test: add a manual test for seccomp decoding

* test/.gitignore: Add seccomp.
* test/Makefile (PROGS): Likewise.
* test/seccomp.c: New file.
* test/README: Mention ../tests/.

diff --git a/test/.gitignore b/test/.gitignore
index 7eb39cf492d4327bf43e310a1183c1423d0053dd..b91be8bd30e52e0cace0dde4ba4a2ee585b5526e 100644 (file)
--- a/test/.gitignore
+++ b/test/.gitignore
@@ -1,13 +1,14 @@
-vfork
-fork
-sig
-skodic
+childthread
 clone
+fork
 leaderkill
-childthread
+mtd
+seccomp
+sig
 sigkill_rain
-wait_must_be_interruptible
+sigreturn
+skodic
 threaded_execve
-mtd
 ubi
-sigreturn
+vfork
+wait_must_be_interruptible

diff --git a/test/Makefile b/test/Makefile
index 92142b180ee3762b74f1a70ea44ccd9dcc339f4c..419b5ca30037039e2ab7af4780bc4a333760737a 100644 (file)
--- a/test/Makefile
+++ b/test/Makefile
@@ -3,7 +3,7 @@ CFLAGS += -Wall
 PROGS = \
     vfork fork sig skodic clone leaderkill childthread \
     sigkill_rain wait_must_be_interruptible threaded_execve \
-    mtd ubi sigreturn
+    mtd ubi sigreturn seccomp
 
 all: $(PROGS)
 

diff --git a/test/README b/test/README
index 7fae09b6f86610396eabb2f752ccd93752542b7f..069bd0f77c056a7e0c84afb7e4f91d251d04cf1f 100644 (file)
--- a/test/README
+++ b/test/README
@@ -1,3 +1,6 @@
+This directory contains some manual tests.
+For automated tests, see ../tests/.
+
 To run a test:
 * Run make
 * Run resulting executable(s) under strace

diff --git a/test/seccomp.c b/test/seccomp.c
new file mode 100644 (file)
index 0000000..b305d38
--- /dev/null
+++ b/test/seccomp.c
@@ -0,0 +1,93 @@
+#include <stddef.h>
+#include <unistd.h>
+#include <errno.h>
+#include <sys/prctl.h>
+#include <sys/syscall.h>
+#include <linux/audit.h>
+#include <linux/filter.h>
+#include <linux/seccomp.h>
+
+#if defined __i386__
+# define SECCOMP_ARCH AUDIT_ARCH_I386
+#elif defined __x86_64__
+# define SECCOMP_ARCH AUDIT_ARCH_X86_64
+#elif defined __arm__
+# define SECCOMP_ARCH AUDIT_ARCH_ARM
+#elif defined __arm64__ || defined __aarch64__
+# define SECCOMP_ARCH AUDIT_ARCH_AARCH64
+#else
+# error unsupported architecture
+#endif
+
+#define SOCK_FILTER_KILL_PROCESS \
+               BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL)
+
+#define SOCK_FILTER_DENY_SYSCALL(nr, err) \
+               BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ ## nr, 0, 1), \
+               BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | (SECCOMP_RET_DATA & (err)))
+
+#define SOCK_FILTER_ALLOW_SYSCALL(nr) \
+               BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ ## nr, 0, 1), \
+               BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW)
+
+static const struct sock_filter filter[] = {
+       /* load architecture */
+       BPF_STMT(BPF_LD | BPF_W | BPF_ABS, (offsetof (struct seccomp_data, arch))),
+       /* jump forward 1 instruction if architecture matches */
+       BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SECCOMP_ARCH, 1, 0),
+       /* kill process */
+       SOCK_FILTER_KILL_PROCESS,
+
+       /* load syscall number */
+       BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
+
+       /* allow syscalls */
+       SOCK_FILTER_ALLOW_SYSCALL(close),
+       SOCK_FILTER_ALLOW_SYSCALL(exit),
+       SOCK_FILTER_ALLOW_SYSCALL(exit_group),
+
+       /* deny syscalls */
+       SOCK_FILTER_DENY_SYSCALL(sync, EBUSY),
+       SOCK_FILTER_DENY_SYSCALL(setsid, EACCES),
+       SOCK_FILTER_DENY_SYSCALL(getpid, EPERM),
+       SOCK_FILTER_DENY_SYSCALL(munlockall, SECCOMP_RET_DATA),
+
+       /* kill process */
+       SOCK_FILTER_KILL_PROCESS
+};
+
+static const struct sock_fprog prog = {
+       .len = sizeof(filter) / sizeof(filter[0]),
+       .filter = (struct sock_filter *) filter,
+};
+
+int
+main(void)
+{
+       int fds[2];
+
+       close(0);
+       close(1);
+       if (pipe(fds))
+               return 77;
+
+       if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
+               return 77;
+
+       if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog))
+               return 77;
+
+       if (close(0) || close(1))
+               _exit(1);
+
+#define TEST_DENIED_SYSCALL(nr, err, fail) \
+       if (errno = 0, syscall(__NR_ ## nr, 0xbad, 0xf00d, 0xdead, 0xbeef, err, fail) != -1 || err != errno) \
+               close(-fail)
+
+       TEST_DENIED_SYSCALL(sync, EBUSY, 2);
+       TEST_DENIED_SYSCALL(setsid, EACCES, 3);
+       TEST_DENIED_SYSCALL(getpid, EPERM, 4);
+       TEST_DENIED_SYSCALL(munlockall, SECCOMP_RET_DATA, 5);
+
+       _exit(0);
+}