tests: workaround kernel bugs in seccomp-strict.test and prctl-seccomp-strict.test

If kernel implementation of strict seccomp mode is buggy, test programs
will be killed by SIGKILL.  This is a known problem at least on
x32 and mips.  Skip affected tests if this is the case.

This change partially revert commit 9c1a72cd3f3d52d573876ce474b620a5f141fb1b.

* tests/seccomp-strict.c (main): Remove workaround for x32.
* tests/prctl-seccomp-strict.c: Likewise.
* tests/seccomp-strict.test: Skip the test if the test program
has been killed by SIGKILL.
* tests/prctl-seccomp-strict.test: Likewise.

diff --git a/tests/prctl-seccomp-strict.c b/tests/prctl-seccomp-strict.c
index 0a0d6a8ccb7f3cf93d4e7b8daf0890b3f94d2ef9..8d1fdfc9f5da55f7b4ad6f063be8abce704574fd 100644 (file)
--- a/tests/prctl-seccomp-strict.c
+++ b/tests/prctl-seccomp-strict.c
@@ -41,14 +41,6 @@
 int
 main(void)
 {
-# if defined __x86_64__ && defined __ILP32__
-       /*
-        * Syscall numbers are hardcoded in
-        * kernel/seccomp.c:__secure_computing_strict(),
-        * but x32 syscall numbers are not supported.
-        */
-       error_msg_and_skip("SECCOMP_MODE_STRICT is not supported on x32");
-# else
        static const char text1[] =
                "prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT) = 0\n";
        static const char text2[] = "+++ exited with 0 +++\n";
@@ -64,12 +56,15 @@ main(void)
                       ENOSYS == errno ? "ENOSYS" : "EINVAL");
                fflush(stdout);
        } else {
+               /*
+                * If kernel implementaton of SECCOMP_MODE_STRICT is buggy,
+                * the following syscall will result to SIGKILL.
+                */
                rc += write(1, text1, LENGTH_OF(text1)) != LENGTH_OF(text1);
        }
 
        rc += write(1, text2, LENGTH_OF(text2)) != LENGTH_OF(text2);
        return !!syscall(__NR_exit, rc);
-# endif
 }
 
 #else

diff --git a/tests/prctl-seccomp-strict.test b/tests/prctl-seccomp-strict.test
index ff3c4f3bbe908f201bee995437986b17f0d13b68..1f987df72156b149e0b91133841c1ef70600acf4 100755 (executable)
--- a/tests/prctl-seccomp-strict.test
+++ b/tests/prctl-seccomp-strict.test
@@ -5,9 +5,15 @@
 . "${srcdir=.}/init.sh"
 
 check_prog grep
-run_prog > /dev/null
-run_strace -eprctl $args > "$EXP"
+set -- "./$NAME"
+"$@" > /dev/null || {
+       case $? in
+               77) skip_ "$* exited with code 77" ;;
+               137) framework_skip_ "$* killed by SIGKILL, fix your kernel" ;;
+               *) fail_ "$args failed" ;;
+       esac
+}
+run_strace -eprctl "$@" > "$EXP"
 grep -v '^prctl(PR_GET_' < "$LOG" > "$OUT"
 match_diff "$OUT" "$EXP"
-
 rm -f "$EXP" "$OUT"

diff --git a/tests/seccomp-strict.c b/tests/seccomp-strict.c
index f9fef96dec048040774119bd978c47d2d47f9e06..f615aa187a7172e5e1a620575229d0af39e6690e 100644 (file)
--- a/tests/seccomp-strict.c
+++ b/tests/seccomp-strict.c
@@ -40,14 +40,6 @@
 int
 main(void)
 {
-# if defined __x86_64__ && defined __ILP32__
-       /*
-        * Syscall numbers are hardcoded in
-        * kernel/seccomp.c:__secure_computing_strict(),
-        * but x32 syscall numbers are not supported.
-        */
-       error_msg_and_skip("SECCOMP_SET_MODE_STRICT is not supported on x32");
-# else
        static const char text1[] =
                "seccomp(SECCOMP_SET_MODE_STRICT, 0, NULL) = 0\n";
        static const char text2[] = "+++ exited with 0 +++\n";
@@ -64,12 +56,15 @@ main(void)
                       ENOSYS == errno ? "ENOSYS" : "EINVAL");
                fflush(stdout);
        } else {
+               /*
+                * If kernel implementaton of SECCOMP_MODE_STRICT is buggy,
+                * the following syscall will result to SIGKILL.
+                */
                rc += write(1, text1, LENGTH_OF(text1)) != LENGTH_OF(text1);
        }
 
        rc += write(1, text2, LENGTH_OF(text2)) != LENGTH_OF(text2);
        return !!syscall(__NR_exit, rc);
-# endif
 }
 
 #else

diff --git a/tests/seccomp-strict.test b/tests/seccomp-strict.test
index 62f66b8ad4bc15c821589b98075b721c91b4ba38..b354c6a2994915c7bd625fe481d176d80ff9fd27 100755 (executable)
--- a/tests/seccomp-strict.test
+++ b/tests/seccomp-strict.test
@@ -3,4 +3,15 @@
 # Check how seccomp SECCOMP_SET_MODE_STRICT is decoded.
 
 . "${srcdir=.}/init.sh"
-run_strace_match_diff -e trace=seccomp
+
+set -- "./$NAME"
+"$@" > /dev/null || {
+       case $? in
+               77) skip_ "$* exited with code 77" ;;
+               137) framework_skip_ "$* killed by SIGKILL, fix your kernel" ;;
+               *) fail_ "$args failed" ;;
+       esac
+}
+run_strace -eseccomp "$@" > "$EXP"
+match_diff "$LOG" "$EXP"
+rm -f "$EXP"