Fix -b execve when --seccomp-bpf option is specified

As --seccomp-bpf does not support detaching, explicitly turn off
this option when -b execve is specified.

* strace.c (init): Turn off --seccomp-bpf when -b execve is specified.
* NEWS: Mention this fix.
* tests/bexecve.test: Check it.

Fixes: v5.3~7 "Introduce seccomp-assisted syscall filtering"

diff --git a/NEWS b/NEWS
index 7c687710cc16d356fbebf4df9339098131d70aa7..e0dc79394809c76547811e622528fd8465fefd62 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,7 @@ Noteworthy changes in release ?.? (????-??-??)
 ==============================================
 
 * Bug fixes
+  * Fixed -b execve when --seccomp-bpf option is specified.
   * Fixed build on no-MMU architectures.
 
 Noteworthy changes in release 5.3 (2019-09-25)

diff --git a/strace.c b/strace.c
index b52a3db3412a92d88a3df4f76a6344107968cb6f..a4de6ae3979ea216db8ec50a302130afb0319cec 100644 (file)
--- a/strace.c
+++ b/strace.c
@@ -1786,6 +1786,12 @@ init(int argc, char *argv[])
                error_msg_and_help("PROG [ARGS] must be specified with -D");
        }
 
+       if (seccomp_filtering && detach_on_execve) {
+               error_msg("--seccomp-bpf is not enabled because"
+                         " it is not compatible with -b");
+               seccomp_filtering = false;
+       }
+
        if (seccomp_filtering) {
                if (nprocs && (!argc || debug_flag))
                        error_msg("--seccomp-bpf is not enabled for processes"

diff --git a/tests/bexecve.test b/tests/bexecve.test
index 7a135871c374ea70b6714ae563555d57b919ecde..f74a9f9f7fd6374f27274242aa5bb38a50a3961e 100755 (executable)
--- a/tests/bexecve.test
+++ b/tests/bexecve.test
@@ -36,4 +36,18 @@ if LC_ALL=C grep -E -v -x "($pattern_detached|$pattern_personality)" "$LOG" > /d
        dump_log_and_fail_with "$STRACE $args: unexpected output"
 fi
 
+run_strace_redir --seccomp-bpf -bexecve -enone ../set_ptracer_any false ||
+       dump_log_and_fail_with "$STRACE $args: unexpected exit status"
+
+pattern_seccomp='[^:]*strace: --seccomp-bpf is not enabled because it is not compatible with -b'
+
+LC_ALL=C grep -x "$pattern_detached" "$LOG" > /dev/null &&
+LC_ALL=C grep -x "$pattern_seccomp" "$LOG" > /dev/null ||
+       dump_log_and_fail_with "$STRACE $args: output mismatch"
+
+pattern_all="$pattern_detached|$pattern_seccomp|$pattern_personality"
+if LC_ALL=C grep -E -v -x "$pattern_all" "$LOG" > /dev/null; then
+       dump_log_and_fail_with "$STRACE $args: unexpected output"
+fi
+
 exit 0