |
2396 | memcpy(self->root_prog.filter, &root_filter, sizeof(root_filter)); | |
2397 | self->root_prog.len = (unsigned short)ARRAY_SIZE(root_filter); | |
2398 | ||
2399 | self->apply_prog.filter = malloc(sizeof(apply_filter)); | |
2400 | ASSERT_NE(NULL, self->apply_prog.filter); | |
2401 | memcpy(self->apply_prog.filter, &apply_filter, sizeof(apply_filter)); | |
2402 | self->apply_prog.len = (unsigned short)ARRAY_SIZE(apply_filter); | |
2403 | ||
2404 | self->sibling_count = 0; | |
2405 | pthread_mutex_init(&self->mutex, NULL); | |
2406 | pthread_cond_init(&self->cond, NULL); | |
2407 | sem_init(&self->started, 0, 0); | |
2408 | self->sibling[0].tid = 0; | |
2409 | self->sibling[0].cond = &self->cond; | |
2410 | self->sibling[0].started = &self->started; | |
2411 | self->sibling[0].mutex = &self->mutex; | |
2412 | self->sibling[0].diverge = 0; | |
2413 | self->sibling[0].num_waits = 1; | |
2414 | self->sibling[0].prog = &self->root_prog; | |
2415 | self->sibling[0].metadata = _metadata; | |
2416 | self->sibling[1].tid = 0; | |
2417 | self->sibling[1].cond = &self->cond; | |
2418 | self->sibling[1].started = &self->started; | |
2419 | self->sibling[1].mutex = &self->mutex; | |
2420 | self->sibling[1].diverge = 0; | |
2421 | self->sibling[1].prog = &self->root_prog; | |
2422 | self->sibling[1].num_waits = 1; | |
2423 | self->sibling[1].metadata = _metadata; | |
2424 | } | |
2425 | ||
2426 | FIXTURE_TEARDOWN(TSYNC) | |
2427 | { | |
2428 | int sib = 0; | |
2429 | ||
2430 | if (self->root_prog.filter) | |
2431 | free(self->root_prog.filter); | |
2432 | if (self->apply_prog.filter) | |
2433 | free(self->apply_prog.filter); | |
2434 | ||
2435 | for ( ; sib < self->sibling_count; ++sib) { | |
2436 | struct tsync_sibling *s = &self->sibling[sib]; | |
c99ee51a KC |
2437 | |
2438 | if (!s->tid) | |
2439 | continue; | |
93bd70e3 KC |
2440 | /* |
2441 | * If a thread is still running, it may be stuck, so hit | |
2442 | * it over the head really hard. | |
2443 | */ | |
2444 | pthread_kill(s->tid, 9); | |
c99ee51a KC |
2445 | } |
2446 | pthread_mutex_destroy(&self->mutex); | |
2447 | pthread_cond_destroy(&self->cond); | |
2448 | sem_destroy(&self->started); | |
2449 | } | |
2450 | ||
2451 | void *tsync_sibling(void *data) | |
2452 | { | |
2453 | long ret = 0; | |
2454 | struct tsync_sibling *me = data; | |
2455 | ||
2456 | me->system_tid = syscall(__NR_gettid); | |
2457 | ||
2458 | pthread_mutex_lock(me->mutex); | |
2459 | if (me->diverge) { | |
2460 | /* Just re-apply the root prog to fork the tree */ | |
2461 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, | |
2462 | me->prog, 0, 0); | |
2463 | } | |
2464 | sem_post(me->started); | |
2465 | /* Return outside of started so parent notices failures. */ | |
2466 | if (ret) { | |
2467 | pthread_mutex_unlock(me->mutex); | |
2468 | return (void *)SIBLING_EXIT_FAILURE; | |
2469 | } | |
2470 | do { | |
2471 | pthread_cond_wait(me->cond, me->mutex); | |
2472 | me->num_waits = me->num_waits - 1; | |
2473 | } while (me->num_waits); | |
2474 | pthread_mutex_unlock(me->mutex); | |
2475 | ||
2476 | ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0); | |
2477 | if (!ret) | |
2478 | return (void *)SIBLING_EXIT_NEWPRIVS; | |
2479 | read(0, NULL, 0); | |
2480 | return (void *)SIBLING_EXIT_UNKILLED; | |
2481 | } | |
2482 | ||
2483 | void tsync_start_sibling(struct tsync_sibling *sibling) | |
2484 | { | |
2485 | pthread_create(&sibling->tid, NULL, tsync_sibling, (void *)sibling); | |
2486 | } | |
2487 | ||
2488 | TEST_F(TSYNC, siblings_fail_prctl) | |
2489 | { | |
2490 | long ret; | |
2491 | void *status; | |
2492 | struct sock_filter filter[] = { | |
2493 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
2494 | offsetof(struct seccomp_data, nr)), | |
2495 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1), | |
2496 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EINVAL), | |
2497 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2498 | }; | |
2499 | struct sock_fprog prog = { | |
2500 | .len = (unsigned short)ARRAY_SIZE(filter), | |
2501 | .filter = filter, | |
2502 | }; | |
2503 | ||
2504 | ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
2505 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2506 | } | |
2507 | ||
2508 | /* Check prctl failure detection by requesting sib 0 diverge. */ | |
2509 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog); | |
b623c4da KC |
2510 | ASSERT_NE(ENOSYS, errno) { |
2511 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2512 | } | |
c99ee51a KC |
2513 | ASSERT_EQ(0, ret) { |
2514 | TH_LOG("setting filter failed"); | |
2515 | } | |
2516 | ||
2517 | self->sibling[0].diverge = 1; | |
2518 | tsync_start_sibling(&self->sibling[0]); | |
2519 | tsync_start_sibling(&self->sibling[1]); | |
2520 | ||
2521 | while (self->sibling_count < TSYNC_SIBLINGS) { | |
2522 | sem_wait(&self->started); | |
2523 | self->sibling_count++; | |
2524 | } | |
2525 | ||
2526 | /* Signal the threads to clean up*/ | |
2527 | pthread_mutex_lock(&self->mutex); | |
2528 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2529 | TH_LOG("cond broadcast non-zero"); | |
2530 | } | |
2531 | pthread_mutex_unlock(&self->mutex); | |
2532 | ||
2533 | /* Ensure diverging sibling failed to call prctl. */ | |
93bd70e3 | 2534 | PTHREAD_JOIN(self->sibling[0].tid, &status); |
c99ee51a | 2535 | EXPECT_EQ(SIBLING_EXIT_FAILURE, (long)status); |
93bd70e3 | 2536 | PTHREAD_JOIN(self->sibling[1].tid, &status); |
c99ee51a KC |
2537 | EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); |
2538 | } | |
2539 | ||
2540 | TEST_F(TSYNC, two_siblings_with_ancestor) | |
2541 | { | |
2542 | long ret; | |
2543 | void *status; | |
2544 | ||
2545 | ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
2546 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2547 | } | |
2548 | ||
2549 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog); | |
b623c4da KC |
2550 | ASSERT_NE(ENOSYS, errno) { |
2551 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2552 | } | |
c99ee51a KC |
2553 | ASSERT_EQ(0, ret) { |
2554 | TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!"); | |
2555 | } | |
2556 | tsync_start_sibling(&self->sibling[0]); | |
2557 | tsync_start_sibling(&self->sibling[1]); | |
2558 | ||
2559 | while (self->sibling_count < TSYNC_SIBLINGS) { | |
2560 | sem_wait(&self->started); | |
2561 | self->sibling_count++; | |
2562 | } | |
2563 | ||
6c045d07 | 2564 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a KC |
2565 | &self->apply_prog); |
2566 | ASSERT_EQ(0, ret) { | |
2567 | TH_LOG("Could install filter on all threads!"); | |
2568 | } | |
2569 | /* Tell the siblings to test the policy */ | |
2570 | pthread_mutex_lock(&self->mutex); | |
2571 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2572 | TH_LOG("cond broadcast non-zero"); | |
2573 | } | |
2574 | pthread_mutex_unlock(&self->mutex); | |
2575 | /* Ensure they are both killed and don't exit cleanly. */ | |
93bd70e3 | 2576 | PTHREAD_JOIN(self->sibling[0].tid, &status); |
c99ee51a | 2577 | EXPECT_EQ(0x0, (long)status); |
93bd70e3 | 2578 | PTHREAD_JOIN(self->sibling[1].tid, &status); |
c99ee51a KC |
2579 | EXPECT_EQ(0x0, (long)status); |
2580 | } | |
2581 | ||
2582 | TEST_F(TSYNC, two_sibling_want_nnp) | |
2583 | { | |
2584 | void *status; | |
2585 | ||
2586 | /* start siblings before any prctl() operations */ | |
2587 | tsync_start_sibling(&self->sibling[0]); | |
2588 | tsync_start_sibling(&self->sibling[1]); | |
2589 | while (self->sibling_count < TSYNC_SIBLINGS) { | |
2590 | sem_wait(&self->started); | |
2591 | self->sibling_count++; | |
2592 | } | |
2593 | ||
2594 | /* Tell the siblings to test no policy */ | |
2595 | pthread_mutex_lock(&self->mutex); | |
2596 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2597 | TH_LOG("cond broadcast non-zero"); | |
2598 | } | |
2599 | pthread_mutex_unlock(&self->mutex); | |
2600 | ||
2601 | /* Ensure they are both upset about lacking nnp. */ | |
93bd70e3 | 2602 | PTHREAD_JOIN(self->sibling[0].tid, &status); |
c99ee51a | 2603 | EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status); |
93bd70e3 | 2604 | PTHREAD_JOIN(self->sibling[1].tid, &status); |
c99ee51a KC |
2605 | EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status); |
2606 | } | |
2607 | ||
2608 | TEST_F(TSYNC, two_siblings_with_no_filter) | |
2609 | { | |
2610 | long ret; | |
2611 | void *status; | |
2612 | ||
2613 | /* start siblings before any prctl() operations */ | |
2614 | tsync_start_sibling(&self->sibling[0]); | |
2615 | tsync_start_sibling(&self->sibling[1]); | |
2616 | while (self->sibling_count < TSYNC_SIBLINGS) { | |
2617 | sem_wait(&self->started); | |
2618 | self->sibling_count++; | |
2619 | } | |
2620 | ||
2621 | ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
2622 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2623 | } | |
2624 | ||
6c045d07 | 2625 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a | 2626 | &self->apply_prog); |
b623c4da KC |
2627 | ASSERT_NE(ENOSYS, errno) { |
2628 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2629 | } | |
c99ee51a KC |
2630 | ASSERT_EQ(0, ret) { |
2631 | TH_LOG("Could install filter on all threads!"); | |
2632 | } | |
2633 | ||
2634 | /* Tell the siblings to test the policy */ | |
2635 | pthread_mutex_lock(&self->mutex); | |
2636 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2637 | TH_LOG("cond broadcast non-zero"); | |
2638 | } | |
2639 | pthread_mutex_unlock(&self->mutex); | |
2640 | ||
2641 | /* Ensure they are both killed and don't exit cleanly. */ | |
93bd70e3 | 2642 | PTHREAD_JOIN(self->sibling[0].tid, &status); |
c99ee51a | 2643 | EXPECT_EQ(0x0, (long)status); |
93bd70e3 | 2644 | PTHREAD_JOIN(self->sibling[1].tid, &status); |
c99ee51a KC |
2645 | EXPECT_EQ(0x0, (long)status); |
2646 | } | |
2647 | ||
2648 | TEST_F(TSYNC, two_siblings_with_one_divergence) | |
2649 | { | |
2650 | long ret; | |
2651 | void *status; | |
2652 | ||
2653 | ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
2654 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2655 | } | |
2656 | ||
2657 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog); | |
b623c4da KC |
2658 | ASSERT_NE(ENOSYS, errno) { |
2659 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2660 | } | |
c99ee51a KC |
2661 | ASSERT_EQ(0, ret) { |
2662 | TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!"); | |
2663 | } | |
2664 | self->sibling[0].diverge = 1; | |
2665 | tsync_start_sibling(&self->sibling[0]); | |
2666 | tsync_start_sibling(&self->sibling[1]); | |
2667 | ||
2668 | while (self->sibling_count < TSYNC_SIBLINGS) { | |
2669 | sem_wait(&self->started); | |
2670 | self->sibling_count++; | |
2671 | } | |
2672 | ||
6c045d07 | 2673 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a KC |
2674 | &self->apply_prog); |
2675 | ASSERT_EQ(self->sibling[0].system_tid, ret) { | |
2676 | TH_LOG("Did not fail on diverged sibling."); | |
2677 | } | |
2678 | ||
2679 | /* Wake the threads */ | |
2680 | pthread_mutex_lock(&self->mutex); | |
2681 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2682 | TH_LOG("cond broadcast non-zero"); | |
2683 | } | |
2684 | pthread_mutex_unlock(&self->mutex); | |
2685 | ||
2686 | /* Ensure they are both unkilled. */ | |
93bd70e3 | 2687 | PTHREAD_JOIN(self->sibling[0].tid, &status); |
c99ee51a | 2688 | EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); |
93bd70e3 | 2689 | PTHREAD_JOIN(self->sibling[1].tid, &status); |
c99ee51a KC |
2690 | EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); |
2691 | } | |
2692 | ||
51891498 TA |
2693 | TEST_F(TSYNC, two_siblings_with_one_divergence_no_tid_in_err) |
2694 | { | |
2695 | long ret, flags; | |
2696 | void *status; | |
2697 | ||
2698 | ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
2699 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2700 | } | |
2701 | ||
2702 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog); | |
2703 | ASSERT_NE(ENOSYS, errno) { | |
2704 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2705 | } | |
2706 | ASSERT_EQ(0, ret) { | |
2707 | TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!"); | |
2708 | } | |
2709 | self->sibling[0].diverge = 1; | |
2710 | tsync_start_sibling(&self->sibling[0]); | |
2711 | tsync_start_sibling(&self->sibling[1]); | |
2712 | ||
2713 | while (self->sibling_count < TSYNC_SIBLINGS) { | |
2714 | sem_wait(&self->started); | |
2715 | self->sibling_count++; | |
2716 | } | |
2717 | ||
2718 | flags = SECCOMP_FILTER_FLAG_TSYNC | \ | |
2719 | SECCOMP_FILTER_FLAG_TSYNC_ESRCH; | |
2720 | ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &self->apply_prog); | |
2721 | ASSERT_EQ(ESRCH, errno) { | |
2722 | TH_LOG("Did not return ESRCH for diverged sibling."); | |
2723 | } | |
2724 | ASSERT_EQ(-1, ret) { | |
2725 | TH_LOG("Did not fail on diverged sibling."); | |
2726 | } | |
2727 | ||
2728 | /* Wake the threads */ | |
2729 | pthread_mutex_lock(&self->mutex); | |
2730 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2731 | TH_LOG("cond broadcast non-zero"); | |
2732 | } | |
2733 | pthread_mutex_unlock(&self->mutex); | |
2734 | ||
2735 | /* Ensure they are both unkilled. */ | |
2736 | PTHREAD_JOIN(self->sibling[0].tid, &status); | |
2737 | EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); | |
2738 | PTHREAD_JOIN(self->sibling[1].tid, &status); | |
2739 | EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); | |
2740 | } | |
2741 | ||
c99ee51a KC |
2742 | TEST_F(TSYNC, two_siblings_not_under_filter) |
2743 | { | |
2744 | long ret, sib; | |
2745 | void *status; | |
ed492c2a | 2746 | struct timespec delay = { .tv_nsec = 100000000 }; |
c99ee51a KC |
2747 | |
2748 | ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
2749 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2750 | } | |
2751 | ||
2752 | /* | |
2753 | * Sibling 0 will have its own seccomp policy | |
2754 | * and Sibling 1 will not be under seccomp at | |
2755 | * all. Sibling 1 will enter seccomp and 0 | |
2756 | * will cause failure. | |
2757 | */ | |
2758 | self->sibling[0].diverge = 1; | |
2759 | tsync_start_sibling(&self->sibling[0]); | |
2760 | tsync_start_sibling(&self->sibling[1]); | |
2761 | ||
2762 | while (self->sibling_count < TSYNC_SIBLINGS) { | |
2763 | sem_wait(&self->started); | |
2764 | self->sibling_count++; | |
2765 | } | |
2766 | ||
2767 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog); | |
b623c4da KC |
2768 | ASSERT_NE(ENOSYS, errno) { |
2769 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2770 | } | |
c99ee51a KC |
2771 | ASSERT_EQ(0, ret) { |
2772 | TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!"); | |
2773 | } | |
2774 | ||
6c045d07 | 2775 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a KC |
2776 | &self->apply_prog); |
2777 | ASSERT_EQ(ret, self->sibling[0].system_tid) { | |
2778 | TH_LOG("Did not fail on diverged sibling."); | |
2779 | } | |
2780 | sib = 1; | |
2781 | if (ret == self->sibling[0].system_tid) | |
2782 | sib = 0; | |
2783 | ||
2784 | pthread_mutex_lock(&self->mutex); | |
2785 | ||
2786 | /* Increment the other siblings num_waits so we can clean up | |
2787 | * the one we just saw. | |
2788 | */ | |
2789 | self->sibling[!sib].num_waits += 1; | |
2790 | ||
2791 | /* Signal the thread to clean up*/ | |
2792 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2793 | TH_LOG("cond broadcast non-zero"); | |
2794 | } | |
2795 | pthread_mutex_unlock(&self->mutex); | |
93bd70e3 | 2796 | PTHREAD_JOIN(self->sibling[sib].tid, &status); |
c99ee51a KC |
2797 | EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); |
2798 | /* Poll for actual task death. pthread_join doesn't guarantee it. */ | |
2799 | while (!kill(self->sibling[sib].system_tid, 0)) | |
ed492c2a | 2800 | nanosleep(&delay, NULL); |
c99ee51a KC |
2801 | /* Switch to the remaining sibling */ |
2802 | sib = !sib; | |
2803 | ||
6c045d07 | 2804 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a KC |
2805 | &self->apply_prog); |
2806 | ASSERT_EQ(0, ret) { | |
2807 | TH_LOG("Expected the remaining sibling to sync"); | |
2808 | }; | |
2809 | ||
2810 | pthread_mutex_lock(&self->mutex); | |
2811 | ||
2812 | /* If remaining sibling didn't have a chance to wake up during | |
2813 | * the first broadcast, manually reduce the num_waits now. | |
2814 | */ | |
2815 | if (self->sibling[sib].num_waits > 1) | |
2816 | self->sibling[sib].num_waits = 1; | |
2817 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2818 | TH_LOG("cond broadcast non-zero"); | |
2819 | } | |
2820 | pthread_mutex_unlock(&self->mutex); | |
93bd70e3 | 2821 | PTHREAD_JOIN(self->sibling[sib].tid, &status); |
c99ee51a KC |
2822 | EXPECT_EQ(0, (long)status); |
2823 | /* Poll for actual task death. pthread_join doesn't guarantee it. */ | |
2824 | while (!kill(self->sibling[sib].system_tid, 0)) | |
ed492c2a | 2825 | nanosleep(&delay, NULL); |
c99ee51a | 2826 | |
6c045d07 | 2827 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a KC |
2828 | &self->apply_prog); |
2829 | ASSERT_EQ(0, ret); /* just us chickens */ | |
2830 | } | |
2831 | ||
2832 | /* Make sure restarted syscalls are seen directly as "restart_syscall". */ | |
2833 | TEST(syscall_restart) | |
2834 | { | |
2835 | long ret; | |
2836 | unsigned long msg; | |
2837 | pid_t child_pid; | |
2838 | int pipefd[2]; | |
2839 | int status; | |
2840 | siginfo_t info = { }; | |
2841 | struct sock_filter filter[] = { | |
2842 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
2843 | offsetof(struct seccomp_data, nr)), | |
2844 | ||
2845 | #ifdef __NR_sigreturn | |
d42b8dbe | 2846 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_sigreturn, 7, 0), |
c99ee51a | 2847 | #endif |
d42b8dbe TLSC |
2848 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 6, 0), |
2849 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_exit, 5, 0), | |
2850 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_rt_sigreturn, 4, 0), | |
2851 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_nanosleep, 5, 0), | |
2852 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_clock_nanosleep, 4, 0), | |
c99ee51a KC |
2853 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_restart_syscall, 4, 0), |
2854 | ||
2855 | /* Allow __NR_write for easy logging. */ | |
2856 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_write, 0, 1), | |
2857 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2858 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
256d0afb KC |
2859 | /* The nanosleep jump target. */ |
2860 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x100), | |
2861 | /* The restart_syscall jump target. */ | |
2862 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x200), | |
c99ee51a KC |
2863 | }; |
2864 | struct sock_fprog prog = { | |
2865 | .len = (unsigned short)ARRAY_SIZE(filter), | |
2866 | .filter = filter, | |
2867 | }; | |
256d0afb KC |
2868 | #if defined(__arm__) |
2869 | struct utsname utsbuf; | |
2870 | #endif | |
c99ee51a KC |
2871 | |
2872 | ASSERT_EQ(0, pipe(pipefd)); | |
2873 | ||
2874 | child_pid = fork(); | |
2875 | ASSERT_LE(0, child_pid); | |
2876 | if (child_pid == 0) { | |
2877 | /* Child uses EXPECT not ASSERT to deliver status correctly. */ | |
2878 | char buf = ' '; | |
256d0afb | 2879 | struct timespec timeout = { }; |
c99ee51a KC |
2880 | |
2881 | /* Attach parent as tracer and stop. */ | |
2882 | EXPECT_EQ(0, ptrace(PTRACE_TRACEME)); | |
2883 | EXPECT_EQ(0, raise(SIGSTOP)); | |
2884 | ||
2885 | EXPECT_EQ(0, close(pipefd[1])); | |
2886 | ||
2887 | EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
2888 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2889 | } | |
2890 | ||
2891 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
2892 | EXPECT_EQ(0, ret) { | |
2893 | TH_LOG("Failed to install filter!"); | |
2894 | } | |
2895 | ||
2896 | EXPECT_EQ(1, read(pipefd[0], &buf, 1)) { | |
2897 | TH_LOG("Failed to read() sync from parent"); | |
2898 | } | |
2899 | EXPECT_EQ('.', buf) { | |
2900 | TH_LOG("Failed to get sync data from read()"); | |
2901 | } | |
2902 | ||
256d0afb KC |
2903 | /* Start nanosleep to be interrupted. */ |
2904 | timeout.tv_sec = 1; | |
c99ee51a | 2905 | errno = 0; |
256d0afb KC |
2906 | EXPECT_EQ(0, nanosleep(&timeout, NULL)) { |
2907 | TH_LOG("Call to nanosleep() failed (errno %d)", errno); | |
c99ee51a KC |
2908 | } |
2909 | ||
2910 | /* Read final sync from parent. */ | |
2911 | EXPECT_EQ(1, read(pipefd[0], &buf, 1)) { | |
2912 | TH_LOG("Failed final read() from parent"); | |
2913 | } | |
2914 | EXPECT_EQ('!', buf) { | |
2915 | TH_LOG("Failed to get final data from read()"); | |
2916 | } | |
2917 | ||
2918 | /* Directly report the status of our test harness results. */ | |
2919 | syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS | |
2920 | : EXIT_FAILURE); | |
2921 | } | |
2922 | EXPECT_EQ(0, close(pipefd[0])); | |
2923 | ||
2924 | /* Attach to child, setup options, and release. */ | |
2925 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); | |
2926 | ASSERT_EQ(true, WIFSTOPPED(status)); | |
2927 | ASSERT_EQ(0, ptrace(PTRACE_SETOPTIONS, child_pid, NULL, | |
2928 | PTRACE_O_TRACESECCOMP)); | |
2929 | ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); | |
2930 | ASSERT_EQ(1, write(pipefd[1], ".", 1)); | |
2931 | ||
256d0afb | 2932 | /* Wait for nanosleep() to start. */ |
c99ee51a KC |
2933 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); |
2934 | ASSERT_EQ(true, WIFSTOPPED(status)); | |
2935 | ASSERT_EQ(SIGTRAP, WSTOPSIG(status)); | |
2936 | ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16)); | |
2937 | ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg)); | |
2938 | ASSERT_EQ(0x100, msg); | |
d42b8dbe TLSC |
2939 | ret = get_syscall(_metadata, child_pid); |
2940 | EXPECT_TRUE(ret == __NR_nanosleep || ret == __NR_clock_nanosleep); | |
c99ee51a KC |
2941 | |
2942 | /* Might as well check siginfo for sanity while we're here. */ | |
2943 | ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info)); | |
2944 | ASSERT_EQ(SIGTRAP, info.si_signo); | |
2945 | ASSERT_EQ(SIGTRAP | (PTRACE_EVENT_SECCOMP << 8), info.si_code); | |
2946 | EXPECT_EQ(0, info.si_errno); | |
2947 | EXPECT_EQ(getuid(), info.si_uid); | |
2948 | /* Verify signal delivery came from child (seccomp-triggered). */ | |
2949 | EXPECT_EQ(child_pid, info.si_pid); | |
2950 | ||
256d0afb | 2951 | /* Interrupt nanosleep with SIGSTOP (which we'll need to handle). */ |
c99ee51a KC |
2952 | ASSERT_EQ(0, kill(child_pid, SIGSTOP)); |
2953 | ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); | |
2954 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); | |
2955 | ASSERT_EQ(true, WIFSTOPPED(status)); | |
2956 | ASSERT_EQ(SIGSTOP, WSTOPSIG(status)); | |
c99ee51a | 2957 | ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info)); |
2bd61abe KC |
2958 | /* |
2959 | * There is no siginfo on SIGSTOP any more, so we can't verify | |
2960 | * signal delivery came from parent now (getpid() == info.si_pid). | |
2961 | * https://lkml.kernel.org/r/CAGXu5jJaZAOzP1qFz66tYrtbuywqb+UN2SOA1VLHpCCOiYvYeg@mail.gmail.com | |
2962 | * At least verify the SIGSTOP via PTRACE_GETSIGINFO. | |
2963 | */ | |
2964 | EXPECT_EQ(SIGSTOP, info.si_signo); | |
c99ee51a | 2965 | |
256d0afb | 2966 | /* Restart nanosleep with SIGCONT, which triggers restart_syscall. */ |
c99ee51a KC |
2967 | ASSERT_EQ(0, kill(child_pid, SIGCONT)); |
2968 | ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); | |
2969 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); | |
2970 | ASSERT_EQ(true, WIFSTOPPED(status)); | |
2971 | ASSERT_EQ(SIGCONT, WSTOPSIG(status)); | |
2972 | ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); | |
2973 | ||
2974 | /* Wait for restart_syscall() to start. */ | |
2975 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); | |
2976 | ASSERT_EQ(true, WIFSTOPPED(status)); | |
2977 | ASSERT_EQ(SIGTRAP, WSTOPSIG(status)); | |
2978 | ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16)); | |
2979 | ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg)); | |
256d0afb | 2980 | |
c99ee51a KC |
2981 | ASSERT_EQ(0x200, msg); |
2982 | ret = get_syscall(_metadata, child_pid); | |
2983 | #if defined(__arm__) | |
256d0afb KC |
2984 | /* |
2985 | * FIXME: | |
2986 | * - native ARM registers do NOT expose true syscall. | |
2987 | * - compat ARM registers on ARM64 DO expose true syscall. | |
2988 | */ | |
2989 | ASSERT_EQ(0, uname(&utsbuf)); | |
2990 | if (strncmp(utsbuf.machine, "arm", 3) == 0) { | |
2991 | EXPECT_EQ(__NR_nanosleep, ret); | |
2992 | } else | |
c99ee51a | 2993 | #endif |
256d0afb KC |
2994 | { |
2995 | EXPECT_EQ(__NR_restart_syscall, ret); | |
2996 | } | |
c99ee51a | 2997 | |
256d0afb | 2998 | /* Write again to end test. */ |
c99ee51a KC |
2999 | ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); |
3000 | ASSERT_EQ(1, write(pipefd[1], "!", 1)); | |
3001 | EXPECT_EQ(0, close(pipefd[1])); | |
3002 | ||
3003 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); | |
3004 | if (WIFSIGNALED(status) || WEXITSTATUS(status)) | |
3005 | _metadata->passed = 0; | |
3006 | } | |
3007 | ||
e66a3997 TH |
3008 | TEST_SIGNAL(filter_flag_log, SIGSYS) |
3009 | { | |
3010 | struct sock_filter allow_filter[] = { | |
3011 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
3012 | }; | |
3013 | struct sock_filter kill_filter[] = { | |
3014 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
3015 | offsetof(struct seccomp_data, nr)), | |
3016 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), | |
3017 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
3018 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
3019 | }; | |
3020 | struct sock_fprog allow_prog = { | |
3021 | .len = (unsigned short)ARRAY_SIZE(allow_filter), | |
3022 | .filter = allow_filter, | |
3023 | }; | |
3024 | struct sock_fprog kill_prog = { | |
3025 | .len = (unsigned short)ARRAY_SIZE(kill_filter), | |
3026 | .filter = kill_filter, | |
3027 | }; | |
3028 | long ret; | |
3029 | pid_t parent = getppid(); | |
3030 | ||
3031 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
3032 | ASSERT_EQ(0, ret); | |
3033 | ||
3034 | /* Verify that the FILTER_FLAG_LOG flag isn't accepted in strict mode */ | |
3035 | ret = seccomp(SECCOMP_SET_MODE_STRICT, SECCOMP_FILTER_FLAG_LOG, | |
3036 | &allow_prog); | |
3037 | ASSERT_NE(ENOSYS, errno) { | |
3038 | TH_LOG("Kernel does not support seccomp syscall!"); | |
3039 | } | |
3040 | EXPECT_NE(0, ret) { | |
3041 | TH_LOG("Kernel accepted FILTER_FLAG_LOG flag in strict mode!"); | |
3042 | } | |
3043 | EXPECT_EQ(EINVAL, errno) { | |
3044 | TH_LOG("Kernel returned unexpected errno for FILTER_FLAG_LOG flag in strict mode!"); | |
3045 | } | |
3046 | ||
3047 | /* Verify that a simple, permissive filter can be added with no flags */ | |
3048 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &allow_prog); | |
3049 | EXPECT_EQ(0, ret); | |
3050 | ||
3051 | /* See if the same filter can be added with the FILTER_FLAG_LOG flag */ | |
3052 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG, | |
3053 | &allow_prog); | |
3054 | ASSERT_NE(EINVAL, errno) { | |
3055 | TH_LOG("Kernel does not support the FILTER_FLAG_LOG flag!"); | |
3056 | } | |
3057 | EXPECT_EQ(0, ret); | |
3058 | ||
3059 | /* Ensure that the kill filter works with the FILTER_FLAG_LOG flag */ | |
3060 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG, | |
3061 | &kill_prog); | |
3062 | EXPECT_EQ(0, ret); | |
3063 | ||
3064 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
3065 | /* getpid() should never return. */ | |
3066 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
3067 | } | |
3068 | ||
d612b1fd TH |
3069 | TEST(get_action_avail) |
3070 | { | |
fd76875c | 3071 | __u32 actions[] = { SECCOMP_RET_KILL_THREAD, SECCOMP_RET_TRAP, |
d612b1fd | 3072 | SECCOMP_RET_ERRNO, SECCOMP_RET_TRACE, |
59f5cf44 | 3073 | SECCOMP_RET_LOG, SECCOMP_RET_ALLOW }; |
d612b1fd TH |
3074 | __u32 unknown_action = 0x10000000U; |
3075 | int i; | |
3076 | long ret; | |
3077 | ||
3078 | ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[0]); | |
3079 | ASSERT_NE(ENOSYS, errno) { | |
3080 | TH_LOG("Kernel does not support seccomp syscall!"); | |
3081 | } | |
3082 | ASSERT_NE(EINVAL, errno) { | |
3083 | TH_LOG("Kernel does not support SECCOMP_GET_ACTION_AVAIL operation!"); | |
3084 | } | |
3085 | EXPECT_EQ(ret, 0); | |
3086 | ||
3087 | for (i = 0; i < ARRAY_SIZE(actions); i++) { | |
3088 | ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[i]); | |
3089 | EXPECT_EQ(ret, 0) { | |
3090 | TH_LOG("Expected action (0x%X) not available!", | |
3091 | actions[i]); | |
3092 | } | |
3093 | } | |
3094 | ||
3095 | /* Check that an unknown action is handled properly (EOPNOTSUPP) */ | |
3096 | ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &unknown_action); | |
3097 | EXPECT_EQ(ret, -1); | |
3098 | EXPECT_EQ(errno, EOPNOTSUPP); | |
3099 | } | |
3100 | ||
d057dc4e TA |
3101 | TEST(get_metadata) |
3102 | { | |
3103 | pid_t pid; | |
3104 | int pipefd[2]; | |
3105 | char buf; | |
3106 | struct seccomp_metadata md; | |
6c3b6d50 | 3107 | long ret; |
d057dc4e | 3108 | |
3aa415dd TA |
3109 | /* Only real root can get metadata. */ |
3110 | if (geteuid()) { | |
8b1bc88c | 3111 | SKIP(return, "get_metadata requires real root"); |
3aa415dd TA |
3112 | return; |
3113 | } | |
3114 | ||
d057dc4e TA |
3115 | ASSERT_EQ(0, pipe(pipefd)); |
3116 | ||
3117 | pid = fork(); | |
3118 | ASSERT_GE(pid, 0); | |
3119 | if (pid == 0) { | |
3120 | struct sock_filter filter[] = { | |
3121 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
3122 | }; | |
3123 | struct sock_fprog prog = { | |
3124 | .len = (unsigned short)ARRAY_SIZE(filter), | |
3125 | .filter = filter, | |
3126 | }; | |
3127 | ||
3128 | /* one with log, one without */ | |
fb024a07 | 3129 | EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, |
d057dc4e | 3130 | SECCOMP_FILTER_FLAG_LOG, &prog)); |
fb024a07 | 3131 | EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog)); |
d057dc4e | 3132 | |
fb024a07 | 3133 | EXPECT_EQ(0, close(pipefd[0])); |
d057dc4e TA |
3134 | ASSERT_EQ(1, write(pipefd[1], "1", 1)); |
3135 | ASSERT_EQ(0, close(pipefd[1])); | |
3136 | ||
3137 | while (1) | |
3138 | sleep(100); | |
3139 | } | |
3140 | ||
3141 | ASSERT_EQ(0, close(pipefd[1])); | |
3142 | ASSERT_EQ(1, read(pipefd[0], &buf, 1)); | |
3143 | ||
3144 | ASSERT_EQ(0, ptrace(PTRACE_ATTACH, pid)); | |
3145 | ASSERT_EQ(pid, waitpid(pid, NULL, 0)); | |
3146 | ||
6c3b6d50 KC |
3147 | /* Past here must not use ASSERT or child process is never killed. */ |
3148 | ||
d057dc4e | 3149 | md.filter_off = 0; |
6c3b6d50 KC |
3150 | errno = 0; |
3151 | ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md); | |
3152 | EXPECT_EQ(sizeof(md), ret) { | |
3153 | if (errno == EINVAL) | |
8b1bc88c | 3154 | SKIP(goto skip, "Kernel does not support PTRACE_SECCOMP_GET_METADATA (missing CONFIG_CHECKPOINT_RESTORE?)"); |
6c3b6d50 KC |
3155 | } |
3156 | ||
d057dc4e TA |
3157 | EXPECT_EQ(md.flags, SECCOMP_FILTER_FLAG_LOG); |
3158 | EXPECT_EQ(md.filter_off, 0); | |
3159 | ||
3160 | md.filter_off = 1; | |
6c3b6d50 KC |
3161 | ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md); |
3162 | EXPECT_EQ(sizeof(md), ret); | |
d057dc4e TA |
3163 | EXPECT_EQ(md.flags, 0); |
3164 | EXPECT_EQ(md.filter_off, 1); | |
3165 | ||
6c3b6d50 | 3166 | skip: |
d057dc4e TA |
3167 | ASSERT_EQ(0, kill(pid, SIGKILL)); |
3168 | } | |
3169 | ||
279ed890 | 3170 | static int user_notif_syscall(int nr, unsigned int flags) |
6a21cc50 TA |
3171 | { |
3172 | struct sock_filter filter[] = { | |
3173 | BPF_STMT(BPF_LD+BPF_W+BPF_ABS, | |
3174 | offsetof(struct seccomp_data, nr)), | |
3175 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, nr, 0, 1), | |
3176 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_USER_NOTIF), | |
3177 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), | |
3178 | }; | |
3179 | ||
3180 | struct sock_fprog prog = { | |
3181 | .len = (unsigned short)ARRAY_SIZE(filter), | |
3182 | .filter = filter, | |
3183 | }; | |
3184 | ||
3185 | return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog); | |
3186 | } | |
3187 | ||
223e660b | 3188 | #define USER_NOTIF_MAGIC INT_MAX |
6a21cc50 TA |
3189 | TEST(user_notification_basic) |
3190 | { | |
3191 | pid_t pid; | |
3192 | long ret; | |
3193 | int status, listener; | |
3194 | struct seccomp_notif req = {}; | |
3195 | struct seccomp_notif_resp resp = {}; | |
3196 | struct pollfd pollfd; | |
3197 | ||
3198 | struct sock_filter filter[] = { | |
3199 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
3200 | }; | |
3201 | struct sock_fprog prog = { | |
3202 | .len = (unsigned short)ARRAY_SIZE(filter), | |
3203 | .filter = filter, | |
3204 | }; | |
3205 | ||
c7140706 TA |
3206 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); |
3207 | ASSERT_EQ(0, ret) { | |
3208 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
3209 | } | |
3210 | ||
6a21cc50 TA |
3211 | pid = fork(); |
3212 | ASSERT_GE(pid, 0); | |
3213 | ||
3214 | /* Check that we get -ENOSYS with no listener attached */ | |
3215 | if (pid == 0) { | |
279ed890 | 3216 | if (user_notif_syscall(__NR_getppid, 0) < 0) |
6a21cc50 | 3217 | exit(1); |
9dd3fcb0 | 3218 | ret = syscall(__NR_getppid); |
6a21cc50 TA |
3219 | exit(ret >= 0 || errno != ENOSYS); |
3220 | } | |
3221 | ||
3222 | EXPECT_EQ(waitpid(pid, &status, 0), pid); | |
3223 | EXPECT_EQ(true, WIFEXITED(status)); | |
3224 | EXPECT_EQ(0, WEXITSTATUS(status)); | |
3225 | ||
0b54b443 | 3226 | /* Add some no-op filters for grins. */ |
6a21cc50 TA |
3227 | EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0); |
3228 | EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0); | |
3229 | EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0); | |
3230 | EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0); | |
3231 | ||
3232 | /* Check that the basic notification machinery works */ | |
279ed890 KC |
3233 | listener = user_notif_syscall(__NR_getppid, |
3234 | SECCOMP_FILTER_FLAG_NEW_LISTENER); | |
3d244c19 | 3235 | ASSERT_GE(listener, 0); |
6a21cc50 TA |
3236 | |
3237 | /* Installing a second listener in the chain should EBUSY */ | |
279ed890 KC |
3238 | EXPECT_EQ(user_notif_syscall(__NR_getppid, |
3239 | SECCOMP_FILTER_FLAG_NEW_LISTENER), | |
6a21cc50 TA |
3240 | -1); |
3241 | EXPECT_EQ(errno, EBUSY); | |
3242 | ||
3243 | pid = fork(); | |
3244 | ASSERT_GE(pid, 0); | |
3245 | ||
3246 | if (pid == 0) { | |
9dd3fcb0 | 3247 | ret = syscall(__NR_getppid); |
6a21cc50 TA |
3248 | exit(ret != USER_NOTIF_MAGIC); |
3249 | } | |
3250 | ||
3251 | pollfd.fd = listener; | |
3252 | pollfd.events = POLLIN | POLLOUT; | |
3253 | ||
3254 | EXPECT_GT(poll(&pollfd, 1, -1), 0); | |
3255 | EXPECT_EQ(pollfd.revents, POLLIN); | |
3256 | ||
e4ab5ccc SD |
3257 | /* Test that we can't pass garbage to the kernel. */ |
3258 | memset(&req, 0, sizeof(req)); | |
3259 | req.pid = -1; | |
3260 | errno = 0; | |
3261 | ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req); | |
3262 | EXPECT_EQ(-1, ret); | |
3263 | EXPECT_EQ(EINVAL, errno); | |
3264 | ||
3265 | if (ret) { | |
3266 | req.pid = 0; | |
3267 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); | |
3268 | } | |
6a21cc50 TA |
3269 | |
3270 | pollfd.fd = listener; | |
3271 | pollfd.events = POLLIN | POLLOUT; | |
3272 | ||
3273 | EXPECT_GT(poll(&pollfd, 1, -1), 0); | |
3274 | EXPECT_EQ(pollfd.revents, POLLOUT); | |
3275 | ||
9dd3fcb0 | 3276 | EXPECT_EQ(req.data.nr, __NR_getppid); |
6a21cc50 TA |
3277 | |
3278 | resp.id = req.id; | |
3279 | resp.error = 0; | |
3280 | resp.val = USER_NOTIF_MAGIC; | |
3281 | ||
3282 | /* check that we make sure flags == 0 */ | |
3283 | resp.flags = 1; | |
3284 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1); | |
3285 | EXPECT_EQ(errno, EINVAL); | |
3286 | ||
3287 | resp.flags = 0; | |
3288 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); | |
3289 | ||
3290 | EXPECT_EQ(waitpid(pid, &status, 0), pid); | |
3291 | EXPECT_EQ(true, WIFEXITED(status)); | |
3292 | EXPECT_EQ(0, WEXITSTATUS(status)); | |
3293 | } | |
3294 | ||
51891498 TA |
3295 | TEST(user_notification_with_tsync) |
3296 | { | |
3297 | int ret; | |
3298 | unsigned int flags; | |
3299 | ||
e4d05028 KC |
3300 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); |
3301 | ASSERT_EQ(0, ret) { | |
3302 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
3303 | } | |
3304 | ||
51891498 TA |
3305 | /* these were exclusive */ |
3306 | flags = SECCOMP_FILTER_FLAG_NEW_LISTENER | | |
3307 | SECCOMP_FILTER_FLAG_TSYNC; | |
279ed890 | 3308 | ASSERT_EQ(-1, user_notif_syscall(__NR_getppid, flags)); |
51891498 TA |
3309 | ASSERT_EQ(EINVAL, errno); |
3310 | ||
3311 | /* but now they're not */ | |
3312 | flags |= SECCOMP_FILTER_FLAG_TSYNC_ESRCH; | |
279ed890 | 3313 | ret = user_notif_syscall(__NR_getppid, flags); |
51891498 TA |
3314 | close(ret); |
3315 | ASSERT_LE(0, ret); | |
3316 | } | |
3317 | ||
6a21cc50 TA |
3318 | TEST(user_notification_kill_in_middle) |
3319 | { | |
3320 | pid_t pid; | |
3321 | long ret; | |
3322 | int listener; | |
3323 | struct seccomp_notif req = {}; | |
3324 | struct seccomp_notif_resp resp = {}; | |
3325 | ||
c7140706 TA |
3326 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); |
3327 | ASSERT_EQ(0, ret) { | |
3328 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
3329 | } | |
3330 | ||
279ed890 KC |
3331 | listener = user_notif_syscall(__NR_getppid, |
3332 | SECCOMP_FILTER_FLAG_NEW_LISTENER); | |
3d244c19 | 3333 | ASSERT_GE(listener, 0); |
6a21cc50 TA |
3334 | |
3335 | /* | |
3336 | * Check that nothing bad happens when we kill the task in the middle | |
3337 | * of a syscall. | |
3338 | */ | |
3339 | pid = fork(); | |
3340 | ASSERT_GE(pid, 0); | |
3341 | ||
3342 | if (pid == 0) { | |
9dd3fcb0 | 3343 | ret = syscall(__NR_getppid); |
6a21cc50 TA |
3344 | exit(ret != USER_NOTIF_MAGIC); |
3345 | } | |
3346 | ||
3347 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); | |
3348 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id), 0); | |
3349 | ||
3350 | EXPECT_EQ(kill(pid, SIGKILL), 0); | |
3351 | EXPECT_EQ(waitpid(pid, NULL, 0), pid); | |
3352 | ||
3353 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id), -1); | |
3354 | ||
3355 | resp.id = req.id; | |
3356 | ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp); | |
3357 | EXPECT_EQ(ret, -1); | |
3358 | EXPECT_EQ(errno, ENOENT); | |
3359 | } | |
3360 | ||
3361 | static int handled = -1; | |
3362 | ||
3363 | static void signal_handler(int signal) | |
3364 | { | |
3365 | if (write(handled, "c", 1) != 1) | |
3366 | perror("write from signal"); | |
3367 | } | |
3368 | ||
3369 | TEST(user_notification_signal) | |
3370 | { | |
3371 | pid_t pid; | |
3372 | long ret; | |
3373 | int status, listener, sk_pair[2]; | |
3374 | struct seccomp_notif req = {}; | |
3375 | struct seccomp_notif_resp resp = {}; | |
3376 | char c; | |
3377 | ||
c7140706 TA |
3378 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); |
3379 | ASSERT_EQ(0, ret) { | |
3380 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
3381 | } | |
3382 | ||
6a21cc50 TA |
3383 | ASSERT_EQ(socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair), 0); |
3384 | ||
279ed890 KC |
3385 | listener = user_notif_syscall(__NR_gettid, |
3386 | SECCOMP_FILTER_FLAG_NEW_LISTENER); | |
3d244c19 | 3387 | ASSERT_GE(listener, 0); |
6a21cc50 TA |
3388 | |
3389 | pid = fork(); | |
3390 | ASSERT_GE(pid, 0); | |
3391 | ||
3392 | if (pid == 0) { | |
3393 | close(sk_pair[0]); | |
3394 | handled = sk_pair[1]; | |
3395 | if (signal(SIGUSR1, signal_handler) == SIG_ERR) { | |
3396 | perror("signal"); | |
3397 | exit(1); | |
3398 | } | |
3399 | /* | |
3400 | * ERESTARTSYS behavior is a bit hard to test, because we need | |
3401 | * to rely on a signal that has not yet been handled. Let's at | |
3402 | * least check that the error code gets propagated through, and | |
3403 | * hope that it doesn't break when there is actually a signal :) | |
3404 | */ | |
3405 | ret = syscall(__NR_gettid); | |
3406 | exit(!(ret == -1 && errno == 512)); | |
3407 | } | |
3408 | ||
3409 | close(sk_pair[1]); | |
3410 | ||
88c13f8b | 3411 | memset(&req, 0, sizeof(req)); |
6a21cc50 TA |
3412 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); |
3413 | ||
3414 | EXPECT_EQ(kill(pid, SIGUSR1), 0); | |
3415 | ||
3416 | /* | |
3417 | * Make sure the signal really is delivered, which means we're not | |
3418 | * stuck in the user notification code any more and the notification | |
3419 | * should be dead. | |
3420 | */ | |
3421 | EXPECT_EQ(read(sk_pair[0], &c, 1), 1); | |
3422 | ||
3423 | resp.id = req.id; | |
3424 | resp.error = -EPERM; | |
3425 | resp.val = 0; | |
3426 | ||
3427 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1); | |
3428 | EXPECT_EQ(errno, ENOENT); | |
3429 | ||
88c13f8b | 3430 | memset(&req, 0, sizeof(req)); |
6a21cc50 TA |
3431 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); |
3432 | ||
3433 | resp.id = req.id; | |
3434 | resp.error = -512; /* -ERESTARTSYS */ | |
3435 | resp.val = 0; | |
3436 | ||
3437 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); | |
3438 | ||
3439 | EXPECT_EQ(waitpid(pid, &status, 0), pid); | |
3440 | EXPECT_EQ(true, WIFEXITED(status)); | |
3441 | EXPECT_EQ(0, WEXITSTATUS(status)); | |
3442 | } | |
3443 | ||
3444 | TEST(user_notification_closed_listener) | |
3445 | { | |
3446 | pid_t pid; | |
3447 | long ret; | |
3448 | int status, listener; | |
3449 | ||
c7140706 TA |
3450 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); |
3451 | ASSERT_EQ(0, ret) { | |
3452 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
3453 | } | |
3454 | ||
279ed890 KC |
3455 | listener = user_notif_syscall(__NR_getppid, |
3456 | SECCOMP_FILTER_FLAG_NEW_LISTENER); | |
3d244c19 | 3457 | ASSERT_GE(listener, 0); |
6a21cc50 TA |
3458 | |
3459 | /* | |
3460 | * Check that we get an ENOSYS when the listener is closed. | |
3461 | */ | |
3462 | pid = fork(); | |
3463 | ASSERT_GE(pid, 0); | |
3464 | if (pid == 0) { | |
3465 | close(listener); | |
9dd3fcb0 | 3466 | ret = syscall(__NR_getppid); |
6a21cc50 TA |
3467 | exit(ret != -1 && errno != ENOSYS); |
3468 | } | |
3469 | ||
3470 | close(listener); | |
3471 | ||
3472 | EXPECT_EQ(waitpid(pid, &status, 0), pid); | |
3473 | EXPECT_EQ(true, WIFEXITED(status)); | |
3474 | EXPECT_EQ(0, WEXITSTATUS(status)); | |
3475 | } | |
3476 | ||
3477 | /* | |
3478 | * Check that a pid in a child namespace still shows up as valid in ours. | |
3479 | */ | |
3480 | TEST(user_notification_child_pid_ns) | |
3481 | { | |
3482 | pid_t pid; | |
3483 | int status, listener; | |
3484 | struct seccomp_notif req = {}; | |
3485 | struct seccomp_notif_resp resp = {}; | |
3486 | ||
d7d2e5bb KC |
3487 | ASSERT_EQ(unshare(CLONE_NEWUSER | CLONE_NEWPID), 0) { |
3488 | if (errno == EINVAL) | |
3489 | SKIP(return, "kernel missing CLONE_NEWUSER support"); | |
3490 | }; | |
6a21cc50 | 3491 | |
279ed890 KC |
3492 | listener = user_notif_syscall(__NR_getppid, |
3493 | SECCOMP_FILTER_FLAG_NEW_LISTENER); | |
6a21cc50 TA |
3494 | ASSERT_GE(listener, 0); |
3495 | ||
3496 | pid = fork(); | |
3497 | ASSERT_GE(pid, 0); | |
3498 | ||
3499 | if (pid == 0) | |
9dd3fcb0 | 3500 | exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC); |
6a21cc50 TA |
3501 | |
3502 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); | |
3503 | EXPECT_EQ(req.pid, pid); | |
3504 | ||
3505 | resp.id = req.id; | |
3506 | resp.error = 0; | |
3507 | resp.val = USER_NOTIF_MAGIC; | |
3508 | ||
3509 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); | |
3510 | ||
3511 | EXPECT_EQ(waitpid(pid, &status, 0), pid); | |
3512 | EXPECT_EQ(true, WIFEXITED(status)); | |
3513 | EXPECT_EQ(0, WEXITSTATUS(status)); | |
3514 | close(listener); | |
3515 | } | |
3516 | ||
3517 | /* | |
3518 | * Check that a pid in a sibling (i.e. unrelated) namespace shows up as 0, i.e. | |
3519 | * invalid. | |
3520 | */ | |
3521 | TEST(user_notification_sibling_pid_ns) | |
3522 | { | |
3523 | pid_t pid, pid2; | |
3524 | int status, listener; | |
3525 | struct seccomp_notif req = {}; | |
3526 | struct seccomp_notif_resp resp = {}; | |
3527 | ||
c7140706 TA |
3528 | ASSERT_EQ(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0) { |
3529 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
3530 | } | |
3531 | ||
279ed890 KC |
3532 | listener = user_notif_syscall(__NR_getppid, |
3533 | SECCOMP_FILTER_FLAG_NEW_LISTENER); | |
6a21cc50 TA |
3534 | ASSERT_GE(listener, 0); |
3535 | ||
3536 | pid = fork(); | |
3537 | ASSERT_GE(pid, 0); | |
3538 | ||
3539 | if (pid == 0) { | |
3540 | ASSERT_EQ(unshare(CLONE_NEWPID), 0); | |
3541 | ||
3542 | pid2 = fork(); | |
3543 | ASSERT_GE(pid2, 0); | |
3544 | ||
3545 | if (pid2 == 0) | |
9dd3fcb0 | 3546 | exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC); |
6a21cc50 TA |
3547 | |
3548 | EXPECT_EQ(waitpid(pid2, &status, 0), pid2); | |
3549 | EXPECT_EQ(true, WIFEXITED(status)); | |
3550 | EXPECT_EQ(0, WEXITSTATUS(status)); | |
3551 | exit(WEXITSTATUS(status)); | |
3552 | } | |
3553 | ||
3554 | /* Create the sibling ns, and sibling in it. */ | |
d7d2e5bb KC |
3555 | ASSERT_EQ(unshare(CLONE_NEWPID), 0) { |
3556 | if (errno == EPERM) | |
3557 | SKIP(return, "CLONE_NEWPID requires CAP_SYS_ADMIN"); | |
3558 | } | |
9dd3fcb0 | 3559 | ASSERT_EQ(errno, 0); |
6a21cc50 TA |
3560 | |
3561 | pid2 = fork(); | |
9dd3fcb0 | 3562 | ASSERT_GE(pid2, 0); |
6a21cc50 TA |
3563 | |
3564 | if (pid2 == 0) { | |
3565 | ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); | |
3566 | /* | |
3567 | * The pid should be 0, i.e. the task is in some namespace that | |
3568 | * we can't "see". | |
3569 | */ | |
9dd3fcb0 | 3570 | EXPECT_EQ(req.pid, 0); |
6a21cc50 TA |
3571 | |
3572 | resp.id = req.id; | |
3573 | resp.error = 0; | |
3574 | resp.val = USER_NOTIF_MAGIC; | |
3575 | ||
3576 | ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); | |
3577 | exit(0); | |
3578 | } | |
3579 | ||
3580 | close(listener); | |
3581 | ||
3582 | EXPECT_EQ(waitpid(pid, &status, 0), pid); | |
3583 | EXPECT_EQ(true, WIFEXITED(status)); | |
3584 | EXPECT_EQ(0, WEXITSTATUS(status)); | |
3585 | ||
3586 | EXPECT_EQ(waitpid(pid2, &status, 0), pid2); | |
3587 | EXPECT_EQ(true, WIFEXITED(status)); | |
3588 | EXPECT_EQ(0, WEXITSTATUS(status)); | |
3589 | } | |
3590 | ||
3591 | TEST(user_notification_fault_recv) | |
3592 | { | |
3593 | pid_t pid; | |
3594 | int status, listener; | |
3595 | struct seccomp_notif req = {}; | |
3596 | struct seccomp_notif_resp resp = {}; | |
3597 | ||
30d53a58 TA |
3598 | ASSERT_EQ(unshare(CLONE_NEWUSER), 0); |
3599 | ||
279ed890 KC |
3600 | listener = user_notif_syscall(__NR_getppid, |
3601 | SECCOMP_FILTER_FLAG_NEW_LISTENER); | |
6a21cc50 TA |
3602 | ASSERT_GE(listener, 0); |
3603 | ||
3604 | pid = fork(); | |
3605 | ASSERT_GE(pid, 0); | |
3606 | ||
3607 | if (pid == 0) | |
9dd3fcb0 | 3608 | exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC); |
6a21cc50 TA |
3609 | |
3610 | /* Do a bad recv() */ | |
3611 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, NULL), -1); | |
3612 | EXPECT_EQ(errno, EFAULT); | |
3613 | ||
3614 | /* We should still be able to receive this notification, though. */ | |
3615 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); | |
3616 | EXPECT_EQ(req.pid, pid); | |
3617 | ||
3618 | resp.id = req.id; | |
3619 | resp.error = 0; | |
3620 | resp.val = USER_NOTIF_MAGIC; | |
3621 | ||
3622 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); | |
3623 | ||
3624 | EXPECT_EQ(waitpid(pid, &status, 0), pid); | |
3625 | EXPECT_EQ(true, WIFEXITED(status)); | |
3626 | EXPECT_EQ(0, WEXITSTATUS(status)); | |
3627 | } | |
3628 | ||
3629 | TEST(seccomp_get_notif_sizes) | |
3630 | { | |
3631 | struct seccomp_notif_sizes sizes; | |
3632 | ||
3d244c19 | 3633 | ASSERT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0); |
6a21cc50 TA |
3634 | EXPECT_EQ(sizes.seccomp_notif, sizeof(struct seccomp_notif)); |
3635 | EXPECT_EQ(sizes.seccomp_notif_resp, sizeof(struct seccomp_notif_resp)); | |
3636 | } | |
3637 | ||
0eebfed2 CB |
3638 | TEST(user_notification_continue) |
3639 | { | |
3640 | pid_t pid; | |
3641 | long ret; | |
3642 | int status, listener; | |
3643 | struct seccomp_notif req = {}; | |
3644 | struct seccomp_notif_resp resp = {}; | |
3645 | struct pollfd pollfd; | |
3646 | ||
3647 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
3648 | ASSERT_EQ(0, ret) { | |
3649 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
3650 | } | |
3651 | ||
279ed890 | 3652 | listener = user_notif_syscall(__NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER); |
0eebfed2 CB |
3653 | ASSERT_GE(listener, 0); |
3654 | ||
3655 | pid = fork(); | |
3656 | ASSERT_GE(pid, 0); | |
3657 | ||
3658 | if (pid == 0) { | |
3659 | int dup_fd, pipe_fds[2]; | |
3660 | pid_t self; | |
3661 | ||
cf8918db | 3662 | ASSERT_GE(pipe(pipe_fds), 0); |
0eebfed2 CB |
3663 | |
3664 | dup_fd = dup(pipe_fds[0]); | |
cf8918db KC |
3665 | ASSERT_GE(dup_fd, 0); |
3666 | EXPECT_NE(pipe_fds[0], dup_fd); | |
0eebfed2 CB |
3667 | |
3668 | self = getpid(); | |
cf8918db | 3669 | ASSERT_EQ(filecmp(self, self, pipe_fds[0], dup_fd), 0); |
0eebfed2 CB |
3670 | exit(0); |
3671 | } | |
3672 | ||
3673 | pollfd.fd = listener; | |
3674 | pollfd.events = POLLIN | POLLOUT; | |
3675 | ||
3676 | EXPECT_GT(poll(&pollfd, 1, -1), 0); | |
3677 | EXPECT_EQ(pollfd.revents, POLLIN); | |
3678 | ||
3679 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); | |
3680 | ||
3681 | pollfd.fd = listener; | |
3682 | pollfd.events = POLLIN | POLLOUT; | |
3683 | ||
3684 | EXPECT_GT(poll(&pollfd, 1, -1), 0); | |
3685 | EXPECT_EQ(pollfd.revents, POLLOUT); | |
3686 | ||
3687 | EXPECT_EQ(req.data.nr, __NR_dup); | |
3688 | ||
3689 | resp.id = req.id; | |
3690 | resp.flags = SECCOMP_USER_NOTIF_FLAG_CONTINUE; | |
3691 | ||
3692 | /* | |
3693 | * Verify that setting SECCOMP_USER_NOTIF_FLAG_CONTINUE enforces other | |
3694 | * args be set to 0. | |
3695 | */ | |
3696 | resp.error = 0; | |
3697 | resp.val = USER_NOTIF_MAGIC; | |
3698 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1); | |
3699 | EXPECT_EQ(errno, EINVAL); | |
3700 | ||
3701 | resp.error = USER_NOTIF_MAGIC; | |
3702 | resp.val = 0; | |
3703 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1); | |
3704 | EXPECT_EQ(errno, EINVAL); | |
3705 | ||
3706 | resp.error = 0; | |
3707 | resp.val = 0; | |
3708 | EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0) { | |
3709 | if (errno == EINVAL) | |
8b1bc88c | 3710 | SKIP(goto skip, "Kernel does not support SECCOMP_USER_NOTIF_FLAG_CONTINUE"); |
0eebfed2 CB |
3711 | } |
3712 | ||
3713 | skip: | |
3714 | EXPECT_EQ(waitpid(pid, &status, 0), pid); | |
3715 | EXPECT_EQ(true, WIFEXITED(status)); | |
3716 | EXPECT_EQ(0, WEXITSTATUS(status)) { | |
3717 | if (WEXITSTATUS(status) == 2) { | |
8b1bc88c | 3718 | SKIP(return, "Kernel does not support kcmp() syscall"); |
0eebfed2 CB |
3719 | return; |
3720 | } | |
3721 | } | |
3722 | } | |
3723 | ||
ad568218 CB |
3724 | TEST(user_notification_filter_empty) |
3725 | { | |
3726 | pid_t pid; | |
3727 | long ret; | |
3728 | int status; | |
3729 | struct pollfd pollfd; | |
3730 | struct clone_args args = { | |
3731 | .flags = CLONE_FILES, | |
3732 | .exit_signal = SIGCHLD, | |
3733 | }; | |
3734 | ||
3735 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
3736 | ASSERT_EQ(0, ret) { | |
3737 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
3738 | } | |
3739 | ||
3740 | pid = sys_clone3(&args, sizeof(args)); | |
3741 | ASSERT_GE(pid, 0); | |
3742 | ||
3743 | if (pid == 0) { | |
3744 | int listener; | |
3745 | ||
279ed890 | 3746 | listener = user_notif_syscall(__NR_mknod, SECCOMP_FILTER_FLAG_NEW_LISTENER); |
ad568218 CB |
3747 | if (listener < 0) |
3748 | _exit(EXIT_FAILURE); | |
3749 | ||
3750 | if (dup2(listener, 200) != 200) | |
3751 | _exit(EXIT_FAILURE); | |
3752 | ||
3753 | close(listener); | |
3754 | ||
3755 | _exit(EXIT_SUCCESS); | |
3756 | } | |
3757 | ||
3758 | EXPECT_EQ(waitpid(pid, &status, 0), pid); | |
3759 | EXPECT_EQ(true, WIFEXITED(status)); | |
3760 | EXPECT_EQ(0, WEXITSTATUS(status)); | |
3761 | ||
3762 | /* | |
3763 | * The seccomp filter has become unused so we should be notified once | |
3764 | * the kernel gets around to cleaning up task struct. | |
3765 | */ | |
3766 | pollfd.fd = 200; | |
3767 | pollfd.events = POLLHUP; | |
3768 | ||
3769 | EXPECT_GT(poll(&pollfd, 1, 2000), 0); | |
3770 | EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0); | |
3771 | } | |
3772 | ||
3773 | static void *do_thread(void *data) | |
3774 | { | |
3775 | return NULL; | |
3776 | } | |
3777 | ||
3778 | TEST(user_notification_filter_empty_threaded) | |
3779 | { | |
3780 | pid_t pid; | |
3781 | long ret; | |
3782 | int status; | |
3783 | struct pollfd pollfd; | |
3784 | struct clone_args args = { | |
3785 | .flags = CLONE_FILES, | |
3786 | .exit_signal = SIGCHLD, | |
3787 | }; | |
3788 | ||
3789 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
3790 | ASSERT_EQ(0, ret) { | |
3791 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
3792 | } | |
3793 | ||
3794 | pid = sys_clone3(&args, sizeof(args)); | |
3795 | ASSERT_GE(pid, 0); | |
3796 | ||
3797 | if (pid == 0) { | |
3798 | pid_t pid1, pid2; | |
3799 | int listener, status; | |
3800 | pthread_t thread; | |
3801 | ||
279ed890 | 3802 | listener = user_notif_syscall(__NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER); |
ad568218 CB |
3803 | if (listener < 0) |
3804 | _exit(EXIT_FAILURE); | |
3805 | ||
3806 | if (dup2(listener, 200) != 200) | |
3807 | _exit(EXIT_FAILURE); | |
3808 | ||
3809 | close(listener); | |
3810 | ||
3811 | pid1 = fork(); | |
3812 | if (pid1 < 0) | |
3813 | _exit(EXIT_FAILURE); | |
3814 | ||
3815 | if (pid1 == 0) | |
3816 | _exit(EXIT_SUCCESS); | |
3817 | ||
3818 | pid2 = fork(); | |
3819 | if (pid2 < 0) | |
3820 | _exit(EXIT_FAILURE); | |
3821 | ||
3822 | if (pid2 == 0) | |
3823 | _exit(EXIT_SUCCESS); | |
3824 | ||
3825 | if (pthread_create(&thread, NULL, do_thread, NULL) || | |
3826 | pthread_join(thread, NULL)) | |
3827 | _exit(EXIT_FAILURE); | |
3828 | ||
3829 | if (pthread_create(&thread, NULL, do_thread, NULL) || | |
3830 | pthread_join(thread, NULL)) | |
3831 | _exit(EXIT_FAILURE); | |
3832 | ||
3833 | if (waitpid(pid1, &status, 0) != pid1 || !WIFEXITED(status) || | |
3834 | WEXITSTATUS(status)) | |
3835 | _exit(EXIT_FAILURE); | |
3836 | ||
3837 | if (waitpid(pid2, &status, 0) != pid2 || !WIFEXITED(status) || | |
3838 | WEXITSTATUS(status)) | |
3839 | _exit(EXIT_FAILURE); | |
3840 | ||
3841 | exit(EXIT_SUCCESS); | |
3842 | } | |
3843 | ||
3844 | EXPECT_EQ(waitpid(pid, &status, 0), pid); | |
3845 | EXPECT_EQ(true, WIFEXITED(status)); | |
3846 | EXPECT_EQ(0, WEXITSTATUS(status)); | |
3847 | ||
3848 | /* | |
3849 | * The seccomp filter has become unused so we should be notified once | |
3850 | * the kernel gets around to cleaning up task struct. | |
3851 | */ | |
3852 | pollfd.fd = 200; | |
3853 | pollfd.events = POLLHUP; | |
3854 | ||
3855 | EXPECT_GT(poll(&pollfd, 1, 2000), 0); | |
3856 | EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0); | |
3857 | } | |
3858 | ||
c99ee51a KC |
3859 | /* |
3860 | * TODO: | |
c99ee51a KC |
3861 | * - expand NNP testing |
3862 | * - better arch-specific TRACE and TRAP handlers. | |
3863 | * - endianness checking when appropriate | |
3864 | * - 64-bit arg prodding | |
3865 | * - arch value testing (x86 modes especially) | |
e66a3997 | 3866 | * - verify that FILTER_FLAG_LOG filters generate log messages |
59f5cf44 | 3867 | * - verify that RET_LOG generates log messages |
c99ee51a KC |
3868 | */ |
3869 | ||
3870 | TEST_HARNESS_MAIN |