tools/testing/selftests/seccomp/seccomp_bpf.c

   1 /*
   2  * Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
   3  * Use of this source code is governed by the GPLv2 license.
   4  *
   5  * Test code for seccomp bpf.
   6  */
   7
   8 #include <sys/types.h>
   9 #include <asm/siginfo.h>
  10 #define __have_siginfo_t 1
  11 #define __have_sigval_t 1
  12 #define __have_sigevent_t 1
  13
  14 #include <errno.h>
  15 #include <linux/filter.h>
  16 #include <sys/prctl.h>
  17 #include <sys/ptrace.h>
  18 #include <sys/user.h>
  19 #include <linux/prctl.h>
  20 #include <linux/ptrace.h>
  21 #include <linux/seccomp.h>
  22 #include <pthread.h>
  23 #include <semaphore.h>
  24 #include <signal.h>
  25 #include <stddef.h>
  26 #include <stdbool.h>
  27 #include <string.h>
  28 #include <time.h>
  29 #include <linux/elf.h>
  30 #include <sys/uio.h>
  31 #include <sys/utsname.h>
  32 #include <sys/fcntl.h>
  33 #include <sys/mman.h>
  34 #include <sys/times.h>
  35
  36 #define _GNU_SOURCE
  37 #include <unistd.h>
  38 #include <sys/syscall.h>
  39
  40 #include "../kselftest_harness.h"
  41
  42 #ifndef PR_SET_PTRACER
  43 # define PR_SET_PTRACER 0x59616d61
  44 #endif
  45
  46 #ifndef PR_SET_NO_NEW_PRIVS
  47 #define PR_SET_NO_NEW_PRIVS 38
  48 #define PR_GET_NO_NEW_PRIVS 39
  49 #endif
  50
  51 #ifndef PR_SECCOMP_EXT
  52 #define PR_SECCOMP_EXT 43
  53 #endif
  54
  55 #ifndef SECCOMP_EXT_ACT
  56 #define SECCOMP_EXT_ACT 1
  57 #endif
  58
  59 #ifndef SECCOMP_EXT_ACT_TSYNC
  60 #define SECCOMP_EXT_ACT_TSYNC 1
  61 #endif
  62
  63 #ifndef SECCOMP_MODE_STRICT
  64 #define SECCOMP_MODE_STRICT 1
  65 #endif
  66
  67 #ifndef SECCOMP_MODE_FILTER
  68 #define SECCOMP_MODE_FILTER 2
  69 #endif
  70
  71 #ifndef SECCOMP_RET_KILL_THREAD
  72 #define SECCOMP_RET_KILL_THREAD  0x00000000U /* kill the thread */
  73 #endif
  74 #ifndef SECCOMP_RET_KILL
  75 #define SECCOMP_RET_KILL         SECCOMP_RET_KILL_THREAD
  76 #define SECCOMP_RET_TRAP         0x00030000U /* disallow and force a SIGSYS */
  77 #define SECCOMP_RET_ERRNO        0x00050000U /* returns an errno */
  78 #define SECCOMP_RET_TRACE        0x7ff00000U /* pass to a tracer or disallow */
  79 #define SECCOMP_RET_ALLOW        0x7fff0000U /* allow */
  80 #endif
  81 #ifndef SECCOMP_RET_LOG
  82 #define SECCOMP_RET_LOG          0x7ffc0000U /* allow after logging */
  83 #endif
  84
  85 #ifndef SECCOMP_RET_ACTION
  86 /* Masks for the return value sections. */
  87 #define SECCOMP_RET_ACTION      0x7fff0000U
  88 #define SECCOMP_RET_DATA        0x0000ffffU
  89
  90 struct seccomp_data {
  91         int nr;
  92         __u32 arch;
  93         __u64 instruction_pointer;
  94         __u64 args[6];
  95 };
  96 #endif
  97
  98 #if __BYTE_ORDER == __LITTLE_ENDIAN
  99 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
 100 #elif __BYTE_ORDER == __BIG_ENDIAN
 101 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]) + sizeof(__u32))
 102 #else
 103 #error "wut? Unknown __BYTE_ORDER?!"
 104 #endif
 105
 106 #define SIBLING_EXIT_UNKILLED   0xbadbeef
 107 #define SIBLING_EXIT_FAILURE    0xbadface
 108 #define SIBLING_EXIT_NEWPRIVS   0xbadfeed
 109
 110 TEST(mode_strict_support)
 111 {
 112         long ret;
 113
 114         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL);
 115         ASSERT_EQ(0, ret) {
 116                 TH_LOG("Kernel does not support CONFIG_SECCOMP");
 117         }
 118         syscall(__NR_exit, 1);
 119 }
 120
 121 TEST_SIGNAL(mode_strict_cannot_call_prctl, SIGKILL)
 122 {
 123         long ret;
 124
 125         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL);
 126         ASSERT_EQ(0, ret) {
 127                 TH_LOG("Kernel does not support CONFIG_SECCOMP");
 128         }
 129         syscall(__NR_prctl, PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
 130                 NULL, NULL, NULL);
 131         EXPECT_FALSE(true) {
 132                 TH_LOG("Unreachable!");
 133         }
 134 }
 135
 136 /* Note! This doesn't test no new privs behavior */
 137 TEST(no_new_privs_support)
 138 {
 139         long ret;
 140
 141         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 142         EXPECT_EQ(0, ret) {
 143                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
 144         }
 145 }
 146
 147 /* Tests kernel support by checking for a copy_from_user() fault on NULL. */
 148 TEST(mode_filter_support)
 149 {
 150         long ret;
 151
 152         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
 153         ASSERT_EQ(0, ret) {
 154                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
 155         }
 156         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, NULL, NULL);
 157         EXPECT_EQ(-1, ret);
 158         EXPECT_EQ(EFAULT, errno) {
 159                 TH_LOG("Kernel does not support CONFIG_SECCOMP_FILTER!");
 160         }
 161 }
 162
 163 TEST(mode_filter_without_nnp)
 164 {
 165         struct sock_filter filter[] = {
 166                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 167         };
 168         struct sock_fprog prog = {
 169                 .len = (unsigned short)ARRAY_SIZE(filter),
 170                 .filter = filter,
 171         };
 172         long ret;
 173
 174         ret = prctl(PR_GET_NO_NEW_PRIVS, 0, NULL, 0, 0);
 175         ASSERT_LE(0, ret) {
 176                 TH_LOG("Expected 0 or unsupported for NO_NEW_PRIVS");
 177         }
 178         errno = 0;
 179         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 180         /* Succeeds with CAP_SYS_ADMIN, fails without */
 181         /* TODO(wad) check caps not euid */
 182         if (geteuid()) {
 183                 EXPECT_EQ(-1, ret);
 184                 EXPECT_EQ(EACCES, errno);
 185         } else {
 186                 EXPECT_EQ(0, ret);
 187         }
 188 }
 189
 190 #define MAX_INSNS_PER_PATH 32768
 191
 192 TEST(filter_size_limits)
 193 {
 194         int i;
 195         int count = BPF_MAXINSNS + 1;
 196         struct sock_filter allow[] = {
 197                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 198         };
 199         struct sock_filter *filter;
 200         struct sock_fprog prog = { };
 201         long ret;
 202
 203         filter = calloc(count, sizeof(*filter));
 204         ASSERT_NE(NULL, filter);
 205
 206         for (i = 0; i < count; i++)
 207                 filter[i] = allow[0];
 208
 209         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 210         ASSERT_EQ(0, ret);
 211
 212         prog.filter = filter;
 213         prog.len = count;
 214
 215         /* Too many filter instructions in a single filter. */
 216         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 217         ASSERT_NE(0, ret) {
 218                 TH_LOG("Installing %d insn filter was allowed", prog.len);
 219         }
 220
 221         /* One less is okay, though. */
 222         prog.len -= 1;
 223         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 224         ASSERT_EQ(0, ret) {
 225                 TH_LOG("Installing %d insn filter wasn't allowed", prog.len);
 226         }
 227 }
 228
 229 TEST(filter_chain_limits)
 230 {
 231         int i;
 232         int count = BPF_MAXINSNS;
 233         struct sock_filter allow[] = {
 234                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 235         };
 236         struct sock_filter *filter;
 237         struct sock_fprog prog = { };
 238         long ret;
 239
 240         filter = calloc(count, sizeof(*filter));
 241         ASSERT_NE(NULL, filter);
 242
 243         for (i = 0; i < count; i++)
 244                 filter[i] = allow[0];
 245
 246         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 247         ASSERT_EQ(0, ret);
 248
 249         prog.filter = filter;
 250         prog.len = 1;
 251
 252         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 253         ASSERT_EQ(0, ret);
 254
 255         prog.len = count;
 256
 257         /* Too many total filter instructions. */
 258         for (i = 0; i < MAX_INSNS_PER_PATH; i++) {
 259                 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 260                 if (ret != 0)
 261                         break;
 262         }
 263         ASSERT_NE(0, ret) {
 264                 TH_LOG("Allowed %d %d-insn filters (total with penalties:%d)",
 265                        i, count, i * (count + 4));
 266         }
 267 }
 268
 269 TEST(mode_filter_cannot_move_to_strict)
 270 {
 271         struct sock_filter filter[] = {
 272                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 273         };
 274         struct sock_fprog prog = {
 275                 .len = (unsigned short)ARRAY_SIZE(filter),
 276                 .filter = filter,
 277         };
 278         long ret;
 279
 280         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 281         ASSERT_EQ(0, ret);
 282
 283         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 284         ASSERT_EQ(0, ret);
 285
 286         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, 0, 0);
 287         EXPECT_EQ(-1, ret);
 288         EXPECT_EQ(EINVAL, errno);
 289 }
 290
 291
 292 TEST(mode_filter_get_seccomp)
 293 {
 294         struct sock_filter filter[] = {
 295                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 296         };
 297         struct sock_fprog prog = {
 298                 .len = (unsigned short)ARRAY_SIZE(filter),
 299                 .filter = filter,
 300         };
 301         long ret;
 302
 303         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 304         ASSERT_EQ(0, ret);
 305
 306         ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
 307         EXPECT_EQ(0, ret);
 308
 309         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 310         ASSERT_EQ(0, ret);
 311
 312         ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
 313         EXPECT_EQ(2, ret);
 314 }
 315
 316
 317 TEST(ALLOW_all)
 318 {
 319         struct sock_filter filter[] = {
 320                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 321         };
 322         struct sock_fprog prog = {
 323                 .len = (unsigned short)ARRAY_SIZE(filter),
 324                 .filter = filter,
 325         };
 326         long ret;
 327
 328         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 329         ASSERT_EQ(0, ret);
 330
 331         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 332         ASSERT_EQ(0, ret);
 333 }
 334
 335 TEST(empty_prog)
 336 {
 337         struct sock_filter filter[] = {
 338         };
 339         struct sock_fprog prog = {
 340                 .len = (unsigned short)ARRAY_SIZE(filter),
 341                 .filter = filter,
 342         };
 343         long ret;
 344
 345         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 346         ASSERT_EQ(0, ret);
 347
 348         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 349         EXPECT_EQ(-1, ret);
 350         EXPECT_EQ(EINVAL, errno);
 351 }
 352
 353 TEST(log_all)
 354 {
 355         struct sock_filter filter[] = {
 356                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG),
 357         };
 358         struct sock_fprog prog = {
 359                 .len = (unsigned short)ARRAY_SIZE(filter),
 360                 .filter = filter,
 361         };
 362         long ret;
 363         pid_t parent = getppid();
 364
 365         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 366         ASSERT_EQ(0, ret);
 367
 368         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 369         ASSERT_EQ(0, ret);
 370
 371         /* getppid() should succeed and be logged (no check for logging) */
 372         EXPECT_EQ(parent, syscall(__NR_getppid));
 373 }
 374
 375 TEST_SIGNAL(unknown_ret_is_kill_inside, SIGSYS)
 376 {
 377         struct sock_filter filter[] = {
 378                 BPF_STMT(BPF_RET|BPF_K, 0x10000000U),
 379         };
 380         struct sock_fprog prog = {
 381                 .len = (unsigned short)ARRAY_SIZE(filter),
 382                 .filter = filter,
 383         };
 384         long ret;
 385
 386         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 387         ASSERT_EQ(0, ret);
 388
 389         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 390         ASSERT_EQ(0, ret);
 391         EXPECT_EQ(0, syscall(__NR_getpid)) {
 392                 TH_LOG("getpid() shouldn't ever return");
 393         }
 394 }
 395
 396 /* return code >= 0x80000000 is unused. */
 397 TEST_SIGNAL(unknown_ret_is_kill_above_allow, SIGSYS)
 398 {
 399         struct sock_filter filter[] = {
 400                 BPF_STMT(BPF_RET|BPF_K, 0x90000000U),
 401         };
 402         struct sock_fprog prog = {
 403                 .len = (unsigned short)ARRAY_SIZE(filter),
 404                 .filter = filter,
 405         };
 406         long ret;
 407
 408         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 409         ASSERT_EQ(0, ret);
 410
 411         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 412         ASSERT_EQ(0, ret);
 413         EXPECT_EQ(0, syscall(__NR_getpid)) {
 414                 TH_LOG("getpid() shouldn't ever return");
 415         }
 416 }
 417
 418 TEST_SIGNAL(KILL_all, SIGSYS)
 419 {
 420         struct sock_filter filter[] = {
 421                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 422         };
 423         struct sock_fprog prog = {
 424                 .len = (unsigned short)ARRAY_SIZE(filter),
 425                 .filter = filter,
 426         };
 427         long ret;
 428
 429         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 430         ASSERT_EQ(0, ret);
 431
 432         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 433         ASSERT_EQ(0, ret);
 434 }
 435
 436 TEST_SIGNAL(KILL_one, SIGSYS)
 437 {
 438         struct sock_filter filter[] = {
 439                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 440                         offsetof(struct seccomp_data, nr)),
 441                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
 442                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 443                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 444         };
 445         struct sock_fprog prog = {
 446                 .len = (unsigned short)ARRAY_SIZE(filter),
 447                 .filter = filter,
 448         };
 449         long ret;
 450         pid_t parent = getppid();
 451
 452         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 453         ASSERT_EQ(0, ret);
 454
 455         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 456         ASSERT_EQ(0, ret);
 457
 458         EXPECT_EQ(parent, syscall(__NR_getppid));
 459         /* getpid() should never return. */
 460         EXPECT_EQ(0, syscall(__NR_getpid));
 461 }
 462
 463 TEST_SIGNAL(KILL_one_arg_one, SIGSYS)
 464 {
 465         void *fatal_address;
 466         struct sock_filter filter[] = {
 467                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 468                         offsetof(struct seccomp_data, nr)),
 469                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_times, 1, 0),
 470                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 471                 /* Only both with lower 32-bit for now. */
 472                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(0)),
 473                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K,
 474                         (unsigned long)&fatal_address, 0, 1),
 475                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 476                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 477         };
 478         struct sock_fprog prog = {
 479                 .len = (unsigned short)ARRAY_SIZE(filter),
 480                 .filter = filter,
 481         };
 482         long ret;
 483         pid_t parent = getppid();
 484         struct tms timebuf;
 485         clock_t clock = times(&timebuf);
 486
 487         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 488         ASSERT_EQ(0, ret);
 489
 490         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 491         ASSERT_EQ(0, ret);
 492
 493         EXPECT_EQ(parent, syscall(__NR_getppid));
 494         EXPECT_LE(clock, syscall(__NR_times, &timebuf));
 495         /* times() should never return. */
 496         EXPECT_EQ(0, syscall(__NR_times, &fatal_address));
 497 }
 498
 499 TEST_SIGNAL(KILL_one_arg_six, SIGSYS)
 500 {
 501 #ifndef __NR_mmap2
 502         int sysno = __NR_mmap;
 503 #else
 504         int sysno = __NR_mmap2;
 505 #endif
 506         struct sock_filter filter[] = {
 507                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 508                         offsetof(struct seccomp_data, nr)),
 509                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, sysno, 1, 0),
 510                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 511                 /* Only both with lower 32-bit for now. */
 512                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(5)),
 513                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 0x0C0FFEE, 0, 1),
 514                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 515                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 516         };
 517         struct sock_fprog prog = {
 518                 .len = (unsigned short)ARRAY_SIZE(filter),
 519                 .filter = filter,
 520         };
 521         long ret;
 522         pid_t parent = getppid();
 523         int fd;
 524         void *map1, *map2;
 525         int page_size = sysconf(_SC_PAGESIZE);
 526
 527         ASSERT_LT(0, page_size);
 528
 529         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 530         ASSERT_EQ(0, ret);
 531
 532         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 533         ASSERT_EQ(0, ret);
 534
 535         fd = open("/dev/zero", O_RDONLY);
 536         ASSERT_NE(-1, fd);
 537
 538         EXPECT_EQ(parent, syscall(__NR_getppid));
 539         map1 = (void *)syscall(sysno,
 540                 NULL, page_size, PROT_READ, MAP_PRIVATE, fd, page_size);
 541         EXPECT_NE(MAP_FAILED, map1);
 542         /* mmap2() should never return. */
 543         map2 = (void *)syscall(sysno,
 544                  NULL, page_size, PROT_READ, MAP_PRIVATE, fd, 0x0C0FFEE);
 545         EXPECT_EQ(MAP_FAILED, map2);
 546
 547         /* The test failed, so clean up the resources. */
 548         munmap(map1, page_size);
 549         munmap(map2, page_size);
 550         close(fd);
 551 }
 552
 553 /* TODO(wad) add 64-bit versus 32-bit arg tests. */
 554 TEST(arg_out_of_range)
 555 {
 556         struct sock_filter filter[] = {
 557                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(6)),
 558                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 559         };
 560         struct sock_fprog prog = {
 561                 .len = (unsigned short)ARRAY_SIZE(filter),
 562                 .filter = filter,
 563         };
 564         long ret;
 565
 566         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 567         ASSERT_EQ(0, ret);
 568
 569         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 570         EXPECT_EQ(-1, ret);
 571         EXPECT_EQ(EINVAL, errno);
 572 }
 573
 574 #define ERRNO_FILTER(name, errno)                                       \
 575         struct sock_filter _read_filter_##name[] = {                    \
 576                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,                          \
 577                         offsetof(struct seccomp_data, nr)),             \
 578                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),       \
 579                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | errno),     \
 580                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),             \
 581         };                                                              \
 582         struct sock_fprog prog_##name = {                               \
 583                 .len = (unsigned short)ARRAY_SIZE(_read_filter_##name), \
 584                 .filter = _read_filter_##name,                          \
 585         }
 586
 587 /* Make sure basic errno values are correctly passed through a filter. */
 588 TEST(ERRNO_valid)
 589 {
 590         ERRNO_FILTER(valid, E2BIG);
 591         long ret;
 592         pid_t parent = getppid();
 593
 594         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 595         ASSERT_EQ(0, ret);
 596
 597         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_valid);
 598         ASSERT_EQ(0, ret);
 599
 600         EXPECT_EQ(parent, syscall(__NR_getppid));
 601         EXPECT_EQ(-1, read(0, NULL, 0));
 602         EXPECT_EQ(E2BIG, errno);
 603 }
 604
 605 /* Make sure an errno of zero is correctly handled by the arch code. */
 606 TEST(ERRNO_zero)
 607 {
 608         ERRNO_FILTER(zero, 0);
 609         long ret;
 610         pid_t parent = getppid();
 611
 612         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 613         ASSERT_EQ(0, ret);
 614
 615         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_zero);
 616         ASSERT_EQ(0, ret);
 617
 618         EXPECT_EQ(parent, syscall(__NR_getppid));
 619         /* "errno" of 0 is ok. */
 620         EXPECT_EQ(0, read(0, NULL, 0));
 621 }
 622
 623 /*
 624  * The SECCOMP_RET_DATA mask is 16 bits wide, but errno is smaller.
 625  * This tests that the errno value gets capped correctly, fixed by
 626  * 580c57f10768 ("seccomp: cap SECCOMP_RET_ERRNO data to MAX_ERRNO").
 627  */
 628 TEST(ERRNO_capped)
 629 {
 630         ERRNO_FILTER(capped, 4096);
 631         long ret;
 632         pid_t parent = getppid();
 633
 634         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 635         ASSERT_EQ(0, ret);
 636
 637         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_capped);
 638         ASSERT_EQ(0, ret);
 639
 640         EXPECT_EQ(parent, syscall(__NR_getppid));
 641         EXPECT_EQ(-1, read(0, NULL, 0));
 642         EXPECT_EQ(4095, errno);
 643 }
 644
 645 /*
 646  * Filters are processed in reverse order: last applied is executed first.
 647  * Since only the SECCOMP_RET_ACTION mask is tested for return values, the
 648  * SECCOMP_RET_DATA mask results will follow the most recently applied
 649  * matching filter return (and not the lowest or highest value).
 650  */
 651 TEST(ERRNO_order)
 652 {
 653         ERRNO_FILTER(first,  11);
 654         ERRNO_FILTER(second, 13);
 655         ERRNO_FILTER(third,  12);
 656         long ret;
 657         pid_t parent = getppid();
 658
 659         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 660         ASSERT_EQ(0, ret);
 661
 662         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_first);
 663         ASSERT_EQ(0, ret);
 664
 665         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_second);
 666         ASSERT_EQ(0, ret);
 667
 668         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_third);
 669         ASSERT_EQ(0, ret);
 670
 671         EXPECT_EQ(parent, syscall(__NR_getppid));
 672         EXPECT_EQ(-1, read(0, NULL, 0));
 673         EXPECT_EQ(12, errno);
 674 }
 675
 676 FIXTURE_DATA(TRAP) {
 677         struct sock_fprog prog;
 678 };
 679
 680 FIXTURE_SETUP(TRAP)
 681 {
 682         struct sock_filter filter[] = {
 683                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 684                         offsetof(struct seccomp_data, nr)),
 685                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
 686                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
 687                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 688         };
 689
 690         memset(&self->prog, 0, sizeof(self->prog));
 691         self->prog.filter = malloc(sizeof(filter));
 692         ASSERT_NE(NULL, self->prog.filter);
 693         memcpy(self->prog.filter, filter, sizeof(filter));
 694         self->prog.len = (unsigned short)ARRAY_SIZE(filter);
 695 }
 696
 697 FIXTURE_TEARDOWN(TRAP)
 698 {
 699         if (self->prog.filter)
 700                 free(self->prog.filter);
 701 }
 702
 703 TEST_F_SIGNAL(TRAP, dfl, SIGSYS)
 704 {
 705         long ret;
 706
 707         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 708         ASSERT_EQ(0, ret);
 709
 710         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
 711         ASSERT_EQ(0, ret);
 712         syscall(__NR_getpid);
 713 }
 714
 715 /* Ensure that SIGSYS overrides SIG_IGN */
 716 TEST_F_SIGNAL(TRAP, ign, SIGSYS)
 717 {
 718         long ret;
 719
 720         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 721         ASSERT_EQ(0, ret);
 722
 723         signal(SIGSYS, SIG_IGN);
 724
 725         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
 726         ASSERT_EQ(0, ret);
 727         syscall(__NR_getpid);
 728 }
 729
 730 static struct siginfo TRAP_info;
 731 static volatile int TRAP_nr;
 732 static void TRAP_action(int nr, siginfo_t *info, void *void_context)
 733 {
 734         memcpy(&TRAP_info, info, sizeof(TRAP_info));
 735         TRAP_nr = nr;
 736 }
 737
 738 TEST_F(TRAP, handler)
 739 {
 740         int ret, test;
 741         struct sigaction act;
 742         sigset_t mask;
 743
 744         memset(&act, 0, sizeof(act));
 745         sigemptyset(&mask);
 746         sigaddset(&mask, SIGSYS);
 747
 748         act.sa_sigaction = &TRAP_action;
 749         act.sa_flags = SA_SIGINFO;
 750         ret = sigaction(SIGSYS, &act, NULL);
 751         ASSERT_EQ(0, ret) {
 752                 TH_LOG("sigaction failed");
 753         }
 754         ret = sigprocmask(SIG_UNBLOCK, &mask, NULL);
 755         ASSERT_EQ(0, ret) {
 756                 TH_LOG("sigprocmask failed");
 757         }
 758
 759         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 760         ASSERT_EQ(0, ret);
 761         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
 762         ASSERT_EQ(0, ret);
 763         TRAP_nr = 0;
 764         memset(&TRAP_info, 0, sizeof(TRAP_info));
 765         /* Expect the registers to be rolled back. (nr = error) may vary
 766          * based on arch. */
 767         ret = syscall(__NR_getpid);
 768         /* Silence gcc warning about volatile. */
 769         test = TRAP_nr;
 770         EXPECT_EQ(SIGSYS, test);
 771         struct local_sigsys {
 772                 void *_call_addr;       /* calling user insn */
 773                 int _syscall;           /* triggering system call number */
 774                 unsigned int _arch;     /* AUDIT_ARCH_* of syscall */
 775         } *sigsys = (struct local_sigsys *)
 776 #ifdef si_syscall
 777                 &(TRAP_info.si_call_addr);
 778 #else
 779                 &TRAP_info.si_pid;
 780 #endif
 781         EXPECT_EQ(__NR_getpid, sigsys->_syscall);
 782         /* Make sure arch is non-zero. */
 783         EXPECT_NE(0, sigsys->_arch);
 784         EXPECT_NE(0, (unsigned long)sigsys->_call_addr);
 785 }
 786
 787 FIXTURE_DATA(precedence) {
 788         struct sock_fprog allow;
 789         struct sock_fprog log;
 790         struct sock_fprog trace;
 791         struct sock_fprog error;
 792         struct sock_fprog trap;
 793         struct sock_fprog kill;
 794 };
 795
 796 FIXTURE_SETUP(precedence)
 797 {
 798         struct sock_filter allow_insns[] = {
 799                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 800         };
 801         struct sock_filter log_insns[] = {
 802                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 803                         offsetof(struct seccomp_data, nr)),
 804                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
 805                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 806                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG),
 807         };
 808         struct sock_filter trace_insns[] = {
 809                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 810                         offsetof(struct seccomp_data, nr)),
 811                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
 812                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 813                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE),
 814         };
 815         struct sock_filter error_insns[] = {
 816                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 817                         offsetof(struct seccomp_data, nr)),
 818                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
 819                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 820                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO),
 821         };
 822         struct sock_filter trap_insns[] = {
 823                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 824                         offsetof(struct seccomp_data, nr)),
 825                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
 826                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 827                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
 828         };
 829         struct sock_filter kill_insns[] = {
 830                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 831                         offsetof(struct seccomp_data, nr)),
 832                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
 833                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 834                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 835         };
 836
 837         memset(self, 0, sizeof(*self));
 838 #define FILTER_ALLOC(_x) \
 839         self->_x.filter = malloc(sizeof(_x##_insns)); \
 840         ASSERT_NE(NULL, self->_x.filter); \
 841         memcpy(self->_x.filter, &_x##_insns, sizeof(_x##_insns)); \
 842         self->_x.len = (unsigned short)ARRAY_SIZE(_x##_insns)
 843         FILTER_ALLOC(allow);
 844         FILTER_ALLOC(log);
 845         FILTER_ALLOC(trace);
 846         FILTER_ALLOC(error);
 847         FILTER_ALLOC(trap);
 848         FILTER_ALLOC(kill);
 849 }
 850
 851 FIXTURE_TEARDOWN(precedence)
 852 {
 853 #define FILTER_FREE(_x) if (self->_x.filter) free(self->_x.filter)
 854         FILTER_FREE(allow);
 855         FILTER_FREE(log);
 856         FILTER_FREE(trace);
 857         FILTER_FREE(error);
 858         FILTER_FREE(trap);
 859         FILTER_FREE(kill);
 860 }
 861
 862 TEST_F(precedence, allow_ok)
 863 {
 864         pid_t parent, res = 0;
 865         long ret;
 866
 867         parent = getppid();
 868         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 869         ASSERT_EQ(0, ret);
 870
 871         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 872         ASSERT_EQ(0, ret);
 873         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
 874         ASSERT_EQ(0, ret);
 875         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 876         ASSERT_EQ(0, ret);
 877         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
 878         ASSERT_EQ(0, ret);
 879         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
 880         ASSERT_EQ(0, ret);
 881         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
 882         ASSERT_EQ(0, ret);
 883         /* Should work just fine. */
 884         res = syscall(__NR_getppid);
 885         EXPECT_EQ(parent, res);
 886 }
 887
 888 TEST_F_SIGNAL(precedence, kill_is_highest, SIGSYS)
 889 {
 890         pid_t parent, res = 0;
 891         long ret;
 892
 893         parent = getppid();
 894         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 895         ASSERT_EQ(0, ret);
 896
 897         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 898         ASSERT_EQ(0, ret);
 899         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
 900         ASSERT_EQ(0, ret);
 901         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 902         ASSERT_EQ(0, ret);
 903         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
 904         ASSERT_EQ(0, ret);
 905         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
 906         ASSERT_EQ(0, ret);
 907         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
 908         ASSERT_EQ(0, ret);
 909         /* Should work just fine. */
 910         res = syscall(__NR_getppid);
 911         EXPECT_EQ(parent, res);
 912         /* getpid() should never return. */
 913         res = syscall(__NR_getpid);
 914         EXPECT_EQ(0, res);
 915 }
 916
 917 TEST_F_SIGNAL(precedence, kill_is_highest_in_any_order, SIGSYS)
 918 {
 919         pid_t parent;
 920         long ret;
 921
 922         parent = getppid();
 923         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 924         ASSERT_EQ(0, ret);
 925
 926         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 927         ASSERT_EQ(0, ret);
 928         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
 929         ASSERT_EQ(0, ret);
 930         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
 931         ASSERT_EQ(0, ret);
 932         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
 933         ASSERT_EQ(0, ret);
 934         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 935         ASSERT_EQ(0, ret);
 936         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
 937         ASSERT_EQ(0, ret);
 938         /* Should work just fine. */
 939         EXPECT_EQ(parent, syscall(__NR_getppid));
 940         /* getpid() should never return. */
 941         EXPECT_EQ(0, syscall(__NR_getpid));
 942 }
 943
 944 TEST_F_SIGNAL(precedence, trap_is_second, SIGSYS)
 945 {
 946         pid_t parent;
 947         long ret;
 948
 949         parent = getppid();
 950         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 951         ASSERT_EQ(0, ret);
 952
 953         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 954         ASSERT_EQ(0, ret);
 955         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
 956         ASSERT_EQ(0, ret);
 957         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 958         ASSERT_EQ(0, ret);
 959         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
 960         ASSERT_EQ(0, ret);
 961         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
 962         ASSERT_EQ(0, ret);
 963         /* Should work just fine. */
 964         EXPECT_EQ(parent, syscall(__NR_getppid));
 965         /* getpid() should never return. */
 966         EXPECT_EQ(0, syscall(__NR_getpid));
 967 }
 968
 969 TEST_F_SIGNAL(precedence, trap_is_second_in_any_order, SIGSYS)
 970 {
 971         pid_t parent;
 972         long ret;
 973
 974         parent = getppid();
 975         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 976         ASSERT_EQ(0, ret);
 977
 978         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 979         ASSERT_EQ(0, ret);
 980         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
 981         ASSERT_EQ(0, ret);
 982         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
 983         ASSERT_EQ(0, ret);
 984         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 985         ASSERT_EQ(0, ret);
 986         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
 987         ASSERT_EQ(0, ret);
 988         /* Should work just fine. */
 989         EXPECT_EQ(parent, syscall(__NR_getppid));
 990         /* getpid() should never return. */
 991         EXPECT_EQ(0, syscall(__NR_getpid));
 992 }
 993
 994 TEST_F(precedence, errno_is_third)
 995 {
 996         pid_t parent;
 997         long ret;
 998
 999         parent = getppid();
1000         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1001         ASSERT_EQ(0, ret);
1002
1003         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1004         ASSERT_EQ(0, ret);
1005         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1006         ASSERT_EQ(0, ret);
1007         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1008         ASSERT_EQ(0, ret);
1009         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1010         ASSERT_EQ(0, ret);
1011         /* Should work just fine. */
1012         EXPECT_EQ(parent, syscall(__NR_getppid));
1013         EXPECT_EQ(0, syscall(__NR_getpid));
1014 }
1015
1016 TEST_F(precedence, errno_is_third_in_any_order)
1017 {
1018         pid_t parent;
1019         long ret;
1020
1021         parent = getppid();
1022         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1023         ASSERT_EQ(0, ret);
1024
1025         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1026         ASSERT_EQ(0, ret);
1027         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1028         ASSERT_EQ(0, ret);
1029         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1030         ASSERT_EQ(0, ret);
1031         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1032         ASSERT_EQ(0, ret);
1033         /* Should work just fine. */
1034         EXPECT_EQ(parent, syscall(__NR_getppid));
1035         EXPECT_EQ(0, syscall(__NR_getpid));
1036 }
1037
1038 TEST_F(precedence, trace_is_fourth)
1039 {
1040         pid_t parent;
1041         long ret;
1042
1043         parent = getppid();
1044         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1045         ASSERT_EQ(0, ret);
1046
1047         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1048         ASSERT_EQ(0, ret);
1049         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1050         ASSERT_EQ(0, ret);
1051         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1052         ASSERT_EQ(0, ret);
1053         /* Should work just fine. */
1054         EXPECT_EQ(parent, syscall(__NR_getppid));
1055         /* No ptracer */
1056         EXPECT_EQ(-1, syscall(__NR_getpid));
1057 }
1058
1059 TEST_F(precedence, trace_is_fourth_in_any_order)
1060 {
1061         pid_t parent;
1062         long ret;
1063
1064         parent = getppid();
1065         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1066         ASSERT_EQ(0, ret);
1067
1068         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1069         ASSERT_EQ(0, ret);
1070         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1071         ASSERT_EQ(0, ret);
1072         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1073         ASSERT_EQ(0, ret);
1074         /* Should work just fine. */
1075         EXPECT_EQ(parent, syscall(__NR_getppid));
1076         /* No ptracer */
1077         EXPECT_EQ(-1, syscall(__NR_getpid));
1078 }
1079
1080 TEST_F(precedence, log_is_fifth)
1081 {
1082         pid_t mypid, parent;
1083         long ret;
1084
1085         mypid = getpid();
1086         parent = getppid();
1087         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1088         ASSERT_EQ(0, ret);
1089
1090         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1091         ASSERT_EQ(0, ret);
1092         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1093         ASSERT_EQ(0, ret);
1094         /* Should work just fine. */
1095         EXPECT_EQ(parent, syscall(__NR_getppid));
1096         /* Should also work just fine */
1097         EXPECT_EQ(mypid, syscall(__NR_getpid));
1098 }
1099
1100 TEST_F(precedence, log_is_fifth_in_any_order)
1101 {
1102         pid_t mypid, parent;
1103         long ret;
1104
1105         mypid = getpid();
1106         parent = getppid();
1107         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1108         ASSERT_EQ(0, ret);
1109
1110         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1111         ASSERT_EQ(0, ret);
1112         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1113         ASSERT_EQ(0, ret);
1114         /* Should work just fine. */
1115         EXPECT_EQ(parent, syscall(__NR_getppid));
1116         /* Should also work just fine */
1117         EXPECT_EQ(mypid, syscall(__NR_getpid));
1118 }
1119
1120 #ifndef PTRACE_O_TRACESECCOMP
1121 #define PTRACE_O_TRACESECCOMP   0x00000080
1122 #endif
1123
1124 /* Catch the Ubuntu 12.04 value error. */
1125 #if PTRACE_EVENT_SECCOMP != 7
1126 #undef PTRACE_EVENT_SECCOMP
1127 #endif
1128
1129 #ifndef PTRACE_EVENT_SECCOMP
1130 #define PTRACE_EVENT_SECCOMP 7
1131 #endif
1132
1133 #define IS_SECCOMP_EVENT(status) ((status >> 16) == PTRACE_EVENT_SECCOMP)
1134 bool tracer_running;
1135 void tracer_stop(int sig)
1136 {
1137         tracer_running = false;
1138 }
1139
1140 typedef void tracer_func_t(struct __test_metadata *_metadata,
1141                            pid_t tracee, int status, void *args);
1142
1143 void start_tracer(struct __test_metadata *_metadata, int fd, pid_t tracee,
1144             tracer_func_t tracer_func, void *args, bool ptrace_syscall)
1145 {
1146         int ret = -1;
1147         struct sigaction action = {
1148                 .sa_handler = tracer_stop,
1149         };
1150
1151         /* Allow external shutdown. */
1152         tracer_running = true;
1153         ASSERT_EQ(0, sigaction(SIGUSR1, &action, NULL));
1154
1155         errno = 0;
1156         while (ret == -1 && errno != EINVAL)
1157                 ret = ptrace(PTRACE_ATTACH, tracee, NULL, 0);
1158         ASSERT_EQ(0, ret) {
1159                 kill(tracee, SIGKILL);
1160         }
1161         /* Wait for attach stop */
1162         wait(NULL);
1163
1164         ret = ptrace(PTRACE_SETOPTIONS, tracee, NULL, ptrace_syscall ?
1165                                                       PTRACE_O_TRACESYSGOOD :
1166                                                       PTRACE_O_TRACESECCOMP);
1167         ASSERT_EQ(0, ret) {
1168                 TH_LOG("Failed to set PTRACE_O_TRACESECCOMP");
1169                 kill(tracee, SIGKILL);
1170         }
1171         ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT,
1172                      tracee, NULL, 0);
1173         ASSERT_EQ(0, ret);
1174
1175         /* Unblock the tracee */
1176         ASSERT_EQ(1, write(fd, "A", 1));
1177         ASSERT_EQ(0, close(fd));
1178
1179         /* Run until we're shut down. Must assert to stop execution. */
1180         while (tracer_running) {
1181                 int status;
1182
1183                 if (wait(&status) != tracee)
1184                         continue;
1185                 if (WIFSIGNALED(status) || WIFEXITED(status))
1186                         /* Child is dead. Time to go. */
1187                         return;
1188
1189                 /* Check if this is a seccomp event. */
1190                 ASSERT_EQ(!ptrace_syscall, IS_SECCOMP_EVENT(status));
1191
1192                 tracer_func(_metadata, tracee, status, args);
1193
1194                 ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT,
1195                              tracee, NULL, 0);
1196                 ASSERT_EQ(0, ret);
1197         }
1198         /* Directly report the status of our test harness results. */
1199         syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);
1200 }
1201
1202 /* Common tracer setup/teardown functions. */
1203 void cont_handler(int num)
1204 { }
1205 pid_t setup_trace_fixture(struct __test_metadata *_metadata,
1206                           tracer_func_t func, void *args, bool ptrace_syscall)
1207 {
1208         char sync;
1209         int pipefd[2];
1210         pid_t tracer_pid;
1211         pid_t tracee = getpid();
1212
1213         /* Setup a pipe for clean synchronization. */
1214         ASSERT_EQ(0, pipe(pipefd));
1215
1216         /* Fork a child which we'll promote to tracer */
1217         tracer_pid = fork();
1218         ASSERT_LE(0, tracer_pid);
1219         signal(SIGALRM, cont_handler);
1220         if (tracer_pid == 0) {
1221                 close(pipefd[0]);
1222                 start_tracer(_metadata, pipefd[1], tracee, func, args,
1223                              ptrace_syscall);
1224                 syscall(__NR_exit, 0);
1225         }
1226         close(pipefd[1]);
1227         prctl(PR_SET_PTRACER, tracer_pid, 0, 0, 0);
1228         read(pipefd[0], &sync, 1);
1229         close(pipefd[0]);
1230
1231         return tracer_pid;
1232 }
1233 void teardown_trace_fixture(struct __test_metadata *_metadata,
1234                             pid_t tracer)
1235 {
1236         if (tracer) {
1237                 int status;
1238                 /*
1239                  * Extract the exit code from the other process and
1240                  * adopt it for ourselves in case its asserts failed.
1241                  */
1242                 ASSERT_EQ(0, kill(tracer, SIGUSR1));
1243                 ASSERT_EQ(tracer, waitpid(tracer, &status, 0));
1244                 if (WEXITSTATUS(status))
1245                         _metadata->passed = 0;
1246         }
1247 }
1248
1249 /* "poke" tracer arguments and function. */
1250 struct tracer_args_poke_t {
1251         unsigned long poke_addr;
1252 };
1253
1254 void tracer_poke(struct __test_metadata *_metadata, pid_t tracee, int status,
1255                  void *args)
1256 {
1257         int ret;
1258         unsigned long msg;
1259         struct tracer_args_poke_t *info = (struct tracer_args_poke_t *)args;
1260
1261         ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
1262         EXPECT_EQ(0, ret);
1263         /* If this fails, don't try to recover. */
1264         ASSERT_EQ(0x1001, msg) {
1265                 kill(tracee, SIGKILL);
1266         }
1267         /*
1268          * Poke in the message.
1269          * Registers are not touched to try to keep this relatively arch
1270          * agnostic.
1271          */
1272         ret = ptrace(PTRACE_POKEDATA, tracee, info->poke_addr, 0x1001);
1273         EXPECT_EQ(0, ret);
1274 }
1275
1276 FIXTURE_DATA(TRACE_poke) {
1277         struct sock_fprog prog;
1278         pid_t tracer;
1279         long poked;
1280         struct tracer_args_poke_t tracer_args;
1281 };
1282
1283 FIXTURE_SETUP(TRACE_poke)
1284 {
1285         struct sock_filter filter[] = {
1286                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1287                         offsetof(struct seccomp_data, nr)),
1288                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
1289                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1001),
1290                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1291         };
1292
1293         self->poked = 0;
1294         memset(&self->prog, 0, sizeof(self->prog));
1295         self->prog.filter = malloc(sizeof(filter));
1296         ASSERT_NE(NULL, self->prog.filter);
1297         memcpy(self->prog.filter, filter, sizeof(filter));
1298         self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1299
1300         /* Set up tracer args. */
1301         self->tracer_args.poke_addr = (unsigned long)&self->poked;
1302
1303         /* Launch tracer. */
1304         self->tracer = setup_trace_fixture(_metadata, tracer_poke,
1305                                            &self->tracer_args, false);
1306 }
1307
1308 FIXTURE_TEARDOWN(TRACE_poke)
1309 {
1310         teardown_trace_fixture(_metadata, self->tracer);
1311         if (self->prog.filter)
1312                 free(self->prog.filter);
1313 }
1314
1315 TEST_F(TRACE_poke, read_has_side_effects)
1316 {
1317         ssize_t ret;
1318
1319         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1320         ASSERT_EQ(0, ret);
1321
1322         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1323         ASSERT_EQ(0, ret);
1324
1325         EXPECT_EQ(0, self->poked);
1326         ret = read(-1, NULL, 0);
1327         EXPECT_EQ(-1, ret);
1328         EXPECT_EQ(0x1001, self->poked);
1329 }
1330
1331 TEST_F(TRACE_poke, getpid_runs_normally)
1332 {
1333         long ret;
1334
1335         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1336         ASSERT_EQ(0, ret);
1337
1338         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1339         ASSERT_EQ(0, ret);
1340
1341         EXPECT_EQ(0, self->poked);
1342         EXPECT_NE(0, syscall(__NR_getpid));
1343         EXPECT_EQ(0, self->poked);
1344 }
1345
1346 #if defined(__x86_64__)
1347 # define ARCH_REGS      struct user_regs_struct
1348 # define SYSCALL_NUM    orig_rax
1349 # define SYSCALL_RET    rax
1350 #elif defined(__i386__)
1351 # define ARCH_REGS      struct user_regs_struct
1352 # define SYSCALL_NUM    orig_eax
1353 # define SYSCALL_RET    eax
1354 #elif defined(__arm__)
1355 # define ARCH_REGS      struct pt_regs
1356 # define SYSCALL_NUM    ARM_r7
1357 # define SYSCALL_RET    ARM_r0
1358 #elif defined(__aarch64__)
1359 # define ARCH_REGS      struct user_pt_regs
1360 # define SYSCALL_NUM    regs[8]
1361 # define SYSCALL_RET    regs[0]
1362 #elif defined(__hppa__)
1363 # define ARCH_REGS      struct user_regs_struct
1364 # define SYSCALL_NUM    gr[20]
1365 # define SYSCALL_RET    gr[28]
1366 #elif defined(__powerpc__)
1367 # define ARCH_REGS      struct pt_regs
1368 # define SYSCALL_NUM    gpr[0]
1369 # define SYSCALL_RET    gpr[3]
1370 #elif defined(__s390__)
1371 # define ARCH_REGS     s390_regs
1372 # define SYSCALL_NUM   gprs[2]
1373 # define SYSCALL_RET   gprs[2]
1374 #elif defined(__mips__)
1375 # define ARCH_REGS      struct pt_regs
1376 # define SYSCALL_NUM    regs[2]
1377 # define SYSCALL_SYSCALL_NUM regs[4]
1378 # define SYSCALL_RET    regs[2]
1379 # define SYSCALL_NUM_RET_SHARE_REG
1380 #else
1381 # error "Do not know how to find your architecture's registers and syscalls"
1382 #endif
1383
1384 /* When the syscall return can't be changed, stub out the tests for it. */
1385 #ifdef SYSCALL_NUM_RET_SHARE_REG
1386 # define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(-1, action)
1387 #else
1388 # define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(val, action)
1389 #endif
1390
1391 /* Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
1392  * architectures without HAVE_ARCH_TRACEHOOK (e.g. User-mode Linux).
1393  */
1394 #if defined(__x86_64__) || defined(__i386__) || defined(__mips__)
1395 #define HAVE_GETREGS
1396 #endif
1397
1398 /* Architecture-specific syscall fetching routine. */
1399 int get_syscall(struct __test_metadata *_metadata, pid_t tracee)
1400 {
1401         ARCH_REGS regs;
1402 #ifdef HAVE_GETREGS
1403         EXPECT_EQ(0, ptrace(PTRACE_GETREGS, tracee, 0, &regs)) {
1404                 TH_LOG("PTRACE_GETREGS failed");
1405                 return -1;
1406         }
1407 #else
1408         struct iovec iov;
1409
1410         iov.iov_base = &regs;
1411         iov.iov_len = sizeof(regs);
1412         EXPECT_EQ(0, ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &iov)) {
1413                 TH_LOG("PTRACE_GETREGSET failed");
1414                 return -1;
1415         }
1416 #endif
1417
1418 #if defined(__mips__)
1419         if (regs.SYSCALL_NUM == __NR_O32_Linux)
1420                 return regs.SYSCALL_SYSCALL_NUM;
1421 #endif
1422         return regs.SYSCALL_NUM;
1423 }
1424
1425 /* Architecture-specific syscall changing routine. */
1426 void change_syscall(struct __test_metadata *_metadata,
1427                     pid_t tracee, int syscall)
1428 {
1429         int ret;
1430         ARCH_REGS regs;
1431 #ifdef HAVE_GETREGS
1432         ret = ptrace(PTRACE_GETREGS, tracee, 0, &regs);
1433 #else
1434         struct iovec iov;
1435         iov.iov_base = &regs;
1436         iov.iov_len = sizeof(regs);
1437         ret = ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &iov);
1438 #endif
1439         EXPECT_EQ(0, ret) {}
1440
1441 #if defined(__x86_64__) || defined(__i386__) || defined(__powerpc__) || \
1442     defined(__s390__) || defined(__hppa__)
1443         {
1444                 regs.SYSCALL_NUM = syscall;
1445         }
1446 #elif defined(__mips__)
1447         {
1448                 if (regs.SYSCALL_NUM == __NR_O32_Linux)
1449                         regs.SYSCALL_SYSCALL_NUM = syscall;
1450                 else
1451                         regs.SYSCALL_NUM = syscall;
1452         }
1453
1454 #elif defined(__arm__)
1455 # ifndef PTRACE_SET_SYSCALL
1456 #  define PTRACE_SET_SYSCALL   23
1457 # endif
1458         {
1459                 ret = ptrace(PTRACE_SET_SYSCALL, tracee, NULL, syscall);
1460                 EXPECT_EQ(0, ret);
1461         }
1462
1463 #elif defined(__aarch64__)
1464 # ifndef NT_ARM_SYSTEM_CALL
1465 #  define NT_ARM_SYSTEM_CALL 0x404
1466 # endif
1467         {
1468                 iov.iov_base = &syscall;
1469                 iov.iov_len = sizeof(syscall);
1470                 ret = ptrace(PTRACE_SETREGSET, tracee, NT_ARM_SYSTEM_CALL,
1471                              &iov);
1472                 EXPECT_EQ(0, ret);
1473         }
1474
1475 #else
1476         ASSERT_EQ(1, 0) {
1477                 TH_LOG("How is the syscall changed on this architecture?");
1478         }
1479 #endif
1480
1481         /* If syscall is skipped, change return value. */
1482         if (syscall == -1)
1483 #ifdef SYSCALL_NUM_RET_SHARE_REG
1484                 TH_LOG("Can't modify syscall return on this architecture");
1485 #else
1486                 regs.SYSCALL_RET = EPERM;
1487 #endif
1488
1489 #ifdef HAVE_GETREGS
1490         ret = ptrace(PTRACE_SETREGS, tracee, 0, &regs);
1491 #else
1492         iov.iov_base = &regs;
1493         iov.iov_len = sizeof(regs);
1494         ret = ptrace(PTRACE_SETREGSET, tracee, NT_PRSTATUS, &iov);
1495 #endif
1496         EXPECT_EQ(0, ret);
1497 }
1498
1499 void tracer_syscall(struct __test_metadata *_metadata, pid_t tracee,
1500                     int status, void *args)
1501 {
1502         int ret;
1503         unsigned long msg;
1504
1505         /* Make sure we got the right message. */
1506         ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
1507         EXPECT_EQ(0, ret);
1508
1509         /* Validate and take action on expected syscalls. */
1510         switch (msg) {
1511         case 0x1002:
1512                 /* change getpid to getppid. */
1513                 EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee));
1514                 change_syscall(_metadata, tracee, __NR_getppid);
1515                 break;
1516         case 0x1003:
1517                 /* skip gettid. */
1518                 EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee));
1519                 change_syscall(_metadata, tracee, -1);
1520                 break;
1521         case 0x1004:
1522                 /* do nothing (allow getppid) */
1523                 EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee));
1524                 break;
1525         default:
1526                 EXPECT_EQ(0, msg) {
1527                         TH_LOG("Unknown PTRACE_GETEVENTMSG: 0x%lx", msg);
1528                         kill(tracee, SIGKILL);
1529                 }
1530         }
1531
1532 }
1533
1534 void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
1535                    int status, void *args)
1536 {
1537         int ret, nr;
1538         unsigned long msg;
1539         static bool entry;
1540
1541         /* Make sure we got an empty message. */
1542         ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
1543         EXPECT_EQ(0, ret);
1544         EXPECT_EQ(0, msg);
1545
1546         /* The only way to tell PTRACE_SYSCALL entry/exit is by counting. */
1547         entry = !entry;
1548         if (!entry)
1549                 return;
1550
1551         nr = get_syscall(_metadata, tracee);
1552
1553         if (nr == __NR_getpid)
1554                 change_syscall(_metadata, tracee, __NR_getppid);
1555         if (nr == __NR_open)
1556                 change_syscall(_metadata, tracee, -1);
1557 }
1558
1559 FIXTURE_DATA(TRACE_syscall) {
1560         struct sock_fprog prog;
1561         pid_t tracer, mytid, mypid, parent;
1562 };
1563
1564 FIXTURE_SETUP(TRACE_syscall)
1565 {
1566         struct sock_filter filter[] = {
1567                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1568                         offsetof(struct seccomp_data, nr)),
1569                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
1570                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002),
1571                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1),
1572                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003),
1573                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
1574                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004),
1575                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1576         };
1577
1578         memset(&self->prog, 0, sizeof(self->prog));
1579         self->prog.filter = malloc(sizeof(filter));
1580         ASSERT_NE(NULL, self->prog.filter);
1581         memcpy(self->prog.filter, filter, sizeof(filter));
1582         self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1583
1584         /* Prepare some testable syscall results. */
1585         self->mytid = syscall(__NR_gettid);
1586         ASSERT_GT(self->mytid, 0);
1587         ASSERT_NE(self->mytid, 1) {
1588                 TH_LOG("Running this test as init is not supported. :)");
1589         }
1590
1591         self->mypid = getpid();
1592         ASSERT_GT(self->mypid, 0);
1593         ASSERT_EQ(self->mytid, self->mypid);
1594
1595         self->parent = getppid();
1596         ASSERT_GT(self->parent, 0);
1597         ASSERT_NE(self->parent, self->mypid);
1598
1599         /* Launch tracer. */
1600         self->tracer = setup_trace_fixture(_metadata, tracer_syscall, NULL,
1601                                            false);
1602 }
1603
1604 FIXTURE_TEARDOWN(TRACE_syscall)
1605 {
1606         teardown_trace_fixture(_metadata, self->tracer);
1607         if (self->prog.filter)
1608                 free(self->prog.filter);
1609 }
1610
1611 TEST_F(TRACE_syscall, ptrace_syscall_redirected)
1612 {
1613         /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
1614         teardown_trace_fixture(_metadata, self->tracer);
1615         self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
1616                                            true);
1617
1618         /* Tracer will redirect getpid to getppid. */
1619         EXPECT_NE(self->mypid, syscall(__NR_getpid));
1620 }
1621
1622 TEST_F(TRACE_syscall, ptrace_syscall_dropped)
1623 {
1624         /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
1625         teardown_trace_fixture(_metadata, self->tracer);
1626         self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
1627                                            true);
1628
1629         /* Tracer should skip the open syscall, resulting in EPERM. */
1630         EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_open));
1631 }
1632
1633 TEST_F(TRACE_syscall, syscall_allowed)
1634 {
1635         long ret;
1636
1637         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1638         ASSERT_EQ(0, ret);
1639
1640         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1641         ASSERT_EQ(0, ret);
1642
1643         /* getppid works as expected (no changes). */
1644         EXPECT_EQ(self->parent, syscall(__NR_getppid));
1645         EXPECT_NE(self->mypid, syscall(__NR_getppid));
1646 }
1647
1648 TEST_F(TRACE_syscall, syscall_redirected)
1649 {
1650         long ret;
1651
1652         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1653         ASSERT_EQ(0, ret);
1654
1655         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1656         ASSERT_EQ(0, ret);
1657
1658         /* getpid has been redirected to getppid as expected. */
1659         EXPECT_EQ(self->parent, syscall(__NR_getpid));
1660         EXPECT_NE(self->mypid, syscall(__NR_getpid));
1661 }
1662
1663 TEST_F(TRACE_syscall, syscall_dropped)
1664 {
1665         long ret;
1666
1667         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1668         ASSERT_EQ(0, ret);
1669
1670         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1671         ASSERT_EQ(0, ret);
1672
1673         /* gettid has been skipped and an altered return value stored. */
1674         EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_gettid));
1675         EXPECT_NE(self->mytid, syscall(__NR_gettid));
1676 }
1677
1678 TEST_F(TRACE_syscall, skip_after_RET_TRACE)
1679 {
1680         struct sock_filter filter[] = {
1681                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1682                         offsetof(struct seccomp_data, nr)),
1683                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
1684                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EPERM),
1685                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1686         };
1687         struct sock_fprog prog = {
1688                 .len = (unsigned short)ARRAY_SIZE(filter),
1689                 .filter = filter,
1690         };
1691         long ret;
1692
1693         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1694         ASSERT_EQ(0, ret);
1695
1696         /* Install fixture filter. */
1697         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1698         ASSERT_EQ(0, ret);
1699
1700         /* Install "errno on getppid" filter. */
1701         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
1702         ASSERT_EQ(0, ret);
1703
1704         /* Tracer will redirect getpid to getppid, and we should see EPERM. */
1705         errno = 0;
1706         EXPECT_EQ(-1, syscall(__NR_getpid));
1707         EXPECT_EQ(EPERM, errno);
1708 }
1709
1710 TEST_F_SIGNAL(TRACE_syscall, kill_after_RET_TRACE, SIGSYS)
1711 {
1712         struct sock_filter filter[] = {
1713                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1714                         offsetof(struct seccomp_data, nr)),
1715                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
1716                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
1717                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1718         };
1719         struct sock_fprog prog = {
1720                 .len = (unsigned short)ARRAY_SIZE(filter),
1721                 .filter = filter,
1722         };
1723         long ret;
1724
1725         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1726         ASSERT_EQ(0, ret);
1727
1728         /* Install fixture filter. */
1729         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1730         ASSERT_EQ(0, ret);
1731
1732         /* Install "death on getppid" filter. */
1733         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
1734         ASSERT_EQ(0, ret);
1735
1736         /* Tracer will redirect getpid to getppid, and we should die. */
1737         EXPECT_NE(self->mypid, syscall(__NR_getpid));
1738 }
1739
1740 TEST_F(TRACE_syscall, skip_after_ptrace)
1741 {
1742         struct sock_filter filter[] = {
1743                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1744                         offsetof(struct seccomp_data, nr)),
1745                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
1746                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EPERM),
1747                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1748         };
1749         struct sock_fprog prog = {
1750                 .len = (unsigned short)ARRAY_SIZE(filter),
1751                 .filter = filter,
1752         };
1753         long ret;
1754
1755         /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
1756         teardown_trace_fixture(_metadata, self->tracer);
1757         self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
1758                                            true);
1759
1760         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1761         ASSERT_EQ(0, ret);
1762
1763         /* Install "errno on getppid" filter. */
1764         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
1765         ASSERT_EQ(0, ret);
1766
1767         /* Tracer will redirect getpid to getppid, and we should see EPERM. */
1768         EXPECT_EQ(-1, syscall(__NR_getpid));
1769         EXPECT_EQ(EPERM, errno);
1770 }
1771
1772 TEST_F_SIGNAL(TRACE_syscall, kill_after_ptrace, SIGSYS)
1773 {
1774         struct sock_filter filter[] = {
1775                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1776                         offsetof(struct seccomp_data, nr)),
1777                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
1778                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
1779                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1780         };
1781         struct sock_fprog prog = {
1782                 .len = (unsigned short)ARRAY_SIZE(filter),
1783                 .filter = filter,
1784         };
1785         long ret;
1786
1787         /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
1788         teardown_trace_fixture(_metadata, self->tracer);
1789         self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
1790                                            true);
1791
1792         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1793         ASSERT_EQ(0, ret);
1794
1795         /* Install "death on getppid" filter. */
1796         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
1797         ASSERT_EQ(0, ret);
1798
1799         /* Tracer will redirect getpid to getppid, and we should die. */
1800         EXPECT_NE(self->mypid, syscall(__NR_getpid));
1801 }
1802
1803 #ifndef __NR_seccomp
1804 # if defined(__i386__)
1805 #  define __NR_seccomp 354
1806 # elif defined(__x86_64__)
1807 #  define __NR_seccomp 317
1808 # elif defined(__arm__)
1809 #  define __NR_seccomp 383
1810 # elif defined(__aarch64__)
1811 #  define __NR_seccomp 277
1812 # elif defined(__hppa__)
1813 #  define __NR_seccomp 338
1814 # elif defined(__powerpc__)
1815 #  define __NR_seccomp 358
1816 # elif defined(__s390__)
1817 #  define __NR_seccomp 348
1818 # else
1819 #  warning "seccomp syscall number unknown for this architecture"
1820 #  define __NR_seccomp 0xffff
1821 # endif
1822 #endif
1823
1824 #ifndef SECCOMP_SET_MODE_STRICT
1825 #define SECCOMP_SET_MODE_STRICT 0
1826 #endif
1827
1828 #ifndef SECCOMP_SET_MODE_FILTER
1829 #define SECCOMP_SET_MODE_FILTER 1
1830 #endif
1831
1832 #ifndef SECCOMP_GET_ACTION_AVAIL
1833 #define SECCOMP_GET_ACTION_AVAIL 2
1834 #endif
1835
1836 #ifndef SECCOMP_FILTER_FLAG_TSYNC
1837 #define SECCOMP_FILTER_FLAG_TSYNC 1
1838 #endif
1839
1840 #ifndef SECCOMP_FILTER_FLAG_LOG
1841 #define SECCOMP_FILTER_FLAG_LOG 2
1842 #endif
1843
1844 #ifndef seccomp
1845 int seccomp(unsigned int op, unsigned int flags, void *args)
1846 {
1847         errno = 0;
1848         return syscall(__NR_seccomp, op, flags, args);
1849 }
1850 #endif
1851
1852 TEST(seccomp_syscall)
1853 {
1854         struct sock_filter filter[] = {
1855                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1856         };
1857         struct sock_fprog prog = {
1858                 .len = (unsigned short)ARRAY_SIZE(filter),
1859                 .filter = filter,
1860         };
1861         long ret;
1862
1863         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1864         ASSERT_EQ(0, ret) {
1865                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
1866         }
1867
1868         /* Reject insane operation. */
1869         ret = seccomp(-1, 0, &prog);
1870         ASSERT_NE(ENOSYS, errno) {
1871                 TH_LOG("Kernel does not support seccomp syscall!");
1872         }
1873         EXPECT_EQ(EINVAL, errno) {
1874                 TH_LOG("Did not reject crazy op value!");
1875         }
1876
1877         /* Reject strict with flags or pointer. */
1878         ret = seccomp(SECCOMP_SET_MODE_STRICT, -1, NULL);
1879         EXPECT_EQ(EINVAL, errno) {
1880                 TH_LOG("Did not reject mode strict with flags!");
1881         }
1882         ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, &prog);
1883         EXPECT_EQ(EINVAL, errno) {
1884                 TH_LOG("Did not reject mode strict with uargs!");
1885         }
1886
1887         /* Reject insane args for filter. */
1888         ret = seccomp(SECCOMP_SET_MODE_FILTER, -1, &prog);
1889         EXPECT_EQ(EINVAL, errno) {
1890                 TH_LOG("Did not reject crazy filter flags!");
1891         }
1892         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, NULL);
1893         EXPECT_EQ(EFAULT, errno) {
1894                 TH_LOG("Did not reject NULL filter!");
1895         }
1896
1897         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
1898         EXPECT_EQ(0, errno) {
1899                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER: %s",
1900                         strerror(errno));
1901         }
1902 }
1903
1904 TEST(seccomp_syscall_mode_lock)
1905 {
1906         struct sock_filter filter[] = {
1907                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1908         };
1909         struct sock_fprog prog = {
1910                 .len = (unsigned short)ARRAY_SIZE(filter),
1911                 .filter = filter,
1912         };
1913         long ret;
1914
1915         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
1916         ASSERT_EQ(0, ret) {
1917                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
1918         }
1919
1920         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
1921         ASSERT_NE(ENOSYS, errno) {
1922                 TH_LOG("Kernel does not support seccomp syscall!");
1923         }
1924         EXPECT_EQ(0, ret) {
1925                 TH_LOG("Could not install filter!");
1926         }
1927
1928         /* Make sure neither entry point will switch to strict. */
1929         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, 0, 0, 0);
1930         EXPECT_EQ(EINVAL, errno) {
1931                 TH_LOG("Switched to mode strict!");
1932         }
1933
1934         ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, NULL);
1935         EXPECT_EQ(EINVAL, errno) {
1936                 TH_LOG("Switched to mode strict!");
1937         }
1938 }
1939
1940 /*
1941  * Test detection of known and unknown filter flags. Userspace needs to be able
1942  * to check if a filter flag is supported by the current kernel and a good way
1943  * of doing that is by attempting to enter filter mode, with the flag bit in
1944  * question set, and a NULL pointer for the _args_ parameter. EFAULT indicates
1945  * that the flag is valid and EINVAL indicates that the flag is invalid.
1946  */
1947 TEST(detect_seccomp_filter_flags)
1948 {
1949         unsigned int flags[] = { SECCOMP_FILTER_FLAG_TSYNC,
1950                                  SECCOMP_FILTER_FLAG_LOG };
1951         unsigned int flag, all_flags;
1952         int i;
1953         long ret;
1954
1955         /* Test detection of known-good filter flags */
1956         for (i = 0, all_flags = 0; i < ARRAY_SIZE(flags); i++) {
1957                 flag = flags[i];
1958                 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
1959                 ASSERT_NE(ENOSYS, errno) {
1960                         TH_LOG("Kernel does not support seccomp syscall!");
1961                 }
1962                 EXPECT_EQ(-1, ret);
1963                 EXPECT_EQ(EFAULT, errno) {
1964                         TH_LOG("Failed to detect that a known-good filter flag (0x%X) is supported!",
1965                                flag);
1966                 }
1967
1968                 all_flags |= flag;
1969         }
1970
1971         /* Test detection of all known-good filter flags */
1972         ret = seccomp(SECCOMP_SET_MODE_FILTER, all_flags, NULL);
1973         EXPECT_EQ(-1, ret);
1974         EXPECT_EQ(EFAULT, errno) {
1975                 TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!",
1976                        all_flags);
1977         }
1978
1979         /* Test detection of an unknown filter flag */
1980         flag = -1;
1981         ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
1982         EXPECT_EQ(-1, ret);
1983         EXPECT_EQ(EINVAL, errno) {
1984                 TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported!",
1985                        flag);
1986         }
1987
1988         /*
1989          * Test detection of an unknown filter flag that may simply need to be
1990          * added to this test
1991          */
1992         flag = flags[ARRAY_SIZE(flags) - 1] << 1;
1993         ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
1994         EXPECT_EQ(-1, ret);
1995         EXPECT_EQ(EINVAL, errno) {
1996                 TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported! Does a new flag need to be added to this test?",
1997                        flag);
1998         }
1999 }
2000
2001 TEST(TSYNC_first)
2002 {
2003         struct sock_filter filter[] = {
2004                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2005         };
2006         struct sock_fprog prog = {
2007                 .len = (unsigned short)ARRAY_SIZE(filter),
2008                 .filter = filter,
2009         };
2010         long ret;
2011
2012         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
2013         ASSERT_EQ(0, ret) {
2014                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2015         }
2016
2017         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2018                       &prog);
2019         ASSERT_NE(ENOSYS, errno) {
2020                 TH_LOG("Kernel does not support seccomp syscall!");
2021         }
2022         EXPECT_EQ(0, ret) {
2023                 TH_LOG("Could not install initial filter with TSYNC!");
2024         }
2025 }
2026
2027 #define TSYNC_SIBLINGS 2
2028 struct tsync_sibling {
2029         pthread_t tid;
2030         pid_t system_tid;
2031         sem_t *started;
2032         pthread_cond_t *cond;
2033         pthread_mutex_t *mutex;
2034         int diverge;
2035         int num_waits;
2036         struct sock_fprog *prog;
2037         struct __test_metadata *metadata;
2038 };
2039
2040 /*
2041  * To avoid joining joined threads (which is not allowed by Bionic),
2042  * make sure we both successfully join and clear the tid to skip a
2043  * later join attempt during fixture teardown. Any remaining threads
2044  * will be directly killed during teardown.
2045  */
2046 #define PTHREAD_JOIN(tid, status)                                       \
2047         do {                                                            \
2048                 int _rc = pthread_join(tid, status);                    \
2049                 if (_rc) {                                              \
2050                         TH_LOG("pthread_join of tid %u failed: %d\n",   \
2051                                 (unsigned int)tid, _rc);                \
2052                 } else {                                                \
2053                         tid = 0;                                        \
2054                 }                                                       \
2055         } while (0)
2056
2057 FIXTURE_DATA(TSYNC) {
2058         struct sock_fprog root_prog, apply_prog;
2059         struct tsync_sibling sibling[TSYNC_SIBLINGS];
2060         sem_t started;
2061         pthread_cond_t cond;
2062         pthread_mutex_t mutex;
2063         int sibling_count;
2064 };
2065
2066 FIXTURE_SETUP(TSYNC)
2067 {
2068         struct sock_filter root_filter[] = {
2069                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2070         };
2071         struct sock_filter apply_filter[] = {
2072                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2073                         offsetof(struct seccomp_data, nr)),
2074                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
2075                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
2076                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2077         };
2078
2079         memset(&self->root_prog, 0, sizeof(self->root_prog));
2080         memset(&self->apply_prog, 0, sizeof(self->apply_prog));
2081         memset(&self->sibling, 0, sizeof(self->sibling));
2082         self->root_prog.filter = malloc(sizeof(root_filter));
2083         ASSERT_NE(NULL, self->root_prog.filter);
2084         memcpy(self->root_prog.filter, &root_filter, sizeof(root_filter));
2085         self->root_prog.len = (unsigned short)ARRAY_SIZE(root_filter);
2086
2087         self->apply_prog.filter = malloc(sizeof(apply_filter));
2088         ASSERT_NE(NULL, self->apply_prog.filter);
2089         memcpy(self->apply_prog.filter, &apply_filter, sizeof(apply_filter));
2090         self->apply_prog.len = (unsigned short)ARRAY_SIZE(apply_filter);
2091
2092         self->sibling_count = 0;
2093         pthread_mutex_init(&self->mutex, NULL);
2094         pthread_cond_init(&self->cond, NULL);
2095         sem_init(&self->started, 0, 0);
2096         self->sibling[0].tid = 0;
2097         self->sibling[0].cond = &self->cond;
2098         self->sibling[0].started = &self->started;
2099         self->sibling[0].mutex = &self->mutex;
2100         self->sibling[0].diverge = 0;
2101         self->sibling[0].num_waits = 1;
2102         self->sibling[0].prog = &self->root_prog;
2103         self->sibling[0].metadata = _metadata;
2104         self->sibling[1].tid = 0;
2105         self->sibling[1].cond = &self->cond;
2106         self->sibling[1].started = &self->started;
2107         self->sibling[1].mutex = &self->mutex;
2108         self->sibling[1].diverge = 0;
2109         self->sibling[1].prog = &self->root_prog;
2110         self->sibling[1].num_waits = 1;
2111         self->sibling[1].metadata = _metadata;
2112 }
2113
2114 FIXTURE_TEARDOWN(TSYNC)
2115 {
2116         int sib = 0;
2117
2118         if (self->root_prog.filter)
2119                 free(self->root_prog.filter);
2120         if (self->apply_prog.filter)
2121                 free(self->apply_prog.filter);
2122
2123         for ( ; sib < self->sibling_count; ++sib) {
2124                 struct tsync_sibling *s = &self->sibling[sib];
2125
2126                 if (!s->tid)
2127                         continue;
2128                 /*
2129                  * If a thread is still running, it may be stuck, so hit
2130                  * it over the head really hard.
2131                  */
2132                 pthread_kill(s->tid, 9);
2133         }
2134         pthread_mutex_destroy(&self->mutex);
2135         pthread_cond_destroy(&self->cond);
2136         sem_destroy(&self->started);
2137 }
2138
2139 void *tsync_sibling(void *data)
2140 {
2141         long ret = 0;
2142         struct tsync_sibling *me = data;
2143
2144         me->system_tid = syscall(__NR_gettid);
2145
2146         pthread_mutex_lock(me->mutex);
2147         if (me->diverge) {
2148                 /* Just re-apply the root prog to fork the tree */
2149                 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
2150                                 me->prog, 0, 0);
2151         }
2152         sem_post(me->started);
2153         /* Return outside of started so parent notices failures. */
2154         if (ret) {
2155                 pthread_mutex_unlock(me->mutex);
2156                 return (void *)SIBLING_EXIT_FAILURE;
2157         }
2158         do {
2159                 pthread_cond_wait(me->cond, me->mutex);
2160                 me->num_waits = me->num_waits - 1;
2161         } while (me->num_waits);
2162         pthread_mutex_unlock(me->mutex);
2163
2164         ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
2165         if (!ret)
2166                 return (void *)SIBLING_EXIT_NEWPRIVS;
2167         read(0, NULL, 0);
2168         return (void *)SIBLING_EXIT_UNKILLED;
2169 }
2170
2171 void tsync_start_sibling(struct tsync_sibling *sibling)
2172 {
2173         pthread_create(&sibling->tid, NULL, tsync_sibling, (void *)sibling);
2174 }
2175
2176 TEST_F(TSYNC, siblings_fail_prctl)
2177 {
2178         long ret;
2179         void *status;
2180         struct sock_filter filter[] = {
2181                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2182                         offsetof(struct seccomp_data, nr)),
2183                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
2184                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EINVAL),
2185                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2186         };
2187         struct sock_fprog prog = {
2188                 .len = (unsigned short)ARRAY_SIZE(filter),
2189                 .filter = filter,
2190         };
2191
2192         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2193                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2194         }
2195
2196         /* Check prctl failure detection by requesting sib 0 diverge. */
2197         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
2198         ASSERT_NE(ENOSYS, errno) {
2199                 TH_LOG("Kernel does not support seccomp syscall!");
2200         }
2201         ASSERT_EQ(0, ret) {
2202                 TH_LOG("setting filter failed");
2203         }
2204
2205         self->sibling[0].diverge = 1;
2206         tsync_start_sibling(&self->sibling[0]);
2207         tsync_start_sibling(&self->sibling[1]);
2208
2209         while (self->sibling_count < TSYNC_SIBLINGS) {
2210                 sem_wait(&self->started);
2211                 self->sibling_count++;
2212         }
2213
2214         /* Signal the threads to clean up*/
2215         pthread_mutex_lock(&self->mutex);
2216         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2217                 TH_LOG("cond broadcast non-zero");
2218         }
2219         pthread_mutex_unlock(&self->mutex);
2220
2221         /* Ensure diverging sibling failed to call prctl. */
2222         PTHREAD_JOIN(self->sibling[0].tid, &status);
2223         EXPECT_EQ(SIBLING_EXIT_FAILURE, (long)status);
2224         PTHREAD_JOIN(self->sibling[1].tid, &status);
2225         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2226 }
2227
2228 TEST_F(TSYNC, two_siblings_with_ancestor)
2229 {
2230         long ret;
2231         void *status;
2232
2233         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2234                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2235         }
2236
2237         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2238         ASSERT_NE(ENOSYS, errno) {
2239                 TH_LOG("Kernel does not support seccomp syscall!");
2240         }
2241         ASSERT_EQ(0, ret) {
2242                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2243         }
2244         tsync_start_sibling(&self->sibling[0]);
2245         tsync_start_sibling(&self->sibling[1]);
2246
2247         while (self->sibling_count < TSYNC_SIBLINGS) {
2248                 sem_wait(&self->started);
2249                 self->sibling_count++;
2250         }
2251
2252         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2253                       &self->apply_prog);
2254         ASSERT_EQ(0, ret) {
2255                 TH_LOG("Could install filter on all threads!");
2256         }
2257         /* Tell the siblings to test the policy */
2258         pthread_mutex_lock(&self->mutex);
2259         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2260                 TH_LOG("cond broadcast non-zero");
2261         }
2262         pthread_mutex_unlock(&self->mutex);
2263         /* Ensure they are both killed and don't exit cleanly. */
2264         PTHREAD_JOIN(self->sibling[0].tid, &status);
2265         EXPECT_EQ(0x0, (long)status);
2266         PTHREAD_JOIN(self->sibling[1].tid, &status);
2267         EXPECT_EQ(0x0, (long)status);
2268 }
2269
2270 TEST_F(TSYNC, two_sibling_want_nnp)
2271 {
2272         void *status;
2273
2274         /* start siblings before any prctl() operations */
2275         tsync_start_sibling(&self->sibling[0]);
2276         tsync_start_sibling(&self->sibling[1]);
2277         while (self->sibling_count < TSYNC_SIBLINGS) {
2278                 sem_wait(&self->started);
2279                 self->sibling_count++;
2280         }
2281
2282         /* Tell the siblings to test no policy */
2283         pthread_mutex_lock(&self->mutex);
2284         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2285                 TH_LOG("cond broadcast non-zero");
2286         }
2287         pthread_mutex_unlock(&self->mutex);
2288
2289         /* Ensure they are both upset about lacking nnp. */
2290         PTHREAD_JOIN(self->sibling[0].tid, &status);
2291         EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status);
2292         PTHREAD_JOIN(self->sibling[1].tid, &status);
2293         EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status);
2294 }
2295
2296 TEST_F(TSYNC, two_siblings_with_no_filter)
2297 {
2298         long ret;
2299         void *status;
2300
2301         /* start siblings before any prctl() operations */
2302         tsync_start_sibling(&self->sibling[0]);
2303         tsync_start_sibling(&self->sibling[1]);
2304         while (self->sibling_count < TSYNC_SIBLINGS) {
2305                 sem_wait(&self->started);
2306                 self->sibling_count++;
2307         }
2308
2309         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2310                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2311         }
2312
2313         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2314                       &self->apply_prog);
2315         ASSERT_NE(ENOSYS, errno) {
2316                 TH_LOG("Kernel does not support seccomp syscall!");
2317         }
2318         ASSERT_EQ(0, ret) {
2319                 TH_LOG("Could install filter on all threads!");
2320         }
2321
2322         /* Tell the siblings to test the policy */
2323         pthread_mutex_lock(&self->mutex);
2324         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2325                 TH_LOG("cond broadcast non-zero");
2326         }
2327         pthread_mutex_unlock(&self->mutex);
2328
2329         /* Ensure they are both killed and don't exit cleanly. */
2330         PTHREAD_JOIN(self->sibling[0].tid, &status);
2331         EXPECT_EQ(0x0, (long)status);
2332         PTHREAD_JOIN(self->sibling[1].tid, &status);
2333         EXPECT_EQ(0x0, (long)status);
2334 }
2335
2336 TEST_F(TSYNC, two_siblings_with_one_divergence)
2337 {
2338         long ret;
2339         void *status;
2340
2341         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2342                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2343         }
2344
2345         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2346         ASSERT_NE(ENOSYS, errno) {
2347                 TH_LOG("Kernel does not support seccomp syscall!");
2348         }
2349         ASSERT_EQ(0, ret) {
2350                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2351         }
2352         self->sibling[0].diverge = 1;
2353         tsync_start_sibling(&self->sibling[0]);
2354         tsync_start_sibling(&self->sibling[1]);
2355
2356         while (self->sibling_count < TSYNC_SIBLINGS) {
2357                 sem_wait(&self->started);
2358                 self->sibling_count++;
2359         }
2360
2361         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2362                       &self->apply_prog);
2363         ASSERT_EQ(self->sibling[0].system_tid, ret) {
2364                 TH_LOG("Did not fail on diverged sibling.");
2365         }
2366
2367         /* Wake the threads */
2368         pthread_mutex_lock(&self->mutex);
2369         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2370                 TH_LOG("cond broadcast non-zero");
2371         }
2372         pthread_mutex_unlock(&self->mutex);
2373
2374         /* Ensure they are both unkilled. */
2375         PTHREAD_JOIN(self->sibling[0].tid, &status);
2376         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2377         PTHREAD_JOIN(self->sibling[1].tid, &status);
2378         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2379 }
2380
2381 TEST_F(TSYNC, two_siblings_not_under_filter)
2382 {
2383         long ret, sib;
2384         void *status;
2385
2386         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2387                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2388         }
2389
2390         /*
2391          * Sibling 0 will have its own seccomp policy
2392          * and Sibling 1 will not be under seccomp at
2393          * all. Sibling 1 will enter seccomp and 0
2394          * will cause failure.
2395          */
2396         self->sibling[0].diverge = 1;
2397         tsync_start_sibling(&self->sibling[0]);
2398         tsync_start_sibling(&self->sibling[1]);
2399
2400         while (self->sibling_count < TSYNC_SIBLINGS) {
2401                 sem_wait(&self->started);
2402                 self->sibling_count++;
2403         }
2404
2405         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2406         ASSERT_NE(ENOSYS, errno) {
2407                 TH_LOG("Kernel does not support seccomp syscall!");
2408         }
2409         ASSERT_EQ(0, ret) {
2410                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2411         }
2412
2413         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2414                       &self->apply_prog);
2415         ASSERT_EQ(ret, self->sibling[0].system_tid) {
2416                 TH_LOG("Did not fail on diverged sibling.");
2417         }
2418         sib = 1;
2419         if (ret == self->sibling[0].system_tid)
2420                 sib = 0;
2421
2422         pthread_mutex_lock(&self->mutex);
2423
2424         /* Increment the other siblings num_waits so we can clean up
2425          * the one we just saw.
2426          */
2427         self->sibling[!sib].num_waits += 1;
2428
2429         /* Signal the thread to clean up*/
2430         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2431                 TH_LOG("cond broadcast non-zero");
2432         }
2433         pthread_mutex_unlock(&self->mutex);
2434         PTHREAD_JOIN(self->sibling[sib].tid, &status);
2435         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2436         /* Poll for actual task death. pthread_join doesn't guarantee it. */
2437         while (!kill(self->sibling[sib].system_tid, 0))
2438                 sleep(0.1);
2439         /* Switch to the remaining sibling */
2440         sib = !sib;
2441
2442         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2443                       &self->apply_prog);
2444         ASSERT_EQ(0, ret) {
2445                 TH_LOG("Expected the remaining sibling to sync");
2446         };
2447
2448         pthread_mutex_lock(&self->mutex);
2449
2450         /* If remaining sibling didn't have a chance to wake up during
2451          * the first broadcast, manually reduce the num_waits now.
2452          */
2453         if (self->sibling[sib].num_waits > 1)
2454                 self->sibling[sib].num_waits = 1;
2455         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2456                 TH_LOG("cond broadcast non-zero");
2457         }
2458         pthread_mutex_unlock(&self->mutex);
2459         PTHREAD_JOIN(self->sibling[sib].tid, &status);
2460         EXPECT_EQ(0, (long)status);
2461         /* Poll for actual task death. pthread_join doesn't guarantee it. */
2462         while (!kill(self->sibling[sib].system_tid, 0))
2463                 sleep(0.1);
2464
2465         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2466                       &self->apply_prog);
2467         ASSERT_EQ(0, ret);  /* just us chickens */
2468 }
2469
2470 /* Make sure restarted syscalls are seen directly as "restart_syscall". */
2471 TEST(syscall_restart)
2472 {
2473         long ret;
2474         unsigned long msg;
2475         pid_t child_pid;
2476         int pipefd[2];
2477         int status;
2478         siginfo_t info = { };
2479         struct sock_filter filter[] = {
2480                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2481                          offsetof(struct seccomp_data, nr)),
2482
2483 #ifdef __NR_sigreturn
2484                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_sigreturn, 6, 0),
2485 #endif
2486                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 5, 0),
2487                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_exit, 4, 0),
2488                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_rt_sigreturn, 3, 0),
2489                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_nanosleep, 4, 0),
2490                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_restart_syscall, 4, 0),
2491
2492                 /* Allow __NR_write for easy logging. */
2493                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_write, 0, 1),
2494                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2495                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
2496                 /* The nanosleep jump target. */
2497                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x100),
2498                 /* The restart_syscall jump target. */
2499                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x200),
2500         };
2501         struct sock_fprog prog = {
2502                 .len = (unsigned short)ARRAY_SIZE(filter),
2503                 .filter = filter,
2504         };
2505 #if defined(__arm__)
2506         struct utsname utsbuf;
2507 #endif
2508
2509         ASSERT_EQ(0, pipe(pipefd));
2510
2511         child_pid = fork();
2512         ASSERT_LE(0, child_pid);
2513         if (child_pid == 0) {
2514                 /* Child uses EXPECT not ASSERT to deliver status correctly. */
2515                 char buf = ' ';
2516                 struct timespec timeout = { };
2517
2518                 /* Attach parent as tracer and stop. */
2519                 EXPECT_EQ(0, ptrace(PTRACE_TRACEME));
2520                 EXPECT_EQ(0, raise(SIGSTOP));
2521
2522                 EXPECT_EQ(0, close(pipefd[1]));
2523
2524                 EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2525                         TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2526                 }
2527
2528                 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2529                 EXPECT_EQ(0, ret) {
2530                         TH_LOG("Failed to install filter!");
2531                 }
2532
2533                 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) {
2534                         TH_LOG("Failed to read() sync from parent");
2535                 }
2536                 EXPECT_EQ('.', buf) {
2537                         TH_LOG("Failed to get sync data from read()");
2538                 }
2539
2540                 /* Start nanosleep to be interrupted. */
2541                 timeout.tv_sec = 1;
2542                 errno = 0;
2543                 EXPECT_EQ(0, nanosleep(&timeout, NULL)) {
2544                         TH_LOG("Call to nanosleep() failed (errno %d)", errno);
2545                 }
2546
2547                 /* Read final sync from parent. */
2548                 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) {
2549                         TH_LOG("Failed final read() from parent");
2550                 }
2551                 EXPECT_EQ('!', buf) {
2552                         TH_LOG("Failed to get final data from read()");
2553                 }
2554
2555                 /* Directly report the status of our test harness results. */
2556                 syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS
2557                                                      : EXIT_FAILURE);
2558         }
2559         EXPECT_EQ(0, close(pipefd[0]));
2560
2561         /* Attach to child, setup options, and release. */
2562         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
2563         ASSERT_EQ(true, WIFSTOPPED(status));
2564         ASSERT_EQ(0, ptrace(PTRACE_SETOPTIONS, child_pid, NULL,
2565                             PTRACE_O_TRACESECCOMP));
2566         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
2567         ASSERT_EQ(1, write(pipefd[1], ".", 1));
2568
2569         /* Wait for nanosleep() to start. */
2570         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
2571         ASSERT_EQ(true, WIFSTOPPED(status));
2572         ASSERT_EQ(SIGTRAP, WSTOPSIG(status));
2573         ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16));
2574         ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg));
2575         ASSERT_EQ(0x100, msg);
2576         EXPECT_EQ(__NR_nanosleep, get_syscall(_metadata, child_pid));
2577
2578         /* Might as well check siginfo for sanity while we're here. */
2579         ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info));
2580         ASSERT_EQ(SIGTRAP, info.si_signo);
2581         ASSERT_EQ(SIGTRAP | (PTRACE_EVENT_SECCOMP << 8), info.si_code);
2582         EXPECT_EQ(0, info.si_errno);
2583         EXPECT_EQ(getuid(), info.si_uid);
2584         /* Verify signal delivery came from child (seccomp-triggered). */
2585         EXPECT_EQ(child_pid, info.si_pid);
2586
2587         /* Interrupt nanosleep with SIGSTOP (which we'll need to handle). */
2588         ASSERT_EQ(0, kill(child_pid, SIGSTOP));
2589         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
2590         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
2591         ASSERT_EQ(true, WIFSTOPPED(status));
2592         ASSERT_EQ(SIGSTOP, WSTOPSIG(status));
2593         /* Verify signal delivery came from parent now. */
2594         ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info));
2595         EXPECT_EQ(getpid(), info.si_pid);
2596
2597         /* Restart nanosleep with SIGCONT, which triggers restart_syscall. */
2598         ASSERT_EQ(0, kill(child_pid, SIGCONT));
2599         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
2600         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
2601         ASSERT_EQ(true, WIFSTOPPED(status));
2602         ASSERT_EQ(SIGCONT, WSTOPSIG(status));
2603         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
2604
2605         /* Wait for restart_syscall() to start. */
2606         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
2607         ASSERT_EQ(true, WIFSTOPPED(status));
2608         ASSERT_EQ(SIGTRAP, WSTOPSIG(status));
2609         ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16));
2610         ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg));
2611
2612         ASSERT_EQ(0x200, msg);
2613         ret = get_syscall(_metadata, child_pid);
2614 #if defined(__arm__)
2615         /*
2616          * FIXME:
2617          * - native ARM registers do NOT expose true syscall.
2618          * - compat ARM registers on ARM64 DO expose true syscall.
2619          */
2620         ASSERT_EQ(0, uname(&utsbuf));
2621         if (strncmp(utsbuf.machine, "arm", 3) == 0) {
2622                 EXPECT_EQ(__NR_nanosleep, ret);
2623         } else
2624 #endif
2625         {
2626                 EXPECT_EQ(__NR_restart_syscall, ret);
2627         }
2628
2629         /* Write again to end test. */
2630         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
2631         ASSERT_EQ(1, write(pipefd[1], "!", 1));
2632         EXPECT_EQ(0, close(pipefd[1]));
2633
2634         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
2635         if (WIFSIGNALED(status) || WEXITSTATUS(status))
2636                 _metadata->passed = 0;
2637 }
2638
2639 TEST_SIGNAL(filter_flag_log, SIGSYS)
2640 {
2641         struct sock_filter allow_filter[] = {
2642                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2643         };
2644         struct sock_filter kill_filter[] = {
2645                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2646                         offsetof(struct seccomp_data, nr)),
2647                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
2648                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
2649                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2650         };
2651         struct sock_fprog allow_prog = {
2652                 .len = (unsigned short)ARRAY_SIZE(allow_filter),
2653                 .filter = allow_filter,
2654         };
2655         struct sock_fprog kill_prog = {
2656                 .len = (unsigned short)ARRAY_SIZE(kill_filter),
2657                 .filter = kill_filter,
2658         };
2659         long ret;
2660         pid_t parent = getppid();
2661
2662         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
2663         ASSERT_EQ(0, ret);
2664
2665         /* Verify that the FILTER_FLAG_LOG flag isn't accepted in strict mode */
2666         ret = seccomp(SECCOMP_SET_MODE_STRICT, SECCOMP_FILTER_FLAG_LOG,
2667                       &allow_prog);
2668         ASSERT_NE(ENOSYS, errno) {
2669                 TH_LOG("Kernel does not support seccomp syscall!");
2670         }
2671         EXPECT_NE(0, ret) {
2672                 TH_LOG("Kernel accepted FILTER_FLAG_LOG flag in strict mode!");
2673         }
2674         EXPECT_EQ(EINVAL, errno) {
2675                 TH_LOG("Kernel returned unexpected errno for FILTER_FLAG_LOG flag in strict mode!");
2676         }
2677
2678         /* Verify that a simple, permissive filter can be added with no flags */
2679         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &allow_prog);
2680         EXPECT_EQ(0, ret);
2681
2682         /* See if the same filter can be added with the FILTER_FLAG_LOG flag */
2683         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
2684                       &allow_prog);
2685         ASSERT_NE(EINVAL, errno) {
2686                 TH_LOG("Kernel does not support the FILTER_FLAG_LOG flag!");
2687         }
2688         EXPECT_EQ(0, ret);
2689
2690         /* Ensure that the kill filter works with the FILTER_FLAG_LOG flag */
2691         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
2692                       &kill_prog);
2693         EXPECT_EQ(0, ret);
2694
2695         EXPECT_EQ(parent, syscall(__NR_getppid));
2696         /* getpid() should never return. */
2697         EXPECT_EQ(0, syscall(__NR_getpid));
2698 }
2699
2700 TEST(get_action_avail)
2701 {
2702         __u32 actions[] = { SECCOMP_RET_KILL_THREAD, SECCOMP_RET_TRAP,
2703                             SECCOMP_RET_ERRNO, SECCOMP_RET_TRACE,
2704                             SECCOMP_RET_LOG,   SECCOMP_RET_ALLOW };
2705         __u32 unknown_action = 0x10000000U;
2706         int i;
2707         long ret;
2708
2709         ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[0]);
2710         ASSERT_NE(ENOSYS, errno) {
2711                 TH_LOG("Kernel does not support seccomp syscall!");
2712         }
2713         ASSERT_NE(EINVAL, errno) {
2714                 TH_LOG("Kernel does not support SECCOMP_GET_ACTION_AVAIL operation!");
2715         }
2716         EXPECT_EQ(ret, 0);
2717
2718         for (i = 0; i < ARRAY_SIZE(actions); i++) {
2719                 ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[i]);
2720                 EXPECT_EQ(ret, 0) {
2721                         TH_LOG("Expected action (0x%X) not available!",
2722                                actions[i]);
2723                 }
2724         }
2725
2726         /* Check that an unknown action is handled properly (EOPNOTSUPP) */
2727         ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &unknown_action);
2728         EXPECT_EQ(ret, -1);
2729         EXPECT_EQ(errno, EOPNOTSUPP);
2730 }
2731
2732 /*
2733  * TODO:
2734  * - add microbenchmarks
2735  * - expand NNP testing
2736  * - better arch-specific TRACE and TRAP handlers.
2737  * - endianness checking when appropriate
2738  * - 64-bit arg prodding
2739  * - arch value testing (x86 modes especially)
2740  * - verify that FILTER_FLAG_LOG filters generate log messages
2741  * - verify that RET_LOG generates log messages
2742  * - ...
2743  */
2744
2745 TEST_HARNESS_MAIN