Commit | Line | Data |
---|---|---|
c99ee51a KC |
1 | /* |
2 | * Copyright (c) 2012 The Chromium OS Authors. All rights reserved. | |
3 | * Use of this source code is governed by the GPLv2 license. | |
4 | * | |
5 | * Test code for seccomp bpf. | |
6 | */ | |
7 | ||
0ce105bf | 8 | #include <sys/types.h> |
c99ee51a KC |
9 | #include <asm/siginfo.h> |
10 | #define __have_siginfo_t 1 | |
11 | #define __have_sigval_t 1 | |
12 | #define __have_sigevent_t 1 | |
13 | ||
14 | #include <errno.h> | |
15 | #include <linux/filter.h> | |
16 | #include <sys/prctl.h> | |
17 | #include <sys/ptrace.h> | |
18 | #include <sys/user.h> | |
19 | #include <linux/prctl.h> | |
20 | #include <linux/ptrace.h> | |
21 | #include <linux/seccomp.h> | |
c99ee51a KC |
22 | #include <pthread.h> |
23 | #include <semaphore.h> | |
24 | #include <signal.h> | |
25 | #include <stddef.h> | |
26 | #include <stdbool.h> | |
27 | #include <string.h> | |
256d0afb | 28 | #include <time.h> |
c99ee51a KC |
29 | #include <linux/elf.h> |
30 | #include <sys/uio.h> | |
256d0afb | 31 | #include <sys/utsname.h> |
fd88d16c RS |
32 | #include <sys/fcntl.h> |
33 | #include <sys/mman.h> | |
34 | #include <sys/times.h> | |
c99ee51a KC |
35 | |
36 | #define _GNU_SOURCE | |
37 | #include <unistd.h> | |
38 | #include <sys/syscall.h> | |
39 | ||
0b40808a | 40 | #include "../kselftest_harness.h" |
c99ee51a KC |
41 | |
42 | #ifndef PR_SET_PTRACER | |
43 | # define PR_SET_PTRACER 0x59616d61 | |
44 | #endif | |
45 | ||
46 | #ifndef PR_SET_NO_NEW_PRIVS | |
47 | #define PR_SET_NO_NEW_PRIVS 38 | |
48 | #define PR_GET_NO_NEW_PRIVS 39 | |
49 | #endif | |
50 | ||
51 | #ifndef PR_SECCOMP_EXT | |
52 | #define PR_SECCOMP_EXT 43 | |
53 | #endif | |
54 | ||
55 | #ifndef SECCOMP_EXT_ACT | |
56 | #define SECCOMP_EXT_ACT 1 | |
57 | #endif | |
58 | ||
59 | #ifndef SECCOMP_EXT_ACT_TSYNC | |
60 | #define SECCOMP_EXT_ACT_TSYNC 1 | |
61 | #endif | |
62 | ||
63 | #ifndef SECCOMP_MODE_STRICT | |
64 | #define SECCOMP_MODE_STRICT 1 | |
65 | #endif | |
66 | ||
67 | #ifndef SECCOMP_MODE_FILTER | |
68 | #define SECCOMP_MODE_FILTER 2 | |
69 | #endif | |
70 | ||
fd76875c KC |
71 | #ifndef SECCOMP_RET_KILL_THREAD |
72 | #define SECCOMP_RET_KILL_THREAD 0x00000000U /* kill the thread */ | |
73 | #endif | |
c99ee51a | 74 | #ifndef SECCOMP_RET_KILL |
fd76875c KC |
75 | #define SECCOMP_RET_KILL SECCOMP_RET_KILL_THREAD |
76 | #define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */ | |
77 | #define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */ | |
78 | #define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */ | |
79 | #define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */ | |
59f5cf44 TH |
80 | #endif |
81 | #ifndef SECCOMP_RET_LOG | |
fd76875c | 82 | #define SECCOMP_RET_LOG 0x7ffc0000U /* allow after logging */ |
59f5cf44 | 83 | #endif |
c99ee51a | 84 | |
59f5cf44 | 85 | #ifndef SECCOMP_RET_ACTION |
c99ee51a KC |
86 | /* Masks for the return value sections. */ |
87 | #define SECCOMP_RET_ACTION 0x7fff0000U | |
88 | #define SECCOMP_RET_DATA 0x0000ffffU | |
89 | ||
90 | struct seccomp_data { | |
91 | int nr; | |
92 | __u32 arch; | |
93 | __u64 instruction_pointer; | |
94 | __u64 args[6]; | |
95 | }; | |
96 | #endif | |
97 | ||
c385d0db | 98 | #if __BYTE_ORDER == __LITTLE_ENDIAN |
c99ee51a | 99 | #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n])) |
c385d0db ME |
100 | #elif __BYTE_ORDER == __BIG_ENDIAN |
101 | #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]) + sizeof(__u32)) | |
102 | #else | |
103 | #error "wut? Unknown __BYTE_ORDER?!" | |
104 | #endif | |
c99ee51a KC |
105 | |
106 | #define SIBLING_EXIT_UNKILLED 0xbadbeef | |
107 | #define SIBLING_EXIT_FAILURE 0xbadface | |
108 | #define SIBLING_EXIT_NEWPRIVS 0xbadfeed | |
109 | ||
110 | TEST(mode_strict_support) | |
111 | { | |
112 | long ret; | |
113 | ||
114 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL); | |
115 | ASSERT_EQ(0, ret) { | |
116 | TH_LOG("Kernel does not support CONFIG_SECCOMP"); | |
117 | } | |
118 | syscall(__NR_exit, 1); | |
119 | } | |
120 | ||
121 | TEST_SIGNAL(mode_strict_cannot_call_prctl, SIGKILL) | |
122 | { | |
123 | long ret; | |
124 | ||
125 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL); | |
126 | ASSERT_EQ(0, ret) { | |
127 | TH_LOG("Kernel does not support CONFIG_SECCOMP"); | |
128 | } | |
129 | syscall(__NR_prctl, PR_SET_SECCOMP, SECCOMP_MODE_FILTER, | |
130 | NULL, NULL, NULL); | |
131 | EXPECT_FALSE(true) { | |
132 | TH_LOG("Unreachable!"); | |
133 | } | |
134 | } | |
135 | ||
136 | /* Note! This doesn't test no new privs behavior */ | |
137 | TEST(no_new_privs_support) | |
138 | { | |
139 | long ret; | |
140 | ||
141 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
142 | EXPECT_EQ(0, ret) { | |
143 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
144 | } | |
145 | } | |
146 | ||
f3f6e306 | 147 | /* Tests kernel support by checking for a copy_from_user() fault on NULL. */ |
c99ee51a KC |
148 | TEST(mode_filter_support) |
149 | { | |
150 | long ret; | |
151 | ||
152 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0); | |
153 | ASSERT_EQ(0, ret) { | |
154 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
155 | } | |
156 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, NULL, NULL); | |
157 | EXPECT_EQ(-1, ret); | |
158 | EXPECT_EQ(EFAULT, errno) { | |
159 | TH_LOG("Kernel does not support CONFIG_SECCOMP_FILTER!"); | |
160 | } | |
161 | } | |
162 | ||
163 | TEST(mode_filter_without_nnp) | |
164 | { | |
165 | struct sock_filter filter[] = { | |
166 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
167 | }; | |
168 | struct sock_fprog prog = { | |
169 | .len = (unsigned short)ARRAY_SIZE(filter), | |
170 | .filter = filter, | |
171 | }; | |
172 | long ret; | |
173 | ||
174 | ret = prctl(PR_GET_NO_NEW_PRIVS, 0, NULL, 0, 0); | |
175 | ASSERT_LE(0, ret) { | |
176 | TH_LOG("Expected 0 or unsupported for NO_NEW_PRIVS"); | |
177 | } | |
178 | errno = 0; | |
179 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
180 | /* Succeeds with CAP_SYS_ADMIN, fails without */ | |
181 | /* TODO(wad) check caps not euid */ | |
182 | if (geteuid()) { | |
183 | EXPECT_EQ(-1, ret); | |
184 | EXPECT_EQ(EACCES, errno); | |
185 | } else { | |
186 | EXPECT_EQ(0, ret); | |
187 | } | |
188 | } | |
189 | ||
190 | #define MAX_INSNS_PER_PATH 32768 | |
191 | ||
192 | TEST(filter_size_limits) | |
193 | { | |
194 | int i; | |
195 | int count = BPF_MAXINSNS + 1; | |
196 | struct sock_filter allow[] = { | |
197 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
198 | }; | |
199 | struct sock_filter *filter; | |
200 | struct sock_fprog prog = { }; | |
201 | long ret; | |
202 | ||
203 | filter = calloc(count, sizeof(*filter)); | |
204 | ASSERT_NE(NULL, filter); | |
205 | ||
206 | for (i = 0; i < count; i++) | |
207 | filter[i] = allow[0]; | |
208 | ||
209 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
210 | ASSERT_EQ(0, ret); | |
211 | ||
212 | prog.filter = filter; | |
213 | prog.len = count; | |
214 | ||
215 | /* Too many filter instructions in a single filter. */ | |
216 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
217 | ASSERT_NE(0, ret) { | |
218 | TH_LOG("Installing %d insn filter was allowed", prog.len); | |
219 | } | |
220 | ||
221 | /* One less is okay, though. */ | |
222 | prog.len -= 1; | |
223 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
224 | ASSERT_EQ(0, ret) { | |
225 | TH_LOG("Installing %d insn filter wasn't allowed", prog.len); | |
226 | } | |
227 | } | |
228 | ||
229 | TEST(filter_chain_limits) | |
230 | { | |
231 | int i; | |
232 | int count = BPF_MAXINSNS; | |
233 | struct sock_filter allow[] = { | |
234 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
235 | }; | |
236 | struct sock_filter *filter; | |
237 | struct sock_fprog prog = { }; | |
238 | long ret; | |
239 | ||
240 | filter = calloc(count, sizeof(*filter)); | |
241 | ASSERT_NE(NULL, filter); | |
242 | ||
243 | for (i = 0; i < count; i++) | |
244 | filter[i] = allow[0]; | |
245 | ||
246 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
247 | ASSERT_EQ(0, ret); | |
248 | ||
249 | prog.filter = filter; | |
250 | prog.len = 1; | |
251 | ||
252 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
253 | ASSERT_EQ(0, ret); | |
254 | ||
255 | prog.len = count; | |
256 | ||
257 | /* Too many total filter instructions. */ | |
258 | for (i = 0; i < MAX_INSNS_PER_PATH; i++) { | |
259 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
260 | if (ret != 0) | |
261 | break; | |
262 | } | |
263 | ASSERT_NE(0, ret) { | |
264 | TH_LOG("Allowed %d %d-insn filters (total with penalties:%d)", | |
265 | i, count, i * (count + 4)); | |
266 | } | |
267 | } | |
268 | ||
269 | TEST(mode_filter_cannot_move_to_strict) | |
270 | { | |
271 | struct sock_filter filter[] = { | |
272 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
273 | }; | |
274 | struct sock_fprog prog = { | |
275 | .len = (unsigned short)ARRAY_SIZE(filter), | |
276 | .filter = filter, | |
277 | }; | |
278 | long ret; | |
279 | ||
280 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
281 | ASSERT_EQ(0, ret); | |
282 | ||
283 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
284 | ASSERT_EQ(0, ret); | |
285 | ||
286 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, 0, 0); | |
287 | EXPECT_EQ(-1, ret); | |
288 | EXPECT_EQ(EINVAL, errno); | |
289 | } | |
290 | ||
291 | ||
292 | TEST(mode_filter_get_seccomp) | |
293 | { | |
294 | struct sock_filter filter[] = { | |
295 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
296 | }; | |
297 | struct sock_fprog prog = { | |
298 | .len = (unsigned short)ARRAY_SIZE(filter), | |
299 | .filter = filter, | |
300 | }; | |
301 | long ret; | |
302 | ||
303 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
304 | ASSERT_EQ(0, ret); | |
305 | ||
306 | ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0); | |
307 | EXPECT_EQ(0, ret); | |
308 | ||
309 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
310 | ASSERT_EQ(0, ret); | |
311 | ||
312 | ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0); | |
313 | EXPECT_EQ(2, ret); | |
314 | } | |
315 | ||
316 | ||
317 | TEST(ALLOW_all) | |
318 | { | |
319 | struct sock_filter filter[] = { | |
320 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
321 | }; | |
322 | struct sock_fprog prog = { | |
323 | .len = (unsigned short)ARRAY_SIZE(filter), | |
324 | .filter = filter, | |
325 | }; | |
326 | long ret; | |
327 | ||
328 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
329 | ASSERT_EQ(0, ret); | |
330 | ||
331 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
332 | ASSERT_EQ(0, ret); | |
333 | } | |
334 | ||
335 | TEST(empty_prog) | |
336 | { | |
337 | struct sock_filter filter[] = { | |
338 | }; | |
339 | struct sock_fprog prog = { | |
340 | .len = (unsigned short)ARRAY_SIZE(filter), | |
341 | .filter = filter, | |
342 | }; | |
343 | long ret; | |
344 | ||
345 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
346 | ASSERT_EQ(0, ret); | |
347 | ||
348 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
349 | EXPECT_EQ(-1, ret); | |
350 | EXPECT_EQ(EINVAL, errno); | |
351 | } | |
352 | ||
59f5cf44 TH |
353 | TEST(log_all) |
354 | { | |
355 | struct sock_filter filter[] = { | |
356 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG), | |
357 | }; | |
358 | struct sock_fprog prog = { | |
359 | .len = (unsigned short)ARRAY_SIZE(filter), | |
360 | .filter = filter, | |
361 | }; | |
362 | long ret; | |
363 | pid_t parent = getppid(); | |
364 | ||
365 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
366 | ASSERT_EQ(0, ret); | |
367 | ||
368 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
369 | ASSERT_EQ(0, ret); | |
370 | ||
371 | /* getppid() should succeed and be logged (no check for logging) */ | |
372 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
373 | } | |
374 | ||
c99ee51a KC |
375 | TEST_SIGNAL(unknown_ret_is_kill_inside, SIGSYS) |
376 | { | |
377 | struct sock_filter filter[] = { | |
378 | BPF_STMT(BPF_RET|BPF_K, 0x10000000U), | |
379 | }; | |
380 | struct sock_fprog prog = { | |
381 | .len = (unsigned short)ARRAY_SIZE(filter), | |
382 | .filter = filter, | |
383 | }; | |
384 | long ret; | |
385 | ||
386 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
387 | ASSERT_EQ(0, ret); | |
388 | ||
389 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
390 | ASSERT_EQ(0, ret); | |
391 | EXPECT_EQ(0, syscall(__NR_getpid)) { | |
392 | TH_LOG("getpid() shouldn't ever return"); | |
393 | } | |
394 | } | |
395 | ||
396 | /* return code >= 0x80000000 is unused. */ | |
397 | TEST_SIGNAL(unknown_ret_is_kill_above_allow, SIGSYS) | |
398 | { | |
399 | struct sock_filter filter[] = { | |
400 | BPF_STMT(BPF_RET|BPF_K, 0x90000000U), | |
401 | }; | |
402 | struct sock_fprog prog = { | |
403 | .len = (unsigned short)ARRAY_SIZE(filter), | |
404 | .filter = filter, | |
405 | }; | |
406 | long ret; | |
407 | ||
408 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
409 | ASSERT_EQ(0, ret); | |
410 | ||
411 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
412 | ASSERT_EQ(0, ret); | |
413 | EXPECT_EQ(0, syscall(__NR_getpid)) { | |
414 | TH_LOG("getpid() shouldn't ever return"); | |
415 | } | |
416 | } | |
417 | ||
418 | TEST_SIGNAL(KILL_all, SIGSYS) | |
419 | { | |
420 | struct sock_filter filter[] = { | |
421 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
422 | }; | |
423 | struct sock_fprog prog = { | |
424 | .len = (unsigned short)ARRAY_SIZE(filter), | |
425 | .filter = filter, | |
426 | }; | |
427 | long ret; | |
428 | ||
429 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
430 | ASSERT_EQ(0, ret); | |
431 | ||
432 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
433 | ASSERT_EQ(0, ret); | |
434 | } | |
435 | ||
436 | TEST_SIGNAL(KILL_one, SIGSYS) | |
437 | { | |
438 | struct sock_filter filter[] = { | |
439 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
440 | offsetof(struct seccomp_data, nr)), | |
441 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), | |
442 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
443 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
444 | }; | |
445 | struct sock_fprog prog = { | |
446 | .len = (unsigned short)ARRAY_SIZE(filter), | |
447 | .filter = filter, | |
448 | }; | |
449 | long ret; | |
450 | pid_t parent = getppid(); | |
451 | ||
452 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
453 | ASSERT_EQ(0, ret); | |
454 | ||
455 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
456 | ASSERT_EQ(0, ret); | |
457 | ||
458 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
459 | /* getpid() should never return. */ | |
460 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
461 | } | |
462 | ||
463 | TEST_SIGNAL(KILL_one_arg_one, SIGSYS) | |
464 | { | |
fd88d16c | 465 | void *fatal_address; |
c99ee51a KC |
466 | struct sock_filter filter[] = { |
467 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
468 | offsetof(struct seccomp_data, nr)), | |
fd88d16c | 469 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_times, 1, 0), |
c99ee51a KC |
470 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), |
471 | /* Only both with lower 32-bit for now. */ | |
472 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(0)), | |
fd88d16c RS |
473 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, |
474 | (unsigned long)&fatal_address, 0, 1), | |
c99ee51a KC |
475 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), |
476 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
477 | }; | |
478 | struct sock_fprog prog = { | |
479 | .len = (unsigned short)ARRAY_SIZE(filter), | |
480 | .filter = filter, | |
481 | }; | |
482 | long ret; | |
483 | pid_t parent = getppid(); | |
fd88d16c RS |
484 | struct tms timebuf; |
485 | clock_t clock = times(&timebuf); | |
c99ee51a KC |
486 | |
487 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
488 | ASSERT_EQ(0, ret); | |
489 | ||
490 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
491 | ASSERT_EQ(0, ret); | |
492 | ||
493 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
fd88d16c RS |
494 | EXPECT_LE(clock, syscall(__NR_times, &timebuf)); |
495 | /* times() should never return. */ | |
496 | EXPECT_EQ(0, syscall(__NR_times, &fatal_address)); | |
c99ee51a KC |
497 | } |
498 | ||
499 | TEST_SIGNAL(KILL_one_arg_six, SIGSYS) | |
500 | { | |
fd88d16c RS |
501 | #ifndef __NR_mmap2 |
502 | int sysno = __NR_mmap; | |
503 | #else | |
504 | int sysno = __NR_mmap2; | |
505 | #endif | |
c99ee51a KC |
506 | struct sock_filter filter[] = { |
507 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
508 | offsetof(struct seccomp_data, nr)), | |
fd88d16c | 509 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, sysno, 1, 0), |
c99ee51a KC |
510 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), |
511 | /* Only both with lower 32-bit for now. */ | |
512 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(5)), | |
513 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 0x0C0FFEE, 0, 1), | |
514 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
515 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
516 | }; | |
517 | struct sock_fprog prog = { | |
518 | .len = (unsigned short)ARRAY_SIZE(filter), | |
519 | .filter = filter, | |
520 | }; | |
521 | long ret; | |
522 | pid_t parent = getppid(); | |
fd88d16c RS |
523 | int fd; |
524 | void *map1, *map2; | |
2ce47b44 BJZ |
525 | int page_size = sysconf(_SC_PAGESIZE); |
526 | ||
527 | ASSERT_LT(0, page_size); | |
c99ee51a KC |
528 | |
529 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
530 | ASSERT_EQ(0, ret); | |
531 | ||
532 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
533 | ASSERT_EQ(0, ret); | |
534 | ||
fd88d16c RS |
535 | fd = open("/dev/zero", O_RDONLY); |
536 | ASSERT_NE(-1, fd); | |
537 | ||
c99ee51a | 538 | EXPECT_EQ(parent, syscall(__NR_getppid)); |
fd88d16c | 539 | map1 = (void *)syscall(sysno, |
2ce47b44 | 540 | NULL, page_size, PROT_READ, MAP_PRIVATE, fd, page_size); |
fd88d16c RS |
541 | EXPECT_NE(MAP_FAILED, map1); |
542 | /* mmap2() should never return. */ | |
543 | map2 = (void *)syscall(sysno, | |
2ce47b44 | 544 | NULL, page_size, PROT_READ, MAP_PRIVATE, fd, 0x0C0FFEE); |
fd88d16c RS |
545 | EXPECT_EQ(MAP_FAILED, map2); |
546 | ||
547 | /* The test failed, so clean up the resources. */ | |
2ce47b44 BJZ |
548 | munmap(map1, page_size); |
549 | munmap(map2, page_size); | |
fd88d16c | 550 | close(fd); |
c99ee51a KC |
551 | } |
552 | ||
553 | /* TODO(wad) add 64-bit versus 32-bit arg tests. */ | |
554 | TEST(arg_out_of_range) | |
555 | { | |
556 | struct sock_filter filter[] = { | |
557 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(6)), | |
558 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
559 | }; | |
560 | struct sock_fprog prog = { | |
561 | .len = (unsigned short)ARRAY_SIZE(filter), | |
562 | .filter = filter, | |
563 | }; | |
564 | long ret; | |
565 | ||
566 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
567 | ASSERT_EQ(0, ret); | |
568 | ||
569 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | |
570 | EXPECT_EQ(-1, ret); | |
571 | EXPECT_EQ(EINVAL, errno); | |
572 | } | |
573 | ||
f3f6e306 KC |
574 | #define ERRNO_FILTER(name, errno) \ |
575 | struct sock_filter _read_filter_##name[] = { \ | |
576 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, \ | |
577 | offsetof(struct seccomp_data, nr)), \ | |
578 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1), \ | |
579 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | errno), \ | |
580 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), \ | |
581 | }; \ | |
582 | struct sock_fprog prog_##name = { \ | |
583 | .len = (unsigned short)ARRAY_SIZE(_read_filter_##name), \ | |
584 | .filter = _read_filter_##name, \ | |
585 | } | |
586 | ||
587 | /* Make sure basic errno values are correctly passed through a filter. */ | |
c99ee51a KC |
588 | TEST(ERRNO_valid) |
589 | { | |
f3f6e306 | 590 | ERRNO_FILTER(valid, E2BIG); |
c99ee51a KC |
591 | long ret; |
592 | pid_t parent = getppid(); | |
593 | ||
594 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
595 | ASSERT_EQ(0, ret); | |
596 | ||
f3f6e306 | 597 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_valid); |
c99ee51a KC |
598 | ASSERT_EQ(0, ret); |
599 | ||
600 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
601 | EXPECT_EQ(-1, read(0, NULL, 0)); | |
602 | EXPECT_EQ(E2BIG, errno); | |
603 | } | |
604 | ||
f3f6e306 | 605 | /* Make sure an errno of zero is correctly handled by the arch code. */ |
c99ee51a KC |
606 | TEST(ERRNO_zero) |
607 | { | |
f3f6e306 | 608 | ERRNO_FILTER(zero, 0); |
c99ee51a KC |
609 | long ret; |
610 | pid_t parent = getppid(); | |
611 | ||
612 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
613 | ASSERT_EQ(0, ret); | |
614 | ||
f3f6e306 | 615 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_zero); |
c99ee51a KC |
616 | ASSERT_EQ(0, ret); |
617 | ||
618 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
619 | /* "errno" of 0 is ok. */ | |
620 | EXPECT_EQ(0, read(0, NULL, 0)); | |
621 | } | |
622 | ||
f3f6e306 KC |
623 | /* |
624 | * The SECCOMP_RET_DATA mask is 16 bits wide, but errno is smaller. | |
625 | * This tests that the errno value gets capped correctly, fixed by | |
626 | * 580c57f10768 ("seccomp: cap SECCOMP_RET_ERRNO data to MAX_ERRNO"). | |
627 | */ | |
c99ee51a KC |
628 | TEST(ERRNO_capped) |
629 | { | |
f3f6e306 | 630 | ERRNO_FILTER(capped, 4096); |
c99ee51a KC |
631 | long ret; |
632 | pid_t parent = getppid(); | |
633 | ||
634 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
635 | ASSERT_EQ(0, ret); | |
636 | ||
f3f6e306 | 637 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_capped); |
c99ee51a KC |
638 | ASSERT_EQ(0, ret); |
639 | ||
640 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
641 | EXPECT_EQ(-1, read(0, NULL, 0)); | |
642 | EXPECT_EQ(4095, errno); | |
643 | } | |
644 | ||
f3f6e306 KC |
645 | /* |
646 | * Filters are processed in reverse order: last applied is executed first. | |
647 | * Since only the SECCOMP_RET_ACTION mask is tested for return values, the | |
648 | * SECCOMP_RET_DATA mask results will follow the most recently applied | |
649 | * matching filter return (and not the lowest or highest value). | |
650 | */ | |
651 | TEST(ERRNO_order) | |
652 | { | |
653 | ERRNO_FILTER(first, 11); | |
654 | ERRNO_FILTER(second, 13); | |
655 | ERRNO_FILTER(third, 12); | |
656 | long ret; | |
657 | pid_t parent = getppid(); | |
658 | ||
659 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
660 | ASSERT_EQ(0, ret); | |
661 | ||
662 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_first); | |
663 | ASSERT_EQ(0, ret); | |
664 | ||
665 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_second); | |
666 | ASSERT_EQ(0, ret); | |
667 | ||
668 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_third); | |
669 | ASSERT_EQ(0, ret); | |
670 | ||
671 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
672 | EXPECT_EQ(-1, read(0, NULL, 0)); | |
673 | EXPECT_EQ(12, errno); | |
674 | } | |
675 | ||
c99ee51a KC |
676 | FIXTURE_DATA(TRAP) { |
677 | struct sock_fprog prog; | |
678 | }; | |
679 | ||
680 | FIXTURE_SETUP(TRAP) | |
681 | { | |
682 | struct sock_filter filter[] = { | |
683 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
684 | offsetof(struct seccomp_data, nr)), | |
685 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), | |
686 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP), | |
687 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
688 | }; | |
689 | ||
690 | memset(&self->prog, 0, sizeof(self->prog)); | |
691 | self->prog.filter = malloc(sizeof(filter)); | |
692 | ASSERT_NE(NULL, self->prog.filter); | |
693 | memcpy(self->prog.filter, filter, sizeof(filter)); | |
694 | self->prog.len = (unsigned short)ARRAY_SIZE(filter); | |
695 | } | |
696 | ||
697 | FIXTURE_TEARDOWN(TRAP) | |
698 | { | |
699 | if (self->prog.filter) | |
700 | free(self->prog.filter); | |
701 | } | |
702 | ||
703 | TEST_F_SIGNAL(TRAP, dfl, SIGSYS) | |
704 | { | |
705 | long ret; | |
706 | ||
707 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
708 | ASSERT_EQ(0, ret); | |
709 | ||
710 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog); | |
711 | ASSERT_EQ(0, ret); | |
712 | syscall(__NR_getpid); | |
713 | } | |
714 | ||
715 | /* Ensure that SIGSYS overrides SIG_IGN */ | |
716 | TEST_F_SIGNAL(TRAP, ign, SIGSYS) | |
717 | { | |
718 | long ret; | |
719 | ||
720 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
721 | ASSERT_EQ(0, ret); | |
722 | ||
723 | signal(SIGSYS, SIG_IGN); | |
724 | ||
725 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog); | |
726 | ASSERT_EQ(0, ret); | |
727 | syscall(__NR_getpid); | |
728 | } | |
729 | ||
730 | static struct siginfo TRAP_info; | |
731 | static volatile int TRAP_nr; | |
732 | static void TRAP_action(int nr, siginfo_t *info, void *void_context) | |
733 | { | |
734 | memcpy(&TRAP_info, info, sizeof(TRAP_info)); | |
735 | TRAP_nr = nr; | |
736 | } | |
737 | ||
738 | TEST_F(TRAP, handler) | |
739 | { | |
740 | int ret, test; | |
741 | struct sigaction act; | |
742 | sigset_t mask; | |
743 | ||
744 | memset(&act, 0, sizeof(act)); | |
745 | sigemptyset(&mask); | |
746 | sigaddset(&mask, SIGSYS); | |
747 | ||
748 | act.sa_sigaction = &TRAP_action; | |
749 | act.sa_flags = SA_SIGINFO; | |
750 | ret = sigaction(SIGSYS, &act, NULL); | |
751 | ASSERT_EQ(0, ret) { | |
752 | TH_LOG("sigaction failed"); | |
753 | } | |
754 | ret = sigprocmask(SIG_UNBLOCK, &mask, NULL); | |
755 | ASSERT_EQ(0, ret) { | |
756 | TH_LOG("sigprocmask failed"); | |
757 | } | |
758 | ||
759 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
760 | ASSERT_EQ(0, ret); | |
761 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog); | |
762 | ASSERT_EQ(0, ret); | |
763 | TRAP_nr = 0; | |
764 | memset(&TRAP_info, 0, sizeof(TRAP_info)); | |
765 | /* Expect the registers to be rolled back. (nr = error) may vary | |
766 | * based on arch. */ | |
767 | ret = syscall(__NR_getpid); | |
768 | /* Silence gcc warning about volatile. */ | |
769 | test = TRAP_nr; | |
770 | EXPECT_EQ(SIGSYS, test); | |
771 | struct local_sigsys { | |
772 | void *_call_addr; /* calling user insn */ | |
773 | int _syscall; /* triggering system call number */ | |
774 | unsigned int _arch; /* AUDIT_ARCH_* of syscall */ | |
775 | } *sigsys = (struct local_sigsys *) | |
776 | #ifdef si_syscall | |
777 | &(TRAP_info.si_call_addr); | |
778 | #else | |
779 | &TRAP_info.si_pid; | |
780 | #endif | |
781 | EXPECT_EQ(__NR_getpid, sigsys->_syscall); | |
782 | /* Make sure arch is non-zero. */ | |
783 | EXPECT_NE(0, sigsys->_arch); | |
784 | EXPECT_NE(0, (unsigned long)sigsys->_call_addr); | |
785 | } | |
786 | ||
787 | FIXTURE_DATA(precedence) { | |
788 | struct sock_fprog allow; | |
59f5cf44 | 789 | struct sock_fprog log; |
c99ee51a KC |
790 | struct sock_fprog trace; |
791 | struct sock_fprog error; | |
792 | struct sock_fprog trap; | |
793 | struct sock_fprog kill; | |
794 | }; | |
795 | ||
796 | FIXTURE_SETUP(precedence) | |
797 | { | |
798 | struct sock_filter allow_insns[] = { | |
799 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
800 | }; | |
59f5cf44 TH |
801 | struct sock_filter log_insns[] = { |
802 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
803 | offsetof(struct seccomp_data, nr)), | |
804 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), | |
805 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
806 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG), | |
807 | }; | |
c99ee51a KC |
808 | struct sock_filter trace_insns[] = { |
809 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
810 | offsetof(struct seccomp_data, nr)), | |
811 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), | |
812 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
813 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE), | |
814 | }; | |
815 | struct sock_filter error_insns[] = { | |
816 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
817 | offsetof(struct seccomp_data, nr)), | |
818 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), | |
819 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
820 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO), | |
821 | }; | |
822 | struct sock_filter trap_insns[] = { | |
823 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
824 | offsetof(struct seccomp_data, nr)), | |
825 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), | |
826 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
827 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP), | |
828 | }; | |
829 | struct sock_filter kill_insns[] = { | |
830 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
831 | offsetof(struct seccomp_data, nr)), | |
832 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), | |
833 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
834 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
835 | }; | |
836 | ||
837 | memset(self, 0, sizeof(*self)); | |
838 | #define FILTER_ALLOC(_x) \ | |
839 | self->_x.filter = malloc(sizeof(_x##_insns)); \ | |
840 | ASSERT_NE(NULL, self->_x.filter); \ | |
841 | memcpy(self->_x.filter, &_x##_insns, sizeof(_x##_insns)); \ | |
842 | self->_x.len = (unsigned short)ARRAY_SIZE(_x##_insns) | |
843 | FILTER_ALLOC(allow); | |
59f5cf44 | 844 | FILTER_ALLOC(log); |
c99ee51a KC |
845 | FILTER_ALLOC(trace); |
846 | FILTER_ALLOC(error); | |
847 | FILTER_ALLOC(trap); | |
848 | FILTER_ALLOC(kill); | |
849 | } | |
850 | ||
851 | FIXTURE_TEARDOWN(precedence) | |
852 | { | |
853 | #define FILTER_FREE(_x) if (self->_x.filter) free(self->_x.filter) | |
854 | FILTER_FREE(allow); | |
59f5cf44 | 855 | FILTER_FREE(log); |
c99ee51a KC |
856 | FILTER_FREE(trace); |
857 | FILTER_FREE(error); | |
858 | FILTER_FREE(trap); | |
859 | FILTER_FREE(kill); | |
860 | } | |
861 | ||
862 | TEST_F(precedence, allow_ok) | |
863 | { | |
864 | pid_t parent, res = 0; | |
865 | long ret; | |
866 | ||
867 | parent = getppid(); | |
868 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
869 | ASSERT_EQ(0, ret); | |
870 | ||
871 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
872 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
873 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
874 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
875 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
876 | ASSERT_EQ(0, ret); | |
877 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); | |
878 | ASSERT_EQ(0, ret); | |
879 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); | |
880 | ASSERT_EQ(0, ret); | |
881 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill); | |
882 | ASSERT_EQ(0, ret); | |
883 | /* Should work just fine. */ | |
884 | res = syscall(__NR_getppid); | |
885 | EXPECT_EQ(parent, res); | |
886 | } | |
887 | ||
888 | TEST_F_SIGNAL(precedence, kill_is_highest, SIGSYS) | |
889 | { | |
890 | pid_t parent, res = 0; | |
891 | long ret; | |
892 | ||
893 | parent = getppid(); | |
894 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
895 | ASSERT_EQ(0, ret); | |
896 | ||
897 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
898 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
899 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
900 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
901 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
902 | ASSERT_EQ(0, ret); | |
903 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); | |
904 | ASSERT_EQ(0, ret); | |
905 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); | |
906 | ASSERT_EQ(0, ret); | |
907 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill); | |
908 | ASSERT_EQ(0, ret); | |
909 | /* Should work just fine. */ | |
910 | res = syscall(__NR_getppid); | |
911 | EXPECT_EQ(parent, res); | |
912 | /* getpid() should never return. */ | |
913 | res = syscall(__NR_getpid); | |
914 | EXPECT_EQ(0, res); | |
915 | } | |
916 | ||
917 | TEST_F_SIGNAL(precedence, kill_is_highest_in_any_order, SIGSYS) | |
918 | { | |
919 | pid_t parent; | |
920 | long ret; | |
921 | ||
922 | parent = getppid(); | |
923 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
924 | ASSERT_EQ(0, ret); | |
925 | ||
926 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
927 | ASSERT_EQ(0, ret); | |
928 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill); | |
929 | ASSERT_EQ(0, ret); | |
930 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); | |
931 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
932 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
933 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
934 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
935 | ASSERT_EQ(0, ret); | |
936 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); | |
937 | ASSERT_EQ(0, ret); | |
938 | /* Should work just fine. */ | |
939 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
940 | /* getpid() should never return. */ | |
941 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
942 | } | |
943 | ||
944 | TEST_F_SIGNAL(precedence, trap_is_second, SIGSYS) | |
945 | { | |
946 | pid_t parent; | |
947 | long ret; | |
948 | ||
949 | parent = getppid(); | |
950 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
951 | ASSERT_EQ(0, ret); | |
952 | ||
953 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
954 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
955 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
956 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
957 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
958 | ASSERT_EQ(0, ret); | |
959 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); | |
960 | ASSERT_EQ(0, ret); | |
961 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); | |
962 | ASSERT_EQ(0, ret); | |
963 | /* Should work just fine. */ | |
964 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
965 | /* getpid() should never return. */ | |
966 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
967 | } | |
968 | ||
969 | TEST_F_SIGNAL(precedence, trap_is_second_in_any_order, SIGSYS) | |
970 | { | |
971 | pid_t parent; | |
972 | long ret; | |
973 | ||
974 | parent = getppid(); | |
975 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
976 | ASSERT_EQ(0, ret); | |
977 | ||
978 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
979 | ASSERT_EQ(0, ret); | |
980 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); | |
981 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
982 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
983 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
984 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
985 | ASSERT_EQ(0, ret); | |
986 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); | |
987 | ASSERT_EQ(0, ret); | |
988 | /* Should work just fine. */ | |
989 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
990 | /* getpid() should never return. */ | |
991 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
992 | } | |
993 | ||
994 | TEST_F(precedence, errno_is_third) | |
995 | { | |
996 | pid_t parent; | |
997 | long ret; | |
998 | ||
999 | parent = getppid(); | |
1000 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1001 | ASSERT_EQ(0, ret); | |
1002 | ||
1003 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1004 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
1005 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
1006 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1007 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
1008 | ASSERT_EQ(0, ret); | |
1009 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); | |
1010 | ASSERT_EQ(0, ret); | |
1011 | /* Should work just fine. */ | |
1012 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1013 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
1014 | } | |
1015 | ||
1016 | TEST_F(precedence, errno_is_third_in_any_order) | |
1017 | { | |
1018 | pid_t parent; | |
1019 | long ret; | |
1020 | ||
1021 | parent = getppid(); | |
1022 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1023 | ASSERT_EQ(0, ret); | |
1024 | ||
59f5cf44 TH |
1025 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
1026 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1027 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); |
1028 | ASSERT_EQ(0, ret); | |
1029 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); | |
1030 | ASSERT_EQ(0, ret); | |
1031 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1032 | ASSERT_EQ(0, ret); | |
1033 | /* Should work just fine. */ | |
1034 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1035 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
1036 | } | |
1037 | ||
1038 | TEST_F(precedence, trace_is_fourth) | |
1039 | { | |
1040 | pid_t parent; | |
1041 | long ret; | |
1042 | ||
1043 | parent = getppid(); | |
1044 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1045 | ASSERT_EQ(0, ret); | |
1046 | ||
1047 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1048 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
1049 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
1050 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1051 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); |
1052 | ASSERT_EQ(0, ret); | |
1053 | /* Should work just fine. */ | |
1054 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1055 | /* No ptracer */ | |
1056 | EXPECT_EQ(-1, syscall(__NR_getpid)); | |
1057 | } | |
1058 | ||
1059 | TEST_F(precedence, trace_is_fourth_in_any_order) | |
1060 | { | |
1061 | pid_t parent; | |
1062 | long ret; | |
1063 | ||
1064 | parent = getppid(); | |
1065 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1066 | ASSERT_EQ(0, ret); | |
1067 | ||
1068 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); | |
1069 | ASSERT_EQ(0, ret); | |
1070 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1071 | ASSERT_EQ(0, ret); | |
59f5cf44 TH |
1072 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); |
1073 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1074 | /* Should work just fine. */ |
1075 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1076 | /* No ptracer */ | |
1077 | EXPECT_EQ(-1, syscall(__NR_getpid)); | |
1078 | } | |
1079 | ||
59f5cf44 TH |
1080 | TEST_F(precedence, log_is_fifth) |
1081 | { | |
1082 | pid_t mypid, parent; | |
1083 | long ret; | |
1084 | ||
1085 | mypid = getpid(); | |
1086 | parent = getppid(); | |
1087 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1088 | ASSERT_EQ(0, ret); | |
1089 | ||
1090 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1091 | ASSERT_EQ(0, ret); | |
1092 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); | |
1093 | ASSERT_EQ(0, ret); | |
1094 | /* Should work just fine. */ | |
1095 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1096 | /* Should also work just fine */ | |
1097 | EXPECT_EQ(mypid, syscall(__NR_getpid)); | |
1098 | } | |
1099 | ||
1100 | TEST_F(precedence, log_is_fifth_in_any_order) | |
1101 | { | |
1102 | pid_t mypid, parent; | |
1103 | long ret; | |
1104 | ||
1105 | mypid = getpid(); | |
1106 | parent = getppid(); | |
1107 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1108 | ASSERT_EQ(0, ret); | |
1109 | ||
1110 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); | |
1111 | ASSERT_EQ(0, ret); | |
1112 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); | |
1113 | ASSERT_EQ(0, ret); | |
1114 | /* Should work just fine. */ | |
1115 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
1116 | /* Should also work just fine */ | |
1117 | EXPECT_EQ(mypid, syscall(__NR_getpid)); | |
1118 | } | |
1119 | ||
c99ee51a KC |
1120 | #ifndef PTRACE_O_TRACESECCOMP |
1121 | #define PTRACE_O_TRACESECCOMP 0x00000080 | |
1122 | #endif | |
1123 | ||
1124 | /* Catch the Ubuntu 12.04 value error. */ | |
1125 | #if PTRACE_EVENT_SECCOMP != 7 | |
1126 | #undef PTRACE_EVENT_SECCOMP | |
1127 | #endif | |
1128 | ||
1129 | #ifndef PTRACE_EVENT_SECCOMP | |
1130 | #define PTRACE_EVENT_SECCOMP 7 | |
1131 | #endif | |
1132 | ||
1133 | #define IS_SECCOMP_EVENT(status) ((status >> 16) == PTRACE_EVENT_SECCOMP) | |
1134 | bool tracer_running; | |
1135 | void tracer_stop(int sig) | |
1136 | { | |
1137 | tracer_running = false; | |
1138 | } | |
1139 | ||
1140 | typedef void tracer_func_t(struct __test_metadata *_metadata, | |
1141 | pid_t tracee, int status, void *args); | |
1142 | ||
58d0a862 KC |
1143 | void start_tracer(struct __test_metadata *_metadata, int fd, pid_t tracee, |
1144 | tracer_func_t tracer_func, void *args, bool ptrace_syscall) | |
c99ee51a KC |
1145 | { |
1146 | int ret = -1; | |
1147 | struct sigaction action = { | |
1148 | .sa_handler = tracer_stop, | |
1149 | }; | |
1150 | ||
1151 | /* Allow external shutdown. */ | |
1152 | tracer_running = true; | |
1153 | ASSERT_EQ(0, sigaction(SIGUSR1, &action, NULL)); | |
1154 | ||
1155 | errno = 0; | |
1156 | while (ret == -1 && errno != EINVAL) | |
1157 | ret = ptrace(PTRACE_ATTACH, tracee, NULL, 0); | |
1158 | ASSERT_EQ(0, ret) { | |
1159 | kill(tracee, SIGKILL); | |
1160 | } | |
1161 | /* Wait for attach stop */ | |
1162 | wait(NULL); | |
1163 | ||
58d0a862 KC |
1164 | ret = ptrace(PTRACE_SETOPTIONS, tracee, NULL, ptrace_syscall ? |
1165 | PTRACE_O_TRACESYSGOOD : | |
1166 | PTRACE_O_TRACESECCOMP); | |
c99ee51a KC |
1167 | ASSERT_EQ(0, ret) { |
1168 | TH_LOG("Failed to set PTRACE_O_TRACESECCOMP"); | |
1169 | kill(tracee, SIGKILL); | |
1170 | } | |
58d0a862 KC |
1171 | ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT, |
1172 | tracee, NULL, 0); | |
1173 | ASSERT_EQ(0, ret); | |
c99ee51a KC |
1174 | |
1175 | /* Unblock the tracee */ | |
1176 | ASSERT_EQ(1, write(fd, "A", 1)); | |
1177 | ASSERT_EQ(0, close(fd)); | |
1178 | ||
1179 | /* Run until we're shut down. Must assert to stop execution. */ | |
1180 | while (tracer_running) { | |
1181 | int status; | |
1182 | ||
1183 | if (wait(&status) != tracee) | |
1184 | continue; | |
1185 | if (WIFSIGNALED(status) || WIFEXITED(status)) | |
1186 | /* Child is dead. Time to go. */ | |
1187 | return; | |
1188 | ||
58d0a862 KC |
1189 | /* Check if this is a seccomp event. */ |
1190 | ASSERT_EQ(!ptrace_syscall, IS_SECCOMP_EVENT(status)); | |
c99ee51a KC |
1191 | |
1192 | tracer_func(_metadata, tracee, status, args); | |
1193 | ||
58d0a862 KC |
1194 | ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT, |
1195 | tracee, NULL, 0); | |
c99ee51a KC |
1196 | ASSERT_EQ(0, ret); |
1197 | } | |
1198 | /* Directly report the status of our test harness results. */ | |
1199 | syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE); | |
1200 | } | |
1201 | ||
1202 | /* Common tracer setup/teardown functions. */ | |
1203 | void cont_handler(int num) | |
1204 | { } | |
1205 | pid_t setup_trace_fixture(struct __test_metadata *_metadata, | |
58d0a862 | 1206 | tracer_func_t func, void *args, bool ptrace_syscall) |
c99ee51a KC |
1207 | { |
1208 | char sync; | |
1209 | int pipefd[2]; | |
1210 | pid_t tracer_pid; | |
1211 | pid_t tracee = getpid(); | |
1212 | ||
1213 | /* Setup a pipe for clean synchronization. */ | |
1214 | ASSERT_EQ(0, pipe(pipefd)); | |
1215 | ||
1216 | /* Fork a child which we'll promote to tracer */ | |
1217 | tracer_pid = fork(); | |
1218 | ASSERT_LE(0, tracer_pid); | |
1219 | signal(SIGALRM, cont_handler); | |
1220 | if (tracer_pid == 0) { | |
1221 | close(pipefd[0]); | |
58d0a862 KC |
1222 | start_tracer(_metadata, pipefd[1], tracee, func, args, |
1223 | ptrace_syscall); | |
c99ee51a KC |
1224 | syscall(__NR_exit, 0); |
1225 | } | |
1226 | close(pipefd[1]); | |
1227 | prctl(PR_SET_PTRACER, tracer_pid, 0, 0, 0); | |
1228 | read(pipefd[0], &sync, 1); | |
1229 | close(pipefd[0]); | |
1230 | ||
1231 | return tracer_pid; | |
1232 | } | |
1233 | void teardown_trace_fixture(struct __test_metadata *_metadata, | |
1234 | pid_t tracer) | |
1235 | { | |
1236 | if (tracer) { | |
1237 | int status; | |
1238 | /* | |
1239 | * Extract the exit code from the other process and | |
1240 | * adopt it for ourselves in case its asserts failed. | |
1241 | */ | |
1242 | ASSERT_EQ(0, kill(tracer, SIGUSR1)); | |
1243 | ASSERT_EQ(tracer, waitpid(tracer, &status, 0)); | |
1244 | if (WEXITSTATUS(status)) | |
1245 | _metadata->passed = 0; | |
1246 | } | |
1247 | } | |
1248 | ||
1249 | /* "poke" tracer arguments and function. */ | |
1250 | struct tracer_args_poke_t { | |
1251 | unsigned long poke_addr; | |
1252 | }; | |
1253 | ||
1254 | void tracer_poke(struct __test_metadata *_metadata, pid_t tracee, int status, | |
1255 | void *args) | |
1256 | { | |
1257 | int ret; | |
1258 | unsigned long msg; | |
1259 | struct tracer_args_poke_t *info = (struct tracer_args_poke_t *)args; | |
1260 | ||
1261 | ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg); | |
1262 | EXPECT_EQ(0, ret); | |
1263 | /* If this fails, don't try to recover. */ | |
1264 | ASSERT_EQ(0x1001, msg) { | |
1265 | kill(tracee, SIGKILL); | |
1266 | } | |
1267 | /* | |
1268 | * Poke in the message. | |
1269 | * Registers are not touched to try to keep this relatively arch | |
1270 | * agnostic. | |
1271 | */ | |
1272 | ret = ptrace(PTRACE_POKEDATA, tracee, info->poke_addr, 0x1001); | |
1273 | EXPECT_EQ(0, ret); | |
1274 | } | |
1275 | ||
1276 | FIXTURE_DATA(TRACE_poke) { | |
1277 | struct sock_fprog prog; | |
1278 | pid_t tracer; | |
1279 | long poked; | |
1280 | struct tracer_args_poke_t tracer_args; | |
1281 | }; | |
1282 | ||
1283 | FIXTURE_SETUP(TRACE_poke) | |
1284 | { | |
1285 | struct sock_filter filter[] = { | |
1286 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
1287 | offsetof(struct seccomp_data, nr)), | |
1288 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1), | |
1289 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1001), | |
1290 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1291 | }; | |
1292 | ||
1293 | self->poked = 0; | |
1294 | memset(&self->prog, 0, sizeof(self->prog)); | |
1295 | self->prog.filter = malloc(sizeof(filter)); | |
1296 | ASSERT_NE(NULL, self->prog.filter); | |
1297 | memcpy(self->prog.filter, filter, sizeof(filter)); | |
1298 | self->prog.len = (unsigned short)ARRAY_SIZE(filter); | |
1299 | ||
1300 | /* Set up tracer args. */ | |
1301 | self->tracer_args.poke_addr = (unsigned long)&self->poked; | |
1302 | ||
1303 | /* Launch tracer. */ | |
1304 | self->tracer = setup_trace_fixture(_metadata, tracer_poke, | |
58d0a862 | 1305 | &self->tracer_args, false); |
c99ee51a KC |
1306 | } |
1307 | ||
1308 | FIXTURE_TEARDOWN(TRACE_poke) | |
1309 | { | |
1310 | teardown_trace_fixture(_metadata, self->tracer); | |
1311 | if (self->prog.filter) | |
1312 | free(self->prog.filter); | |
1313 | } | |
1314 | ||
1315 | TEST_F(TRACE_poke, read_has_side_effects) | |
1316 | { | |
1317 | ssize_t ret; | |
1318 | ||
1319 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1320 | ASSERT_EQ(0, ret); | |
1321 | ||
1322 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
1323 | ASSERT_EQ(0, ret); | |
1324 | ||
1325 | EXPECT_EQ(0, self->poked); | |
1326 | ret = read(-1, NULL, 0); | |
1327 | EXPECT_EQ(-1, ret); | |
1328 | EXPECT_EQ(0x1001, self->poked); | |
1329 | } | |
1330 | ||
1331 | TEST_F(TRACE_poke, getpid_runs_normally) | |
1332 | { | |
1333 | long ret; | |
1334 | ||
1335 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1336 | ASSERT_EQ(0, ret); | |
1337 | ||
1338 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
1339 | ASSERT_EQ(0, ret); | |
1340 | ||
1341 | EXPECT_EQ(0, self->poked); | |
1342 | EXPECT_NE(0, syscall(__NR_getpid)); | |
1343 | EXPECT_EQ(0, self->poked); | |
1344 | } | |
1345 | ||
1346 | #if defined(__x86_64__) | |
1347 | # define ARCH_REGS struct user_regs_struct | |
1348 | # define SYSCALL_NUM orig_rax | |
1349 | # define SYSCALL_RET rax | |
1350 | #elif defined(__i386__) | |
1351 | # define ARCH_REGS struct user_regs_struct | |
1352 | # define SYSCALL_NUM orig_eax | |
1353 | # define SYSCALL_RET eax | |
1354 | #elif defined(__arm__) | |
1355 | # define ARCH_REGS struct pt_regs | |
1356 | # define SYSCALL_NUM ARM_r7 | |
1357 | # define SYSCALL_RET ARM_r0 | |
1358 | #elif defined(__aarch64__) | |
1359 | # define ARCH_REGS struct user_pt_regs | |
1360 | # define SYSCALL_NUM regs[8] | |
1361 | # define SYSCALL_RET regs[0] | |
64e2a42b HD |
1362 | #elif defined(__hppa__) |
1363 | # define ARCH_REGS struct user_regs_struct | |
1364 | # define SYSCALL_NUM gr[20] | |
1365 | # define SYSCALL_RET gr[28] | |
5d83c2b3 ME |
1366 | #elif defined(__powerpc__) |
1367 | # define ARCH_REGS struct pt_regs | |
1368 | # define SYSCALL_NUM gpr[0] | |
1369 | # define SYSCALL_RET gpr[3] | |
b623c4da KC |
1370 | #elif defined(__s390__) |
1371 | # define ARCH_REGS s390_regs | |
1372 | # define SYSCALL_NUM gprs[2] | |
1373 | # define SYSCALL_RET gprs[2] | |
0ce105bf MR |
1374 | #elif defined(__mips__) |
1375 | # define ARCH_REGS struct pt_regs | |
1376 | # define SYSCALL_NUM regs[2] | |
1377 | # define SYSCALL_SYSCALL_NUM regs[4] | |
1378 | # define SYSCALL_RET regs[2] | |
1379 | # define SYSCALL_NUM_RET_SHARE_REG | |
c99ee51a KC |
1380 | #else |
1381 | # error "Do not know how to find your architecture's registers and syscalls" | |
1382 | #endif | |
1383 | ||
a33b2d03 KC |
1384 | /* When the syscall return can't be changed, stub out the tests for it. */ |
1385 | #ifdef SYSCALL_NUM_RET_SHARE_REG | |
1386 | # define EXPECT_SYSCALL_RETURN(val, action) EXPECT_EQ(-1, action) | |
1387 | #else | |
1388 | # define EXPECT_SYSCALL_RETURN(val, action) EXPECT_EQ(val, action) | |
1389 | #endif | |
1390 | ||
4a0b8807 MS |
1391 | /* Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for |
1392 | * architectures without HAVE_ARCH_TRACEHOOK (e.g. User-mode Linux). | |
1393 | */ | |
0ce105bf | 1394 | #if defined(__x86_64__) || defined(__i386__) || defined(__mips__) |
4a0b8807 MS |
1395 | #define HAVE_GETREGS |
1396 | #endif | |
1397 | ||
c99ee51a KC |
1398 | /* Architecture-specific syscall fetching routine. */ |
1399 | int get_syscall(struct __test_metadata *_metadata, pid_t tracee) | |
1400 | { | |
c99ee51a | 1401 | ARCH_REGS regs; |
4a0b8807 MS |
1402 | #ifdef HAVE_GETREGS |
1403 | EXPECT_EQ(0, ptrace(PTRACE_GETREGS, tracee, 0, ®s)) { | |
1404 | TH_LOG("PTRACE_GETREGS failed"); | |
1405 | return -1; | |
1406 | } | |
1407 | #else | |
1408 | struct iovec iov; | |
c99ee51a KC |
1409 | |
1410 | iov.iov_base = ®s; | |
1411 | iov.iov_len = sizeof(regs); | |
1412 | EXPECT_EQ(0, ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &iov)) { | |
1413 | TH_LOG("PTRACE_GETREGSET failed"); | |
1414 | return -1; | |
1415 | } | |
4a0b8807 | 1416 | #endif |
c99ee51a | 1417 | |
0ce105bf MR |
1418 | #if defined(__mips__) |
1419 | if (regs.SYSCALL_NUM == __NR_O32_Linux) | |
1420 | return regs.SYSCALL_SYSCALL_NUM; | |
1421 | #endif | |
c99ee51a KC |
1422 | return regs.SYSCALL_NUM; |
1423 | } | |
1424 | ||
1425 | /* Architecture-specific syscall changing routine. */ | |
1426 | void change_syscall(struct __test_metadata *_metadata, | |
1427 | pid_t tracee, int syscall) | |
1428 | { | |
c99ee51a KC |
1429 | int ret; |
1430 | ARCH_REGS regs; | |
4a0b8807 MS |
1431 | #ifdef HAVE_GETREGS |
1432 | ret = ptrace(PTRACE_GETREGS, tracee, 0, ®s); | |
1433 | #else | |
1434 | struct iovec iov; | |
c99ee51a KC |
1435 | iov.iov_base = ®s; |
1436 | iov.iov_len = sizeof(regs); | |
1437 | ret = ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &iov); | |
4a0b8807 | 1438 | #endif |
34a048cc | 1439 | EXPECT_EQ(0, ret) {} |
c99ee51a | 1440 | |
256d0afb | 1441 | #if defined(__x86_64__) || defined(__i386__) || defined(__powerpc__) || \ |
64e2a42b | 1442 | defined(__s390__) || defined(__hppa__) |
c99ee51a KC |
1443 | { |
1444 | regs.SYSCALL_NUM = syscall; | |
1445 | } | |
0ce105bf MR |
1446 | #elif defined(__mips__) |
1447 | { | |
1448 | if (regs.SYSCALL_NUM == __NR_O32_Linux) | |
1449 | regs.SYSCALL_SYSCALL_NUM = syscall; | |
1450 | else | |
1451 | regs.SYSCALL_NUM = syscall; | |
1452 | } | |
c99ee51a KC |
1453 | |
1454 | #elif defined(__arm__) | |
1455 | # ifndef PTRACE_SET_SYSCALL | |
1456 | # define PTRACE_SET_SYSCALL 23 | |
1457 | # endif | |
1458 | { | |
1459 | ret = ptrace(PTRACE_SET_SYSCALL, tracee, NULL, syscall); | |
1460 | EXPECT_EQ(0, ret); | |
1461 | } | |
1462 | ||
256d0afb KC |
1463 | #elif defined(__aarch64__) |
1464 | # ifndef NT_ARM_SYSTEM_CALL | |
1465 | # define NT_ARM_SYSTEM_CALL 0x404 | |
1466 | # endif | |
1467 | { | |
1468 | iov.iov_base = &syscall; | |
1469 | iov.iov_len = sizeof(syscall); | |
1470 | ret = ptrace(PTRACE_SETREGSET, tracee, NT_ARM_SYSTEM_CALL, | |
1471 | &iov); | |
1472 | EXPECT_EQ(0, ret); | |
1473 | } | |
1474 | ||
c99ee51a KC |
1475 | #else |
1476 | ASSERT_EQ(1, 0) { | |
1477 | TH_LOG("How is the syscall changed on this architecture?"); | |
1478 | } | |
1479 | #endif | |
1480 | ||
1481 | /* If syscall is skipped, change return value. */ | |
1482 | if (syscall == -1) | |
0ce105bf MR |
1483 | #ifdef SYSCALL_NUM_RET_SHARE_REG |
1484 | TH_LOG("Can't modify syscall return on this architecture"); | |
1485 | #else | |
a33b2d03 | 1486 | regs.SYSCALL_RET = EPERM; |
0ce105bf | 1487 | #endif |
c99ee51a | 1488 | |
4a0b8807 MS |
1489 | #ifdef HAVE_GETREGS |
1490 | ret = ptrace(PTRACE_SETREGS, tracee, 0, ®s); | |
1491 | #else | |
256d0afb KC |
1492 | iov.iov_base = ®s; |
1493 | iov.iov_len = sizeof(regs); | |
c99ee51a | 1494 | ret = ptrace(PTRACE_SETREGSET, tracee, NT_PRSTATUS, &iov); |
4a0b8807 | 1495 | #endif |
c99ee51a KC |
1496 | EXPECT_EQ(0, ret); |
1497 | } | |
1498 | ||
1499 | void tracer_syscall(struct __test_metadata *_metadata, pid_t tracee, | |
1500 | int status, void *args) | |
1501 | { | |
1502 | int ret; | |
1503 | unsigned long msg; | |
1504 | ||
1505 | /* Make sure we got the right message. */ | |
1506 | ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg); | |
1507 | EXPECT_EQ(0, ret); | |
1508 | ||
b623c4da | 1509 | /* Validate and take action on expected syscalls. */ |
c99ee51a KC |
1510 | switch (msg) { |
1511 | case 0x1002: | |
1512 | /* change getpid to getppid. */ | |
b623c4da | 1513 | EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee)); |
c99ee51a KC |
1514 | change_syscall(_metadata, tracee, __NR_getppid); |
1515 | break; | |
1516 | case 0x1003: | |
1517 | /* skip gettid. */ | |
b623c4da | 1518 | EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee)); |
c99ee51a KC |
1519 | change_syscall(_metadata, tracee, -1); |
1520 | break; | |
1521 | case 0x1004: | |
1522 | /* do nothing (allow getppid) */ | |
b623c4da | 1523 | EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee)); |
c99ee51a KC |
1524 | break; |
1525 | default: | |
1526 | EXPECT_EQ(0, msg) { | |
1527 | TH_LOG("Unknown PTRACE_GETEVENTMSG: 0x%lx", msg); | |
1528 | kill(tracee, SIGKILL); | |
1529 | } | |
1530 | } | |
1531 | ||
1532 | } | |
1533 | ||
58d0a862 KC |
1534 | void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee, |
1535 | int status, void *args) | |
1536 | { | |
1537 | int ret, nr; | |
1538 | unsigned long msg; | |
1539 | static bool entry; | |
1540 | ||
1541 | /* Make sure we got an empty message. */ | |
1542 | ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg); | |
1543 | EXPECT_EQ(0, ret); | |
1544 | EXPECT_EQ(0, msg); | |
1545 | ||
1546 | /* The only way to tell PTRACE_SYSCALL entry/exit is by counting. */ | |
1547 | entry = !entry; | |
1548 | if (!entry) | |
1549 | return; | |
1550 | ||
1551 | nr = get_syscall(_metadata, tracee); | |
1552 | ||
1553 | if (nr == __NR_getpid) | |
1554 | change_syscall(_metadata, tracee, __NR_getppid); | |
a33b2d03 KC |
1555 | if (nr == __NR_open) |
1556 | change_syscall(_metadata, tracee, -1); | |
58d0a862 KC |
1557 | } |
1558 | ||
c99ee51a KC |
1559 | FIXTURE_DATA(TRACE_syscall) { |
1560 | struct sock_fprog prog; | |
1561 | pid_t tracer, mytid, mypid, parent; | |
1562 | }; | |
1563 | ||
1564 | FIXTURE_SETUP(TRACE_syscall) | |
1565 | { | |
1566 | struct sock_filter filter[] = { | |
1567 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
1568 | offsetof(struct seccomp_data, nr)), | |
1569 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), | |
1570 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002), | |
1571 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1), | |
1572 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003), | |
1573 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1), | |
1574 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004), | |
1575 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1576 | }; | |
1577 | ||
1578 | memset(&self->prog, 0, sizeof(self->prog)); | |
1579 | self->prog.filter = malloc(sizeof(filter)); | |
1580 | ASSERT_NE(NULL, self->prog.filter); | |
1581 | memcpy(self->prog.filter, filter, sizeof(filter)); | |
1582 | self->prog.len = (unsigned short)ARRAY_SIZE(filter); | |
1583 | ||
1584 | /* Prepare some testable syscall results. */ | |
1585 | self->mytid = syscall(__NR_gettid); | |
1586 | ASSERT_GT(self->mytid, 0); | |
1587 | ASSERT_NE(self->mytid, 1) { | |
1588 | TH_LOG("Running this test as init is not supported. :)"); | |
1589 | } | |
1590 | ||
1591 | self->mypid = getpid(); | |
1592 | ASSERT_GT(self->mypid, 0); | |
1593 | ASSERT_EQ(self->mytid, self->mypid); | |
1594 | ||
1595 | self->parent = getppid(); | |
1596 | ASSERT_GT(self->parent, 0); | |
1597 | ASSERT_NE(self->parent, self->mypid); | |
1598 | ||
1599 | /* Launch tracer. */ | |
58d0a862 KC |
1600 | self->tracer = setup_trace_fixture(_metadata, tracer_syscall, NULL, |
1601 | false); | |
c99ee51a KC |
1602 | } |
1603 | ||
1604 | FIXTURE_TEARDOWN(TRACE_syscall) | |
1605 | { | |
1606 | teardown_trace_fixture(_metadata, self->tracer); | |
1607 | if (self->prog.filter) | |
1608 | free(self->prog.filter); | |
1609 | } | |
1610 | ||
a33b2d03 KC |
1611 | TEST_F(TRACE_syscall, ptrace_syscall_redirected) |
1612 | { | |
1613 | /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */ | |
1614 | teardown_trace_fixture(_metadata, self->tracer); | |
1615 | self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL, | |
1616 | true); | |
1617 | ||
1618 | /* Tracer will redirect getpid to getppid. */ | |
1619 | EXPECT_NE(self->mypid, syscall(__NR_getpid)); | |
1620 | } | |
1621 | ||
1622 | TEST_F(TRACE_syscall, ptrace_syscall_dropped) | |
1623 | { | |
1624 | /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */ | |
1625 | teardown_trace_fixture(_metadata, self->tracer); | |
1626 | self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL, | |
1627 | true); | |
1628 | ||
1629 | /* Tracer should skip the open syscall, resulting in EPERM. */ | |
1630 | EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_open)); | |
1631 | } | |
1632 | ||
c99ee51a KC |
1633 | TEST_F(TRACE_syscall, syscall_allowed) |
1634 | { | |
1635 | long ret; | |
1636 | ||
1637 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1638 | ASSERT_EQ(0, ret); | |
1639 | ||
1640 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
1641 | ASSERT_EQ(0, ret); | |
1642 | ||
1643 | /* getppid works as expected (no changes). */ | |
1644 | EXPECT_EQ(self->parent, syscall(__NR_getppid)); | |
1645 | EXPECT_NE(self->mypid, syscall(__NR_getppid)); | |
1646 | } | |
1647 | ||
1648 | TEST_F(TRACE_syscall, syscall_redirected) | |
1649 | { | |
1650 | long ret; | |
1651 | ||
1652 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1653 | ASSERT_EQ(0, ret); | |
1654 | ||
1655 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
1656 | ASSERT_EQ(0, ret); | |
1657 | ||
1658 | /* getpid has been redirected to getppid as expected. */ | |
1659 | EXPECT_EQ(self->parent, syscall(__NR_getpid)); | |
1660 | EXPECT_NE(self->mypid, syscall(__NR_getpid)); | |
1661 | } | |
1662 | ||
1663 | TEST_F(TRACE_syscall, syscall_dropped) | |
1664 | { | |
1665 | long ret; | |
1666 | ||
1667 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1668 | ASSERT_EQ(0, ret); | |
1669 | ||
1670 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
1671 | ASSERT_EQ(0, ret); | |
1672 | ||
1673 | /* gettid has been skipped and an altered return value stored. */ | |
a33b2d03 | 1674 | EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_gettid)); |
c99ee51a KC |
1675 | EXPECT_NE(self->mytid, syscall(__NR_gettid)); |
1676 | } | |
1677 | ||
58d0a862 KC |
1678 | TEST_F(TRACE_syscall, skip_after_RET_TRACE) |
1679 | { | |
1680 | struct sock_filter filter[] = { | |
1681 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
1682 | offsetof(struct seccomp_data, nr)), | |
1683 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1), | |
1684 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EPERM), | |
1685 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1686 | }; | |
1687 | struct sock_fprog prog = { | |
1688 | .len = (unsigned short)ARRAY_SIZE(filter), | |
1689 | .filter = filter, | |
1690 | }; | |
1691 | long ret; | |
1692 | ||
1693 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1694 | ASSERT_EQ(0, ret); | |
1695 | ||
1696 | /* Install fixture filter. */ | |
1697 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
1698 | ASSERT_EQ(0, ret); | |
1699 | ||
1700 | /* Install "errno on getppid" filter. */ | |
1701 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
1702 | ASSERT_EQ(0, ret); | |
1703 | ||
1704 | /* Tracer will redirect getpid to getppid, and we should see EPERM. */ | |
a33b2d03 | 1705 | errno = 0; |
58d0a862 KC |
1706 | EXPECT_EQ(-1, syscall(__NR_getpid)); |
1707 | EXPECT_EQ(EPERM, errno); | |
1708 | } | |
1709 | ||
1710 | TEST_F_SIGNAL(TRACE_syscall, kill_after_RET_TRACE, SIGSYS) | |
1711 | { | |
1712 | struct sock_filter filter[] = { | |
1713 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
1714 | offsetof(struct seccomp_data, nr)), | |
1715 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1), | |
1716 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
1717 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1718 | }; | |
1719 | struct sock_fprog prog = { | |
1720 | .len = (unsigned short)ARRAY_SIZE(filter), | |
1721 | .filter = filter, | |
1722 | }; | |
1723 | long ret; | |
1724 | ||
1725 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1726 | ASSERT_EQ(0, ret); | |
1727 | ||
1728 | /* Install fixture filter. */ | |
1729 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); | |
1730 | ASSERT_EQ(0, ret); | |
1731 | ||
1732 | /* Install "death on getppid" filter. */ | |
1733 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
1734 | ASSERT_EQ(0, ret); | |
1735 | ||
1736 | /* Tracer will redirect getpid to getppid, and we should die. */ | |
1737 | EXPECT_NE(self->mypid, syscall(__NR_getpid)); | |
1738 | } | |
1739 | ||
1740 | TEST_F(TRACE_syscall, skip_after_ptrace) | |
1741 | { | |
1742 | struct sock_filter filter[] = { | |
1743 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
1744 | offsetof(struct seccomp_data, nr)), | |
1745 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1), | |
1746 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EPERM), | |
1747 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1748 | }; | |
1749 | struct sock_fprog prog = { | |
1750 | .len = (unsigned short)ARRAY_SIZE(filter), | |
1751 | .filter = filter, | |
1752 | }; | |
1753 | long ret; | |
1754 | ||
1755 | /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */ | |
1756 | teardown_trace_fixture(_metadata, self->tracer); | |
1757 | self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL, | |
1758 | true); | |
1759 | ||
1760 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1761 | ASSERT_EQ(0, ret); | |
1762 | ||
1763 | /* Install "errno on getppid" filter. */ | |
1764 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
1765 | ASSERT_EQ(0, ret); | |
1766 | ||
1767 | /* Tracer will redirect getpid to getppid, and we should see EPERM. */ | |
1768 | EXPECT_EQ(-1, syscall(__NR_getpid)); | |
1769 | EXPECT_EQ(EPERM, errno); | |
1770 | } | |
1771 | ||
1772 | TEST_F_SIGNAL(TRACE_syscall, kill_after_ptrace, SIGSYS) | |
1773 | { | |
1774 | struct sock_filter filter[] = { | |
1775 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
1776 | offsetof(struct seccomp_data, nr)), | |
1777 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1), | |
1778 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
1779 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1780 | }; | |
1781 | struct sock_fprog prog = { | |
1782 | .len = (unsigned short)ARRAY_SIZE(filter), | |
1783 | .filter = filter, | |
1784 | }; | |
1785 | long ret; | |
1786 | ||
1787 | /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */ | |
1788 | teardown_trace_fixture(_metadata, self->tracer); | |
1789 | self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL, | |
1790 | true); | |
1791 | ||
1792 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1793 | ASSERT_EQ(0, ret); | |
1794 | ||
1795 | /* Install "death on getppid" filter. */ | |
1796 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
1797 | ASSERT_EQ(0, ret); | |
1798 | ||
1799 | /* Tracer will redirect getpid to getppid, and we should die. */ | |
1800 | EXPECT_NE(self->mypid, syscall(__NR_getpid)); | |
1801 | } | |
1802 | ||
c99ee51a KC |
1803 | #ifndef __NR_seccomp |
1804 | # if defined(__i386__) | |
1805 | # define __NR_seccomp 354 | |
1806 | # elif defined(__x86_64__) | |
1807 | # define __NR_seccomp 317 | |
1808 | # elif defined(__arm__) | |
1809 | # define __NR_seccomp 383 | |
1810 | # elif defined(__aarch64__) | |
1811 | # define __NR_seccomp 277 | |
64e2a42b HD |
1812 | # elif defined(__hppa__) |
1813 | # define __NR_seccomp 338 | |
5d83c2b3 ME |
1814 | # elif defined(__powerpc__) |
1815 | # define __NR_seccomp 358 | |
b623c4da KC |
1816 | # elif defined(__s390__) |
1817 | # define __NR_seccomp 348 | |
c99ee51a KC |
1818 | # else |
1819 | # warning "seccomp syscall number unknown for this architecture" | |
1820 | # define __NR_seccomp 0xffff | |
1821 | # endif | |
1822 | #endif | |
1823 | ||
1824 | #ifndef SECCOMP_SET_MODE_STRICT | |
1825 | #define SECCOMP_SET_MODE_STRICT 0 | |
1826 | #endif | |
1827 | ||
1828 | #ifndef SECCOMP_SET_MODE_FILTER | |
1829 | #define SECCOMP_SET_MODE_FILTER 1 | |
1830 | #endif | |
1831 | ||
d612b1fd TH |
1832 | #ifndef SECCOMP_GET_ACTION_AVAIL |
1833 | #define SECCOMP_GET_ACTION_AVAIL 2 | |
1834 | #endif | |
1835 | ||
6c045d07 MS |
1836 | #ifndef SECCOMP_FILTER_FLAG_TSYNC |
1837 | #define SECCOMP_FILTER_FLAG_TSYNC 1 | |
c99ee51a KC |
1838 | #endif |
1839 | ||
e66a3997 TH |
1840 | #ifndef SECCOMP_FILTER_FLAG_LOG |
1841 | #define SECCOMP_FILTER_FLAG_LOG 2 | |
1842 | #endif | |
1843 | ||
c99ee51a | 1844 | #ifndef seccomp |
505ce68c | 1845 | int seccomp(unsigned int op, unsigned int flags, void *args) |
c99ee51a KC |
1846 | { |
1847 | errno = 0; | |
505ce68c | 1848 | return syscall(__NR_seccomp, op, flags, args); |
c99ee51a KC |
1849 | } |
1850 | #endif | |
1851 | ||
1852 | TEST(seccomp_syscall) | |
1853 | { | |
1854 | struct sock_filter filter[] = { | |
1855 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1856 | }; | |
1857 | struct sock_fprog prog = { | |
1858 | .len = (unsigned short)ARRAY_SIZE(filter), | |
1859 | .filter = filter, | |
1860 | }; | |
1861 | long ret; | |
1862 | ||
1863 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
1864 | ASSERT_EQ(0, ret) { | |
1865 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
1866 | } | |
1867 | ||
1868 | /* Reject insane operation. */ | |
1869 | ret = seccomp(-1, 0, &prog); | |
b623c4da KC |
1870 | ASSERT_NE(ENOSYS, errno) { |
1871 | TH_LOG("Kernel does not support seccomp syscall!"); | |
1872 | } | |
c99ee51a KC |
1873 | EXPECT_EQ(EINVAL, errno) { |
1874 | TH_LOG("Did not reject crazy op value!"); | |
1875 | } | |
1876 | ||
1877 | /* Reject strict with flags or pointer. */ | |
1878 | ret = seccomp(SECCOMP_SET_MODE_STRICT, -1, NULL); | |
1879 | EXPECT_EQ(EINVAL, errno) { | |
1880 | TH_LOG("Did not reject mode strict with flags!"); | |
1881 | } | |
1882 | ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, &prog); | |
1883 | EXPECT_EQ(EINVAL, errno) { | |
1884 | TH_LOG("Did not reject mode strict with uargs!"); | |
1885 | } | |
1886 | ||
1887 | /* Reject insane args for filter. */ | |
1888 | ret = seccomp(SECCOMP_SET_MODE_FILTER, -1, &prog); | |
1889 | EXPECT_EQ(EINVAL, errno) { | |
1890 | TH_LOG("Did not reject crazy filter flags!"); | |
1891 | } | |
1892 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, NULL); | |
1893 | EXPECT_EQ(EFAULT, errno) { | |
1894 | TH_LOG("Did not reject NULL filter!"); | |
1895 | } | |
1896 | ||
1897 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog); | |
1898 | EXPECT_EQ(0, errno) { | |
1899 | TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER: %s", | |
1900 | strerror(errno)); | |
1901 | } | |
1902 | } | |
1903 | ||
1904 | TEST(seccomp_syscall_mode_lock) | |
1905 | { | |
1906 | struct sock_filter filter[] = { | |
1907 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
1908 | }; | |
1909 | struct sock_fprog prog = { | |
1910 | .len = (unsigned short)ARRAY_SIZE(filter), | |
1911 | .filter = filter, | |
1912 | }; | |
1913 | long ret; | |
1914 | ||
1915 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0); | |
1916 | ASSERT_EQ(0, ret) { | |
1917 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
1918 | } | |
1919 | ||
1920 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog); | |
b623c4da KC |
1921 | ASSERT_NE(ENOSYS, errno) { |
1922 | TH_LOG("Kernel does not support seccomp syscall!"); | |
1923 | } | |
c99ee51a KC |
1924 | EXPECT_EQ(0, ret) { |
1925 | TH_LOG("Could not install filter!"); | |
1926 | } | |
1927 | ||
1928 | /* Make sure neither entry point will switch to strict. */ | |
1929 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, 0, 0, 0); | |
1930 | EXPECT_EQ(EINVAL, errno) { | |
1931 | TH_LOG("Switched to mode strict!"); | |
1932 | } | |
1933 | ||
1934 | ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, NULL); | |
1935 | EXPECT_EQ(EINVAL, errno) { | |
1936 | TH_LOG("Switched to mode strict!"); | |
1937 | } | |
1938 | } | |
1939 | ||
2b7ea5b5 TH |
1940 | /* |
1941 | * Test detection of known and unknown filter flags. Userspace needs to be able | |
1942 | * to check if a filter flag is supported by the current kernel and a good way | |
1943 | * of doing that is by attempting to enter filter mode, with the flag bit in | |
1944 | * question set, and a NULL pointer for the _args_ parameter. EFAULT indicates | |
1945 | * that the flag is valid and EINVAL indicates that the flag is invalid. | |
1946 | */ | |
1947 | TEST(detect_seccomp_filter_flags) | |
1948 | { | |
e66a3997 TH |
1949 | unsigned int flags[] = { SECCOMP_FILTER_FLAG_TSYNC, |
1950 | SECCOMP_FILTER_FLAG_LOG }; | |
2b7ea5b5 TH |
1951 | unsigned int flag, all_flags; |
1952 | int i; | |
1953 | long ret; | |
1954 | ||
1955 | /* Test detection of known-good filter flags */ | |
1956 | for (i = 0, all_flags = 0; i < ARRAY_SIZE(flags); i++) { | |
1957 | flag = flags[i]; | |
1958 | ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); | |
1959 | ASSERT_NE(ENOSYS, errno) { | |
1960 | TH_LOG("Kernel does not support seccomp syscall!"); | |
1961 | } | |
1962 | EXPECT_EQ(-1, ret); | |
1963 | EXPECT_EQ(EFAULT, errno) { | |
1964 | TH_LOG("Failed to detect that a known-good filter flag (0x%X) is supported!", | |
1965 | flag); | |
1966 | } | |
1967 | ||
1968 | all_flags |= flag; | |
1969 | } | |
1970 | ||
1971 | /* Test detection of all known-good filter flags */ | |
1972 | ret = seccomp(SECCOMP_SET_MODE_FILTER, all_flags, NULL); | |
1973 | EXPECT_EQ(-1, ret); | |
1974 | EXPECT_EQ(EFAULT, errno) { | |
1975 | TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!", | |
1976 | all_flags); | |
1977 | } | |
1978 | ||
1979 | /* Test detection of an unknown filter flag */ | |
1980 | flag = -1; | |
1981 | ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); | |
1982 | EXPECT_EQ(-1, ret); | |
1983 | EXPECT_EQ(EINVAL, errno) { | |
1984 | TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported!", | |
1985 | flag); | |
1986 | } | |
1987 | ||
1988 | /* | |
1989 | * Test detection of an unknown filter flag that may simply need to be | |
1990 | * added to this test | |
1991 | */ | |
1992 | flag = flags[ARRAY_SIZE(flags) - 1] << 1; | |
1993 | ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); | |
1994 | EXPECT_EQ(-1, ret); | |
1995 | EXPECT_EQ(EINVAL, errno) { | |
1996 | TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported! Does a new flag need to be added to this test?", | |
1997 | flag); | |
1998 | } | |
1999 | } | |
2000 | ||
c99ee51a KC |
2001 | TEST(TSYNC_first) |
2002 | { | |
2003 | struct sock_filter filter[] = { | |
2004 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2005 | }; | |
2006 | struct sock_fprog prog = { | |
2007 | .len = (unsigned short)ARRAY_SIZE(filter), | |
2008 | .filter = filter, | |
2009 | }; | |
2010 | long ret; | |
2011 | ||
2012 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0); | |
2013 | ASSERT_EQ(0, ret) { | |
2014 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2015 | } | |
2016 | ||
6c045d07 | 2017 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a | 2018 | &prog); |
b623c4da KC |
2019 | ASSERT_NE(ENOSYS, errno) { |
2020 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2021 | } | |
c99ee51a KC |
2022 | EXPECT_EQ(0, ret) { |
2023 | TH_LOG("Could not install initial filter with TSYNC!"); | |
2024 | } | |
2025 | } | |
2026 | ||
2027 | #define TSYNC_SIBLINGS 2 | |
2028 | struct tsync_sibling { | |
2029 | pthread_t tid; | |
2030 | pid_t system_tid; | |
2031 | sem_t *started; | |
2032 | pthread_cond_t *cond; | |
2033 | pthread_mutex_t *mutex; | |
2034 | int diverge; | |
2035 | int num_waits; | |
2036 | struct sock_fprog *prog; | |
2037 | struct __test_metadata *metadata; | |
2038 | }; | |
2039 | ||
93bd70e3 KC |
2040 | /* |
2041 | * To avoid joining joined threads (which is not allowed by Bionic), | |
2042 | * make sure we both successfully join and clear the tid to skip a | |
2043 | * later join attempt during fixture teardown. Any remaining threads | |
2044 | * will be directly killed during teardown. | |
2045 | */ | |
2046 | #define PTHREAD_JOIN(tid, status) \ | |
2047 | do { \ | |
2048 | int _rc = pthread_join(tid, status); \ | |
2049 | if (_rc) { \ | |
2050 | TH_LOG("pthread_join of tid %u failed: %d\n", \ | |
2051 | (unsigned int)tid, _rc); \ | |
2052 | } else { \ | |
2053 | tid = 0; \ | |
2054 | } \ | |
2055 | } while (0) | |
2056 | ||
c99ee51a KC |
2057 | FIXTURE_DATA(TSYNC) { |
2058 | struct sock_fprog root_prog, apply_prog; | |
2059 | struct tsync_sibling sibling[TSYNC_SIBLINGS]; | |
2060 | sem_t started; | |
2061 | pthread_cond_t cond; | |
2062 | pthread_mutex_t mutex; | |
2063 | int sibling_count; | |
2064 | }; | |
2065 | ||
2066 | FIXTURE_SETUP(TSYNC) | |
2067 | { | |
2068 | struct sock_filter root_filter[] = { | |
2069 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2070 | }; | |
2071 | struct sock_filter apply_filter[] = { | |
2072 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
2073 | offsetof(struct seccomp_data, nr)), | |
2074 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1), | |
2075 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
2076 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2077 | }; | |
2078 | ||
2079 | memset(&self->root_prog, 0, sizeof(self->root_prog)); | |
2080 | memset(&self->apply_prog, 0, sizeof(self->apply_prog)); | |
2081 | memset(&self->sibling, 0, sizeof(self->sibling)); | |
2082 | self->root_prog.filter = malloc(sizeof(root_filter)); | |
2083 | ASSERT_NE(NULL, self->root_prog.filter); | |
2084 | memcpy(self->root_prog.filter, &root_filter, sizeof(root_filter)); | |
2085 | self->root_prog.len = (unsigned short)ARRAY_SIZE(root_filter); | |
2086 | ||
2087 | self->apply_prog.filter = malloc(sizeof(apply_filter)); | |
2088 | ASSERT_NE(NULL, self->apply_prog.filter); | |
2089 | memcpy(self->apply_prog.filter, &apply_filter, sizeof(apply_filter)); | |
2090 | self->apply_prog.len = (unsigned short)ARRAY_SIZE(apply_filter); | |
2091 | ||
2092 | self->sibling_count = 0; | |
2093 | pthread_mutex_init(&self->mutex, NULL); | |
2094 | pthread_cond_init(&self->cond, NULL); | |
2095 | sem_init(&self->started, 0, 0); | |
2096 | self->sibling[0].tid = 0; | |
2097 | self->sibling[0].cond = &self->cond; | |
2098 | self->sibling[0].started = &self->started; | |
2099 | self->sibling[0].mutex = &self->mutex; | |
2100 | self->sibling[0].diverge = 0; | |
2101 | self->sibling[0].num_waits = 1; | |
2102 | self->sibling[0].prog = &self->root_prog; | |
2103 | self->sibling[0].metadata = _metadata; | |
2104 | self->sibling[1].tid = 0; | |
2105 | self->sibling[1].cond = &self->cond; | |
2106 | self->sibling[1].started = &self->started; | |
2107 | self->sibling[1].mutex = &self->mutex; | |
2108 | self->sibling[1].diverge = 0; | |
2109 | self->sibling[1].prog = &self->root_prog; | |
2110 | self->sibling[1].num_waits = 1; | |
2111 | self->sibling[1].metadata = _metadata; | |
2112 | } | |
2113 | ||
2114 | FIXTURE_TEARDOWN(TSYNC) | |
2115 | { | |
2116 | int sib = 0; | |
2117 | ||
2118 | if (self->root_prog.filter) | |
2119 | free(self->root_prog.filter); | |
2120 | if (self->apply_prog.filter) | |
2121 | free(self->apply_prog.filter); | |
2122 | ||
2123 | for ( ; sib < self->sibling_count; ++sib) { | |
2124 | struct tsync_sibling *s = &self->sibling[sib]; | |
c99ee51a KC |
2125 | |
2126 | if (!s->tid) | |
2127 | continue; | |
93bd70e3 KC |
2128 | /* |
2129 | * If a thread is still running, it may be stuck, so hit | |
2130 | * it over the head really hard. | |
2131 | */ | |
2132 | pthread_kill(s->tid, 9); | |
c99ee51a KC |
2133 | } |
2134 | pthread_mutex_destroy(&self->mutex); | |
2135 | pthread_cond_destroy(&self->cond); | |
2136 | sem_destroy(&self->started); | |
2137 | } | |
2138 | ||
2139 | void *tsync_sibling(void *data) | |
2140 | { | |
2141 | long ret = 0; | |
2142 | struct tsync_sibling *me = data; | |
2143 | ||
2144 | me->system_tid = syscall(__NR_gettid); | |
2145 | ||
2146 | pthread_mutex_lock(me->mutex); | |
2147 | if (me->diverge) { | |
2148 | /* Just re-apply the root prog to fork the tree */ | |
2149 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, | |
2150 | me->prog, 0, 0); | |
2151 | } | |
2152 | sem_post(me->started); | |
2153 | /* Return outside of started so parent notices failures. */ | |
2154 | if (ret) { | |
2155 | pthread_mutex_unlock(me->mutex); | |
2156 | return (void *)SIBLING_EXIT_FAILURE; | |
2157 | } | |
2158 | do { | |
2159 | pthread_cond_wait(me->cond, me->mutex); | |
2160 | me->num_waits = me->num_waits - 1; | |
2161 | } while (me->num_waits); | |
2162 | pthread_mutex_unlock(me->mutex); | |
2163 | ||
2164 | ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0); | |
2165 | if (!ret) | |
2166 | return (void *)SIBLING_EXIT_NEWPRIVS; | |
2167 | read(0, NULL, 0); | |
2168 | return (void *)SIBLING_EXIT_UNKILLED; | |
2169 | } | |
2170 | ||
2171 | void tsync_start_sibling(struct tsync_sibling *sibling) | |
2172 | { | |
2173 | pthread_create(&sibling->tid, NULL, tsync_sibling, (void *)sibling); | |
2174 | } | |
2175 | ||
2176 | TEST_F(TSYNC, siblings_fail_prctl) | |
2177 | { | |
2178 | long ret; | |
2179 | void *status; | |
2180 | struct sock_filter filter[] = { | |
2181 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
2182 | offsetof(struct seccomp_data, nr)), | |
2183 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1), | |
2184 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EINVAL), | |
2185 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2186 | }; | |
2187 | struct sock_fprog prog = { | |
2188 | .len = (unsigned short)ARRAY_SIZE(filter), | |
2189 | .filter = filter, | |
2190 | }; | |
2191 | ||
2192 | ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
2193 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2194 | } | |
2195 | ||
2196 | /* Check prctl failure detection by requesting sib 0 diverge. */ | |
2197 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog); | |
b623c4da KC |
2198 | ASSERT_NE(ENOSYS, errno) { |
2199 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2200 | } | |
c99ee51a KC |
2201 | ASSERT_EQ(0, ret) { |
2202 | TH_LOG("setting filter failed"); | |
2203 | } | |
2204 | ||
2205 | self->sibling[0].diverge = 1; | |
2206 | tsync_start_sibling(&self->sibling[0]); | |
2207 | tsync_start_sibling(&self->sibling[1]); | |
2208 | ||
2209 | while (self->sibling_count < TSYNC_SIBLINGS) { | |
2210 | sem_wait(&self->started); | |
2211 | self->sibling_count++; | |
2212 | } | |
2213 | ||
2214 | /* Signal the threads to clean up*/ | |
2215 | pthread_mutex_lock(&self->mutex); | |
2216 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2217 | TH_LOG("cond broadcast non-zero"); | |
2218 | } | |
2219 | pthread_mutex_unlock(&self->mutex); | |
2220 | ||
2221 | /* Ensure diverging sibling failed to call prctl. */ | |
93bd70e3 | 2222 | PTHREAD_JOIN(self->sibling[0].tid, &status); |
c99ee51a | 2223 | EXPECT_EQ(SIBLING_EXIT_FAILURE, (long)status); |
93bd70e3 | 2224 | PTHREAD_JOIN(self->sibling[1].tid, &status); |
c99ee51a KC |
2225 | EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); |
2226 | } | |
2227 | ||
2228 | TEST_F(TSYNC, two_siblings_with_ancestor) | |
2229 | { | |
2230 | long ret; | |
2231 | void *status; | |
2232 | ||
2233 | ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
2234 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2235 | } | |
2236 | ||
2237 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog); | |
b623c4da KC |
2238 | ASSERT_NE(ENOSYS, errno) { |
2239 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2240 | } | |
c99ee51a KC |
2241 | ASSERT_EQ(0, ret) { |
2242 | TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!"); | |
2243 | } | |
2244 | tsync_start_sibling(&self->sibling[0]); | |
2245 | tsync_start_sibling(&self->sibling[1]); | |
2246 | ||
2247 | while (self->sibling_count < TSYNC_SIBLINGS) { | |
2248 | sem_wait(&self->started); | |
2249 | self->sibling_count++; | |
2250 | } | |
2251 | ||
6c045d07 | 2252 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a KC |
2253 | &self->apply_prog); |
2254 | ASSERT_EQ(0, ret) { | |
2255 | TH_LOG("Could install filter on all threads!"); | |
2256 | } | |
2257 | /* Tell the siblings to test the policy */ | |
2258 | pthread_mutex_lock(&self->mutex); | |
2259 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2260 | TH_LOG("cond broadcast non-zero"); | |
2261 | } | |
2262 | pthread_mutex_unlock(&self->mutex); | |
2263 | /* Ensure they are both killed and don't exit cleanly. */ | |
93bd70e3 | 2264 | PTHREAD_JOIN(self->sibling[0].tid, &status); |
c99ee51a | 2265 | EXPECT_EQ(0x0, (long)status); |
93bd70e3 | 2266 | PTHREAD_JOIN(self->sibling[1].tid, &status); |
c99ee51a KC |
2267 | EXPECT_EQ(0x0, (long)status); |
2268 | } | |
2269 | ||
2270 | TEST_F(TSYNC, two_sibling_want_nnp) | |
2271 | { | |
2272 | void *status; | |
2273 | ||
2274 | /* start siblings before any prctl() operations */ | |
2275 | tsync_start_sibling(&self->sibling[0]); | |
2276 | tsync_start_sibling(&self->sibling[1]); | |
2277 | while (self->sibling_count < TSYNC_SIBLINGS) { | |
2278 | sem_wait(&self->started); | |
2279 | self->sibling_count++; | |
2280 | } | |
2281 | ||
2282 | /* Tell the siblings to test no policy */ | |
2283 | pthread_mutex_lock(&self->mutex); | |
2284 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2285 | TH_LOG("cond broadcast non-zero"); | |
2286 | } | |
2287 | pthread_mutex_unlock(&self->mutex); | |
2288 | ||
2289 | /* Ensure they are both upset about lacking nnp. */ | |
93bd70e3 | 2290 | PTHREAD_JOIN(self->sibling[0].tid, &status); |
c99ee51a | 2291 | EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status); |
93bd70e3 | 2292 | PTHREAD_JOIN(self->sibling[1].tid, &status); |
c99ee51a KC |
2293 | EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status); |
2294 | } | |
2295 | ||
2296 | TEST_F(TSYNC, two_siblings_with_no_filter) | |
2297 | { | |
2298 | long ret; | |
2299 | void *status; | |
2300 | ||
2301 | /* start siblings before any prctl() operations */ | |
2302 | tsync_start_sibling(&self->sibling[0]); | |
2303 | tsync_start_sibling(&self->sibling[1]); | |
2304 | while (self->sibling_count < TSYNC_SIBLINGS) { | |
2305 | sem_wait(&self->started); | |
2306 | self->sibling_count++; | |
2307 | } | |
2308 | ||
2309 | ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
2310 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2311 | } | |
2312 | ||
6c045d07 | 2313 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a | 2314 | &self->apply_prog); |
b623c4da KC |
2315 | ASSERT_NE(ENOSYS, errno) { |
2316 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2317 | } | |
c99ee51a KC |
2318 | ASSERT_EQ(0, ret) { |
2319 | TH_LOG("Could install filter on all threads!"); | |
2320 | } | |
2321 | ||
2322 | /* Tell the siblings to test the policy */ | |
2323 | pthread_mutex_lock(&self->mutex); | |
2324 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2325 | TH_LOG("cond broadcast non-zero"); | |
2326 | } | |
2327 | pthread_mutex_unlock(&self->mutex); | |
2328 | ||
2329 | /* Ensure they are both killed and don't exit cleanly. */ | |
93bd70e3 | 2330 | PTHREAD_JOIN(self->sibling[0].tid, &status); |
c99ee51a | 2331 | EXPECT_EQ(0x0, (long)status); |
93bd70e3 | 2332 | PTHREAD_JOIN(self->sibling[1].tid, &status); |
c99ee51a KC |
2333 | EXPECT_EQ(0x0, (long)status); |
2334 | } | |
2335 | ||
2336 | TEST_F(TSYNC, two_siblings_with_one_divergence) | |
2337 | { | |
2338 | long ret; | |
2339 | void *status; | |
2340 | ||
2341 | ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
2342 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2343 | } | |
2344 | ||
2345 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog); | |
b623c4da KC |
2346 | ASSERT_NE(ENOSYS, errno) { |
2347 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2348 | } | |
c99ee51a KC |
2349 | ASSERT_EQ(0, ret) { |
2350 | TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!"); | |
2351 | } | |
2352 | self->sibling[0].diverge = 1; | |
2353 | tsync_start_sibling(&self->sibling[0]); | |
2354 | tsync_start_sibling(&self->sibling[1]); | |
2355 | ||
2356 | while (self->sibling_count < TSYNC_SIBLINGS) { | |
2357 | sem_wait(&self->started); | |
2358 | self->sibling_count++; | |
2359 | } | |
2360 | ||
6c045d07 | 2361 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a KC |
2362 | &self->apply_prog); |
2363 | ASSERT_EQ(self->sibling[0].system_tid, ret) { | |
2364 | TH_LOG("Did not fail on diverged sibling."); | |
2365 | } | |
2366 | ||
2367 | /* Wake the threads */ | |
2368 | pthread_mutex_lock(&self->mutex); | |
2369 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2370 | TH_LOG("cond broadcast non-zero"); | |
2371 | } | |
2372 | pthread_mutex_unlock(&self->mutex); | |
2373 | ||
2374 | /* Ensure they are both unkilled. */ | |
93bd70e3 | 2375 | PTHREAD_JOIN(self->sibling[0].tid, &status); |
c99ee51a | 2376 | EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); |
93bd70e3 | 2377 | PTHREAD_JOIN(self->sibling[1].tid, &status); |
c99ee51a KC |
2378 | EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); |
2379 | } | |
2380 | ||
2381 | TEST_F(TSYNC, two_siblings_not_under_filter) | |
2382 | { | |
2383 | long ret, sib; | |
2384 | void *status; | |
2385 | ||
2386 | ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
2387 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2388 | } | |
2389 | ||
2390 | /* | |
2391 | * Sibling 0 will have its own seccomp policy | |
2392 | * and Sibling 1 will not be under seccomp at | |
2393 | * all. Sibling 1 will enter seccomp and 0 | |
2394 | * will cause failure. | |
2395 | */ | |
2396 | self->sibling[0].diverge = 1; | |
2397 | tsync_start_sibling(&self->sibling[0]); | |
2398 | tsync_start_sibling(&self->sibling[1]); | |
2399 | ||
2400 | while (self->sibling_count < TSYNC_SIBLINGS) { | |
2401 | sem_wait(&self->started); | |
2402 | self->sibling_count++; | |
2403 | } | |
2404 | ||
2405 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog); | |
b623c4da KC |
2406 | ASSERT_NE(ENOSYS, errno) { |
2407 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2408 | } | |
c99ee51a KC |
2409 | ASSERT_EQ(0, ret) { |
2410 | TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!"); | |
2411 | } | |
2412 | ||
6c045d07 | 2413 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a KC |
2414 | &self->apply_prog); |
2415 | ASSERT_EQ(ret, self->sibling[0].system_tid) { | |
2416 | TH_LOG("Did not fail on diverged sibling."); | |
2417 | } | |
2418 | sib = 1; | |
2419 | if (ret == self->sibling[0].system_tid) | |
2420 | sib = 0; | |
2421 | ||
2422 | pthread_mutex_lock(&self->mutex); | |
2423 | ||
2424 | /* Increment the other siblings num_waits so we can clean up | |
2425 | * the one we just saw. | |
2426 | */ | |
2427 | self->sibling[!sib].num_waits += 1; | |
2428 | ||
2429 | /* Signal the thread to clean up*/ | |
2430 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2431 | TH_LOG("cond broadcast non-zero"); | |
2432 | } | |
2433 | pthread_mutex_unlock(&self->mutex); | |
93bd70e3 | 2434 | PTHREAD_JOIN(self->sibling[sib].tid, &status); |
c99ee51a KC |
2435 | EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); |
2436 | /* Poll for actual task death. pthread_join doesn't guarantee it. */ | |
2437 | while (!kill(self->sibling[sib].system_tid, 0)) | |
2438 | sleep(0.1); | |
2439 | /* Switch to the remaining sibling */ | |
2440 | sib = !sib; | |
2441 | ||
6c045d07 | 2442 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a KC |
2443 | &self->apply_prog); |
2444 | ASSERT_EQ(0, ret) { | |
2445 | TH_LOG("Expected the remaining sibling to sync"); | |
2446 | }; | |
2447 | ||
2448 | pthread_mutex_lock(&self->mutex); | |
2449 | ||
2450 | /* If remaining sibling didn't have a chance to wake up during | |
2451 | * the first broadcast, manually reduce the num_waits now. | |
2452 | */ | |
2453 | if (self->sibling[sib].num_waits > 1) | |
2454 | self->sibling[sib].num_waits = 1; | |
2455 | ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { | |
2456 | TH_LOG("cond broadcast non-zero"); | |
2457 | } | |
2458 | pthread_mutex_unlock(&self->mutex); | |
93bd70e3 | 2459 | PTHREAD_JOIN(self->sibling[sib].tid, &status); |
c99ee51a KC |
2460 | EXPECT_EQ(0, (long)status); |
2461 | /* Poll for actual task death. pthread_join doesn't guarantee it. */ | |
2462 | while (!kill(self->sibling[sib].system_tid, 0)) | |
2463 | sleep(0.1); | |
2464 | ||
6c045d07 | 2465 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, |
c99ee51a KC |
2466 | &self->apply_prog); |
2467 | ASSERT_EQ(0, ret); /* just us chickens */ | |
2468 | } | |
2469 | ||
2470 | /* Make sure restarted syscalls are seen directly as "restart_syscall". */ | |
2471 | TEST(syscall_restart) | |
2472 | { | |
2473 | long ret; | |
2474 | unsigned long msg; | |
2475 | pid_t child_pid; | |
2476 | int pipefd[2]; | |
2477 | int status; | |
2478 | siginfo_t info = { }; | |
2479 | struct sock_filter filter[] = { | |
2480 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
2481 | offsetof(struct seccomp_data, nr)), | |
2482 | ||
2483 | #ifdef __NR_sigreturn | |
2484 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_sigreturn, 6, 0), | |
2485 | #endif | |
2486 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 5, 0), | |
2487 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_exit, 4, 0), | |
2488 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_rt_sigreturn, 3, 0), | |
256d0afb | 2489 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_nanosleep, 4, 0), |
c99ee51a KC |
2490 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_restart_syscall, 4, 0), |
2491 | ||
2492 | /* Allow __NR_write for easy logging. */ | |
2493 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_write, 0, 1), | |
2494 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2495 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
256d0afb KC |
2496 | /* The nanosleep jump target. */ |
2497 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x100), | |
2498 | /* The restart_syscall jump target. */ | |
2499 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x200), | |
c99ee51a KC |
2500 | }; |
2501 | struct sock_fprog prog = { | |
2502 | .len = (unsigned short)ARRAY_SIZE(filter), | |
2503 | .filter = filter, | |
2504 | }; | |
256d0afb KC |
2505 | #if defined(__arm__) |
2506 | struct utsname utsbuf; | |
2507 | #endif | |
c99ee51a KC |
2508 | |
2509 | ASSERT_EQ(0, pipe(pipefd)); | |
2510 | ||
2511 | child_pid = fork(); | |
2512 | ASSERT_LE(0, child_pid); | |
2513 | if (child_pid == 0) { | |
2514 | /* Child uses EXPECT not ASSERT to deliver status correctly. */ | |
2515 | char buf = ' '; | |
256d0afb | 2516 | struct timespec timeout = { }; |
c99ee51a KC |
2517 | |
2518 | /* Attach parent as tracer and stop. */ | |
2519 | EXPECT_EQ(0, ptrace(PTRACE_TRACEME)); | |
2520 | EXPECT_EQ(0, raise(SIGSTOP)); | |
2521 | ||
2522 | EXPECT_EQ(0, close(pipefd[1])); | |
2523 | ||
2524 | EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | |
2525 | TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); | |
2526 | } | |
2527 | ||
2528 | ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); | |
2529 | EXPECT_EQ(0, ret) { | |
2530 | TH_LOG("Failed to install filter!"); | |
2531 | } | |
2532 | ||
2533 | EXPECT_EQ(1, read(pipefd[0], &buf, 1)) { | |
2534 | TH_LOG("Failed to read() sync from parent"); | |
2535 | } | |
2536 | EXPECT_EQ('.', buf) { | |
2537 | TH_LOG("Failed to get sync data from read()"); | |
2538 | } | |
2539 | ||
256d0afb KC |
2540 | /* Start nanosleep to be interrupted. */ |
2541 | timeout.tv_sec = 1; | |
c99ee51a | 2542 | errno = 0; |
256d0afb KC |
2543 | EXPECT_EQ(0, nanosleep(&timeout, NULL)) { |
2544 | TH_LOG("Call to nanosleep() failed (errno %d)", errno); | |
c99ee51a KC |
2545 | } |
2546 | ||
2547 | /* Read final sync from parent. */ | |
2548 | EXPECT_EQ(1, read(pipefd[0], &buf, 1)) { | |
2549 | TH_LOG("Failed final read() from parent"); | |
2550 | } | |
2551 | EXPECT_EQ('!', buf) { | |
2552 | TH_LOG("Failed to get final data from read()"); | |
2553 | } | |
2554 | ||
2555 | /* Directly report the status of our test harness results. */ | |
2556 | syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS | |
2557 | : EXIT_FAILURE); | |
2558 | } | |
2559 | EXPECT_EQ(0, close(pipefd[0])); | |
2560 | ||
2561 | /* Attach to child, setup options, and release. */ | |
2562 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); | |
2563 | ASSERT_EQ(true, WIFSTOPPED(status)); | |
2564 | ASSERT_EQ(0, ptrace(PTRACE_SETOPTIONS, child_pid, NULL, | |
2565 | PTRACE_O_TRACESECCOMP)); | |
2566 | ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); | |
2567 | ASSERT_EQ(1, write(pipefd[1], ".", 1)); | |
2568 | ||
256d0afb | 2569 | /* Wait for nanosleep() to start. */ |
c99ee51a KC |
2570 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); |
2571 | ASSERT_EQ(true, WIFSTOPPED(status)); | |
2572 | ASSERT_EQ(SIGTRAP, WSTOPSIG(status)); | |
2573 | ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16)); | |
2574 | ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg)); | |
2575 | ASSERT_EQ(0x100, msg); | |
256d0afb | 2576 | EXPECT_EQ(__NR_nanosleep, get_syscall(_metadata, child_pid)); |
c99ee51a KC |
2577 | |
2578 | /* Might as well check siginfo for sanity while we're here. */ | |
2579 | ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info)); | |
2580 | ASSERT_EQ(SIGTRAP, info.si_signo); | |
2581 | ASSERT_EQ(SIGTRAP | (PTRACE_EVENT_SECCOMP << 8), info.si_code); | |
2582 | EXPECT_EQ(0, info.si_errno); | |
2583 | EXPECT_EQ(getuid(), info.si_uid); | |
2584 | /* Verify signal delivery came from child (seccomp-triggered). */ | |
2585 | EXPECT_EQ(child_pid, info.si_pid); | |
2586 | ||
256d0afb | 2587 | /* Interrupt nanosleep with SIGSTOP (which we'll need to handle). */ |
c99ee51a KC |
2588 | ASSERT_EQ(0, kill(child_pid, SIGSTOP)); |
2589 | ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); | |
2590 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); | |
2591 | ASSERT_EQ(true, WIFSTOPPED(status)); | |
2592 | ASSERT_EQ(SIGSTOP, WSTOPSIG(status)); | |
2593 | /* Verify signal delivery came from parent now. */ | |
2594 | ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info)); | |
2595 | EXPECT_EQ(getpid(), info.si_pid); | |
2596 | ||
256d0afb | 2597 | /* Restart nanosleep with SIGCONT, which triggers restart_syscall. */ |
c99ee51a KC |
2598 | ASSERT_EQ(0, kill(child_pid, SIGCONT)); |
2599 | ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); | |
2600 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); | |
2601 | ASSERT_EQ(true, WIFSTOPPED(status)); | |
2602 | ASSERT_EQ(SIGCONT, WSTOPSIG(status)); | |
2603 | ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); | |
2604 | ||
2605 | /* Wait for restart_syscall() to start. */ | |
2606 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); | |
2607 | ASSERT_EQ(true, WIFSTOPPED(status)); | |
2608 | ASSERT_EQ(SIGTRAP, WSTOPSIG(status)); | |
2609 | ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16)); | |
2610 | ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg)); | |
256d0afb | 2611 | |
c99ee51a KC |
2612 | ASSERT_EQ(0x200, msg); |
2613 | ret = get_syscall(_metadata, child_pid); | |
2614 | #if defined(__arm__) | |
256d0afb KC |
2615 | /* |
2616 | * FIXME: | |
2617 | * - native ARM registers do NOT expose true syscall. | |
2618 | * - compat ARM registers on ARM64 DO expose true syscall. | |
2619 | */ | |
2620 | ASSERT_EQ(0, uname(&utsbuf)); | |
2621 | if (strncmp(utsbuf.machine, "arm", 3) == 0) { | |
2622 | EXPECT_EQ(__NR_nanosleep, ret); | |
2623 | } else | |
c99ee51a | 2624 | #endif |
256d0afb KC |
2625 | { |
2626 | EXPECT_EQ(__NR_restart_syscall, ret); | |
2627 | } | |
c99ee51a | 2628 | |
256d0afb | 2629 | /* Write again to end test. */ |
c99ee51a KC |
2630 | ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); |
2631 | ASSERT_EQ(1, write(pipefd[1], "!", 1)); | |
2632 | EXPECT_EQ(0, close(pipefd[1])); | |
2633 | ||
2634 | ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); | |
2635 | if (WIFSIGNALED(status) || WEXITSTATUS(status)) | |
2636 | _metadata->passed = 0; | |
2637 | } | |
2638 | ||
e66a3997 TH |
2639 | TEST_SIGNAL(filter_flag_log, SIGSYS) |
2640 | { | |
2641 | struct sock_filter allow_filter[] = { | |
2642 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2643 | }; | |
2644 | struct sock_filter kill_filter[] = { | |
2645 | BPF_STMT(BPF_LD|BPF_W|BPF_ABS, | |
2646 | offsetof(struct seccomp_data, nr)), | |
2647 | BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), | |
2648 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), | |
2649 | BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), | |
2650 | }; | |
2651 | struct sock_fprog allow_prog = { | |
2652 | .len = (unsigned short)ARRAY_SIZE(allow_filter), | |
2653 | .filter = allow_filter, | |
2654 | }; | |
2655 | struct sock_fprog kill_prog = { | |
2656 | .len = (unsigned short)ARRAY_SIZE(kill_filter), | |
2657 | .filter = kill_filter, | |
2658 | }; | |
2659 | long ret; | |
2660 | pid_t parent = getppid(); | |
2661 | ||
2662 | ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | |
2663 | ASSERT_EQ(0, ret); | |
2664 | ||
2665 | /* Verify that the FILTER_FLAG_LOG flag isn't accepted in strict mode */ | |
2666 | ret = seccomp(SECCOMP_SET_MODE_STRICT, SECCOMP_FILTER_FLAG_LOG, | |
2667 | &allow_prog); | |
2668 | ASSERT_NE(ENOSYS, errno) { | |
2669 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2670 | } | |
2671 | EXPECT_NE(0, ret) { | |
2672 | TH_LOG("Kernel accepted FILTER_FLAG_LOG flag in strict mode!"); | |
2673 | } | |
2674 | EXPECT_EQ(EINVAL, errno) { | |
2675 | TH_LOG("Kernel returned unexpected errno for FILTER_FLAG_LOG flag in strict mode!"); | |
2676 | } | |
2677 | ||
2678 | /* Verify that a simple, permissive filter can be added with no flags */ | |
2679 | ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &allow_prog); | |
2680 | EXPECT_EQ(0, ret); | |
2681 | ||
2682 | /* See if the same filter can be added with the FILTER_FLAG_LOG flag */ | |
2683 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG, | |
2684 | &allow_prog); | |
2685 | ASSERT_NE(EINVAL, errno) { | |
2686 | TH_LOG("Kernel does not support the FILTER_FLAG_LOG flag!"); | |
2687 | } | |
2688 | EXPECT_EQ(0, ret); | |
2689 | ||
2690 | /* Ensure that the kill filter works with the FILTER_FLAG_LOG flag */ | |
2691 | ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG, | |
2692 | &kill_prog); | |
2693 | EXPECT_EQ(0, ret); | |
2694 | ||
2695 | EXPECT_EQ(parent, syscall(__NR_getppid)); | |
2696 | /* getpid() should never return. */ | |
2697 | EXPECT_EQ(0, syscall(__NR_getpid)); | |
2698 | } | |
2699 | ||
d612b1fd TH |
2700 | TEST(get_action_avail) |
2701 | { | |
fd76875c | 2702 | __u32 actions[] = { SECCOMP_RET_KILL_THREAD, SECCOMP_RET_TRAP, |
d612b1fd | 2703 | SECCOMP_RET_ERRNO, SECCOMP_RET_TRACE, |
59f5cf44 | 2704 | SECCOMP_RET_LOG, SECCOMP_RET_ALLOW }; |
d612b1fd TH |
2705 | __u32 unknown_action = 0x10000000U; |
2706 | int i; | |
2707 | long ret; | |
2708 | ||
2709 | ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[0]); | |
2710 | ASSERT_NE(ENOSYS, errno) { | |
2711 | TH_LOG("Kernel does not support seccomp syscall!"); | |
2712 | } | |
2713 | ASSERT_NE(EINVAL, errno) { | |
2714 | TH_LOG("Kernel does not support SECCOMP_GET_ACTION_AVAIL operation!"); | |
2715 | } | |
2716 | EXPECT_EQ(ret, 0); | |
2717 | ||
2718 | for (i = 0; i < ARRAY_SIZE(actions); i++) { | |
2719 | ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[i]); | |
2720 | EXPECT_EQ(ret, 0) { | |
2721 | TH_LOG("Expected action (0x%X) not available!", | |
2722 | actions[i]); | |
2723 | } | |
2724 | } | |
2725 | ||
2726 | /* Check that an unknown action is handled properly (EOPNOTSUPP) */ | |
2727 | ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &unknown_action); | |
2728 | EXPECT_EQ(ret, -1); | |
2729 | EXPECT_EQ(errno, EOPNOTSUPP); | |
2730 | } | |
2731 | ||
c99ee51a KC |
2732 | /* |
2733 | * TODO: | |
2734 | * - add microbenchmarks | |
2735 | * - expand NNP testing | |
2736 | * - better arch-specific TRACE and TRAP handlers. | |
2737 | * - endianness checking when appropriate | |
2738 | * - 64-bit arg prodding | |
2739 | * - arch value testing (x86 modes especially) | |
e66a3997 | 2740 | * - verify that FILTER_FLAG_LOG filters generate log messages |
59f5cf44 | 2741 | * - verify that RET_LOG generates log messages |
c99ee51a KC |
2742 | * - ... |
2743 | */ | |
2744 | ||
2745 | TEST_HARNESS_MAIN |