1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
4 *
5 * Test code for seccomp bpf.
6 */
7
8 #define _GNU_SOURCE
9 #include <sys/types.h>
10
11 /*
12 * glibc 2.26 and later have SIGSYS in siginfo_t. Before that,
13 * we need to use the kernel's siginfo.h file and trick glibc
14 * into accepting it.
15 */
16 #if !__GLIBC_PREREQ(2, 26)
17 # include <asm/siginfo.h>
18 # define __have_siginfo_t 1
19 # define __have_sigval_t 1
20 # define __have_sigevent_t 1
21 #endif
22
23 #include <errno.h>
24 #include <linux/filter.h>
25 #include <sys/prctl.h>
26 #include <sys/ptrace.h>
27 #include <sys/time.h>
28 #include <sys/user.h>
29 #include <linux/prctl.h>
30 #include <linux/ptrace.h>
31 #include <linux/seccomp.h>
32 #include <pthread.h>
33 #include <semaphore.h>
34 #include <signal.h>
35 #include <stddef.h>
36 #include <stdbool.h>
37 #include <string.h>
38 #include <time.h>
39 #include <limits.h>
40 #include <linux/elf.h>
41 #include <sys/uio.h>
42 #include <sys/utsname.h>
43 #include <sys/fcntl.h>
44 #include <sys/mman.h>
45 #include <sys/times.h>
46 #include <sys/socket.h>
47 #include <sys/ioctl.h>
48 #include <linux/kcmp.h>
49 #include <sys/resource.h>
50 #include <sys/capability.h>
51 #include <linux/perf_event.h>
52
53 #include <unistd.h>
54 #include <sys/syscall.h>
55 #include <poll.h>
56
57 #include "kselftest_harness.h"
58 #include "../clone3/clone3_selftests.h"
59
60 /* Attempt to de-conflict with the selftests tree. */
61 #ifndef SKIP
62 #define SKIP(s, ...) XFAIL(s, ##__VA_ARGS__)
63 #endif
64
65 #ifndef MIN
66 #define MIN(X, Y) ((X) < (Y) ? (X) : (Y))
67 #endif
68
69 #ifndef PR_SET_PTRACER
70 # define PR_SET_PTRACER 0x59616d61
71 #endif
72
73 #ifndef noinline
74 #define noinline __attribute__((noinline))
75 #endif
76
77 #ifndef __nocf_check
78 #define __nocf_check __attribute__((nocf_check))
79 #endif
80
81 #ifndef __naked
82 #define __naked __attribute__((__naked__))
83 #endif
84
85 #ifndef PR_SET_NO_NEW_PRIVS
86 #define PR_SET_NO_NEW_PRIVS 38
87 #define PR_GET_NO_NEW_PRIVS 39
88 #endif
89
90 #ifndef PR_SECCOMP_EXT
91 #define PR_SECCOMP_EXT 43
92 #endif
93
94 #ifndef SECCOMP_EXT_ACT
95 #define SECCOMP_EXT_ACT 1
96 #endif
97
98 #ifndef SECCOMP_EXT_ACT_TSYNC
99 #define SECCOMP_EXT_ACT_TSYNC 1
100 #endif
101
102 #ifndef SECCOMP_MODE_STRICT
103 #define SECCOMP_MODE_STRICT 1
104 #endif
105
106 #ifndef SECCOMP_MODE_FILTER
107 #define SECCOMP_MODE_FILTER 2
108 #endif
109
110 #ifndef SECCOMP_RET_ALLOW
111 struct seccomp_data {
112 int nr;
113 __u32 arch;
114 __u64 instruction_pointer;
115 __u64 args[6];
116 };
117 #endif
118
119 #ifndef SECCOMP_RET_KILL_PROCESS
120 #define SECCOMP_RET_KILL_PROCESS 0x80000000U /* kill the process */
121 #define SECCOMP_RET_KILL_THREAD 0x00000000U /* kill the thread */
122 #endif
123 #ifndef SECCOMP_RET_KILL
124 #define SECCOMP_RET_KILL SECCOMP_RET_KILL_THREAD
125 #define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */
126 #define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */
127 #define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */
128 #define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */
129 #endif
130 #ifndef SECCOMP_RET_LOG
131 #define SECCOMP_RET_LOG 0x7ffc0000U /* allow after logging */
132 #endif
133
134 #ifndef __NR_seccomp
135 # if defined(__i386__)
136 # define __NR_seccomp 354
137 # elif defined(__x86_64__)
138 # define __NR_seccomp 317
139 # elif defined(__alpha__)
140 # define __NR_seccomp 514
141 # elif defined(__arm__)
142 # define __NR_seccomp 383
143 # elif defined(__aarch64__)
144 # define __NR_seccomp 277
145 # elif defined(__riscv)
146 # define __NR_seccomp 277
147 # elif defined(__csky__)
148 # define __NR_seccomp 277
149 # elif defined(__loongarch__)
150 # define __NR_seccomp 277
151 # elif defined(__hppa__)
152 # define __NR_seccomp 338
153 # elif defined(__powerpc__)
154 # define __NR_seccomp 358
155 # elif defined(__s390__)
156 # define __NR_seccomp 348
157 # elif defined(__xtensa__)
158 # define __NR_seccomp 337
159 # elif defined(__sh__)
160 # define __NR_seccomp 372
161 # elif defined(__mc68000__)
162 # define __NR_seccomp 380
163 # else
164 # warning "seccomp syscall number unknown for this architecture"
165 # define __NR_seccomp 0xffff
166 # endif
167 #endif
168
169 #ifndef __NR_uretprobe
170 # if defined(__x86_64__)
171 # define __NR_uretprobe 335
172 # endif
173 #endif
174
175 #ifndef __NR_uprobe
176 # if defined(__x86_64__)
177 # define __NR_uprobe 336
178 # endif
179 #endif
180
181 #ifndef SECCOMP_SET_MODE_STRICT
182 #define SECCOMP_SET_MODE_STRICT 0
183 #endif
184
185 #ifndef SECCOMP_SET_MODE_FILTER
186 #define SECCOMP_SET_MODE_FILTER 1
187 #endif
188
189 #ifndef SECCOMP_GET_ACTION_AVAIL
190 #define SECCOMP_GET_ACTION_AVAIL 2
191 #endif
192
193 #ifndef SECCOMP_GET_NOTIF_SIZES
194 #define SECCOMP_GET_NOTIF_SIZES 3
195 #endif
196
197 #ifndef SECCOMP_FILTER_FLAG_TSYNC
198 #define SECCOMP_FILTER_FLAG_TSYNC (1UL << 0)
199 #endif
200
201 #ifndef SECCOMP_FILTER_FLAG_LOG
202 #define SECCOMP_FILTER_FLAG_LOG (1UL << 1)
203 #endif
204
205 #ifndef SECCOMP_FILTER_FLAG_SPEC_ALLOW
206 #define SECCOMP_FILTER_FLAG_SPEC_ALLOW (1UL << 2)
207 #endif
208
209 #ifndef PTRACE_SECCOMP_GET_METADATA
210 #define PTRACE_SECCOMP_GET_METADATA 0x420d
211
212 struct seccomp_metadata {
213 __u64 filter_off; /* Input: which filter */
214 __u64 flags; /* Output: filter's flags */
215 };
216 #endif
217
218 #ifndef SECCOMP_FILTER_FLAG_NEW_LISTENER
219 #define SECCOMP_FILTER_FLAG_NEW_LISTENER (1UL << 3)
220 #endif
221
222 #ifndef SECCOMP_RET_USER_NOTIF
223 #define SECCOMP_RET_USER_NOTIF 0x7fc00000U
224
225 #define SECCOMP_IOC_MAGIC '!'
226 #define SECCOMP_IO(nr) _IO(SECCOMP_IOC_MAGIC, nr)
227 #define SECCOMP_IOR(nr, type) _IOR(SECCOMP_IOC_MAGIC, nr, type)
228 #define SECCOMP_IOW(nr, type) _IOW(SECCOMP_IOC_MAGIC, nr, type)
229 #define SECCOMP_IOWR(nr, type) _IOWR(SECCOMP_IOC_MAGIC, nr, type)
230
231 /* Flags for seccomp notification fd ioctl. */
232 #define SECCOMP_IOCTL_NOTIF_RECV SECCOMP_IOWR(0, struct seccomp_notif)
233 #define SECCOMP_IOCTL_NOTIF_SEND SECCOMP_IOWR(1, \
234 struct seccomp_notif_resp)
235 #define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOW(2, __u64)
236
237 struct seccomp_notif {
238 __u64 id;
239 __u32 pid;
240 __u32 flags;
241 struct seccomp_data data;
242 };
243
244 struct seccomp_notif_resp {
245 __u64 id;
246 __s64 val;
247 __s32 error;
248 __u32 flags;
249 };
250
251 struct seccomp_notif_sizes {
252 __u16 seccomp_notif;
253 __u16 seccomp_notif_resp;
254 __u16 seccomp_data;
255 };
256 #endif
257
258 #ifndef SECCOMP_IOCTL_NOTIF_ADDFD
259 /* On success, the return value is the remote process's added fd number */
260 #define SECCOMP_IOCTL_NOTIF_ADDFD SECCOMP_IOW(3, \
261 struct seccomp_notif_addfd)
262
263 /* valid flags for seccomp_notif_addfd */
264 #define SECCOMP_ADDFD_FLAG_SETFD (1UL << 0) /* Specify remote fd */
265
266 struct seccomp_notif_addfd {
267 __u64 id;
268 __u32 flags;
269 __u32 srcfd;
270 __u32 newfd;
271 __u32 newfd_flags;
272 };
273 #endif
274
275 #ifndef SECCOMP_ADDFD_FLAG_SEND
276 #define SECCOMP_ADDFD_FLAG_SEND (1UL << 1) /* Addfd and return it, atomically */
277 #endif
278
279 struct seccomp_notif_addfd_small {
280 __u64 id;
281 char weird[4];
282 };
283 #define SECCOMP_IOCTL_NOTIF_ADDFD_SMALL \
284 SECCOMP_IOW(3, struct seccomp_notif_addfd_small)
285
286 struct seccomp_notif_addfd_big {
287 union {
288 struct seccomp_notif_addfd addfd;
289 char buf[sizeof(struct seccomp_notif_addfd) + 8];
290 };
291 };
292 #define SECCOMP_IOCTL_NOTIF_ADDFD_BIG \
293 SECCOMP_IOWR(3, struct seccomp_notif_addfd_big)
294
295 #ifndef PTRACE_EVENTMSG_SYSCALL_ENTRY
296 #define PTRACE_EVENTMSG_SYSCALL_ENTRY 1
297 #define PTRACE_EVENTMSG_SYSCALL_EXIT 2
298 #endif
299
300 #ifndef SECCOMP_USER_NOTIF_FLAG_CONTINUE
301 #define SECCOMP_USER_NOTIF_FLAG_CONTINUE 0x00000001
302 #endif
303
304 #ifndef SECCOMP_FILTER_FLAG_TSYNC_ESRCH
305 #define SECCOMP_FILTER_FLAG_TSYNC_ESRCH (1UL << 4)
306 #endif
307
308 #ifndef SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV
309 #define SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV (1UL << 5)
310 #endif
311
312 #ifndef seccomp
seccomp(unsigned int op,unsigned int flags,void * args)313 int seccomp(unsigned int op, unsigned int flags, void *args)
314 {
315 errno = 0;
316 return syscall(__NR_seccomp, op, flags, args);
317 }
318 #endif
319
320 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
321 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
322 #elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
323 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]) + sizeof(__u32))
324 #else
325 #error "wut? Unknown __BYTE_ORDER__?!"
326 #endif
327
328 #define SIBLING_EXIT_UNKILLED 0xbadbeef
329 #define SIBLING_EXIT_FAILURE 0xbadface
330 #define SIBLING_EXIT_NEWPRIVS 0xbadfeed
331
__filecmp(pid_t pid1,pid_t pid2,int fd1,int fd2)332 static int __filecmp(pid_t pid1, pid_t pid2, int fd1, int fd2)
333 {
334 #ifdef __NR_kcmp
335 errno = 0;
336 return syscall(__NR_kcmp, pid1, pid2, KCMP_FILE, fd1, fd2);
337 #else
338 errno = ENOSYS;
339 return -1;
340 #endif
341 }
342
343 /* Have TH_LOG report actual location filecmp() is used. */
344 #define filecmp(pid1, pid2, fd1, fd2) ({ \
345 int _ret; \
346 \
347 _ret = __filecmp(pid1, pid2, fd1, fd2); \
348 if (_ret != 0) { \
349 if (_ret < 0 && errno == ENOSYS) { \
350 TH_LOG("kcmp() syscall missing (test is less accurate)");\
351 _ret = 0; \
352 } \
353 } \
354 _ret; })
355
TEST(kcmp)356 TEST(kcmp)
357 {
358 int ret;
359
360 ret = __filecmp(getpid(), getpid(), 1, 1);
361 EXPECT_EQ(ret, 0);
362 if (ret != 0 && errno == ENOSYS)
363 SKIP(return, "Kernel does not support kcmp() (missing CONFIG_KCMP?)");
364 }
365
TEST(mode_strict_support)366 TEST(mode_strict_support)
367 {
368 long ret;
369
370 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL);
371 ASSERT_EQ(0, ret) {
372 TH_LOG("Kernel does not support CONFIG_SECCOMP");
373 }
374 syscall(__NR_exit, 0);
375 }
376
TEST_SIGNAL(mode_strict_cannot_call_prctl,SIGKILL)377 TEST_SIGNAL(mode_strict_cannot_call_prctl, SIGKILL)
378 {
379 long ret;
380
381 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL);
382 ASSERT_EQ(0, ret) {
383 TH_LOG("Kernel does not support CONFIG_SECCOMP");
384 }
385 syscall(__NR_prctl, PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
386 NULL, NULL, NULL);
387 EXPECT_FALSE(true) {
388 TH_LOG("Unreachable!");
389 }
390 }
391
392 /* Note! This doesn't test no new privs behavior */
TEST(no_new_privs_support)393 TEST(no_new_privs_support)
394 {
395 long ret;
396
397 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
398 EXPECT_EQ(0, ret) {
399 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
400 }
401 }
402
403 /* Tests kernel support by checking for a copy_from_user() fault on NULL. */
TEST(mode_filter_support)404 TEST(mode_filter_support)
405 {
406 long ret;
407
408 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
409 ASSERT_EQ(0, ret) {
410 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
411 }
412 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, NULL, NULL);
413 EXPECT_EQ(-1, ret);
414 EXPECT_EQ(EFAULT, errno) {
415 TH_LOG("Kernel does not support CONFIG_SECCOMP_FILTER!");
416 }
417 }
418
TEST(mode_filter_without_nnp)419 TEST(mode_filter_without_nnp)
420 {
421 struct sock_filter filter[] = {
422 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
423 };
424 struct sock_fprog prog = {
425 .len = (unsigned short)ARRAY_SIZE(filter),
426 .filter = filter,
427 };
428 long ret;
429 cap_t cap = cap_get_proc();
430 cap_flag_value_t is_cap_sys_admin = 0;
431
432 ret = prctl(PR_GET_NO_NEW_PRIVS, 0, NULL, 0, 0);
433 ASSERT_LE(0, ret) {
434 TH_LOG("Expected 0 or unsupported for NO_NEW_PRIVS");
435 }
436 errno = 0;
437 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
438 /* Succeeds with CAP_SYS_ADMIN, fails without */
439 cap_get_flag(cap, CAP_SYS_ADMIN, CAP_EFFECTIVE, &is_cap_sys_admin);
440 if (!is_cap_sys_admin) {
441 EXPECT_EQ(-1, ret);
442 EXPECT_EQ(EACCES, errno);
443 } else {
444 EXPECT_EQ(0, ret);
445 }
446 }
447
448 #define MAX_INSNS_PER_PATH 32768
449
TEST(filter_size_limits)450 TEST(filter_size_limits)
451 {
452 int i;
453 int count = BPF_MAXINSNS + 1;
454 struct sock_filter allow[] = {
455 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
456 };
457 struct sock_filter *filter;
458 struct sock_fprog prog = { };
459 long ret;
460
461 filter = calloc(count, sizeof(*filter));
462 ASSERT_NE(NULL, filter);
463
464 for (i = 0; i < count; i++)
465 filter[i] = allow[0];
466
467 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
468 ASSERT_EQ(0, ret);
469
470 prog.filter = filter;
471 prog.len = count;
472
473 /* Too many filter instructions in a single filter. */
474 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
475 ASSERT_NE(0, ret) {
476 TH_LOG("Installing %d insn filter was allowed", prog.len);
477 }
478
479 /* One less is okay, though. */
480 prog.len -= 1;
481 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
482 ASSERT_EQ(0, ret) {
483 TH_LOG("Installing %d insn filter wasn't allowed", prog.len);
484 }
485 }
486
TEST(filter_chain_limits)487 TEST(filter_chain_limits)
488 {
489 int i;
490 int count = BPF_MAXINSNS;
491 struct sock_filter allow[] = {
492 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
493 };
494 struct sock_filter *filter;
495 struct sock_fprog prog = { };
496 long ret;
497
498 filter = calloc(count, sizeof(*filter));
499 ASSERT_NE(NULL, filter);
500
501 for (i = 0; i < count; i++)
502 filter[i] = allow[0];
503
504 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
505 ASSERT_EQ(0, ret);
506
507 prog.filter = filter;
508 prog.len = 1;
509
510 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
511 ASSERT_EQ(0, ret);
512
513 prog.len = count;
514
515 /* Too many total filter instructions. */
516 for (i = 0; i < MAX_INSNS_PER_PATH; i++) {
517 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
518 if (ret != 0)
519 break;
520 }
521 ASSERT_NE(0, ret) {
522 TH_LOG("Allowed %d %d-insn filters (total with penalties:%d)",
523 i, count, i * (count + 4));
524 }
525 }
526
TEST(mode_filter_cannot_move_to_strict)527 TEST(mode_filter_cannot_move_to_strict)
528 {
529 struct sock_filter filter[] = {
530 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
531 };
532 struct sock_fprog prog = {
533 .len = (unsigned short)ARRAY_SIZE(filter),
534 .filter = filter,
535 };
536 long ret;
537
538 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
539 ASSERT_EQ(0, ret);
540
541 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
542 ASSERT_EQ(0, ret);
543
544 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, 0, 0);
545 EXPECT_EQ(-1, ret);
546 EXPECT_EQ(EINVAL, errno);
547 }
548
549
TEST(mode_filter_get_seccomp)550 TEST(mode_filter_get_seccomp)
551 {
552 struct sock_filter filter[] = {
553 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
554 };
555 struct sock_fprog prog = {
556 .len = (unsigned short)ARRAY_SIZE(filter),
557 .filter = filter,
558 };
559 long ret;
560
561 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
562 ASSERT_EQ(0, ret);
563
564 ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
565 EXPECT_EQ(0, ret);
566
567 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
568 ASSERT_EQ(0, ret);
569
570 ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
571 EXPECT_EQ(2, ret);
572 }
573
574
TEST(ALLOW_all)575 TEST(ALLOW_all)
576 {
577 struct sock_filter filter[] = {
578 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
579 };
580 struct sock_fprog prog = {
581 .len = (unsigned short)ARRAY_SIZE(filter),
582 .filter = filter,
583 };
584 long ret;
585
586 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
587 ASSERT_EQ(0, ret);
588
589 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
590 ASSERT_EQ(0, ret);
591 }
592
TEST(empty_prog)593 TEST(empty_prog)
594 {
595 struct sock_filter filter[] = {
596 };
597 struct sock_fprog prog = {
598 .len = (unsigned short)ARRAY_SIZE(filter),
599 .filter = filter,
600 };
601 long ret;
602
603 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
604 ASSERT_EQ(0, ret);
605
606 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
607 EXPECT_EQ(-1, ret);
608 EXPECT_EQ(EINVAL, errno);
609 }
610
TEST(log_all)611 TEST(log_all)
612 {
613 struct sock_filter filter[] = {
614 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG),
615 };
616 struct sock_fprog prog = {
617 .len = (unsigned short)ARRAY_SIZE(filter),
618 .filter = filter,
619 };
620 long ret;
621 pid_t parent = getppid();
622
623 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
624 ASSERT_EQ(0, ret);
625
626 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
627 ASSERT_EQ(0, ret);
628
629 /* getppid() should succeed and be logged (no check for logging) */
630 EXPECT_EQ(parent, syscall(__NR_getppid));
631 }
632
TEST_SIGNAL(unknown_ret_is_kill_inside,SIGSYS)633 TEST_SIGNAL(unknown_ret_is_kill_inside, SIGSYS)
634 {
635 struct sock_filter filter[] = {
636 BPF_STMT(BPF_RET|BPF_K, 0x10000000U),
637 };
638 struct sock_fprog prog = {
639 .len = (unsigned short)ARRAY_SIZE(filter),
640 .filter = filter,
641 };
642 long ret;
643
644 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
645 ASSERT_EQ(0, ret);
646
647 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
648 ASSERT_EQ(0, ret);
649 EXPECT_EQ(0, syscall(__NR_getpid)) {
650 TH_LOG("getpid() shouldn't ever return");
651 }
652 }
653
654 /* return code >= 0x80000000 is unused. */
TEST_SIGNAL(unknown_ret_is_kill_above_allow,SIGSYS)655 TEST_SIGNAL(unknown_ret_is_kill_above_allow, SIGSYS)
656 {
657 struct sock_filter filter[] = {
658 BPF_STMT(BPF_RET|BPF_K, 0x90000000U),
659 };
660 struct sock_fprog prog = {
661 .len = (unsigned short)ARRAY_SIZE(filter),
662 .filter = filter,
663 };
664 long ret;
665
666 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
667 ASSERT_EQ(0, ret);
668
669 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
670 ASSERT_EQ(0, ret);
671 EXPECT_EQ(0, syscall(__NR_getpid)) {
672 TH_LOG("getpid() shouldn't ever return");
673 }
674 }
675
TEST_SIGNAL(KILL_all,SIGSYS)676 TEST_SIGNAL(KILL_all, SIGSYS)
677 {
678 struct sock_filter filter[] = {
679 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
680 };
681 struct sock_fprog prog = {
682 .len = (unsigned short)ARRAY_SIZE(filter),
683 .filter = filter,
684 };
685 long ret;
686
687 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
688 ASSERT_EQ(0, ret);
689
690 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
691 ASSERT_EQ(0, ret);
692 }
693
TEST_SIGNAL(KILL_one,SIGSYS)694 TEST_SIGNAL(KILL_one, SIGSYS)
695 {
696 struct sock_filter filter[] = {
697 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
698 offsetof(struct seccomp_data, nr)),
699 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
700 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
701 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
702 };
703 struct sock_fprog prog = {
704 .len = (unsigned short)ARRAY_SIZE(filter),
705 .filter = filter,
706 };
707 long ret;
708 pid_t parent = getppid();
709
710 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
711 ASSERT_EQ(0, ret);
712
713 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
714 ASSERT_EQ(0, ret);
715
716 EXPECT_EQ(parent, syscall(__NR_getppid));
717 /* getpid() should never return. */
718 EXPECT_EQ(0, syscall(__NR_getpid));
719 }
720
TEST_SIGNAL(KILL_one_arg_one,SIGSYS)721 TEST_SIGNAL(KILL_one_arg_one, SIGSYS)
722 {
723 void *fatal_address;
724 struct sock_filter filter[] = {
725 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
726 offsetof(struct seccomp_data, nr)),
727 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_times, 1, 0),
728 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
729 /* Only both with lower 32-bit for now. */
730 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(0)),
731 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K,
732 (unsigned long)&fatal_address, 0, 1),
733 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
734 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
735 };
736 struct sock_fprog prog = {
737 .len = (unsigned short)ARRAY_SIZE(filter),
738 .filter = filter,
739 };
740 long ret;
741 pid_t parent = getppid();
742 struct tms timebuf;
743 clock_t clock = times(&timebuf);
744
745 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
746 ASSERT_EQ(0, ret);
747
748 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
749 ASSERT_EQ(0, ret);
750
751 EXPECT_EQ(parent, syscall(__NR_getppid));
752 EXPECT_LE(clock, syscall(__NR_times, &timebuf));
753 /* times() should never return. */
754 EXPECT_EQ(0, syscall(__NR_times, &fatal_address));
755 }
756
TEST_SIGNAL(KILL_one_arg_six,SIGSYS)757 TEST_SIGNAL(KILL_one_arg_six, SIGSYS)
758 {
759 #ifndef __NR_mmap2
760 int sysno = __NR_mmap;
761 #else
762 int sysno = __NR_mmap2;
763 #endif
764 struct sock_filter filter[] = {
765 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
766 offsetof(struct seccomp_data, nr)),
767 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, sysno, 1, 0),
768 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
769 /* Only both with lower 32-bit for now. */
770 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(5)),
771 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 0x0C0FFEE, 0, 1),
772 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
773 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
774 };
775 struct sock_fprog prog = {
776 .len = (unsigned short)ARRAY_SIZE(filter),
777 .filter = filter,
778 };
779 long ret;
780 pid_t parent = getppid();
781 int fd;
782 void *map1, *map2;
783 int page_size = sysconf(_SC_PAGESIZE);
784
785 ASSERT_LT(0, page_size);
786
787 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
788 ASSERT_EQ(0, ret);
789
790 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
791 ASSERT_EQ(0, ret);
792
793 fd = open("/dev/zero", O_RDONLY);
794 ASSERT_NE(-1, fd);
795
796 EXPECT_EQ(parent, syscall(__NR_getppid));
797 map1 = (void *)syscall(sysno,
798 NULL, page_size, PROT_READ, MAP_PRIVATE, fd, page_size);
799 EXPECT_NE(MAP_FAILED, map1);
800 /* mmap2() should never return. */
801 map2 = (void *)syscall(sysno,
802 NULL, page_size, PROT_READ, MAP_PRIVATE, fd, 0x0C0FFEE);
803 EXPECT_EQ(MAP_FAILED, map2);
804
805 /* The test failed, so clean up the resources. */
806 munmap(map1, page_size);
807 munmap(map2, page_size);
808 close(fd);
809 }
810
811 /* This is a thread task to die via seccomp filter violation. */
kill_thread(void * data)812 void *kill_thread(void *data)
813 {
814 bool die = (bool)data;
815
816 if (die) {
817 syscall(__NR_getpid);
818 return (void *)SIBLING_EXIT_FAILURE;
819 }
820
821 return (void *)SIBLING_EXIT_UNKILLED;
822 }
823
824 enum kill_t {
825 KILL_THREAD,
826 KILL_PROCESS,
827 RET_UNKNOWN
828 };
829
830 /* Prepare a thread that will kill itself or both of us. */
kill_thread_or_group(struct __test_metadata * _metadata,enum kill_t kill_how)831 void kill_thread_or_group(struct __test_metadata *_metadata,
832 enum kill_t kill_how)
833 {
834 pthread_t thread;
835 void *status;
836 /* Kill only when calling __NR_getpid. */
837 struct sock_filter filter_thread[] = {
838 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
839 offsetof(struct seccomp_data, nr)),
840 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
841 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_THREAD),
842 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
843 };
844 struct sock_fprog prog_thread = {
845 .len = (unsigned short)ARRAY_SIZE(filter_thread),
846 .filter = filter_thread,
847 };
848 int kill = kill_how == KILL_PROCESS ? SECCOMP_RET_KILL_PROCESS : 0xAAAAAAAA;
849 struct sock_filter filter_process[] = {
850 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
851 offsetof(struct seccomp_data, nr)),
852 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
853 BPF_STMT(BPF_RET|BPF_K, kill),
854 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
855 };
856 struct sock_fprog prog_process = {
857 .len = (unsigned short)ARRAY_SIZE(filter_process),
858 .filter = filter_process,
859 };
860
861 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
862 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
863 }
864
865 ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0,
866 kill_how == KILL_THREAD ? &prog_thread
867 : &prog_process));
868
869 /*
870 * Add the KILL_THREAD rule again to make sure that the KILL_PROCESS
871 * flag cannot be downgraded by a new filter.
872 */
873 if (kill_how == KILL_PROCESS)
874 ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread));
875
876 /* Start a thread that will exit immediately. */
877 ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)false));
878 ASSERT_EQ(0, pthread_join(thread, &status));
879 ASSERT_EQ(SIBLING_EXIT_UNKILLED, (unsigned long)status);
880
881 /* Start a thread that will die immediately. */
882 ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)true));
883 ASSERT_EQ(0, pthread_join(thread, &status));
884 ASSERT_NE(SIBLING_EXIT_FAILURE, (unsigned long)status);
885
886 /*
887 * If we get here, only the spawned thread died. Let the parent know
888 * the whole process didn't die (i.e. this thread, the spawner,
889 * stayed running).
890 */
891 exit(42);
892 }
893
TEST(KILL_thread)894 TEST(KILL_thread)
895 {
896 int status;
897 pid_t child_pid;
898
899 child_pid = fork();
900 ASSERT_LE(0, child_pid);
901 if (child_pid == 0) {
902 kill_thread_or_group(_metadata, KILL_THREAD);
903 _exit(38);
904 }
905
906 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
907
908 /* If only the thread was killed, we'll see exit 42. */
909 ASSERT_TRUE(WIFEXITED(status));
910 ASSERT_EQ(42, WEXITSTATUS(status));
911 }
912
TEST(KILL_process)913 TEST(KILL_process)
914 {
915 int status;
916 pid_t child_pid;
917
918 child_pid = fork();
919 ASSERT_LE(0, child_pid);
920 if (child_pid == 0) {
921 kill_thread_or_group(_metadata, KILL_PROCESS);
922 _exit(38);
923 }
924
925 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
926
927 /* If the entire process was killed, we'll see SIGSYS. */
928 ASSERT_TRUE(WIFSIGNALED(status));
929 ASSERT_EQ(SIGSYS, WTERMSIG(status));
930 }
931
TEST(KILL_unknown)932 TEST(KILL_unknown)
933 {
934 int status;
935 pid_t child_pid;
936
937 child_pid = fork();
938 ASSERT_LE(0, child_pid);
939 if (child_pid == 0) {
940 kill_thread_or_group(_metadata, RET_UNKNOWN);
941 _exit(38);
942 }
943
944 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
945
946 /* If the entire process was killed, we'll see SIGSYS. */
947 EXPECT_TRUE(WIFSIGNALED(status)) {
948 TH_LOG("Unknown SECCOMP_RET is only killing the thread?");
949 }
950 ASSERT_EQ(SIGSYS, WTERMSIG(status));
951 }
952
953 /* TODO(wad) add 64-bit versus 32-bit arg tests. */
TEST(arg_out_of_range)954 TEST(arg_out_of_range)
955 {
956 struct sock_filter filter[] = {
957 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(6)),
958 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
959 };
960 struct sock_fprog prog = {
961 .len = (unsigned short)ARRAY_SIZE(filter),
962 .filter = filter,
963 };
964 long ret;
965
966 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
967 ASSERT_EQ(0, ret);
968
969 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
970 EXPECT_EQ(-1, ret);
971 EXPECT_EQ(EINVAL, errno);
972 }
973
974 #define ERRNO_FILTER(name, errno) \
975 struct sock_filter _read_filter_##name[] = { \
976 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, \
977 offsetof(struct seccomp_data, nr)), \
978 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1), \
979 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | errno), \
980 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), \
981 }; \
982 struct sock_fprog prog_##name = { \
983 .len = (unsigned short)ARRAY_SIZE(_read_filter_##name), \
984 .filter = _read_filter_##name, \
985 }
986
987 /* Make sure basic errno values are correctly passed through a filter. */
TEST(ERRNO_valid)988 TEST(ERRNO_valid)
989 {
990 ERRNO_FILTER(valid, E2BIG);
991 long ret;
992 pid_t parent = getppid();
993
994 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
995 ASSERT_EQ(0, ret);
996
997 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_valid);
998 ASSERT_EQ(0, ret);
999
1000 EXPECT_EQ(parent, syscall(__NR_getppid));
1001 EXPECT_EQ(-1, read(-1, NULL, 0));
1002 EXPECT_EQ(E2BIG, errno);
1003 }
1004
1005 /* Make sure an errno of zero is correctly handled by the arch code. */
TEST(ERRNO_zero)1006 TEST(ERRNO_zero)
1007 {
1008 ERRNO_FILTER(zero, 0);
1009 long ret;
1010 pid_t parent = getppid();
1011
1012 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1013 ASSERT_EQ(0, ret);
1014
1015 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_zero);
1016 ASSERT_EQ(0, ret);
1017
1018 EXPECT_EQ(parent, syscall(__NR_getppid));
1019 /* "errno" of 0 is ok. */
1020 EXPECT_EQ(0, read(-1, NULL, 0));
1021 }
1022
1023 /*
1024 * The SECCOMP_RET_DATA mask is 16 bits wide, but errno is smaller.
1025 * This tests that the errno value gets capped correctly, fixed by
1026 * 580c57f10768 ("seccomp: cap SECCOMP_RET_ERRNO data to MAX_ERRNO").
1027 */
TEST(ERRNO_capped)1028 TEST(ERRNO_capped)
1029 {
1030 ERRNO_FILTER(capped, 4096);
1031 long ret;
1032 pid_t parent = getppid();
1033
1034 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1035 ASSERT_EQ(0, ret);
1036
1037 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_capped);
1038 ASSERT_EQ(0, ret);
1039
1040 EXPECT_EQ(parent, syscall(__NR_getppid));
1041 EXPECT_EQ(-1, read(-1, NULL, 0));
1042 EXPECT_EQ(4095, errno);
1043 }
1044
1045 /*
1046 * Filters are processed in reverse order: last applied is executed first.
1047 * Since only the SECCOMP_RET_ACTION mask is tested for return values, the
1048 * SECCOMP_RET_DATA mask results will follow the most recently applied
1049 * matching filter return (and not the lowest or highest value).
1050 */
TEST(ERRNO_order)1051 TEST(ERRNO_order)
1052 {
1053 ERRNO_FILTER(first, 11);
1054 ERRNO_FILTER(second, 13);
1055 ERRNO_FILTER(third, 12);
1056 long ret;
1057 pid_t parent = getppid();
1058
1059 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1060 ASSERT_EQ(0, ret);
1061
1062 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_first);
1063 ASSERT_EQ(0, ret);
1064
1065 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_second);
1066 ASSERT_EQ(0, ret);
1067
1068 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_third);
1069 ASSERT_EQ(0, ret);
1070
1071 EXPECT_EQ(parent, syscall(__NR_getppid));
1072 EXPECT_EQ(-1, read(-1, NULL, 0));
1073 EXPECT_EQ(12, errno);
1074 }
1075
FIXTURE(TRAP)1076 FIXTURE(TRAP) {
1077 struct sock_fprog prog;
1078 };
1079
FIXTURE_SETUP(TRAP)1080 FIXTURE_SETUP(TRAP)
1081 {
1082 struct sock_filter filter[] = {
1083 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1084 offsetof(struct seccomp_data, nr)),
1085 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
1086 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
1087 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1088 };
1089
1090 memset(&self->prog, 0, sizeof(self->prog));
1091 self->prog.filter = malloc(sizeof(filter));
1092 ASSERT_NE(NULL, self->prog.filter);
1093 memcpy(self->prog.filter, filter, sizeof(filter));
1094 self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1095 }
1096
FIXTURE_TEARDOWN(TRAP)1097 FIXTURE_TEARDOWN(TRAP)
1098 {
1099 if (self->prog.filter)
1100 free(self->prog.filter);
1101 }
1102
TEST_F_SIGNAL(TRAP,dfl,SIGSYS)1103 TEST_F_SIGNAL(TRAP, dfl, SIGSYS)
1104 {
1105 long ret;
1106
1107 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1108 ASSERT_EQ(0, ret);
1109
1110 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1111 ASSERT_EQ(0, ret);
1112 syscall(__NR_getpid);
1113 }
1114
1115 /* Ensure that SIGSYS overrides SIG_IGN */
TEST_F_SIGNAL(TRAP,ign,SIGSYS)1116 TEST_F_SIGNAL(TRAP, ign, SIGSYS)
1117 {
1118 long ret;
1119
1120 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1121 ASSERT_EQ(0, ret);
1122
1123 signal(SIGSYS, SIG_IGN);
1124
1125 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1126 ASSERT_EQ(0, ret);
1127 syscall(__NR_getpid);
1128 }
1129
1130 static siginfo_t TRAP_info;
1131 static volatile int TRAP_nr;
TRAP_action(int nr,siginfo_t * info,void * void_context)1132 static void TRAP_action(int nr, siginfo_t *info, void *void_context)
1133 {
1134 memcpy(&TRAP_info, info, sizeof(TRAP_info));
1135 TRAP_nr = nr;
1136 }
1137
TEST_F(TRAP,handler)1138 TEST_F(TRAP, handler)
1139 {
1140 int ret, test;
1141 struct sigaction act;
1142 sigset_t mask;
1143
1144 memset(&act, 0, sizeof(act));
1145 sigemptyset(&mask);
1146 sigaddset(&mask, SIGSYS);
1147
1148 act.sa_sigaction = &TRAP_action;
1149 act.sa_flags = SA_SIGINFO;
1150 ret = sigaction(SIGSYS, &act, NULL);
1151 ASSERT_EQ(0, ret) {
1152 TH_LOG("sigaction failed");
1153 }
1154 ret = sigprocmask(SIG_UNBLOCK, &mask, NULL);
1155 ASSERT_EQ(0, ret) {
1156 TH_LOG("sigprocmask failed");
1157 }
1158
1159 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1160 ASSERT_EQ(0, ret);
1161 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1162 ASSERT_EQ(0, ret);
1163 TRAP_nr = 0;
1164 memset(&TRAP_info, 0, sizeof(TRAP_info));
1165 /* Expect the registers to be rolled back. (nr = error) may vary
1166 * based on arch. */
1167 ret = syscall(__NR_getpid);
1168 /* Silence gcc warning about volatile. */
1169 test = TRAP_nr;
1170 EXPECT_EQ(SIGSYS, test);
1171 struct local_sigsys {
1172 void *_call_addr; /* calling user insn */
1173 int _syscall; /* triggering system call number */
1174 unsigned int _arch; /* AUDIT_ARCH_* of syscall */
1175 } *sigsys = (struct local_sigsys *)
1176 #ifdef si_syscall
1177 &(TRAP_info.si_call_addr);
1178 #else
1179 &TRAP_info.si_pid;
1180 #endif
1181 EXPECT_EQ(__NR_getpid, sigsys->_syscall);
1182 /* Make sure arch is non-zero. */
1183 EXPECT_NE(0, sigsys->_arch);
1184 EXPECT_NE(0, (unsigned long)sigsys->_call_addr);
1185 }
1186
FIXTURE(precedence)1187 FIXTURE(precedence) {
1188 struct sock_fprog allow;
1189 struct sock_fprog log;
1190 struct sock_fprog trace;
1191 struct sock_fprog error;
1192 struct sock_fprog trap;
1193 struct sock_fprog kill;
1194 };
1195
FIXTURE_SETUP(precedence)1196 FIXTURE_SETUP(precedence)
1197 {
1198 struct sock_filter allow_insns[] = {
1199 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1200 };
1201 struct sock_filter log_insns[] = {
1202 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1203 offsetof(struct seccomp_data, nr)),
1204 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1205 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1206 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG),
1207 };
1208 struct sock_filter trace_insns[] = {
1209 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1210 offsetof(struct seccomp_data, nr)),
1211 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1212 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1213 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE),
1214 };
1215 struct sock_filter error_insns[] = {
1216 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1217 offsetof(struct seccomp_data, nr)),
1218 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1219 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1220 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO),
1221 };
1222 struct sock_filter trap_insns[] = {
1223 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1224 offsetof(struct seccomp_data, nr)),
1225 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1226 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1227 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
1228 };
1229 struct sock_filter kill_insns[] = {
1230 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1231 offsetof(struct seccomp_data, nr)),
1232 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1233 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1234 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
1235 };
1236
1237 memset(self, 0, sizeof(*self));
1238 #define FILTER_ALLOC(_x) \
1239 self->_x.filter = malloc(sizeof(_x##_insns)); \
1240 ASSERT_NE(NULL, self->_x.filter); \
1241 memcpy(self->_x.filter, &_x##_insns, sizeof(_x##_insns)); \
1242 self->_x.len = (unsigned short)ARRAY_SIZE(_x##_insns)
1243 FILTER_ALLOC(allow);
1244 FILTER_ALLOC(log);
1245 FILTER_ALLOC(trace);
1246 FILTER_ALLOC(error);
1247 FILTER_ALLOC(trap);
1248 FILTER_ALLOC(kill);
1249 }
1250
FIXTURE_TEARDOWN(precedence)1251 FIXTURE_TEARDOWN(precedence)
1252 {
1253 #define FILTER_FREE(_x) if (self->_x.filter) free(self->_x.filter)
1254 FILTER_FREE(allow);
1255 FILTER_FREE(log);
1256 FILTER_FREE(trace);
1257 FILTER_FREE(error);
1258 FILTER_FREE(trap);
1259 FILTER_FREE(kill);
1260 }
1261
TEST_F(precedence,allow_ok)1262 TEST_F(precedence, allow_ok)
1263 {
1264 pid_t parent, res = 0;
1265 long ret;
1266
1267 parent = getppid();
1268 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1269 ASSERT_EQ(0, ret);
1270
1271 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1272 ASSERT_EQ(0, ret);
1273 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1274 ASSERT_EQ(0, ret);
1275 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1276 ASSERT_EQ(0, ret);
1277 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1278 ASSERT_EQ(0, ret);
1279 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1280 ASSERT_EQ(0, ret);
1281 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1282 ASSERT_EQ(0, ret);
1283 /* Should work just fine. */
1284 res = syscall(__NR_getppid);
1285 EXPECT_EQ(parent, res);
1286 }
1287
TEST_F_SIGNAL(precedence,kill_is_highest,SIGSYS)1288 TEST_F_SIGNAL(precedence, kill_is_highest, SIGSYS)
1289 {
1290 pid_t parent, res = 0;
1291 long ret;
1292
1293 parent = getppid();
1294 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1295 ASSERT_EQ(0, ret);
1296
1297 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1298 ASSERT_EQ(0, ret);
1299 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1300 ASSERT_EQ(0, ret);
1301 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1302 ASSERT_EQ(0, ret);
1303 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1304 ASSERT_EQ(0, ret);
1305 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1306 ASSERT_EQ(0, ret);
1307 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1308 ASSERT_EQ(0, ret);
1309 /* Should work just fine. */
1310 res = syscall(__NR_getppid);
1311 EXPECT_EQ(parent, res);
1312 /* getpid() should never return. */
1313 res = syscall(__NR_getpid);
1314 EXPECT_EQ(0, res);
1315 }
1316
TEST_F_SIGNAL(precedence,kill_is_highest_in_any_order,SIGSYS)1317 TEST_F_SIGNAL(precedence, kill_is_highest_in_any_order, SIGSYS)
1318 {
1319 pid_t parent;
1320 long ret;
1321
1322 parent = getppid();
1323 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1324 ASSERT_EQ(0, ret);
1325
1326 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1327 ASSERT_EQ(0, ret);
1328 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1329 ASSERT_EQ(0, ret);
1330 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1331 ASSERT_EQ(0, ret);
1332 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1333 ASSERT_EQ(0, ret);
1334 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1335 ASSERT_EQ(0, ret);
1336 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1337 ASSERT_EQ(0, ret);
1338 /* Should work just fine. */
1339 EXPECT_EQ(parent, syscall(__NR_getppid));
1340 /* getpid() should never return. */
1341 EXPECT_EQ(0, syscall(__NR_getpid));
1342 }
1343
TEST_F_SIGNAL(precedence,trap_is_second,SIGSYS)1344 TEST_F_SIGNAL(precedence, trap_is_second, SIGSYS)
1345 {
1346 pid_t parent;
1347 long ret;
1348
1349 parent = getppid();
1350 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1351 ASSERT_EQ(0, ret);
1352
1353 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1354 ASSERT_EQ(0, ret);
1355 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1356 ASSERT_EQ(0, ret);
1357 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1358 ASSERT_EQ(0, ret);
1359 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1360 ASSERT_EQ(0, ret);
1361 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1362 ASSERT_EQ(0, ret);
1363 /* Should work just fine. */
1364 EXPECT_EQ(parent, syscall(__NR_getppid));
1365 /* getpid() should never return. */
1366 EXPECT_EQ(0, syscall(__NR_getpid));
1367 }
1368
TEST_F_SIGNAL(precedence,trap_is_second_in_any_order,SIGSYS)1369 TEST_F_SIGNAL(precedence, trap_is_second_in_any_order, SIGSYS)
1370 {
1371 pid_t parent;
1372 long ret;
1373
1374 parent = getppid();
1375 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1376 ASSERT_EQ(0, ret);
1377
1378 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1379 ASSERT_EQ(0, ret);
1380 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1381 ASSERT_EQ(0, ret);
1382 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1383 ASSERT_EQ(0, ret);
1384 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1385 ASSERT_EQ(0, ret);
1386 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1387 ASSERT_EQ(0, ret);
1388 /* Should work just fine. */
1389 EXPECT_EQ(parent, syscall(__NR_getppid));
1390 /* getpid() should never return. */
1391 EXPECT_EQ(0, syscall(__NR_getpid));
1392 }
1393
TEST_F(precedence,errno_is_third)1394 TEST_F(precedence, errno_is_third)
1395 {
1396 pid_t parent;
1397 long ret;
1398
1399 parent = getppid();
1400 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1401 ASSERT_EQ(0, ret);
1402
1403 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1404 ASSERT_EQ(0, ret);
1405 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1406 ASSERT_EQ(0, ret);
1407 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1408 ASSERT_EQ(0, ret);
1409 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1410 ASSERT_EQ(0, ret);
1411 /* Should work just fine. */
1412 EXPECT_EQ(parent, syscall(__NR_getppid));
1413 EXPECT_EQ(0, syscall(__NR_getpid));
1414 }
1415
TEST_F(precedence,errno_is_third_in_any_order)1416 TEST_F(precedence, errno_is_third_in_any_order)
1417 {
1418 pid_t parent;
1419 long ret;
1420
1421 parent = getppid();
1422 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1423 ASSERT_EQ(0, ret);
1424
1425 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1426 ASSERT_EQ(0, ret);
1427 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1428 ASSERT_EQ(0, ret);
1429 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1430 ASSERT_EQ(0, ret);
1431 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1432 ASSERT_EQ(0, ret);
1433 /* Should work just fine. */
1434 EXPECT_EQ(parent, syscall(__NR_getppid));
1435 EXPECT_EQ(0, syscall(__NR_getpid));
1436 }
1437
TEST_F(precedence,trace_is_fourth)1438 TEST_F(precedence, trace_is_fourth)
1439 {
1440 pid_t parent;
1441 long ret;
1442
1443 parent = getppid();
1444 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1445 ASSERT_EQ(0, ret);
1446
1447 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1448 ASSERT_EQ(0, ret);
1449 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1450 ASSERT_EQ(0, ret);
1451 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1452 ASSERT_EQ(0, ret);
1453 /* Should work just fine. */
1454 EXPECT_EQ(parent, syscall(__NR_getppid));
1455 /* No ptracer */
1456 EXPECT_EQ(-1, syscall(__NR_getpid));
1457 }
1458
TEST_F(precedence,trace_is_fourth_in_any_order)1459 TEST_F(precedence, trace_is_fourth_in_any_order)
1460 {
1461 pid_t parent;
1462 long ret;
1463
1464 parent = getppid();
1465 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1466 ASSERT_EQ(0, ret);
1467
1468 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1469 ASSERT_EQ(0, ret);
1470 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1471 ASSERT_EQ(0, ret);
1472 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1473 ASSERT_EQ(0, ret);
1474 /* Should work just fine. */
1475 EXPECT_EQ(parent, syscall(__NR_getppid));
1476 /* No ptracer */
1477 EXPECT_EQ(-1, syscall(__NR_getpid));
1478 }
1479
TEST_F(precedence,log_is_fifth)1480 TEST_F(precedence, log_is_fifth)
1481 {
1482 pid_t mypid, parent;
1483 long ret;
1484
1485 mypid = getpid();
1486 parent = getppid();
1487 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1488 ASSERT_EQ(0, ret);
1489
1490 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1491 ASSERT_EQ(0, ret);
1492 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1493 ASSERT_EQ(0, ret);
1494 /* Should work just fine. */
1495 EXPECT_EQ(parent, syscall(__NR_getppid));
1496 /* Should also work just fine */
1497 EXPECT_EQ(mypid, syscall(__NR_getpid));
1498 }
1499
TEST_F(precedence,log_is_fifth_in_any_order)1500 TEST_F(precedence, log_is_fifth_in_any_order)
1501 {
1502 pid_t mypid, parent;
1503 long ret;
1504
1505 mypid = getpid();
1506 parent = getppid();
1507 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1508 ASSERT_EQ(0, ret);
1509
1510 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1511 ASSERT_EQ(0, ret);
1512 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1513 ASSERT_EQ(0, ret);
1514 /* Should work just fine. */
1515 EXPECT_EQ(parent, syscall(__NR_getppid));
1516 /* Should also work just fine */
1517 EXPECT_EQ(mypid, syscall(__NR_getpid));
1518 }
1519
1520 #ifndef PTRACE_O_TRACESECCOMP
1521 #define PTRACE_O_TRACESECCOMP 0x00000080
1522 #endif
1523
1524 /* Catch the Ubuntu 12.04 value error. */
1525 #if PTRACE_EVENT_SECCOMP != 7
1526 #undef PTRACE_EVENT_SECCOMP
1527 #endif
1528
1529 #ifndef PTRACE_EVENT_SECCOMP
1530 #define PTRACE_EVENT_SECCOMP 7
1531 #endif
1532
1533 #define PTRACE_EVENT_MASK(status) ((status) >> 16)
1534 bool tracer_running;
tracer_stop(int sig)1535 void tracer_stop(int sig)
1536 {
1537 tracer_running = false;
1538 }
1539
1540 typedef void tracer_func_t(struct __test_metadata *_metadata,
1541 pid_t tracee, int status, void *args);
1542
start_tracer(struct __test_metadata * _metadata,int fd,pid_t tracee,tracer_func_t tracer_func,void * args,bool ptrace_syscall)1543 void start_tracer(struct __test_metadata *_metadata, int fd, pid_t tracee,
1544 tracer_func_t tracer_func, void *args, bool ptrace_syscall)
1545 {
1546 int ret = -1;
1547 struct sigaction action = {
1548 .sa_handler = tracer_stop,
1549 };
1550
1551 /* Allow external shutdown. */
1552 tracer_running = true;
1553 ASSERT_EQ(0, sigaction(SIGUSR1, &action, NULL));
1554
1555 errno = 0;
1556 while (ret == -1 && errno != EINVAL)
1557 ret = ptrace(PTRACE_ATTACH, tracee, NULL, 0);
1558 ASSERT_EQ(0, ret) {
1559 kill(tracee, SIGKILL);
1560 }
1561 /* Wait for attach stop */
1562 wait(NULL);
1563
1564 ret = ptrace(PTRACE_SETOPTIONS, tracee, NULL, ptrace_syscall ?
1565 PTRACE_O_TRACESYSGOOD :
1566 PTRACE_O_TRACESECCOMP);
1567 ASSERT_EQ(0, ret) {
1568 TH_LOG("Failed to set PTRACE_O_TRACESECCOMP");
1569 kill(tracee, SIGKILL);
1570 }
1571 ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT,
1572 tracee, NULL, 0);
1573 ASSERT_EQ(0, ret);
1574
1575 /* Unblock the tracee */
1576 ASSERT_EQ(1, write(fd, "A", 1));
1577 ASSERT_EQ(0, close(fd));
1578
1579 /* Run until we're shut down. Must assert to stop execution. */
1580 while (tracer_running) {
1581 int status;
1582
1583 if (wait(&status) != tracee)
1584 continue;
1585
1586 if (WIFSIGNALED(status)) {
1587 /* Child caught a fatal signal. */
1588 return;
1589 }
1590 if (WIFEXITED(status)) {
1591 /* Child exited with code. */
1592 return;
1593 }
1594
1595 /* Check if we got an expected event. */
1596 ASSERT_EQ(WIFCONTINUED(status), false);
1597 ASSERT_EQ(WIFSTOPPED(status), true);
1598 ASSERT_EQ(WSTOPSIG(status) & SIGTRAP, SIGTRAP) {
1599 TH_LOG("Unexpected WSTOPSIG: %d", WSTOPSIG(status));
1600 }
1601
1602 tracer_func(_metadata, tracee, status, args);
1603
1604 ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT,
1605 tracee, NULL, 0);
1606 ASSERT_EQ(0, ret);
1607 }
1608 /* Directly report the status of our test harness results. */
1609 syscall(__NR_exit, _metadata->exit_code);
1610 }
1611
1612 /* Common tracer setup/teardown functions. */
cont_handler(int num)1613 void cont_handler(int num)
1614 { }
setup_trace_fixture(struct __test_metadata * _metadata,tracer_func_t func,void * args,bool ptrace_syscall)1615 pid_t setup_trace_fixture(struct __test_metadata *_metadata,
1616 tracer_func_t func, void *args, bool ptrace_syscall)
1617 {
1618 char sync;
1619 int pipefd[2];
1620 pid_t tracer_pid;
1621 pid_t tracee = getpid();
1622
1623 /* Setup a pipe for clean synchronization. */
1624 ASSERT_EQ(0, pipe(pipefd));
1625
1626 /* Fork a child which we'll promote to tracer */
1627 tracer_pid = fork();
1628 ASSERT_LE(0, tracer_pid);
1629 signal(SIGALRM, cont_handler);
1630 if (tracer_pid == 0) {
1631 close(pipefd[0]);
1632 start_tracer(_metadata, pipefd[1], tracee, func, args,
1633 ptrace_syscall);
1634 syscall(__NR_exit, 0);
1635 }
1636 close(pipefd[1]);
1637 prctl(PR_SET_PTRACER, tracer_pid, 0, 0, 0);
1638 read(pipefd[0], &sync, 1);
1639 close(pipefd[0]);
1640
1641 return tracer_pid;
1642 }
1643
teardown_trace_fixture(struct __test_metadata * _metadata,pid_t tracer)1644 void teardown_trace_fixture(struct __test_metadata *_metadata,
1645 pid_t tracer)
1646 {
1647 if (tracer) {
1648 int status;
1649 ASSERT_EQ(0, kill(tracer, SIGUSR1));
1650 ASSERT_EQ(tracer, waitpid(tracer, &status, 0));
1651 }
1652 }
1653
1654 /* "poke" tracer arguments and function. */
1655 struct tracer_args_poke_t {
1656 unsigned long poke_addr;
1657 };
1658
tracer_poke(struct __test_metadata * _metadata,pid_t tracee,int status,void * args)1659 void tracer_poke(struct __test_metadata *_metadata, pid_t tracee, int status,
1660 void *args)
1661 {
1662 int ret;
1663 unsigned long msg;
1664 struct tracer_args_poke_t *info = (struct tracer_args_poke_t *)args;
1665
1666 ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
1667 EXPECT_EQ(0, ret);
1668 /* If this fails, don't try to recover. */
1669 ASSERT_EQ(0x1001, msg) {
1670 kill(tracee, SIGKILL);
1671 }
1672 /*
1673 * Poke in the message.
1674 * Registers are not touched to try to keep this relatively arch
1675 * agnostic.
1676 */
1677 ret = ptrace(PTRACE_POKEDATA, tracee, info->poke_addr, 0x1001);
1678 EXPECT_EQ(0, ret);
1679 }
1680
FIXTURE(TRACE_poke)1681 FIXTURE(TRACE_poke) {
1682 struct sock_fprog prog;
1683 pid_t tracer;
1684 long poked;
1685 struct tracer_args_poke_t tracer_args;
1686 };
1687
FIXTURE_SETUP(TRACE_poke)1688 FIXTURE_SETUP(TRACE_poke)
1689 {
1690 struct sock_filter filter[] = {
1691 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1692 offsetof(struct seccomp_data, nr)),
1693 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
1694 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1001),
1695 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1696 };
1697
1698 self->poked = 0;
1699 memset(&self->prog, 0, sizeof(self->prog));
1700 self->prog.filter = malloc(sizeof(filter));
1701 ASSERT_NE(NULL, self->prog.filter);
1702 memcpy(self->prog.filter, filter, sizeof(filter));
1703 self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1704
1705 /* Set up tracer args. */
1706 self->tracer_args.poke_addr = (unsigned long)&self->poked;
1707
1708 /* Launch tracer. */
1709 self->tracer = setup_trace_fixture(_metadata, tracer_poke,
1710 &self->tracer_args, false);
1711 }
1712
FIXTURE_TEARDOWN(TRACE_poke)1713 FIXTURE_TEARDOWN(TRACE_poke)
1714 {
1715 teardown_trace_fixture(_metadata, self->tracer);
1716 if (self->prog.filter)
1717 free(self->prog.filter);
1718 }
1719
TEST_F(TRACE_poke,read_has_side_effects)1720 TEST_F(TRACE_poke, read_has_side_effects)
1721 {
1722 ssize_t ret;
1723
1724 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1725 ASSERT_EQ(0, ret);
1726
1727 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1728 ASSERT_EQ(0, ret);
1729
1730 EXPECT_EQ(0, self->poked);
1731 ret = read(-1, NULL, 0);
1732 EXPECT_EQ(-1, ret);
1733 EXPECT_EQ(0x1001, self->poked);
1734 }
1735
TEST_F(TRACE_poke,getpid_runs_normally)1736 TEST_F(TRACE_poke, getpid_runs_normally)
1737 {
1738 long ret;
1739
1740 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1741 ASSERT_EQ(0, ret);
1742
1743 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1744 ASSERT_EQ(0, ret);
1745
1746 EXPECT_EQ(0, self->poked);
1747 EXPECT_NE(0, syscall(__NR_getpid));
1748 EXPECT_EQ(0, self->poked);
1749 }
1750
1751 #if defined(__x86_64__)
1752 # define ARCH_REGS struct user_regs_struct
1753 # define SYSCALL_NUM(_regs) (_regs).orig_rax
1754 # define SYSCALL_RET(_regs) (_regs).rax
1755 #elif defined(__i386__)
1756 # define ARCH_REGS struct user_regs_struct
1757 # define SYSCALL_NUM(_regs) (_regs).orig_eax
1758 # define SYSCALL_RET(_regs) (_regs).eax
1759 #elif defined(__alpha__)
1760 /* NT_PRSTATUS contains r0-r30, pc and unique, not struct pt_regs. */
1761 struct alpha_regs {
1762 unsigned long regs[33];
1763 };
1764
1765 # define ARCH_REGS struct alpha_regs
1766 /* The kernel keeps the mutable syscall number in r1. */
1767 # define SYSCALL_NUM(_regs) ((_regs).regs[1])
1768 # define SYSCALL_RET(_regs) ((_regs).regs[0])
1769 /*
1770 * Alpha returns positive errno in r0 with the r19/a3 error flag set.
1771 * At a syscall-entry stop, r19 is still the fourth syscall argument.
1772 * Callers must also set the syscall number to -1 to skip the syscall
1773 * before replacing r19 with the error flag.
1774 */
1775 # define SYSCALL_RET_SET(_regs, _val) \
1776 do { \
1777 struct alpha_regs *__regs = &(_regs); \
1778 long __ret = (_val); \
1779 \
1780 __regs->regs[0] = __ret < 0 ? -__ret : __ret; \
1781 __regs->regs[19] = __ret < 0; \
1782 } while (0)
1783 #elif defined(__arm__)
1784 # define ARCH_REGS struct pt_regs
1785 # define SYSCALL_NUM(_regs) (_regs).ARM_r7
1786 # ifndef PTRACE_SET_SYSCALL
1787 # define PTRACE_SET_SYSCALL 23
1788 # endif
1789 # define SYSCALL_NUM_SET(_regs, _nr) \
1790 EXPECT_EQ(0, ptrace(PTRACE_SET_SYSCALL, tracee, NULL, _nr))
1791 # define SYSCALL_RET(_regs) (_regs).ARM_r0
1792 #elif defined(__aarch64__)
1793 # define ARCH_REGS struct user_pt_regs
1794 # define SYSCALL_NUM(_regs) (_regs).regs[8]
1795 # ifndef NT_ARM_SYSTEM_CALL
1796 # define NT_ARM_SYSTEM_CALL 0x404
1797 # endif
1798 # define SYSCALL_NUM_SET(_regs, _nr) \
1799 do { \
1800 struct iovec __v; \
1801 typeof(_nr) __nr = (_nr); \
1802 __v.iov_base = &__nr; \
1803 __v.iov_len = sizeof(__nr); \
1804 EXPECT_EQ(0, ptrace(PTRACE_SETREGSET, tracee, \
1805 NT_ARM_SYSTEM_CALL, &__v)); \
1806 } while (0)
1807 # define SYSCALL_RET(_regs) (_regs).regs[0]
1808 #elif defined(__loongarch__)
1809 # define ARCH_REGS struct user_pt_regs
1810 # define SYSCALL_NUM(_regs) (_regs).regs[11]
1811 # define SYSCALL_RET(_regs) (_regs).regs[4]
1812 #elif defined(__riscv) && __riscv_xlen == 64
1813 # define ARCH_REGS struct user_regs_struct
1814 # define SYSCALL_NUM(_regs) (_regs).a7
1815 # define SYSCALL_RET(_regs) (_regs).a0
1816 #elif defined(__csky__)
1817 # define ARCH_REGS struct pt_regs
1818 # if defined(__CSKYABIV2__)
1819 # define SYSCALL_NUM(_regs) (_regs).regs[3]
1820 # else
1821 # define SYSCALL_NUM(_regs) (_regs).regs[9]
1822 # endif
1823 # define SYSCALL_RET(_regs) (_regs).a0
1824 #elif defined(__hppa__)
1825 # define ARCH_REGS struct user_regs_struct
1826 # define SYSCALL_NUM(_regs) (_regs).gr[20]
1827 # define SYSCALL_RET(_regs) (_regs).gr[28]
1828 #elif defined(__powerpc__)
1829 # define ARCH_REGS struct pt_regs
1830 # define SYSCALL_NUM(_regs) (_regs).gpr[0]
1831 # define SYSCALL_RET(_regs) (_regs).gpr[3]
1832 # define SYSCALL_RET_SET(_regs, _val) \
1833 do { \
1834 typeof(_val) _result = (_val); \
1835 if ((_regs.trap & 0xfff0) == 0x3000) { \
1836 /* \
1837 * scv 0 system call uses -ve result \
1838 * for error, so no need to adjust. \
1839 */ \
1840 SYSCALL_RET(_regs) = _result; \
1841 } else { \
1842 /* \
1843 * A syscall error is signaled by the \
1844 * CR0 SO bit and the code is stored as \
1845 * a positive value. \
1846 */ \
1847 if (_result < 0) { \
1848 SYSCALL_RET(_regs) = -_result; \
1849 (_regs).ccr |= 0x10000000; \
1850 } else { \
1851 SYSCALL_RET(_regs) = _result; \
1852 (_regs).ccr &= ~0x10000000; \
1853 } \
1854 } \
1855 } while (0)
1856 # define SYSCALL_RET_SET_ON_PTRACE_EXIT
1857 #elif defined(__s390__)
1858 # define ARCH_REGS s390_regs
1859 # define SYSCALL_NUM(_regs) (_regs).gprs[2]
1860 # define SYSCALL_RET_SET(_regs, _val) \
1861 TH_LOG("Can't modify syscall return on this architecture")
1862 #elif defined(__mips__)
1863 # include <asm/unistd_nr_n32.h>
1864 # include <asm/unistd_nr_n64.h>
1865 # include <asm/unistd_nr_o32.h>
1866 # define ARCH_REGS struct pt_regs
1867 # define SYSCALL_NUM(_regs) \
1868 ({ \
1869 typeof((_regs).regs[2]) _nr; \
1870 if ((_regs).regs[2] == __NR_O32_Linux) \
1871 _nr = (_regs).regs[4]; \
1872 else \
1873 _nr = (_regs).regs[2]; \
1874 _nr; \
1875 })
1876 # define SYSCALL_NUM_SET(_regs, _nr) \
1877 do { \
1878 if ((_regs).regs[2] == __NR_O32_Linux) \
1879 (_regs).regs[4] = _nr; \
1880 else \
1881 (_regs).regs[2] = _nr; \
1882 } while (0)
1883 # define SYSCALL_RET_SET(_regs, _val) \
1884 TH_LOG("Can't modify syscall return on this architecture")
1885 #elif defined(__xtensa__)
1886 # define ARCH_REGS struct user_pt_regs
1887 # define SYSCALL_NUM(_regs) (_regs).syscall
1888 /*
1889 * On xtensa syscall return value is in the register
1890 * a2 of the current window which is not fixed.
1891 */
1892 #define SYSCALL_RET(_regs) (_regs).a[(_regs).windowbase * 4 + 2]
1893 #elif defined(__sh__)
1894 # define ARCH_REGS struct pt_regs
1895 # define SYSCALL_NUM(_regs) (_regs).regs[3]
1896 # define SYSCALL_RET(_regs) (_regs).regs[0]
1897 #elif defined(__mc68000__)
1898 # define ARCH_REGS struct user_regs_struct
1899 # define SYSCALL_NUM(_regs) (_regs).orig_d0
1900 # define SYSCALL_RET(_regs) (_regs).d0
1901 #else
1902 # error "Do not know how to find your architecture's registers and syscalls"
1903 #endif
1904
1905 /*
1906 * Most architectures can change the syscall by just updating the
1907 * associated register. This is the default if not defined above.
1908 */
1909 #ifndef SYSCALL_NUM_SET
1910 # define SYSCALL_NUM_SET(_regs, _nr) \
1911 do { \
1912 SYSCALL_NUM(_regs) = (_nr); \
1913 } while (0)
1914 #endif
1915 /*
1916 * Most architectures can change the syscall return value by just
1917 * writing to the SYSCALL_RET register. This is the default if not
1918 * defined above. If an architecture cannot set the return value
1919 * (for example when the syscall and return value register is
1920 * shared), report it with TH_LOG() in an arch-specific definition
1921 * of SYSCALL_RET_SET() above, and leave SYSCALL_RET undefined.
1922 */
1923 #if !defined(SYSCALL_RET) && !defined(SYSCALL_RET_SET)
1924 # error "One of SYSCALL_RET or SYSCALL_RET_SET is needed for this arch"
1925 #endif
1926 #ifndef SYSCALL_RET_SET
1927 # define SYSCALL_RET_SET(_regs, _val) \
1928 do { \
1929 SYSCALL_RET(_regs) = (_val); \
1930 } while (0)
1931 #endif
1932
1933 /* When the syscall return can't be changed, stub out the tests for it. */
1934 #ifndef SYSCALL_RET
1935 # define EXPECT_SYSCALL_RETURN(val, action) EXPECT_EQ(-1, action)
1936 #else
1937 # define EXPECT_SYSCALL_RETURN(val, action) \
1938 do { \
1939 errno = 0; \
1940 if (val < 0) { \
1941 EXPECT_EQ(-1, action); \
1942 EXPECT_EQ(-(val), errno); \
1943 } else { \
1944 EXPECT_EQ(val, action); \
1945 } \
1946 } while (0)
1947 #endif
1948
1949 /*
1950 * Some architectures (e.g. powerpc) can only set syscall
1951 * return values on syscall exit during ptrace.
1952 */
1953 const bool ptrace_entry_set_syscall_nr = true;
1954 const bool ptrace_entry_set_syscall_ret =
1955 #ifndef SYSCALL_RET_SET_ON_PTRACE_EXIT
1956 true;
1957 #else
1958 false;
1959 #endif
1960
1961 /*
1962 * Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
1963 * architectures without HAVE_ARCH_TRACEHOOK (e.g. User-mode Linux).
1964 */
1965 #if defined(__x86_64__) || defined(__i386__) || defined(__mips__) || defined(__mc68000__)
1966 # define ARCH_GETREGS(_regs) ptrace(PTRACE_GETREGS, tracee, 0, &(_regs))
1967 # define ARCH_SETREGS(_regs) ptrace(PTRACE_SETREGS, tracee, 0, &(_regs))
1968 #else
1969 # define ARCH_GETREGS(_regs) ({ \
1970 struct iovec __v; \
1971 __v.iov_base = &(_regs); \
1972 __v.iov_len = sizeof(_regs); \
1973 ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &__v); \
1974 })
1975 # define ARCH_SETREGS(_regs) ({ \
1976 struct iovec __v; \
1977 __v.iov_base = &(_regs); \
1978 __v.iov_len = sizeof(_regs); \
1979 ptrace(PTRACE_SETREGSET, tracee, NT_PRSTATUS, &__v); \
1980 })
1981 #endif
1982
1983 /* Architecture-specific syscall fetching routine. */
get_syscall(struct __test_metadata * _metadata,pid_t tracee)1984 int get_syscall(struct __test_metadata *_metadata, pid_t tracee)
1985 {
1986 ARCH_REGS regs;
1987
1988 EXPECT_EQ(0, ARCH_GETREGS(regs)) {
1989 return -1;
1990 }
1991
1992 return SYSCALL_NUM(regs);
1993 }
1994
1995 /* Architecture-specific syscall changing routine. */
__change_syscall(struct __test_metadata * _metadata,pid_t tracee,long * syscall,long * ret)1996 void __change_syscall(struct __test_metadata *_metadata,
1997 pid_t tracee, long *syscall, long *ret)
1998 {
1999 ARCH_REGS orig, regs;
2000
2001 /* Do not get/set registers if we have nothing to do. */
2002 if (!syscall && !ret)
2003 return;
2004
2005 EXPECT_EQ(0, ARCH_GETREGS(regs)) {
2006 return;
2007 }
2008 orig = regs;
2009
2010 if (syscall)
2011 SYSCALL_NUM_SET(regs, *syscall);
2012
2013 if (ret)
2014 SYSCALL_RET_SET(regs, *ret);
2015
2016 /* Flush any register changes made. */
2017 if (memcmp(&orig, ®s, sizeof(orig)) != 0)
2018 EXPECT_EQ(0, ARCH_SETREGS(regs));
2019 }
2020
2021 /* Change only syscall number. */
change_syscall_nr(struct __test_metadata * _metadata,pid_t tracee,long syscall)2022 void change_syscall_nr(struct __test_metadata *_metadata,
2023 pid_t tracee, long syscall)
2024 {
2025 __change_syscall(_metadata, tracee, &syscall, NULL);
2026 }
2027
2028 /* Change syscall return value (and set syscall number to -1). */
change_syscall_ret(struct __test_metadata * _metadata,pid_t tracee,long ret)2029 void change_syscall_ret(struct __test_metadata *_metadata,
2030 pid_t tracee, long ret)
2031 {
2032 long syscall = -1;
2033
2034 __change_syscall(_metadata, tracee, &syscall, &ret);
2035 }
2036
tracer_seccomp(struct __test_metadata * _metadata,pid_t tracee,int status,void * args)2037 void tracer_seccomp(struct __test_metadata *_metadata, pid_t tracee,
2038 int status, void *args)
2039 {
2040 int ret;
2041 unsigned long msg;
2042
2043 EXPECT_EQ(PTRACE_EVENT_MASK(status), PTRACE_EVENT_SECCOMP) {
2044 TH_LOG("Unexpected ptrace event: %d", PTRACE_EVENT_MASK(status));
2045 return;
2046 }
2047
2048 /* Make sure we got the right message. */
2049 ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
2050 EXPECT_EQ(0, ret);
2051
2052 /* Validate and take action on expected syscalls. */
2053 switch (msg) {
2054 case 0x1002:
2055 /* change getpid to getppid. */
2056 EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee));
2057 change_syscall_nr(_metadata, tracee, __NR_getppid);
2058 break;
2059 case 0x1003:
2060 /* skip gettid with valid return code. */
2061 EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee));
2062 change_syscall_ret(_metadata, tracee, 45000);
2063 break;
2064 case 0x1004:
2065 /* skip openat with error. */
2066 EXPECT_EQ(__NR_openat, get_syscall(_metadata, tracee));
2067 change_syscall_ret(_metadata, tracee, -ESRCH);
2068 break;
2069 case 0x1005:
2070 /* do nothing (allow getppid) */
2071 EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee));
2072 break;
2073 default:
2074 EXPECT_EQ(0, msg) {
2075 TH_LOG("Unknown PTRACE_GETEVENTMSG: 0x%lx", msg);
2076 kill(tracee, SIGKILL);
2077 }
2078 }
2079
2080 }
2081
FIXTURE(TRACE_syscall)2082 FIXTURE(TRACE_syscall) {
2083 struct sock_fprog prog;
2084 pid_t tracer, mytid, mypid, parent;
2085 long syscall_nr;
2086 };
2087
tracer_ptrace(struct __test_metadata * _metadata,pid_t tracee,int status,void * args)2088 void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
2089 int status, void *args)
2090 {
2091 int ret;
2092 unsigned long msg;
2093 static bool entry;
2094 long syscall_nr_val, syscall_ret_val;
2095 long *syscall_nr = NULL, *syscall_ret = NULL;
2096 FIXTURE_DATA(TRACE_syscall) *self = args;
2097
2098 EXPECT_EQ(WSTOPSIG(status) & 0x80, 0x80) {
2099 TH_LOG("Unexpected WSTOPSIG: %d", WSTOPSIG(status));
2100 return;
2101 }
2102
2103 /*
2104 * The traditional way to tell PTRACE_SYSCALL entry/exit
2105 * is by counting.
2106 */
2107 entry = !entry;
2108
2109 /* Make sure we got an appropriate message. */
2110 ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
2111 EXPECT_EQ(0, ret);
2112 EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY
2113 : PTRACE_EVENTMSG_SYSCALL_EXIT, msg);
2114
2115 /*
2116 * Some architectures only support setting return values during
2117 * syscall exit under ptrace, and on exit the syscall number may
2118 * no longer be available. Therefore, save the initial sycall
2119 * number here, so it can be examined during both entry and exit
2120 * phases.
2121 */
2122 if (entry)
2123 self->syscall_nr = get_syscall(_metadata, tracee);
2124
2125 /*
2126 * Depending on the architecture's syscall setting abilities, we
2127 * pick which things to set during this phase (entry or exit).
2128 */
2129 if (entry == ptrace_entry_set_syscall_nr)
2130 syscall_nr = &syscall_nr_val;
2131 if (entry == ptrace_entry_set_syscall_ret)
2132 syscall_ret = &syscall_ret_val;
2133
2134 /* Now handle the actual rewriting cases. */
2135 switch (self->syscall_nr) {
2136 case __NR_getpid:
2137 syscall_nr_val = __NR_getppid;
2138 /* Never change syscall return for this case. */
2139 syscall_ret = NULL;
2140 break;
2141 case __NR_gettid:
2142 syscall_nr_val = -1;
2143 syscall_ret_val = 45000;
2144 break;
2145 case __NR_openat:
2146 syscall_nr_val = -1;
2147 syscall_ret_val = -ESRCH;
2148 break;
2149 default:
2150 /* Unhandled, do nothing. */
2151 return;
2152 }
2153
2154 __change_syscall(_metadata, tracee, syscall_nr, syscall_ret);
2155 }
2156
FIXTURE_VARIANT(TRACE_syscall)2157 FIXTURE_VARIANT(TRACE_syscall) {
2158 /*
2159 * All of the SECCOMP_RET_TRACE behaviors can be tested with either
2160 * SECCOMP_RET_TRACE+PTRACE_CONT or plain ptrace()+PTRACE_SYSCALL.
2161 * This indicates if we should use SECCOMP_RET_TRACE (false), or
2162 * ptrace (true).
2163 */
2164 bool use_ptrace;
2165 };
2166
FIXTURE_VARIANT_ADD(TRACE_syscall,ptrace)2167 FIXTURE_VARIANT_ADD(TRACE_syscall, ptrace) {
2168 .use_ptrace = true,
2169 };
2170
FIXTURE_VARIANT_ADD(TRACE_syscall,seccomp)2171 FIXTURE_VARIANT_ADD(TRACE_syscall, seccomp) {
2172 .use_ptrace = false,
2173 };
2174
FIXTURE_SETUP(TRACE_syscall)2175 FIXTURE_SETUP(TRACE_syscall)
2176 {
2177 struct sock_filter filter[] = {
2178 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2179 offsetof(struct seccomp_data, nr)),
2180 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
2181 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002),
2182 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1),
2183 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003),
2184 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_openat, 0, 1),
2185 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004),
2186 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
2187 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1005),
2188 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2189 };
2190 struct sock_fprog prog = {
2191 .len = (unsigned short)ARRAY_SIZE(filter),
2192 .filter = filter,
2193 };
2194 long ret;
2195
2196 /* Prepare some testable syscall results. */
2197 self->mytid = syscall(__NR_gettid);
2198 ASSERT_GT(self->mytid, 0);
2199 ASSERT_NE(self->mytid, 1) {
2200 TH_LOG("Running this test as init is not supported. :)");
2201 }
2202
2203 self->mypid = getpid();
2204 ASSERT_GT(self->mypid, 0);
2205 ASSERT_EQ(self->mytid, self->mypid);
2206
2207 self->parent = getppid();
2208 ASSERT_GT(self->parent, 0);
2209 ASSERT_NE(self->parent, self->mypid);
2210
2211 /* Launch tracer. */
2212 self->tracer = setup_trace_fixture(_metadata,
2213 variant->use_ptrace ? tracer_ptrace
2214 : tracer_seccomp,
2215 self, variant->use_ptrace);
2216
2217 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
2218 ASSERT_EQ(0, ret);
2219
2220 /* Do not install seccomp rewrite filters, as we'll use ptrace instead. */
2221 if (variant->use_ptrace)
2222 return;
2223
2224 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2225 ASSERT_EQ(0, ret);
2226 }
2227
FIXTURE_TEARDOWN(TRACE_syscall)2228 FIXTURE_TEARDOWN(TRACE_syscall)
2229 {
2230 teardown_trace_fixture(_metadata, self->tracer);
2231 }
2232
TEST(negative_ENOSYS)2233 TEST(negative_ENOSYS)
2234 {
2235 #if defined(__arm__)
2236 SKIP(return, "arm32 does not support calling syscall -1");
2237 #endif
2238 /*
2239 * There should be no difference between an "internal" skip
2240 * and userspace asking for syscall "-1".
2241 */
2242 errno = 0;
2243 EXPECT_EQ(-1, syscall(-1));
2244 EXPECT_EQ(errno, ENOSYS);
2245 /* And no difference for "still not valid but not -1". */
2246 errno = 0;
2247 EXPECT_EQ(-1, syscall(-101));
2248 EXPECT_EQ(errno, ENOSYS);
2249 }
2250
TEST_F(TRACE_syscall,negative_ENOSYS)2251 TEST_F(TRACE_syscall, negative_ENOSYS)
2252 {
2253 negative_ENOSYS(_metadata);
2254 }
2255
TEST_F(TRACE_syscall,syscall_allowed)2256 TEST_F(TRACE_syscall, syscall_allowed)
2257 {
2258 /* getppid works as expected (no changes). */
2259 EXPECT_EQ(self->parent, syscall(__NR_getppid));
2260 EXPECT_NE(self->mypid, syscall(__NR_getppid));
2261 }
2262
TEST_F(TRACE_syscall,syscall_redirected)2263 TEST_F(TRACE_syscall, syscall_redirected)
2264 {
2265 /* getpid has been redirected to getppid as expected. */
2266 EXPECT_EQ(self->parent, syscall(__NR_getpid));
2267 EXPECT_NE(self->mypid, syscall(__NR_getpid));
2268 }
2269
TEST_F(TRACE_syscall,syscall_errno)2270 TEST_F(TRACE_syscall, syscall_errno)
2271 {
2272 /* Tracer should skip the open syscall, resulting in ESRCH. */
2273 EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
2274 }
2275
TEST_F(TRACE_syscall,syscall_faked)2276 TEST_F(TRACE_syscall, syscall_faked)
2277 {
2278 /* Tracer skips the gettid syscall and store altered return value. */
2279 EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
2280 }
2281
TEST_F_SIGNAL(TRACE_syscall,kill_immediate,SIGSYS)2282 TEST_F_SIGNAL(TRACE_syscall, kill_immediate, SIGSYS)
2283 {
2284 struct sock_filter filter[] = {
2285 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2286 offsetof(struct seccomp_data, nr)),
2287 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_mknodat, 0, 1),
2288 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_THREAD),
2289 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2290 };
2291 struct sock_fprog prog = {
2292 .len = (unsigned short)ARRAY_SIZE(filter),
2293 .filter = filter,
2294 };
2295 long ret;
2296
2297 /* Install "kill on mknodat" filter. */
2298 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2299 ASSERT_EQ(0, ret);
2300
2301 /* This should immediately die with SIGSYS, regardless of tracer. */
2302 EXPECT_EQ(-1, syscall(__NR_mknodat, -1, NULL, 0, 0));
2303 }
2304
TEST_F(TRACE_syscall,skip_after)2305 TEST_F(TRACE_syscall, skip_after)
2306 {
2307 struct sock_filter filter[] = {
2308 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2309 offsetof(struct seccomp_data, nr)),
2310 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
2311 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EPERM),
2312 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2313 };
2314 struct sock_fprog prog = {
2315 .len = (unsigned short)ARRAY_SIZE(filter),
2316 .filter = filter,
2317 };
2318 long ret;
2319
2320 /* Install additional "errno on getppid" filter. */
2321 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2322 ASSERT_EQ(0, ret);
2323
2324 /* Tracer will redirect getpid to getppid, and we should see EPERM. */
2325 errno = 0;
2326 EXPECT_EQ(-1, syscall(__NR_getpid));
2327 EXPECT_EQ(EPERM, errno);
2328 }
2329
TEST_F_SIGNAL(TRACE_syscall,kill_after,SIGSYS)2330 TEST_F_SIGNAL(TRACE_syscall, kill_after, SIGSYS)
2331 {
2332 struct sock_filter filter[] = {
2333 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2334 offsetof(struct seccomp_data, nr)),
2335 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
2336 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
2337 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2338 };
2339 struct sock_fprog prog = {
2340 .len = (unsigned short)ARRAY_SIZE(filter),
2341 .filter = filter,
2342 };
2343 long ret;
2344
2345 /* Install additional "death on getppid" filter. */
2346 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2347 ASSERT_EQ(0, ret);
2348
2349 /* Tracer will redirect getpid to getppid, and we should die. */
2350 EXPECT_NE(self->mypid, syscall(__NR_getpid));
2351 }
2352
TEST(seccomp_syscall)2353 TEST(seccomp_syscall)
2354 {
2355 struct sock_filter filter[] = {
2356 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2357 };
2358 struct sock_fprog prog = {
2359 .len = (unsigned short)ARRAY_SIZE(filter),
2360 .filter = filter,
2361 };
2362 long ret;
2363
2364 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
2365 ASSERT_EQ(0, ret) {
2366 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2367 }
2368
2369 /* Reject insane operation. */
2370 ret = seccomp(-1, 0, &prog);
2371 ASSERT_NE(ENOSYS, errno) {
2372 TH_LOG("Kernel does not support seccomp syscall!");
2373 }
2374 EXPECT_EQ(EINVAL, errno) {
2375 TH_LOG("Did not reject crazy op value!");
2376 }
2377
2378 /* Reject strict with flags or pointer. */
2379 ret = seccomp(SECCOMP_SET_MODE_STRICT, -1, NULL);
2380 EXPECT_EQ(EINVAL, errno) {
2381 TH_LOG("Did not reject mode strict with flags!");
2382 }
2383 ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, &prog);
2384 EXPECT_EQ(EINVAL, errno) {
2385 TH_LOG("Did not reject mode strict with uargs!");
2386 }
2387
2388 /* Reject insane args for filter. */
2389 ret = seccomp(SECCOMP_SET_MODE_FILTER, -1, &prog);
2390 EXPECT_EQ(EINVAL, errno) {
2391 TH_LOG("Did not reject crazy filter flags!");
2392 }
2393 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, NULL);
2394 EXPECT_EQ(EFAULT, errno) {
2395 TH_LOG("Did not reject NULL filter!");
2396 }
2397
2398 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
2399 EXPECT_EQ(0, errno) {
2400 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER: %s",
2401 strerror(errno));
2402 }
2403 }
2404
TEST(seccomp_syscall_mode_lock)2405 TEST(seccomp_syscall_mode_lock)
2406 {
2407 struct sock_filter filter[] = {
2408 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2409 };
2410 struct sock_fprog prog = {
2411 .len = (unsigned short)ARRAY_SIZE(filter),
2412 .filter = filter,
2413 };
2414 long ret;
2415
2416 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
2417 ASSERT_EQ(0, ret) {
2418 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2419 }
2420
2421 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
2422 ASSERT_NE(ENOSYS, errno) {
2423 TH_LOG("Kernel does not support seccomp syscall!");
2424 }
2425 EXPECT_EQ(0, ret) {
2426 TH_LOG("Could not install filter!");
2427 }
2428
2429 /* Make sure neither entry point will switch to strict. */
2430 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, 0, 0, 0);
2431 EXPECT_EQ(EINVAL, errno) {
2432 TH_LOG("Switched to mode strict!");
2433 }
2434
2435 ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, NULL);
2436 EXPECT_EQ(EINVAL, errno) {
2437 TH_LOG("Switched to mode strict!");
2438 }
2439 }
2440
2441 /*
2442 * Test detection of known and unknown filter flags. Userspace needs to be able
2443 * to check if a filter flag is supported by the current kernel and a good way
2444 * of doing that is by attempting to enter filter mode, with the flag bit in
2445 * question set, and a NULL pointer for the _args_ parameter. EFAULT indicates
2446 * that the flag is valid and EINVAL indicates that the flag is invalid.
2447 */
TEST(detect_seccomp_filter_flags)2448 TEST(detect_seccomp_filter_flags)
2449 {
2450 unsigned int flags[] = { SECCOMP_FILTER_FLAG_TSYNC,
2451 SECCOMP_FILTER_FLAG_LOG,
2452 SECCOMP_FILTER_FLAG_SPEC_ALLOW,
2453 SECCOMP_FILTER_FLAG_NEW_LISTENER,
2454 SECCOMP_FILTER_FLAG_TSYNC_ESRCH };
2455 unsigned int exclusive[] = {
2456 SECCOMP_FILTER_FLAG_TSYNC,
2457 SECCOMP_FILTER_FLAG_NEW_LISTENER };
2458 unsigned int flag, all_flags, exclusive_mask;
2459 int i;
2460 long ret;
2461
2462 /* Test detection of individual known-good filter flags */
2463 for (i = 0, all_flags = 0; i < ARRAY_SIZE(flags); i++) {
2464 int bits = 0;
2465
2466 flag = flags[i];
2467 /* Make sure the flag is a single bit! */
2468 while (flag) {
2469 if (flag & 0x1)
2470 bits ++;
2471 flag >>= 1;
2472 }
2473 ASSERT_EQ(1, bits);
2474 flag = flags[i];
2475
2476 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2477 ASSERT_NE(ENOSYS, errno) {
2478 TH_LOG("Kernel does not support seccomp syscall!");
2479 }
2480 EXPECT_EQ(-1, ret);
2481 EXPECT_EQ(EFAULT, errno) {
2482 TH_LOG("Failed to detect that a known-good filter flag (0x%X) is supported!",
2483 flag);
2484 }
2485
2486 all_flags |= flag;
2487 }
2488
2489 /*
2490 * Test detection of all known-good filter flags combined. But
2491 * for the exclusive flags we need to mask them out and try them
2492 * individually for the "all flags" testing.
2493 */
2494 exclusive_mask = 0;
2495 for (i = 0; i < ARRAY_SIZE(exclusive); i++)
2496 exclusive_mask |= exclusive[i];
2497 for (i = 0; i < ARRAY_SIZE(exclusive); i++) {
2498 flag = all_flags & ~exclusive_mask;
2499 flag |= exclusive[i];
2500
2501 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2502 EXPECT_EQ(-1, ret);
2503 EXPECT_EQ(EFAULT, errno) {
2504 TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!",
2505 flag);
2506 }
2507 }
2508
2509 /* Test detection of an unknown filter flags, without exclusives. */
2510 flag = -1;
2511 flag &= ~exclusive_mask;
2512 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2513 EXPECT_EQ(-1, ret);
2514 EXPECT_EQ(EINVAL, errno) {
2515 TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported!",
2516 flag);
2517 }
2518
2519 /*
2520 * Test detection of an unknown filter flag that may simply need to be
2521 * added to this test
2522 */
2523 flag = flags[ARRAY_SIZE(flags) - 1] << 1;
2524 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2525 EXPECT_EQ(-1, ret);
2526 EXPECT_EQ(EINVAL, errno) {
2527 TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported! Does a new flag need to be added to this test?",
2528 flag);
2529 }
2530 }
2531
TEST(TSYNC_first)2532 TEST(TSYNC_first)
2533 {
2534 struct sock_filter filter[] = {
2535 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2536 };
2537 struct sock_fprog prog = {
2538 .len = (unsigned short)ARRAY_SIZE(filter),
2539 .filter = filter,
2540 };
2541 long ret;
2542
2543 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
2544 ASSERT_EQ(0, ret) {
2545 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2546 }
2547
2548 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2549 &prog);
2550 ASSERT_NE(ENOSYS, errno) {
2551 TH_LOG("Kernel does not support seccomp syscall!");
2552 }
2553 EXPECT_EQ(0, ret) {
2554 TH_LOG("Could not install initial filter with TSYNC!");
2555 }
2556 }
2557
2558 #define TSYNC_SIBLINGS 2
2559 struct tsync_sibling {
2560 pthread_t tid;
2561 pid_t system_tid;
2562 sem_t *started;
2563 pthread_cond_t *cond;
2564 pthread_mutex_t *mutex;
2565 int diverge;
2566 int num_waits;
2567 struct sock_fprog *prog;
2568 struct __test_metadata *metadata;
2569 };
2570
2571 /*
2572 * To avoid joining joined threads (which is not allowed by Bionic),
2573 * make sure we both successfully join and clear the tid to skip a
2574 * later join attempt during fixture teardown. Any remaining threads
2575 * will be directly killed during teardown.
2576 */
2577 #define PTHREAD_JOIN(tid, status) \
2578 do { \
2579 int _rc = pthread_join(tid, status); \
2580 if (_rc) { \
2581 TH_LOG("pthread_join of tid %u failed: %d\n", \
2582 (unsigned int)tid, _rc); \
2583 } else { \
2584 tid = 0; \
2585 } \
2586 } while (0)
2587
FIXTURE(TSYNC)2588 FIXTURE(TSYNC) {
2589 struct sock_fprog root_prog, apply_prog;
2590 struct tsync_sibling sibling[TSYNC_SIBLINGS];
2591 sem_t started;
2592 pthread_cond_t cond;
2593 pthread_mutex_t mutex;
2594 int sibling_count;
2595 };
2596
FIXTURE_SETUP(TSYNC)2597 FIXTURE_SETUP(TSYNC)
2598 {
2599 struct sock_filter root_filter[] = {
2600 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2601 };
2602 struct sock_filter apply_filter[] = {
2603 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2604 offsetof(struct seccomp_data, nr)),
2605 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
2606 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
2607 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2608 };
2609
2610 memset(&self->root_prog, 0, sizeof(self->root_prog));
2611 memset(&self->apply_prog, 0, sizeof(self->apply_prog));
2612 memset(&self->sibling, 0, sizeof(self->sibling));
2613 self->root_prog.filter = malloc(sizeof(root_filter));
2614 ASSERT_NE(NULL, self->root_prog.filter);
2615 memcpy(self->root_prog.filter, &root_filter, sizeof(root_filter));
2616 self->root_prog.len = (unsigned short)ARRAY_SIZE(root_filter);
2617
2618 self->apply_prog.filter = malloc(sizeof(apply_filter));
2619 ASSERT_NE(NULL, self->apply_prog.filter);
2620 memcpy(self->apply_prog.filter, &apply_filter, sizeof(apply_filter));
2621 self->apply_prog.len = (unsigned short)ARRAY_SIZE(apply_filter);
2622
2623 self->sibling_count = 0;
2624 pthread_mutex_init(&self->mutex, NULL);
2625 pthread_cond_init(&self->cond, NULL);
2626 sem_init(&self->started, 0, 0);
2627 self->sibling[0].tid = 0;
2628 self->sibling[0].cond = &self->cond;
2629 self->sibling[0].started = &self->started;
2630 self->sibling[0].mutex = &self->mutex;
2631 self->sibling[0].diverge = 0;
2632 self->sibling[0].num_waits = 1;
2633 self->sibling[0].prog = &self->root_prog;
2634 self->sibling[0].metadata = _metadata;
2635 self->sibling[1].tid = 0;
2636 self->sibling[1].cond = &self->cond;
2637 self->sibling[1].started = &self->started;
2638 self->sibling[1].mutex = &self->mutex;
2639 self->sibling[1].diverge = 0;
2640 self->sibling[1].prog = &self->root_prog;
2641 self->sibling[1].num_waits = 1;
2642 self->sibling[1].metadata = _metadata;
2643 }
2644
FIXTURE_TEARDOWN(TSYNC)2645 FIXTURE_TEARDOWN(TSYNC)
2646 {
2647 int sib = 0;
2648
2649 if (self->root_prog.filter)
2650 free(self->root_prog.filter);
2651 if (self->apply_prog.filter)
2652 free(self->apply_prog.filter);
2653
2654 for ( ; sib < self->sibling_count; ++sib) {
2655 struct tsync_sibling *s = &self->sibling[sib];
2656
2657 if (!s->tid)
2658 continue;
2659 /*
2660 * If a thread is still running, it may be stuck, so hit
2661 * it over the head really hard.
2662 */
2663 pthread_kill(s->tid, 9);
2664 }
2665 pthread_mutex_destroy(&self->mutex);
2666 pthread_cond_destroy(&self->cond);
2667 sem_destroy(&self->started);
2668 }
2669
tsync_sibling(void * data)2670 void *tsync_sibling(void *data)
2671 {
2672 long ret = 0;
2673 struct tsync_sibling *me = data;
2674
2675 me->system_tid = syscall(__NR_gettid);
2676
2677 pthread_mutex_lock(me->mutex);
2678 if (me->diverge) {
2679 /* Just re-apply the root prog to fork the tree */
2680 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
2681 me->prog, 0, 0);
2682 }
2683 sem_post(me->started);
2684 /* Return outside of started so parent notices failures. */
2685 if (ret) {
2686 pthread_mutex_unlock(me->mutex);
2687 return (void *)SIBLING_EXIT_FAILURE;
2688 }
2689 do {
2690 pthread_cond_wait(me->cond, me->mutex);
2691 me->num_waits = me->num_waits - 1;
2692 } while (me->num_waits);
2693 pthread_mutex_unlock(me->mutex);
2694
2695 ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
2696 if (!ret)
2697 return (void *)SIBLING_EXIT_NEWPRIVS;
2698 read(-1, NULL, 0);
2699 return (void *)SIBLING_EXIT_UNKILLED;
2700 }
2701
tsync_start_sibling(struct tsync_sibling * sibling)2702 void tsync_start_sibling(struct tsync_sibling *sibling)
2703 {
2704 pthread_create(&sibling->tid, NULL, tsync_sibling, (void *)sibling);
2705 }
2706
TEST_F(TSYNC,siblings_fail_prctl)2707 TEST_F(TSYNC, siblings_fail_prctl)
2708 {
2709 long ret;
2710 void *status;
2711 struct sock_filter filter[] = {
2712 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2713 offsetof(struct seccomp_data, nr)),
2714 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
2715 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EINVAL),
2716 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2717 };
2718 struct sock_fprog prog = {
2719 .len = (unsigned short)ARRAY_SIZE(filter),
2720 .filter = filter,
2721 };
2722
2723 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2724 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2725 }
2726
2727 /* Check prctl failure detection by requesting sib 0 diverge. */
2728 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
2729 ASSERT_NE(ENOSYS, errno) {
2730 TH_LOG("Kernel does not support seccomp syscall!");
2731 }
2732 ASSERT_EQ(0, ret) {
2733 TH_LOG("setting filter failed");
2734 }
2735
2736 self->sibling[0].diverge = 1;
2737 tsync_start_sibling(&self->sibling[0]);
2738 tsync_start_sibling(&self->sibling[1]);
2739
2740 while (self->sibling_count < TSYNC_SIBLINGS) {
2741 sem_wait(&self->started);
2742 self->sibling_count++;
2743 }
2744
2745 /* Signal the threads to clean up*/
2746 pthread_mutex_lock(&self->mutex);
2747 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2748 TH_LOG("cond broadcast non-zero");
2749 }
2750 pthread_mutex_unlock(&self->mutex);
2751
2752 /* Ensure diverging sibling failed to call prctl. */
2753 PTHREAD_JOIN(self->sibling[0].tid, &status);
2754 EXPECT_EQ(SIBLING_EXIT_FAILURE, (long)status);
2755 PTHREAD_JOIN(self->sibling[1].tid, &status);
2756 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2757 }
2758
TEST_F(TSYNC,two_siblings_with_ancestor)2759 TEST_F(TSYNC, two_siblings_with_ancestor)
2760 {
2761 long ret;
2762 void *status;
2763
2764 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2765 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2766 }
2767
2768 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2769 ASSERT_NE(ENOSYS, errno) {
2770 TH_LOG("Kernel does not support seccomp syscall!");
2771 }
2772 ASSERT_EQ(0, ret) {
2773 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2774 }
2775 tsync_start_sibling(&self->sibling[0]);
2776 tsync_start_sibling(&self->sibling[1]);
2777
2778 while (self->sibling_count < TSYNC_SIBLINGS) {
2779 sem_wait(&self->started);
2780 self->sibling_count++;
2781 }
2782
2783 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2784 &self->apply_prog);
2785 ASSERT_EQ(0, ret) {
2786 TH_LOG("Could install filter on all threads!");
2787 }
2788 /* Tell the siblings to test the policy */
2789 pthread_mutex_lock(&self->mutex);
2790 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2791 TH_LOG("cond broadcast non-zero");
2792 }
2793 pthread_mutex_unlock(&self->mutex);
2794 /* Ensure they are both killed and don't exit cleanly. */
2795 PTHREAD_JOIN(self->sibling[0].tid, &status);
2796 EXPECT_EQ(0x0, (long)status);
2797 PTHREAD_JOIN(self->sibling[1].tid, &status);
2798 EXPECT_EQ(0x0, (long)status);
2799 }
2800
TEST_F(TSYNC,two_sibling_want_nnp)2801 TEST_F(TSYNC, two_sibling_want_nnp)
2802 {
2803 void *status;
2804
2805 /* start siblings before any prctl() operations */
2806 tsync_start_sibling(&self->sibling[0]);
2807 tsync_start_sibling(&self->sibling[1]);
2808 while (self->sibling_count < TSYNC_SIBLINGS) {
2809 sem_wait(&self->started);
2810 self->sibling_count++;
2811 }
2812
2813 /* Tell the siblings to test no policy */
2814 pthread_mutex_lock(&self->mutex);
2815 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2816 TH_LOG("cond broadcast non-zero");
2817 }
2818 pthread_mutex_unlock(&self->mutex);
2819
2820 /* Ensure they are both upset about lacking nnp. */
2821 PTHREAD_JOIN(self->sibling[0].tid, &status);
2822 EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status);
2823 PTHREAD_JOIN(self->sibling[1].tid, &status);
2824 EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status);
2825 }
2826
TEST_F(TSYNC,two_siblings_with_no_filter)2827 TEST_F(TSYNC, two_siblings_with_no_filter)
2828 {
2829 long ret;
2830 void *status;
2831
2832 /* start siblings before any prctl() operations */
2833 tsync_start_sibling(&self->sibling[0]);
2834 tsync_start_sibling(&self->sibling[1]);
2835 while (self->sibling_count < TSYNC_SIBLINGS) {
2836 sem_wait(&self->started);
2837 self->sibling_count++;
2838 }
2839
2840 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2841 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2842 }
2843
2844 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2845 &self->apply_prog);
2846 ASSERT_NE(ENOSYS, errno) {
2847 TH_LOG("Kernel does not support seccomp syscall!");
2848 }
2849 ASSERT_EQ(0, ret) {
2850 TH_LOG("Could install filter on all threads!");
2851 }
2852
2853 /* Tell the siblings to test the policy */
2854 pthread_mutex_lock(&self->mutex);
2855 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2856 TH_LOG("cond broadcast non-zero");
2857 }
2858 pthread_mutex_unlock(&self->mutex);
2859
2860 /* Ensure they are both killed and don't exit cleanly. */
2861 PTHREAD_JOIN(self->sibling[0].tid, &status);
2862 EXPECT_EQ(0x0, (long)status);
2863 PTHREAD_JOIN(self->sibling[1].tid, &status);
2864 EXPECT_EQ(0x0, (long)status);
2865 }
2866
TEST_F(TSYNC,two_siblings_with_one_divergence)2867 TEST_F(TSYNC, two_siblings_with_one_divergence)
2868 {
2869 long ret;
2870 void *status;
2871
2872 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2873 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2874 }
2875
2876 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2877 ASSERT_NE(ENOSYS, errno) {
2878 TH_LOG("Kernel does not support seccomp syscall!");
2879 }
2880 ASSERT_EQ(0, ret) {
2881 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2882 }
2883 self->sibling[0].diverge = 1;
2884 tsync_start_sibling(&self->sibling[0]);
2885 tsync_start_sibling(&self->sibling[1]);
2886
2887 while (self->sibling_count < TSYNC_SIBLINGS) {
2888 sem_wait(&self->started);
2889 self->sibling_count++;
2890 }
2891
2892 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2893 &self->apply_prog);
2894 ASSERT_EQ(self->sibling[0].system_tid, ret) {
2895 TH_LOG("Did not fail on diverged sibling.");
2896 }
2897
2898 /* Wake the threads */
2899 pthread_mutex_lock(&self->mutex);
2900 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2901 TH_LOG("cond broadcast non-zero");
2902 }
2903 pthread_mutex_unlock(&self->mutex);
2904
2905 /* Ensure they are both unkilled. */
2906 PTHREAD_JOIN(self->sibling[0].tid, &status);
2907 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2908 PTHREAD_JOIN(self->sibling[1].tid, &status);
2909 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2910 }
2911
TEST_F(TSYNC,two_siblings_with_one_divergence_no_tid_in_err)2912 TEST_F(TSYNC, two_siblings_with_one_divergence_no_tid_in_err)
2913 {
2914 long ret, flags;
2915 void *status;
2916
2917 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2918 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2919 }
2920
2921 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2922 ASSERT_NE(ENOSYS, errno) {
2923 TH_LOG("Kernel does not support seccomp syscall!");
2924 }
2925 ASSERT_EQ(0, ret) {
2926 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2927 }
2928 self->sibling[0].diverge = 1;
2929 tsync_start_sibling(&self->sibling[0]);
2930 tsync_start_sibling(&self->sibling[1]);
2931
2932 while (self->sibling_count < TSYNC_SIBLINGS) {
2933 sem_wait(&self->started);
2934 self->sibling_count++;
2935 }
2936
2937 flags = SECCOMP_FILTER_FLAG_TSYNC | \
2938 SECCOMP_FILTER_FLAG_TSYNC_ESRCH;
2939 ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &self->apply_prog);
2940 ASSERT_EQ(ESRCH, errno) {
2941 TH_LOG("Did not return ESRCH for diverged sibling.");
2942 }
2943 ASSERT_EQ(-1, ret) {
2944 TH_LOG("Did not fail on diverged sibling.");
2945 }
2946
2947 /* Wake the threads */
2948 pthread_mutex_lock(&self->mutex);
2949 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2950 TH_LOG("cond broadcast non-zero");
2951 }
2952 pthread_mutex_unlock(&self->mutex);
2953
2954 /* Ensure they are both unkilled. */
2955 PTHREAD_JOIN(self->sibling[0].tid, &status);
2956 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2957 PTHREAD_JOIN(self->sibling[1].tid, &status);
2958 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2959 }
2960
TEST_F(TSYNC,two_siblings_not_under_filter)2961 TEST_F(TSYNC, two_siblings_not_under_filter)
2962 {
2963 long ret, sib;
2964 void *status;
2965 struct timespec delay = { .tv_nsec = 100000000 };
2966
2967 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2968 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2969 }
2970
2971 /*
2972 * Sibling 0 will have its own seccomp policy
2973 * and Sibling 1 will not be under seccomp at
2974 * all. Sibling 1 will enter seccomp and 0
2975 * will cause failure.
2976 */
2977 self->sibling[0].diverge = 1;
2978 tsync_start_sibling(&self->sibling[0]);
2979 tsync_start_sibling(&self->sibling[1]);
2980
2981 while (self->sibling_count < TSYNC_SIBLINGS) {
2982 sem_wait(&self->started);
2983 self->sibling_count++;
2984 }
2985
2986 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2987 ASSERT_NE(ENOSYS, errno) {
2988 TH_LOG("Kernel does not support seccomp syscall!");
2989 }
2990 ASSERT_EQ(0, ret) {
2991 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2992 }
2993
2994 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2995 &self->apply_prog);
2996 ASSERT_EQ(ret, self->sibling[0].system_tid) {
2997 TH_LOG("Did not fail on diverged sibling.");
2998 }
2999 sib = 1;
3000 if (ret == self->sibling[0].system_tid)
3001 sib = 0;
3002
3003 pthread_mutex_lock(&self->mutex);
3004
3005 /* Increment the other siblings num_waits so we can clean up
3006 * the one we just saw.
3007 */
3008 self->sibling[!sib].num_waits += 1;
3009
3010 /* Signal the thread to clean up*/
3011 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
3012 TH_LOG("cond broadcast non-zero");
3013 }
3014 pthread_mutex_unlock(&self->mutex);
3015 PTHREAD_JOIN(self->sibling[sib].tid, &status);
3016 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
3017 /* Poll for actual task death. pthread_join doesn't guarantee it. */
3018 while (!kill(self->sibling[sib].system_tid, 0))
3019 nanosleep(&delay, NULL);
3020 /* Switch to the remaining sibling */
3021 sib = !sib;
3022
3023 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
3024 &self->apply_prog);
3025 ASSERT_EQ(0, ret) {
3026 TH_LOG("Expected the remaining sibling to sync");
3027 };
3028
3029 pthread_mutex_lock(&self->mutex);
3030
3031 /* If remaining sibling didn't have a chance to wake up during
3032 * the first broadcast, manually reduce the num_waits now.
3033 */
3034 if (self->sibling[sib].num_waits > 1)
3035 self->sibling[sib].num_waits = 1;
3036 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
3037 TH_LOG("cond broadcast non-zero");
3038 }
3039 pthread_mutex_unlock(&self->mutex);
3040 PTHREAD_JOIN(self->sibling[sib].tid, &status);
3041 EXPECT_EQ(0, (long)status);
3042 /* Poll for actual task death. pthread_join doesn't guarantee it. */
3043 while (!kill(self->sibling[sib].system_tid, 0))
3044 nanosleep(&delay, NULL);
3045
3046 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
3047 &self->apply_prog);
3048 ASSERT_EQ(0, ret); /* just us chickens */
3049 }
3050
3051 /* Make sure restarted syscalls are seen directly as "restart_syscall". */
TEST(syscall_restart)3052 TEST(syscall_restart)
3053 {
3054 long ret;
3055 unsigned long msg;
3056 pid_t child_pid;
3057 int pipefd[2];
3058 int status;
3059 siginfo_t info = { };
3060 struct sock_filter filter[] = {
3061 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
3062 offsetof(struct seccomp_data, nr)),
3063
3064 #ifdef __NR_sigreturn
3065 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_sigreturn, 7, 0),
3066 #endif
3067 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 6, 0),
3068 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_exit, 5, 0),
3069 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_rt_sigreturn, 4, 0),
3070 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_nanosleep, 5, 0),
3071 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_clock_nanosleep, 4, 0),
3072 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_restart_syscall, 4, 0),
3073
3074 /* Allow __NR_write for easy logging. */
3075 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_write, 0, 1),
3076 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3077 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
3078 /* The nanosleep jump target. */
3079 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x100),
3080 /* The restart_syscall jump target. */
3081 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x200),
3082 };
3083 struct sock_fprog prog = {
3084 .len = (unsigned short)ARRAY_SIZE(filter),
3085 .filter = filter,
3086 };
3087 #if defined(__arm__)
3088 struct utsname utsbuf;
3089 #endif
3090
3091 ASSERT_EQ(0, pipe(pipefd));
3092
3093 child_pid = fork();
3094 ASSERT_LE(0, child_pid);
3095 if (child_pid == 0) {
3096 /* Child uses EXPECT not ASSERT to deliver status correctly. */
3097 char buf = ' ';
3098 struct timespec timeout = { };
3099
3100 /* Attach parent as tracer and stop. */
3101 EXPECT_EQ(0, ptrace(PTRACE_TRACEME));
3102 EXPECT_EQ(0, raise(SIGSTOP));
3103
3104 EXPECT_EQ(0, close(pipefd[1]));
3105
3106 EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
3107 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3108 }
3109
3110 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
3111 EXPECT_EQ(0, ret) {
3112 TH_LOG("Failed to install filter!");
3113 }
3114
3115 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) {
3116 TH_LOG("Failed to read() sync from parent");
3117 }
3118 EXPECT_EQ('.', buf) {
3119 TH_LOG("Failed to get sync data from read()");
3120 }
3121
3122 /* Start nanosleep to be interrupted. */
3123 timeout.tv_sec = 1;
3124 errno = 0;
3125 EXPECT_EQ(0, nanosleep(&timeout, NULL)) {
3126 TH_LOG("Call to nanosleep() failed (errno %d: %s)",
3127 errno, strerror(errno));
3128 }
3129
3130 /* Read final sync from parent. */
3131 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) {
3132 TH_LOG("Failed final read() from parent");
3133 }
3134 EXPECT_EQ('!', buf) {
3135 TH_LOG("Failed to get final data from read()");
3136 }
3137
3138 /* Directly report the status of our test harness results. */
3139 syscall(__NR_exit, _metadata->exit_code);
3140 }
3141 EXPECT_EQ(0, close(pipefd[0]));
3142
3143 /* Attach to child, setup options, and release. */
3144 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3145 ASSERT_EQ(true, WIFSTOPPED(status));
3146 ASSERT_EQ(0, ptrace(PTRACE_SETOPTIONS, child_pid, NULL,
3147 PTRACE_O_TRACESECCOMP));
3148 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3149 ASSERT_EQ(1, write(pipefd[1], ".", 1));
3150
3151 /* Wait for nanosleep() to start. */
3152 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3153 ASSERT_EQ(true, WIFSTOPPED(status));
3154 ASSERT_EQ(SIGTRAP, WSTOPSIG(status));
3155 ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16));
3156 ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg));
3157 ASSERT_EQ(0x100, msg);
3158 ret = get_syscall(_metadata, child_pid);
3159 EXPECT_TRUE(ret == __NR_nanosleep || ret == __NR_clock_nanosleep);
3160
3161 /* Might as well check siginfo for sanity while we're here. */
3162 ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info));
3163 ASSERT_EQ(SIGTRAP, info.si_signo);
3164 ASSERT_EQ(SIGTRAP | (PTRACE_EVENT_SECCOMP << 8), info.si_code);
3165 EXPECT_EQ(0, info.si_errno);
3166 EXPECT_EQ(getuid(), info.si_uid);
3167 /* Verify signal delivery came from child (seccomp-triggered). */
3168 EXPECT_EQ(child_pid, info.si_pid);
3169
3170 /* Interrupt nanosleep with SIGSTOP (which we'll need to handle). */
3171 ASSERT_EQ(0, kill(child_pid, SIGSTOP));
3172 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3173 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3174 ASSERT_EQ(true, WIFSTOPPED(status));
3175 ASSERT_EQ(SIGSTOP, WSTOPSIG(status));
3176 ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info));
3177 /*
3178 * There is no siginfo on SIGSTOP any more, so we can't verify
3179 * signal delivery came from parent now (getpid() == info.si_pid).
3180 * https://lkml.kernel.org/r/CAGXu5jJaZAOzP1qFz66tYrtbuywqb+UN2SOA1VLHpCCOiYvYeg@mail.gmail.com
3181 * At least verify the SIGSTOP via PTRACE_GETSIGINFO.
3182 */
3183 EXPECT_EQ(SIGSTOP, info.si_signo);
3184
3185 /* Restart nanosleep with SIGCONT, which triggers restart_syscall. */
3186 ASSERT_EQ(0, kill(child_pid, SIGCONT));
3187 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3188 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3189 ASSERT_EQ(true, WIFSTOPPED(status));
3190 ASSERT_EQ(SIGCONT, WSTOPSIG(status));
3191 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3192
3193 /* Wait for restart_syscall() to start. */
3194 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3195 ASSERT_EQ(true, WIFSTOPPED(status));
3196 ASSERT_EQ(SIGTRAP, WSTOPSIG(status));
3197 ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16));
3198 ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg));
3199
3200 ASSERT_EQ(0x200, msg);
3201 ret = get_syscall(_metadata, child_pid);
3202 #if defined(__arm__)
3203 /*
3204 * - native ARM registers do NOT expose true syscall.
3205 * - compat ARM registers on ARM64 DO expose true syscall.
3206 * - values of utsbuf.machine include 'armv8l' or 'armb8b'
3207 * for ARM64 running in compat mode.
3208 */
3209 ASSERT_EQ(0, uname(&utsbuf));
3210 if ((strncmp(utsbuf.machine, "arm", 3) == 0) &&
3211 (strncmp(utsbuf.machine, "armv8l", 6) != 0) &&
3212 (strncmp(utsbuf.machine, "armv8b", 6) != 0)) {
3213 EXPECT_EQ(__NR_nanosleep, ret);
3214 } else
3215 #endif
3216 {
3217 EXPECT_EQ(__NR_restart_syscall, ret);
3218 }
3219
3220 /* Write again to end test. */
3221 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3222 ASSERT_EQ(1, write(pipefd[1], "!", 1));
3223 EXPECT_EQ(0, close(pipefd[1]));
3224
3225 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3226 if (WIFSIGNALED(status) || WEXITSTATUS(status))
3227 _metadata->exit_code = KSFT_FAIL;
3228 }
3229
TEST_SIGNAL(filter_flag_log,SIGSYS)3230 TEST_SIGNAL(filter_flag_log, SIGSYS)
3231 {
3232 struct sock_filter allow_filter[] = {
3233 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3234 };
3235 struct sock_filter kill_filter[] = {
3236 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
3237 offsetof(struct seccomp_data, nr)),
3238 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
3239 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
3240 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3241 };
3242 struct sock_fprog allow_prog = {
3243 .len = (unsigned short)ARRAY_SIZE(allow_filter),
3244 .filter = allow_filter,
3245 };
3246 struct sock_fprog kill_prog = {
3247 .len = (unsigned short)ARRAY_SIZE(kill_filter),
3248 .filter = kill_filter,
3249 };
3250 long ret;
3251 pid_t parent = getppid();
3252
3253 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3254 ASSERT_EQ(0, ret);
3255
3256 /* Verify that the FILTER_FLAG_LOG flag isn't accepted in strict mode */
3257 ret = seccomp(SECCOMP_SET_MODE_STRICT, SECCOMP_FILTER_FLAG_LOG,
3258 &allow_prog);
3259 ASSERT_NE(ENOSYS, errno) {
3260 TH_LOG("Kernel does not support seccomp syscall!");
3261 }
3262 EXPECT_NE(0, ret) {
3263 TH_LOG("Kernel accepted FILTER_FLAG_LOG flag in strict mode!");
3264 }
3265 EXPECT_EQ(EINVAL, errno) {
3266 TH_LOG("Kernel returned unexpected errno for FILTER_FLAG_LOG flag in strict mode!");
3267 }
3268
3269 /* Verify that a simple, permissive filter can be added with no flags */
3270 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &allow_prog);
3271 EXPECT_EQ(0, ret);
3272
3273 /* See if the same filter can be added with the FILTER_FLAG_LOG flag */
3274 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
3275 &allow_prog);
3276 ASSERT_NE(EINVAL, errno) {
3277 TH_LOG("Kernel does not support the FILTER_FLAG_LOG flag!");
3278 }
3279 EXPECT_EQ(0, ret);
3280
3281 /* Ensure that the kill filter works with the FILTER_FLAG_LOG flag */
3282 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
3283 &kill_prog);
3284 EXPECT_EQ(0, ret);
3285
3286 EXPECT_EQ(parent, syscall(__NR_getppid));
3287 /* getpid() should never return. */
3288 EXPECT_EQ(0, syscall(__NR_getpid));
3289 }
3290
TEST(get_action_avail)3291 TEST(get_action_avail)
3292 {
3293 __u32 actions[] = { SECCOMP_RET_KILL_THREAD, SECCOMP_RET_TRAP,
3294 SECCOMP_RET_ERRNO, SECCOMP_RET_TRACE,
3295 SECCOMP_RET_LOG, SECCOMP_RET_ALLOW };
3296 __u32 unknown_action = 0x10000000U;
3297 int i;
3298 long ret;
3299
3300 ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[0]);
3301 ASSERT_NE(ENOSYS, errno) {
3302 TH_LOG("Kernel does not support seccomp syscall!");
3303 }
3304 ASSERT_NE(EINVAL, errno) {
3305 TH_LOG("Kernel does not support SECCOMP_GET_ACTION_AVAIL operation!");
3306 }
3307 EXPECT_EQ(ret, 0);
3308
3309 for (i = 0; i < ARRAY_SIZE(actions); i++) {
3310 ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[i]);
3311 EXPECT_EQ(ret, 0) {
3312 TH_LOG("Expected action (0x%X) not available!",
3313 actions[i]);
3314 }
3315 }
3316
3317 /* Check that an unknown action is handled properly (EOPNOTSUPP) */
3318 ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &unknown_action);
3319 EXPECT_EQ(ret, -1);
3320 EXPECT_EQ(errno, EOPNOTSUPP);
3321 }
3322
TEST(get_metadata)3323 TEST(get_metadata)
3324 {
3325 pid_t pid;
3326 int pipefd[2];
3327 char buf;
3328 struct seccomp_metadata md;
3329 long ret;
3330
3331 /* Only real root can get metadata. */
3332 if (geteuid()) {
3333 SKIP(return, "get_metadata requires real root");
3334 return;
3335 }
3336
3337 ASSERT_EQ(0, pipe(pipefd));
3338
3339 pid = fork();
3340 ASSERT_GE(pid, 0);
3341 if (pid == 0) {
3342 struct sock_filter filter[] = {
3343 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3344 };
3345 struct sock_fprog prog = {
3346 .len = (unsigned short)ARRAY_SIZE(filter),
3347 .filter = filter,
3348 };
3349
3350 /* one with log, one without */
3351 EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER,
3352 SECCOMP_FILTER_FLAG_LOG, &prog));
3353 EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog));
3354
3355 EXPECT_EQ(0, close(pipefd[0]));
3356 ASSERT_EQ(1, write(pipefd[1], "1", 1));
3357 ASSERT_EQ(0, close(pipefd[1]));
3358
3359 while (1)
3360 sleep(100);
3361 }
3362
3363 ASSERT_EQ(0, close(pipefd[1]));
3364 ASSERT_EQ(1, read(pipefd[0], &buf, 1));
3365
3366 ASSERT_EQ(0, ptrace(PTRACE_ATTACH, pid));
3367 ASSERT_EQ(pid, waitpid(pid, NULL, 0));
3368
3369 /* Past here must not use ASSERT or child process is never killed. */
3370
3371 md.filter_off = 0;
3372 errno = 0;
3373 ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md);
3374 EXPECT_EQ(sizeof(md), ret) {
3375 if (errno == EINVAL)
3376 SKIP(goto skip, "Kernel does not support PTRACE_SECCOMP_GET_METADATA (missing CONFIG_CHECKPOINT_RESTORE?)");
3377 }
3378
3379 EXPECT_EQ(md.flags, SECCOMP_FILTER_FLAG_LOG);
3380 EXPECT_EQ(md.filter_off, 0);
3381
3382 md.filter_off = 1;
3383 ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md);
3384 EXPECT_EQ(sizeof(md), ret);
3385 EXPECT_EQ(md.flags, 0);
3386 EXPECT_EQ(md.filter_off, 1);
3387
3388 skip:
3389 ASSERT_EQ(0, kill(pid, SIGKILL));
3390 }
3391
user_notif_syscall(int nr,unsigned int flags)3392 static int user_notif_syscall(int nr, unsigned int flags)
3393 {
3394 struct sock_filter filter[] = {
3395 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
3396 offsetof(struct seccomp_data, nr)),
3397 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, nr, 0, 1),
3398 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_USER_NOTIF),
3399 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3400 };
3401
3402 struct sock_fprog prog = {
3403 .len = (unsigned short)ARRAY_SIZE(filter),
3404 .filter = filter,
3405 };
3406
3407 return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog);
3408 }
3409
3410 #define USER_NOTIF_MAGIC INT_MAX
TEST(user_notification_basic)3411 TEST(user_notification_basic)
3412 {
3413 pid_t pid;
3414 long ret;
3415 int status, listener;
3416 struct seccomp_notif req = {};
3417 struct seccomp_notif_resp resp = {};
3418 struct pollfd pollfd;
3419
3420 struct sock_filter filter[] = {
3421 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3422 };
3423 struct sock_fprog prog = {
3424 .len = (unsigned short)ARRAY_SIZE(filter),
3425 .filter = filter,
3426 };
3427
3428 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3429 ASSERT_EQ(0, ret) {
3430 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3431 }
3432
3433 pid = fork();
3434 ASSERT_GE(pid, 0);
3435
3436 /* Check that we get -ENOSYS with no listener attached */
3437 if (pid == 0) {
3438 if (user_notif_syscall(__NR_getppid, 0) < 0)
3439 exit(1);
3440 ret = syscall(__NR_getppid);
3441 exit(ret >= 0 || errno != ENOSYS);
3442 }
3443
3444 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3445 EXPECT_EQ(true, WIFEXITED(status));
3446 EXPECT_EQ(0, WEXITSTATUS(status));
3447
3448 /* Add some no-op filters for grins. */
3449 EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3450 EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3451 EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3452 EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3453
3454 /* Check that the basic notification machinery works */
3455 listener = user_notif_syscall(__NR_getppid,
3456 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3457 ASSERT_GE(listener, 0);
3458
3459 /* Installing a second listener in the chain should EBUSY */
3460 EXPECT_EQ(user_notif_syscall(__NR_getppid,
3461 SECCOMP_FILTER_FLAG_NEW_LISTENER),
3462 -1);
3463 EXPECT_EQ(errno, EBUSY);
3464
3465 pid = fork();
3466 ASSERT_GE(pid, 0);
3467
3468 if (pid == 0) {
3469 ret = syscall(__NR_getppid);
3470 exit(ret != USER_NOTIF_MAGIC);
3471 }
3472
3473 pollfd.fd = listener;
3474 pollfd.events = POLLIN | POLLOUT;
3475
3476 EXPECT_GT(poll(&pollfd, 1, -1), 0);
3477 EXPECT_EQ(pollfd.revents, POLLIN);
3478
3479 /* Test that we can't pass garbage to the kernel. */
3480 memset(&req, 0, sizeof(req));
3481 req.pid = -1;
3482 errno = 0;
3483 ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req);
3484 EXPECT_EQ(-1, ret);
3485 EXPECT_EQ(EINVAL, errno);
3486
3487 if (ret) {
3488 req.pid = 0;
3489 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3490 }
3491
3492 pollfd.fd = listener;
3493 pollfd.events = POLLIN | POLLOUT;
3494
3495 EXPECT_GT(poll(&pollfd, 1, -1), 0);
3496 EXPECT_EQ(pollfd.revents, POLLOUT);
3497
3498 EXPECT_EQ(req.data.nr, __NR_getppid);
3499
3500 resp.id = req.id;
3501 resp.error = 0;
3502 resp.val = USER_NOTIF_MAGIC;
3503
3504 /* check that we make sure flags == 0 */
3505 resp.flags = 1;
3506 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3507 EXPECT_EQ(errno, EINVAL);
3508
3509 resp.flags = 0;
3510 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3511
3512 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3513 EXPECT_EQ(true, WIFEXITED(status));
3514 EXPECT_EQ(0, WEXITSTATUS(status));
3515 }
3516
TEST(user_notification_with_tsync)3517 TEST(user_notification_with_tsync)
3518 {
3519 int ret;
3520 unsigned int flags;
3521
3522 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3523 ASSERT_EQ(0, ret) {
3524 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3525 }
3526
3527 /* these were exclusive */
3528 flags = SECCOMP_FILTER_FLAG_NEW_LISTENER |
3529 SECCOMP_FILTER_FLAG_TSYNC;
3530 ASSERT_EQ(-1, user_notif_syscall(__NR_getppid, flags));
3531 ASSERT_EQ(EINVAL, errno);
3532
3533 /* but now they're not */
3534 flags |= SECCOMP_FILTER_FLAG_TSYNC_ESRCH;
3535 ret = user_notif_syscall(__NR_getppid, flags);
3536 close(ret);
3537 ASSERT_LE(0, ret);
3538 }
3539
TEST(user_notification_kill_in_middle)3540 TEST(user_notification_kill_in_middle)
3541 {
3542 pid_t pid;
3543 long ret;
3544 int listener;
3545 struct seccomp_notif req = {};
3546 struct seccomp_notif_resp resp = {};
3547
3548 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3549 ASSERT_EQ(0, ret) {
3550 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3551 }
3552
3553 listener = user_notif_syscall(__NR_getppid,
3554 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3555 ASSERT_GE(listener, 0);
3556
3557 /*
3558 * Check that nothing bad happens when we kill the task in the middle
3559 * of a syscall.
3560 */
3561 pid = fork();
3562 ASSERT_GE(pid, 0);
3563
3564 if (pid == 0) {
3565 ret = syscall(__NR_getppid);
3566 exit(ret != USER_NOTIF_MAGIC);
3567 }
3568
3569 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3570 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id), 0);
3571
3572 EXPECT_EQ(kill(pid, SIGKILL), 0);
3573 EXPECT_EQ(waitpid(pid, NULL, 0), pid);
3574
3575 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id), -1);
3576
3577 resp.id = req.id;
3578 ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp);
3579 EXPECT_EQ(ret, -1);
3580 EXPECT_EQ(errno, ENOENT);
3581 }
3582
3583 static int handled = -1;
3584
signal_handler(int signal)3585 static void signal_handler(int signal)
3586 {
3587 if (write(handled, "c", 1) != 1)
3588 perror("write from signal");
3589 }
3590
signal_handler_nop(int signal)3591 static void signal_handler_nop(int signal)
3592 {
3593 }
3594
TEST(user_notification_signal)3595 TEST(user_notification_signal)
3596 {
3597 pid_t pid;
3598 long ret;
3599 int status, listener, sk_pair[2];
3600 struct seccomp_notif req = {};
3601 struct seccomp_notif_resp resp = {};
3602 char c;
3603
3604 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3605 ASSERT_EQ(0, ret) {
3606 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3607 }
3608
3609 ASSERT_EQ(socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair), 0);
3610
3611 listener = user_notif_syscall(__NR_gettid,
3612 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3613 ASSERT_GE(listener, 0);
3614
3615 pid = fork();
3616 ASSERT_GE(pid, 0);
3617
3618 if (pid == 0) {
3619 close(sk_pair[0]);
3620 handled = sk_pair[1];
3621 if (signal(SIGUSR1, signal_handler) == SIG_ERR) {
3622 perror("signal");
3623 exit(1);
3624 }
3625 /*
3626 * ERESTARTSYS behavior is a bit hard to test, because we need
3627 * to rely on a signal that has not yet been handled. Let's at
3628 * least check that the error code gets propagated through, and
3629 * hope that it doesn't break when there is actually a signal :)
3630 */
3631 ret = syscall(__NR_gettid);
3632 exit(!(ret == -1 && errno == 512));
3633 }
3634
3635 close(sk_pair[1]);
3636
3637 memset(&req, 0, sizeof(req));
3638 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3639
3640 EXPECT_EQ(kill(pid, SIGUSR1), 0);
3641
3642 /*
3643 * Make sure the signal really is delivered, which means we're not
3644 * stuck in the user notification code any more and the notification
3645 * should be dead.
3646 */
3647 EXPECT_EQ(read(sk_pair[0], &c, 1), 1);
3648
3649 resp.id = req.id;
3650 resp.error = -EPERM;
3651 resp.val = 0;
3652
3653 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3654 EXPECT_EQ(errno, ENOENT);
3655
3656 memset(&req, 0, sizeof(req));
3657 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3658
3659 resp.id = req.id;
3660 resp.error = -512; /* -ERESTARTSYS */
3661 resp.val = 0;
3662
3663 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3664
3665 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3666 EXPECT_EQ(true, WIFEXITED(status));
3667 EXPECT_EQ(0, WEXITSTATUS(status));
3668 }
3669
TEST(user_notification_closed_listener)3670 TEST(user_notification_closed_listener)
3671 {
3672 pid_t pid;
3673 long ret;
3674 int status, listener;
3675
3676 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3677 ASSERT_EQ(0, ret) {
3678 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3679 }
3680
3681 listener = user_notif_syscall(__NR_getppid,
3682 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3683 ASSERT_GE(listener, 0);
3684
3685 /*
3686 * Check that we get an ENOSYS when the listener is closed.
3687 */
3688 pid = fork();
3689 ASSERT_GE(pid, 0);
3690 if (pid == 0) {
3691 close(listener);
3692 ret = syscall(__NR_getppid);
3693 exit(ret != -1 && errno != ENOSYS);
3694 }
3695
3696 close(listener);
3697
3698 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3699 EXPECT_EQ(true, WIFEXITED(status));
3700 EXPECT_EQ(0, WEXITSTATUS(status));
3701 }
3702
3703 /*
3704 * Check that a pid in a child namespace still shows up as valid in ours.
3705 */
TEST(user_notification_child_pid_ns)3706 TEST(user_notification_child_pid_ns)
3707 {
3708 pid_t pid;
3709 int status, listener;
3710 struct seccomp_notif req = {};
3711 struct seccomp_notif_resp resp = {};
3712
3713 ASSERT_EQ(unshare(CLONE_NEWUSER | CLONE_NEWPID), 0) {
3714 if (errno == EINVAL)
3715 SKIP(return, "kernel missing CLONE_NEWUSER support");
3716 };
3717
3718 listener = user_notif_syscall(__NR_getppid,
3719 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3720 ASSERT_GE(listener, 0);
3721
3722 pid = fork();
3723 ASSERT_GE(pid, 0);
3724
3725 if (pid == 0)
3726 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
3727
3728 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3729 EXPECT_EQ(req.pid, pid);
3730
3731 resp.id = req.id;
3732 resp.error = 0;
3733 resp.val = USER_NOTIF_MAGIC;
3734
3735 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3736
3737 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3738 EXPECT_EQ(true, WIFEXITED(status));
3739 EXPECT_EQ(0, WEXITSTATUS(status));
3740 close(listener);
3741 }
3742
3743 /*
3744 * Check that a pid in a sibling (i.e. unrelated) namespace shows up as 0, i.e.
3745 * invalid.
3746 */
TEST(user_notification_sibling_pid_ns)3747 TEST(user_notification_sibling_pid_ns)
3748 {
3749 pid_t pid, pid2;
3750 int status, listener;
3751 struct seccomp_notif req = {};
3752 struct seccomp_notif_resp resp = {};
3753
3754 ASSERT_EQ(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0) {
3755 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3756 }
3757
3758 listener = user_notif_syscall(__NR_getppid,
3759 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3760 ASSERT_GE(listener, 0);
3761
3762 pid = fork();
3763 ASSERT_GE(pid, 0);
3764
3765 if (pid == 0) {
3766 ASSERT_EQ(unshare(CLONE_NEWPID), 0) {
3767 if (errno == EPERM)
3768 SKIP(return, "CLONE_NEWPID requires CAP_SYS_ADMIN");
3769 else if (errno == EINVAL)
3770 SKIP(return, "CLONE_NEWPID is invalid (missing CONFIG_PID_NS?)");
3771 }
3772
3773 pid2 = fork();
3774 ASSERT_GE(pid2, 0);
3775
3776 if (pid2 == 0)
3777 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
3778
3779 EXPECT_EQ(waitpid(pid2, &status, 0), pid2);
3780 EXPECT_EQ(true, WIFEXITED(status));
3781 EXPECT_EQ(0, WEXITSTATUS(status));
3782 exit(WEXITSTATUS(status));
3783 }
3784
3785 /* Create the sibling ns, and sibling in it. */
3786 ASSERT_EQ(unshare(CLONE_NEWPID), 0) {
3787 if (errno == EPERM)
3788 SKIP(return, "CLONE_NEWPID requires CAP_SYS_ADMIN");
3789 else if (errno == EINVAL)
3790 SKIP(return, "CLONE_NEWPID is invalid (missing CONFIG_PID_NS?)");
3791 }
3792 ASSERT_EQ(errno, 0);
3793
3794 pid2 = fork();
3795 ASSERT_GE(pid2, 0);
3796
3797 if (pid2 == 0) {
3798 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3799 /*
3800 * The pid should be 0, i.e. the task is in some namespace that
3801 * we can't "see".
3802 */
3803 EXPECT_EQ(req.pid, 0);
3804
3805 resp.id = req.id;
3806 resp.error = 0;
3807 resp.val = USER_NOTIF_MAGIC;
3808
3809 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3810 exit(0);
3811 }
3812
3813 close(listener);
3814
3815 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3816 EXPECT_EQ(true, WIFEXITED(status));
3817 EXPECT_EQ(0, WEXITSTATUS(status));
3818
3819 EXPECT_EQ(waitpid(pid2, &status, 0), pid2);
3820 EXPECT_EQ(true, WIFEXITED(status));
3821 EXPECT_EQ(0, WEXITSTATUS(status));
3822 }
3823
TEST(user_notification_fault_recv)3824 TEST(user_notification_fault_recv)
3825 {
3826 pid_t pid;
3827 int status, listener;
3828 struct seccomp_notif req = {};
3829 struct seccomp_notif_resp resp = {};
3830
3831 ASSERT_EQ(unshare(CLONE_NEWUSER), 0) {
3832 if (errno == EINVAL)
3833 SKIP(return, "kernel missing CLONE_NEWUSER support");
3834 }
3835
3836 listener = user_notif_syscall(__NR_getppid,
3837 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3838 ASSERT_GE(listener, 0);
3839
3840 pid = fork();
3841 ASSERT_GE(pid, 0);
3842
3843 if (pid == 0)
3844 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
3845
3846 /* Do a bad recv() */
3847 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, NULL), -1);
3848 EXPECT_EQ(errno, EFAULT);
3849
3850 /* We should still be able to receive this notification, though. */
3851 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3852 EXPECT_EQ(req.pid, pid);
3853
3854 resp.id = req.id;
3855 resp.error = 0;
3856 resp.val = USER_NOTIF_MAGIC;
3857
3858 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3859
3860 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3861 EXPECT_EQ(true, WIFEXITED(status));
3862 EXPECT_EQ(0, WEXITSTATUS(status));
3863 }
3864
TEST(seccomp_get_notif_sizes)3865 TEST(seccomp_get_notif_sizes)
3866 {
3867 struct seccomp_notif_sizes sizes;
3868
3869 ASSERT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0);
3870 EXPECT_EQ(sizes.seccomp_notif, sizeof(struct seccomp_notif));
3871 EXPECT_EQ(sizes.seccomp_notif_resp, sizeof(struct seccomp_notif_resp));
3872 }
3873
TEST(user_notification_continue)3874 TEST(user_notification_continue)
3875 {
3876 pid_t pid;
3877 long ret;
3878 int status, listener;
3879 struct seccomp_notif req = {};
3880 struct seccomp_notif_resp resp = {};
3881 struct pollfd pollfd;
3882
3883 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3884 ASSERT_EQ(0, ret) {
3885 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3886 }
3887
3888 listener = user_notif_syscall(__NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER);
3889 ASSERT_GE(listener, 0);
3890
3891 pid = fork();
3892 ASSERT_GE(pid, 0);
3893
3894 if (pid == 0) {
3895 int dup_fd, pipe_fds[2];
3896 pid_t self;
3897
3898 ASSERT_GE(pipe(pipe_fds), 0);
3899
3900 dup_fd = dup(pipe_fds[0]);
3901 ASSERT_GE(dup_fd, 0);
3902 EXPECT_NE(pipe_fds[0], dup_fd);
3903
3904 self = getpid();
3905 ASSERT_EQ(filecmp(self, self, pipe_fds[0], dup_fd), 0);
3906 exit(0);
3907 }
3908
3909 pollfd.fd = listener;
3910 pollfd.events = POLLIN | POLLOUT;
3911
3912 EXPECT_GT(poll(&pollfd, 1, -1), 0);
3913 EXPECT_EQ(pollfd.revents, POLLIN);
3914
3915 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3916
3917 pollfd.fd = listener;
3918 pollfd.events = POLLIN | POLLOUT;
3919
3920 EXPECT_GT(poll(&pollfd, 1, -1), 0);
3921 EXPECT_EQ(pollfd.revents, POLLOUT);
3922
3923 EXPECT_EQ(req.data.nr, __NR_dup);
3924
3925 resp.id = req.id;
3926 resp.flags = SECCOMP_USER_NOTIF_FLAG_CONTINUE;
3927
3928 /*
3929 * Verify that setting SECCOMP_USER_NOTIF_FLAG_CONTINUE enforces other
3930 * args be set to 0.
3931 */
3932 resp.error = 0;
3933 resp.val = USER_NOTIF_MAGIC;
3934 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3935 EXPECT_EQ(errno, EINVAL);
3936
3937 resp.error = USER_NOTIF_MAGIC;
3938 resp.val = 0;
3939 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3940 EXPECT_EQ(errno, EINVAL);
3941
3942 resp.error = 0;
3943 resp.val = 0;
3944 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0) {
3945 if (errno == EINVAL)
3946 SKIP(goto skip, "Kernel does not support SECCOMP_USER_NOTIF_FLAG_CONTINUE");
3947 }
3948
3949 skip:
3950 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3951 EXPECT_EQ(true, WIFEXITED(status));
3952 EXPECT_EQ(0, WEXITSTATUS(status)) {
3953 if (WEXITSTATUS(status) == 2) {
3954 SKIP(return, "Kernel does not support kcmp() syscall");
3955 return;
3956 }
3957 }
3958 }
3959
TEST(user_notification_filter_empty)3960 TEST(user_notification_filter_empty)
3961 {
3962 pid_t pid;
3963 long ret;
3964 int status;
3965 struct pollfd pollfd;
3966 struct __clone_args args = {
3967 .flags = CLONE_FILES,
3968 .exit_signal = SIGCHLD,
3969 };
3970
3971 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3972 ASSERT_EQ(0, ret) {
3973 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3974 }
3975
3976 if (__NR_clone3 < 0)
3977 SKIP(return, "Test not built with clone3 support");
3978
3979 pid = sys_clone3(&args, sizeof(args));
3980 ASSERT_GE(pid, 0);
3981
3982 if (pid == 0) {
3983 int listener;
3984
3985 listener = user_notif_syscall(__NR_mknodat, SECCOMP_FILTER_FLAG_NEW_LISTENER);
3986 if (listener < 0)
3987 _exit(EXIT_FAILURE);
3988
3989 if (dup2(listener, 200) != 200)
3990 _exit(EXIT_FAILURE);
3991
3992 close(listener);
3993
3994 _exit(EXIT_SUCCESS);
3995 }
3996
3997 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3998 EXPECT_EQ(true, WIFEXITED(status));
3999 EXPECT_EQ(0, WEXITSTATUS(status));
4000
4001 /*
4002 * The seccomp filter has become unused so we should be notified once
4003 * the kernel gets around to cleaning up task struct.
4004 */
4005 pollfd.fd = 200;
4006 pollfd.events = POLLHUP;
4007
4008 EXPECT_GT(poll(&pollfd, 1, 2000), 0);
4009 EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0);
4010 }
4011
TEST(user_ioctl_notification_filter_empty)4012 TEST(user_ioctl_notification_filter_empty)
4013 {
4014 pid_t pid;
4015 long ret;
4016 int status, p[2];
4017 struct __clone_args args = {
4018 .flags = CLONE_FILES,
4019 .exit_signal = SIGCHLD,
4020 };
4021 struct seccomp_notif req = {};
4022
4023 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4024 ASSERT_EQ(0, ret) {
4025 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4026 }
4027
4028 if (__NR_clone3 < 0)
4029 SKIP(return, "Test not built with clone3 support");
4030
4031 ASSERT_EQ(0, pipe(p));
4032
4033 pid = sys_clone3(&args, sizeof(args));
4034 ASSERT_GE(pid, 0);
4035
4036 if (pid == 0) {
4037 int listener;
4038
4039 listener = user_notif_syscall(__NR_mknodat, SECCOMP_FILTER_FLAG_NEW_LISTENER);
4040 if (listener < 0)
4041 _exit(EXIT_FAILURE);
4042
4043 if (dup2(listener, 200) != 200)
4044 _exit(EXIT_FAILURE);
4045 close(p[1]);
4046 close(listener);
4047 sleep(1);
4048
4049 _exit(EXIT_SUCCESS);
4050 }
4051 if (read(p[0], &status, 1) != 0)
4052 _exit(EXIT_SUCCESS);
4053 close(p[0]);
4054 /*
4055 * The seccomp filter has become unused so we should be notified once
4056 * the kernel gets around to cleaning up task struct.
4057 */
4058 EXPECT_EQ(ioctl(200, SECCOMP_IOCTL_NOTIF_RECV, &req), -1);
4059 EXPECT_EQ(errno, ENOENT);
4060
4061 EXPECT_EQ(waitpid(pid, &status, 0), pid);
4062 EXPECT_EQ(true, WIFEXITED(status));
4063 EXPECT_EQ(0, WEXITSTATUS(status));
4064 }
4065
do_thread(void * data)4066 static void *do_thread(void *data)
4067 {
4068 return NULL;
4069 }
4070
TEST(user_notification_filter_empty_threaded)4071 TEST(user_notification_filter_empty_threaded)
4072 {
4073 pid_t pid;
4074 long ret;
4075 int status;
4076 struct pollfd pollfd;
4077 struct __clone_args args = {
4078 .flags = CLONE_FILES,
4079 .exit_signal = SIGCHLD,
4080 };
4081
4082 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4083 ASSERT_EQ(0, ret) {
4084 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4085 }
4086
4087 if (__NR_clone3 < 0)
4088 SKIP(return, "Test not built with clone3 support");
4089
4090 pid = sys_clone3(&args, sizeof(args));
4091 ASSERT_GE(pid, 0);
4092
4093 if (pid == 0) {
4094 pid_t pid1, pid2;
4095 int listener, status;
4096 pthread_t thread;
4097
4098 listener = user_notif_syscall(__NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER);
4099 if (listener < 0)
4100 _exit(EXIT_FAILURE);
4101
4102 if (dup2(listener, 200) != 200)
4103 _exit(EXIT_FAILURE);
4104
4105 close(listener);
4106
4107 pid1 = fork();
4108 if (pid1 < 0)
4109 _exit(EXIT_FAILURE);
4110
4111 if (pid1 == 0)
4112 _exit(EXIT_SUCCESS);
4113
4114 pid2 = fork();
4115 if (pid2 < 0)
4116 _exit(EXIT_FAILURE);
4117
4118 if (pid2 == 0)
4119 _exit(EXIT_SUCCESS);
4120
4121 if (pthread_create(&thread, NULL, do_thread, NULL) ||
4122 pthread_join(thread, NULL))
4123 _exit(EXIT_FAILURE);
4124
4125 if (pthread_create(&thread, NULL, do_thread, NULL) ||
4126 pthread_join(thread, NULL))
4127 _exit(EXIT_FAILURE);
4128
4129 if (waitpid(pid1, &status, 0) != pid1 || !WIFEXITED(status) ||
4130 WEXITSTATUS(status))
4131 _exit(EXIT_FAILURE);
4132
4133 if (waitpid(pid2, &status, 0) != pid2 || !WIFEXITED(status) ||
4134 WEXITSTATUS(status))
4135 _exit(EXIT_FAILURE);
4136
4137 exit(EXIT_SUCCESS);
4138 }
4139
4140 EXPECT_EQ(waitpid(pid, &status, 0), pid);
4141 EXPECT_EQ(true, WIFEXITED(status));
4142 EXPECT_EQ(0, WEXITSTATUS(status));
4143
4144 /*
4145 * The seccomp filter has become unused so we should be notified once
4146 * the kernel gets around to cleaning up task struct.
4147 */
4148 pollfd.fd = 200;
4149 pollfd.events = POLLHUP;
4150
4151 EXPECT_GT(poll(&pollfd, 1, 2000), 0);
4152 EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0);
4153 }
4154
4155
get_next_fd(int prev_fd)4156 int get_next_fd(int prev_fd)
4157 {
4158 for (int i = prev_fd + 1; i < FD_SETSIZE; ++i) {
4159 if (fcntl(i, F_GETFD) == -1)
4160 return i;
4161 }
4162 _exit(EXIT_FAILURE);
4163 }
4164
TEST(user_notification_addfd)4165 TEST(user_notification_addfd)
4166 {
4167 pid_t pid;
4168 long ret;
4169 int status, listener, memfd, fd, nextfd;
4170 struct seccomp_notif_addfd addfd = {};
4171 struct seccomp_notif_addfd_small small = {};
4172 struct seccomp_notif_addfd_big big = {};
4173 struct seccomp_notif req = {};
4174 struct seccomp_notif_resp resp = {};
4175 /* 100 ms */
4176 struct timespec delay = { .tv_nsec = 100000000 };
4177
4178 /* There may be arbitrary already-open fds at test start. */
4179 memfd = memfd_create("test", 0);
4180 ASSERT_GE(memfd, 0);
4181 nextfd = get_next_fd(memfd);
4182
4183 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4184 ASSERT_EQ(0, ret) {
4185 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4186 }
4187
4188 /* fd: 4 */
4189 /* Check that the basic notification machinery works */
4190 listener = user_notif_syscall(__NR_getppid,
4191 SECCOMP_FILTER_FLAG_NEW_LISTENER);
4192 ASSERT_EQ(listener, nextfd);
4193 nextfd = get_next_fd(nextfd);
4194
4195 pid = fork();
4196 ASSERT_GE(pid, 0);
4197
4198 if (pid == 0) {
4199 /* fds will be added and this value is expected */
4200 if (syscall(__NR_getppid) != USER_NOTIF_MAGIC)
4201 exit(1);
4202
4203 /* Atomic addfd+send is received here. Check it is a valid fd */
4204 if (fcntl(syscall(__NR_getppid), F_GETFD) == -1)
4205 exit(1);
4206
4207 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
4208 }
4209
4210 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4211
4212 addfd.srcfd = memfd;
4213 addfd.newfd = 0;
4214 addfd.id = req.id;
4215 addfd.flags = 0x0;
4216
4217 /* Verify bad newfd_flags cannot be set */
4218 addfd.newfd_flags = ~O_CLOEXEC;
4219 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4220 EXPECT_EQ(errno, EINVAL);
4221 addfd.newfd_flags = O_CLOEXEC;
4222
4223 /* Verify bad flags cannot be set */
4224 addfd.flags = 0xff;
4225 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4226 EXPECT_EQ(errno, EINVAL);
4227 addfd.flags = 0;
4228
4229 /* Verify that remote_fd cannot be set without setting flags */
4230 addfd.newfd = 1;
4231 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4232 EXPECT_EQ(errno, EINVAL);
4233 addfd.newfd = 0;
4234
4235 /* Verify small size cannot be set */
4236 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_SMALL, &small), -1);
4237 EXPECT_EQ(errno, EINVAL);
4238
4239 /* Verify we can't send bits filled in unknown buffer area */
4240 memset(&big, 0xAA, sizeof(big));
4241 big.addfd = addfd;
4242 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_BIG, &big), -1);
4243 EXPECT_EQ(errno, E2BIG);
4244
4245
4246 /* Verify we can set an arbitrary remote fd */
4247 fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
4248 EXPECT_EQ(fd, nextfd);
4249 nextfd = get_next_fd(nextfd);
4250 EXPECT_EQ(filecmp(getpid(), pid, memfd, fd), 0);
4251
4252 /* Verify we can set an arbitrary remote fd with large size */
4253 memset(&big, 0x0, sizeof(big));
4254 big.addfd = addfd;
4255 fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_BIG, &big);
4256 EXPECT_EQ(fd, nextfd);
4257 nextfd = get_next_fd(nextfd);
4258
4259 /* Verify we can set a specific remote fd */
4260 addfd.newfd = 42;
4261 addfd.flags = SECCOMP_ADDFD_FLAG_SETFD;
4262 fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
4263 EXPECT_EQ(fd, 42);
4264 EXPECT_EQ(filecmp(getpid(), pid, memfd, fd), 0);
4265
4266 /* Resume syscall */
4267 resp.id = req.id;
4268 resp.error = 0;
4269 resp.val = USER_NOTIF_MAGIC;
4270 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4271
4272 /*
4273 * This sets the ID of the ADD FD to the last request plus 1. The
4274 * notification ID increments 1 per notification.
4275 */
4276 addfd.id = req.id + 1;
4277
4278 /* This spins until the underlying notification is generated */
4279 while (ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd) != -1 &&
4280 errno != -EINPROGRESS)
4281 nanosleep(&delay, NULL);
4282
4283 memset(&req, 0, sizeof(req));
4284 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4285 ASSERT_EQ(addfd.id, req.id);
4286
4287 /* Verify we can do an atomic addfd and send */
4288 addfd.newfd = 0;
4289 addfd.flags = SECCOMP_ADDFD_FLAG_SEND;
4290 fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
4291 /*
4292 * Child has earlier "low" fds and now 42, so we expect the next
4293 * lowest available fd to be assigned here.
4294 */
4295 EXPECT_EQ(fd, nextfd);
4296 nextfd = get_next_fd(nextfd);
4297 ASSERT_EQ(filecmp(getpid(), pid, memfd, fd), 0);
4298
4299 /*
4300 * This sets the ID of the ADD FD to the last request plus 1. The
4301 * notification ID increments 1 per notification.
4302 */
4303 addfd.id = req.id + 1;
4304
4305 /* This spins until the underlying notification is generated */
4306 while (ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd) != -1 &&
4307 errno != -EINPROGRESS)
4308 nanosleep(&delay, NULL);
4309
4310 memset(&req, 0, sizeof(req));
4311 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4312 ASSERT_EQ(addfd.id, req.id);
4313
4314 resp.id = req.id;
4315 resp.error = 0;
4316 resp.val = USER_NOTIF_MAGIC;
4317 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4318
4319 /* Wait for child to finish. */
4320 EXPECT_EQ(waitpid(pid, &status, 0), pid);
4321 EXPECT_EQ(true, WIFEXITED(status));
4322 EXPECT_EQ(0, WEXITSTATUS(status));
4323
4324 close(memfd);
4325 }
4326
TEST(user_notification_addfd_rlimit)4327 TEST(user_notification_addfd_rlimit)
4328 {
4329 pid_t pid;
4330 long ret;
4331 int status, listener, memfd;
4332 struct seccomp_notif_addfd addfd = {};
4333 struct seccomp_notif req = {};
4334 struct seccomp_notif_resp resp = {};
4335 const struct rlimit lim = {
4336 .rlim_cur = 0,
4337 .rlim_max = 0,
4338 };
4339
4340 memfd = memfd_create("test", 0);
4341 ASSERT_GE(memfd, 0);
4342
4343 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4344 ASSERT_EQ(0, ret) {
4345 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4346 }
4347
4348 /* Check that the basic notification machinery works */
4349 listener = user_notif_syscall(__NR_getppid,
4350 SECCOMP_FILTER_FLAG_NEW_LISTENER);
4351 ASSERT_GE(listener, 0);
4352
4353 pid = fork();
4354 ASSERT_GE(pid, 0);
4355
4356 if (pid == 0)
4357 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
4358
4359
4360 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4361
4362 ASSERT_EQ(prlimit(pid, RLIMIT_NOFILE, &lim, NULL), 0);
4363
4364 addfd.srcfd = memfd;
4365 addfd.newfd_flags = O_CLOEXEC;
4366 addfd.newfd = 0;
4367 addfd.id = req.id;
4368 addfd.flags = 0;
4369
4370 /* Should probably spot check /proc/sys/fs/file-nr */
4371 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4372 EXPECT_EQ(errno, EMFILE);
4373
4374 addfd.flags = SECCOMP_ADDFD_FLAG_SEND;
4375 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4376 EXPECT_EQ(errno, EMFILE);
4377
4378 addfd.newfd = 100;
4379 addfd.flags = SECCOMP_ADDFD_FLAG_SETFD;
4380 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4381 EXPECT_EQ(errno, EBADF);
4382
4383 resp.id = req.id;
4384 resp.error = 0;
4385 resp.val = USER_NOTIF_MAGIC;
4386
4387 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4388
4389 /* Wait for child to finish. */
4390 EXPECT_EQ(waitpid(pid, &status, 0), pid);
4391 EXPECT_EQ(true, WIFEXITED(status));
4392 EXPECT_EQ(0, WEXITSTATUS(status));
4393
4394 close(memfd);
4395 }
4396
4397 #ifndef SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP
4398 #define SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP (1UL << 0)
4399 #define SECCOMP_IOCTL_NOTIF_SET_FLAGS SECCOMP_IOW(4, __u64)
4400 #endif
4401
TEST(user_notification_sync)4402 TEST(user_notification_sync)
4403 {
4404 struct seccomp_notif req = {};
4405 struct seccomp_notif_resp resp = {};
4406 int status, listener;
4407 pid_t pid;
4408 long ret;
4409
4410 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4411 ASSERT_EQ(0, ret) {
4412 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4413 }
4414
4415 listener = user_notif_syscall(__NR_getppid,
4416 SECCOMP_FILTER_FLAG_NEW_LISTENER);
4417 ASSERT_GE(listener, 0);
4418
4419 /* Try to set invalid flags. */
4420 EXPECT_SYSCALL_RETURN(-EINVAL,
4421 ioctl(listener, SECCOMP_IOCTL_NOTIF_SET_FLAGS, 0xffffffff, 0));
4422
4423 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SET_FLAGS,
4424 SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP, 0), 0);
4425
4426 pid = fork();
4427 ASSERT_GE(pid, 0);
4428 if (pid == 0) {
4429 ret = syscall(__NR_getppid);
4430 ASSERT_EQ(ret, USER_NOTIF_MAGIC) {
4431 _exit(1);
4432 }
4433 _exit(0);
4434 }
4435
4436 req.pid = 0;
4437 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4438
4439 ASSERT_EQ(req.data.nr, __NR_getppid);
4440
4441 resp.id = req.id;
4442 resp.error = 0;
4443 resp.val = USER_NOTIF_MAGIC;
4444 resp.flags = 0;
4445 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4446
4447 ASSERT_EQ(waitpid(pid, &status, 0), pid);
4448 ASSERT_EQ(status, 0);
4449 }
4450
4451
4452 /* Make sure PTRACE_O_SUSPEND_SECCOMP requires CAP_SYS_ADMIN. */
FIXTURE(O_SUSPEND_SECCOMP)4453 FIXTURE(O_SUSPEND_SECCOMP) {
4454 pid_t pid;
4455 };
4456
FIXTURE_SETUP(O_SUSPEND_SECCOMP)4457 FIXTURE_SETUP(O_SUSPEND_SECCOMP)
4458 {
4459 ERRNO_FILTER(block_read, E2BIG);
4460 cap_value_t cap_list[] = { CAP_SYS_ADMIN };
4461 cap_t caps;
4462
4463 self->pid = 0;
4464
4465 /* make sure we don't have CAP_SYS_ADMIN */
4466 caps = cap_get_proc();
4467 ASSERT_NE(NULL, caps);
4468 ASSERT_EQ(0, cap_set_flag(caps, CAP_EFFECTIVE, 1, cap_list, CAP_CLEAR));
4469 ASSERT_EQ(0, cap_set_proc(caps));
4470 cap_free(caps);
4471
4472 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
4473 ASSERT_EQ(0, prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_block_read));
4474
4475 self->pid = fork();
4476 ASSERT_GE(self->pid, 0);
4477
4478 if (self->pid == 0) {
4479 while (1)
4480 pause();
4481 _exit(127);
4482 }
4483 }
4484
FIXTURE_TEARDOWN(O_SUSPEND_SECCOMP)4485 FIXTURE_TEARDOWN(O_SUSPEND_SECCOMP)
4486 {
4487 if (self->pid)
4488 kill(self->pid, SIGKILL);
4489 }
4490
TEST_F(O_SUSPEND_SECCOMP,setoptions)4491 TEST_F(O_SUSPEND_SECCOMP, setoptions)
4492 {
4493 int wstatus;
4494
4495 ASSERT_EQ(0, ptrace(PTRACE_ATTACH, self->pid, NULL, 0));
4496 ASSERT_EQ(self->pid, wait(&wstatus));
4497 ASSERT_EQ(-1, ptrace(PTRACE_SETOPTIONS, self->pid, NULL, PTRACE_O_SUSPEND_SECCOMP));
4498 if (errno == EINVAL)
4499 SKIP(return, "Kernel does not support PTRACE_O_SUSPEND_SECCOMP (missing CONFIG_CHECKPOINT_RESTORE?)");
4500 ASSERT_EQ(EPERM, errno);
4501 }
4502
TEST_F(O_SUSPEND_SECCOMP,seize)4503 TEST_F(O_SUSPEND_SECCOMP, seize)
4504 {
4505 int ret;
4506
4507 ret = ptrace(PTRACE_SEIZE, self->pid, NULL, PTRACE_O_SUSPEND_SECCOMP);
4508 ASSERT_EQ(-1, ret);
4509 if (errno == EINVAL)
4510 SKIP(return, "Kernel does not support PTRACE_O_SUSPEND_SECCOMP (missing CONFIG_CHECKPOINT_RESTORE?)");
4511 ASSERT_EQ(EPERM, errno);
4512 }
4513
4514 /*
4515 * get_nth - Get the nth, space separated entry in a file.
4516 *
4517 * Returns the length of the read field.
4518 * Throws error if field is zero-lengthed.
4519 */
get_nth(struct __test_metadata * _metadata,const char * path,const unsigned int position,char ** entry)4520 static ssize_t get_nth(struct __test_metadata *_metadata, const char *path,
4521 const unsigned int position, char **entry)
4522 {
4523 char *line = NULL;
4524 unsigned int i;
4525 ssize_t nread;
4526 size_t len = 0;
4527 FILE *f;
4528
4529 f = fopen(path, "r");
4530 ASSERT_NE(f, NULL) {
4531 TH_LOG("Could not open %s: %s", path, strerror(errno));
4532 }
4533
4534 for (i = 0; i < position; i++) {
4535 nread = getdelim(&line, &len, ' ', f);
4536 ASSERT_GE(nread, 0) {
4537 TH_LOG("Failed to read %d entry in file %s", i, path);
4538 }
4539 }
4540 fclose(f);
4541
4542 ASSERT_GT(nread, 0) {
4543 TH_LOG("Entry in file %s had zero length", path);
4544 }
4545
4546 *entry = line;
4547 return nread - 1;
4548 }
4549
4550 /* For a given PID, get the task state (D, R, etc...) */
get_proc_stat(struct __test_metadata * _metadata,pid_t pid)4551 static char get_proc_stat(struct __test_metadata *_metadata, pid_t pid)
4552 {
4553 char proc_path[100] = {0};
4554 char status;
4555 char *line;
4556
4557 snprintf(proc_path, sizeof(proc_path), "/proc/%d/stat", pid);
4558 ASSERT_EQ(get_nth(_metadata, proc_path, 3, &line), 1);
4559
4560 status = *line;
4561 free(line);
4562
4563 return status;
4564 }
4565
TEST(user_notification_fifo)4566 TEST(user_notification_fifo)
4567 {
4568 struct seccomp_notif_resp resp = {};
4569 struct seccomp_notif req = {};
4570 int i, status, listener;
4571 pid_t pid, pids[3];
4572 __u64 baseid;
4573 long ret;
4574 /* 100 ms */
4575 struct timespec delay = { .tv_nsec = 100000000 };
4576
4577 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4578 ASSERT_EQ(0, ret) {
4579 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4580 }
4581
4582 /* Setup a listener */
4583 listener = user_notif_syscall(__NR_getppid,
4584 SECCOMP_FILTER_FLAG_NEW_LISTENER);
4585 ASSERT_GE(listener, 0);
4586
4587 pid = fork();
4588 ASSERT_GE(pid, 0);
4589
4590 if (pid == 0) {
4591 ret = syscall(__NR_getppid);
4592 exit(ret != USER_NOTIF_MAGIC);
4593 }
4594
4595 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4596 baseid = req.id + 1;
4597
4598 resp.id = req.id;
4599 resp.error = 0;
4600 resp.val = USER_NOTIF_MAGIC;
4601
4602 /* check that we make sure flags == 0 */
4603 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4604
4605 EXPECT_EQ(waitpid(pid, &status, 0), pid);
4606 EXPECT_EQ(true, WIFEXITED(status));
4607 EXPECT_EQ(0, WEXITSTATUS(status));
4608
4609 /* Start children, and generate notifications */
4610 for (i = 0; i < ARRAY_SIZE(pids); i++) {
4611 pid = fork();
4612 if (pid == 0) {
4613 ret = syscall(__NR_getppid);
4614 exit(ret != USER_NOTIF_MAGIC);
4615 }
4616 pids[i] = pid;
4617 }
4618
4619 /* This spins until all of the children are sleeping */
4620 restart_wait:
4621 for (i = 0; i < ARRAY_SIZE(pids); i++) {
4622 if (get_proc_stat(_metadata, pids[i]) != 'S') {
4623 nanosleep(&delay, NULL);
4624 goto restart_wait;
4625 }
4626 }
4627
4628 /* Read the notifications in order (and respond) */
4629 for (i = 0; i < ARRAY_SIZE(pids); i++) {
4630 memset(&req, 0, sizeof(req));
4631 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4632 EXPECT_EQ(req.id, baseid + i);
4633 resp.id = req.id;
4634 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4635 }
4636
4637 /* Make sure notifications were received */
4638 for (i = 0; i < ARRAY_SIZE(pids); i++) {
4639 EXPECT_EQ(waitpid(pids[i], &status, 0), pids[i]);
4640 EXPECT_EQ(true, WIFEXITED(status));
4641 EXPECT_EQ(0, WEXITSTATUS(status));
4642 }
4643 }
4644
4645 /* get_proc_syscall - Get the syscall in progress for a given pid
4646 *
4647 * Returns the current syscall number for a given process
4648 * Returns -1 if not in syscall (running or blocked)
4649 */
get_proc_syscall(struct __test_metadata * _metadata,int pid)4650 static long get_proc_syscall(struct __test_metadata *_metadata, int pid)
4651 {
4652 char proc_path[100] = {0};
4653 long ret = -1;
4654 ssize_t nread;
4655 char *line;
4656
4657 snprintf(proc_path, sizeof(proc_path), "/proc/%d/syscall", pid);
4658 nread = get_nth(_metadata, proc_path, 1, &line);
4659 ASSERT_GT(nread, 0);
4660
4661 if (!strncmp("running", line, MIN(7, nread)))
4662 ret = strtol(line, NULL, 16);
4663
4664 free(line);
4665 return ret;
4666 }
4667
4668 /* Ensure non-fatal signals prior to receive are unmodified */
TEST(user_notification_wait_killable_pre_notification)4669 TEST(user_notification_wait_killable_pre_notification)
4670 {
4671 struct sigaction new_action = {
4672 .sa_handler = signal_handler,
4673 };
4674 int listener, status, sk_pair[2];
4675 pid_t pid;
4676 long ret;
4677 char c;
4678 /* 100 ms */
4679 struct timespec delay = { .tv_nsec = 100000000 };
4680
4681 ASSERT_EQ(sigemptyset(&new_action.sa_mask), 0);
4682
4683 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4684 ASSERT_EQ(0, ret)
4685 {
4686 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4687 }
4688
4689 ASSERT_EQ(socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair), 0);
4690
4691 listener = user_notif_syscall(
4692 __NR_getppid, SECCOMP_FILTER_FLAG_NEW_LISTENER |
4693 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV);
4694 ASSERT_GE(listener, 0);
4695
4696 /*
4697 * Check that we can kill the process with SIGUSR1 prior to receiving
4698 * the notification. SIGUSR1 is wired up to a custom signal handler,
4699 * and make sure it gets called.
4700 */
4701 pid = fork();
4702 ASSERT_GE(pid, 0);
4703
4704 if (pid == 0) {
4705 close(sk_pair[0]);
4706 handled = sk_pair[1];
4707
4708 /* Setup the non-fatal sigaction without SA_RESTART */
4709 if (sigaction(SIGUSR1, &new_action, NULL)) {
4710 perror("sigaction");
4711 exit(1);
4712 }
4713
4714 ret = syscall(__NR_getppid);
4715 /* Make sure we got a return from a signal interruption */
4716 exit(ret != -1 || errno != EINTR);
4717 }
4718
4719 /*
4720 * Make sure we've gotten to the seccomp user notification wait
4721 * from getppid prior to sending any signals
4722 */
4723 while (get_proc_syscall(_metadata, pid) != __NR_getppid &&
4724 get_proc_stat(_metadata, pid) != 'S')
4725 nanosleep(&delay, NULL);
4726
4727 /* Send non-fatal kill signal */
4728 EXPECT_EQ(kill(pid, SIGUSR1), 0);
4729
4730 /* wait for process to exit (exit checks for EINTR) */
4731 EXPECT_EQ(waitpid(pid, &status, 0), pid);
4732 EXPECT_EQ(true, WIFEXITED(status));
4733 EXPECT_EQ(0, WEXITSTATUS(status));
4734
4735 EXPECT_EQ(read(sk_pair[0], &c, 1), 1);
4736 }
4737
4738 /* Ensure non-fatal signals after receive are blocked */
TEST(user_notification_wait_killable)4739 TEST(user_notification_wait_killable)
4740 {
4741 struct sigaction new_action = {
4742 .sa_handler = signal_handler,
4743 };
4744 struct seccomp_notif_resp resp = {};
4745 struct seccomp_notif req = {};
4746 int listener, status, sk_pair[2];
4747 pid_t pid;
4748 long ret;
4749 char c;
4750 /* 100 ms */
4751 struct timespec delay = { .tv_nsec = 100000000 };
4752
4753 ASSERT_EQ(sigemptyset(&new_action.sa_mask), 0);
4754
4755 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4756 ASSERT_EQ(0, ret)
4757 {
4758 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4759 }
4760
4761 ASSERT_EQ(socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair), 0);
4762
4763 listener = user_notif_syscall(
4764 __NR_getppid, SECCOMP_FILTER_FLAG_NEW_LISTENER |
4765 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV);
4766 ASSERT_GE(listener, 0);
4767
4768 pid = fork();
4769 ASSERT_GE(pid, 0);
4770
4771 if (pid == 0) {
4772 close(sk_pair[0]);
4773 handled = sk_pair[1];
4774
4775 /* Setup the sigaction without SA_RESTART */
4776 if (sigaction(SIGUSR1, &new_action, NULL)) {
4777 perror("sigaction");
4778 exit(1);
4779 }
4780
4781 /* Make sure that the syscall is completed (no EINTR) */
4782 ret = syscall(__NR_getppid);
4783 exit(ret != USER_NOTIF_MAGIC);
4784 }
4785
4786 /*
4787 * Get the notification, to make move the notifying process into a
4788 * non-preemptible (TASK_KILLABLE) state.
4789 */
4790 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4791 /* Send non-fatal kill signal */
4792 EXPECT_EQ(kill(pid, SIGUSR1), 0);
4793
4794 /*
4795 * Make sure the task enters moves to TASK_KILLABLE by waiting for
4796 * D (Disk Sleep) state after receiving non-fatal signal.
4797 */
4798 while (get_proc_stat(_metadata, pid) != 'D')
4799 nanosleep(&delay, NULL);
4800
4801 resp.id = req.id;
4802 resp.val = USER_NOTIF_MAGIC;
4803 /* Make sure the notification is found and able to be replied to */
4804 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4805
4806 /*
4807 * Make sure that the signal handler does get called once we're back in
4808 * userspace.
4809 */
4810 EXPECT_EQ(read(sk_pair[0], &c, 1), 1);
4811 /* wait for process to exit (exit checks for USER_NOTIF_MAGIC) */
4812 EXPECT_EQ(waitpid(pid, &status, 0), pid);
4813 EXPECT_EQ(true, WIFEXITED(status));
4814 EXPECT_EQ(0, WEXITSTATUS(status));
4815 }
4816
4817 /* Ensure fatal signals after receive are not blocked */
TEST(user_notification_wait_killable_fatal)4818 TEST(user_notification_wait_killable_fatal)
4819 {
4820 struct seccomp_notif req = {};
4821 int listener, status;
4822 pid_t pid;
4823 long ret;
4824 /* 100 ms */
4825 struct timespec delay = { .tv_nsec = 100000000 };
4826
4827 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4828 ASSERT_EQ(0, ret)
4829 {
4830 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4831 }
4832
4833 listener = user_notif_syscall(
4834 __NR_getppid, SECCOMP_FILTER_FLAG_NEW_LISTENER |
4835 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV);
4836 ASSERT_GE(listener, 0);
4837
4838 pid = fork();
4839 ASSERT_GE(pid, 0);
4840
4841 if (pid == 0) {
4842 /* This should never complete as it should get a SIGTERM */
4843 syscall(__NR_getppid);
4844 exit(1);
4845 }
4846
4847 while (get_proc_stat(_metadata, pid) != 'S')
4848 nanosleep(&delay, NULL);
4849
4850 /*
4851 * Get the notification, to make move the notifying process into a
4852 * non-preemptible (TASK_KILLABLE) state.
4853 */
4854 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4855 /* Kill the process with a fatal signal */
4856 EXPECT_EQ(kill(pid, SIGTERM), 0);
4857
4858 /*
4859 * Wait for the process to exit, and make sure the process terminated
4860 * due to the SIGTERM signal.
4861 */
4862 EXPECT_EQ(waitpid(pid, &status, 0), pid);
4863 EXPECT_EQ(true, WIFSIGNALED(status));
4864 EXPECT_EQ(SIGTERM, WTERMSIG(status));
4865 }
4866
4867 /* Ensure signals after the reply do not interrupt */
TEST(user_notification_wait_killable_after_reply)4868 TEST(user_notification_wait_killable_after_reply)
4869 {
4870 int i, max_iter = 100000;
4871 int listener, status;
4872 int pipe_fds[2];
4873 pid_t pid;
4874 long ret;
4875
4876 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4877 ASSERT_EQ(0, ret)
4878 {
4879 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4880 }
4881
4882 listener = user_notif_syscall(
4883 __NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER |
4884 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV);
4885 ASSERT_GE(listener, 0);
4886
4887 /*
4888 * Used to count invocations. One token is transferred from the child
4889 * to the parent per syscall invocation, the parent tries to take
4890 * one token per successful RECV. If the syscall is restarted after
4891 * RECV the parent will try to get two tokens while the child only
4892 * provided one.
4893 */
4894 ASSERT_EQ(pipe(pipe_fds), 0);
4895
4896 pid = fork();
4897 ASSERT_GE(pid, 0);
4898
4899 if (pid == 0) {
4900 struct sigaction new_action = {
4901 .sa_handler = signal_handler_nop,
4902 .sa_flags = SA_RESTART,
4903 };
4904 struct itimerval timer = {
4905 .it_value = { .tv_usec = 1000 },
4906 .it_interval = { .tv_usec = 1000 },
4907 };
4908 char c = 'a';
4909
4910 close(pipe_fds[0]);
4911
4912 /* Setup the sigaction with SA_RESTART */
4913 if (sigaction(SIGALRM, &new_action, NULL)) {
4914 perror("sigaction");
4915 exit(1);
4916 }
4917
4918 /*
4919 * Kill with SIGALRM repeatedly, to try to hit the race when
4920 * handling the syscall.
4921 */
4922 if (setitimer(ITIMER_REAL, &timer, NULL) < 0)
4923 perror("setitimer");
4924
4925 for (i = 0; i < max_iter; ++i) {
4926 int fd;
4927
4928 /* Send one token per iteration to catch repeats. */
4929 if (write(pipe_fds[1], &c, sizeof(c)) != 1) {
4930 perror("write");
4931 exit(1);
4932 }
4933
4934 fd = syscall(__NR_dup, 0);
4935 if (fd < 0) {
4936 perror("dup");
4937 exit(1);
4938 }
4939 close(fd);
4940 }
4941
4942 exit(0);
4943 }
4944
4945 close(pipe_fds[1]);
4946
4947 for (i = 0; i < max_iter; ++i) {
4948 struct seccomp_notif req = {};
4949 struct seccomp_notif_addfd addfd = {};
4950 struct pollfd pfd = {
4951 .fd = pipe_fds[0],
4952 .events = POLLIN,
4953 };
4954 char c;
4955
4956 /*
4957 * Try to receive one token. If it failed, one child syscall
4958 * was restarted after RECV and needed to be handled twice.
4959 */
4960 ASSERT_EQ(poll(&pfd, 1, 1000), 1)
4961 kill(pid, SIGKILL);
4962
4963 ASSERT_EQ(read(pipe_fds[0], &c, sizeof(c)), 1)
4964 kill(pid, SIGKILL);
4965
4966 /*
4967 * Get the notification, reply to it as fast as possible to test
4968 * whether the child wrongly skips going into the non-preemptible
4969 * (TASK_KILLABLE) state.
4970 */
4971 do
4972 ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req);
4973 while (ret < 0 && errno == ENOENT); /* Accept interruptions before RECV */
4974 ASSERT_EQ(ret, 0)
4975 kill(pid, SIGKILL);
4976
4977 addfd.id = req.id;
4978 addfd.flags = SECCOMP_ADDFD_FLAG_SEND;
4979 addfd.srcfd = 0;
4980 ASSERT_GE(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), 0)
4981 kill(pid, SIGKILL);
4982 }
4983
4984 /*
4985 * Wait for the process to exit, and make sure the process terminated
4986 * with a zero exit code..
4987 */
4988 EXPECT_EQ(waitpid(pid, &status, 0), pid);
4989 EXPECT_EQ(true, WIFEXITED(status));
4990 EXPECT_EQ(0, WEXITSTATUS(status));
4991 }
4992
4993 struct tsync_vs_thread_leader_args {
4994 pthread_t leader;
4995 };
4996
tsync_vs_dead_thread_leader_sibling(void * _args)4997 static void *tsync_vs_dead_thread_leader_sibling(void *_args)
4998 {
4999 struct sock_filter allow_filter[] = {
5000 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
5001 };
5002 struct sock_fprog allow_prog = {
5003 .len = (unsigned short)ARRAY_SIZE(allow_filter),
5004 .filter = allow_filter,
5005 };
5006 struct tsync_vs_thread_leader_args *args = _args;
5007 void *retval;
5008 long ret;
5009
5010 ret = pthread_join(args->leader, &retval);
5011 if (ret)
5012 exit(1);
5013 if (retval != _args)
5014 exit(2);
5015 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, &allow_prog);
5016 if (ret)
5017 exit(3);
5018
5019 exit(0);
5020 }
5021
5022 /*
5023 * Ensure that a dead thread leader doesn't prevent installing new filters with
5024 * SECCOMP_FILTER_FLAG_TSYNC from other threads.
5025 */
TEST(tsync_vs_dead_thread_leader)5026 TEST(tsync_vs_dead_thread_leader)
5027 {
5028 int status;
5029 pid_t pid;
5030 long ret;
5031
5032 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
5033 ASSERT_EQ(0, ret) {
5034 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
5035 }
5036
5037 pid = fork();
5038 ASSERT_GE(pid, 0);
5039
5040 if (pid == 0) {
5041 struct sock_filter allow_filter[] = {
5042 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
5043 };
5044 struct sock_fprog allow_prog = {
5045 .len = (unsigned short)ARRAY_SIZE(allow_filter),
5046 .filter = allow_filter,
5047 };
5048 struct tsync_vs_thread_leader_args *args;
5049 pthread_t sibling;
5050
5051 args = malloc(sizeof(*args));
5052 ASSERT_NE(NULL, args);
5053 args->leader = pthread_self();
5054
5055 ret = pthread_create(&sibling, NULL,
5056 tsync_vs_dead_thread_leader_sibling, args);
5057 ASSERT_EQ(0, ret);
5058
5059 /* Install a new filter just to the leader thread. */
5060 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &allow_prog);
5061 ASSERT_EQ(0, ret);
5062 pthread_exit(args);
5063 exit(1);
5064 }
5065
5066 EXPECT_EQ(pid, waitpid(pid, &status, 0));
5067 EXPECT_EQ(0, status);
5068 }
5069
5070 #ifdef __x86_64__
5071
5072 /*
5073 * We need naked probed_uprobe function. Using __nocf_check
5074 * check to skip possible endbr64 instruction and ignoring
5075 * -Wattributes, otherwise the compilation might fail.
5076 */
5077 #pragma GCC diagnostic push
5078 #pragma GCC diagnostic ignored "-Wattributes"
5079
probed_uprobe(void)5080 __naked __nocf_check noinline int probed_uprobe(void)
5081 {
5082 /*
5083 * Optimized uprobe is possible only on top of nop5 instruction.
5084 */
5085 asm volatile (" \n"
5086 ".byte 0x0f, 0x1f, 0x44, 0x00, 0x00 \n"
5087 "ret \n"
5088 );
5089 }
5090 #pragma GCC diagnostic pop
5091
5092 #else
probed_uprobe(void)5093 noinline int probed_uprobe(void)
5094 {
5095 return 1;
5096 }
5097 #endif
5098
probed_uretprobe(void)5099 noinline int probed_uretprobe(void)
5100 {
5101 return 1;
5102 }
5103
parse_uint_from_file(const char * file,const char * fmt)5104 static int parse_uint_from_file(const char *file, const char *fmt)
5105 {
5106 int err = -1, ret;
5107 FILE *f;
5108
5109 f = fopen(file, "re");
5110 if (f) {
5111 err = fscanf(f, fmt, &ret);
5112 fclose(f);
5113 }
5114 return err == 1 ? ret : err;
5115 }
5116
determine_uprobe_perf_type(void)5117 static int determine_uprobe_perf_type(void)
5118 {
5119 const char *file = "/sys/bus/event_source/devices/uprobe/type";
5120
5121 return parse_uint_from_file(file, "%d\n");
5122 }
5123
determine_uprobe_retprobe_bit(void)5124 static int determine_uprobe_retprobe_bit(void)
5125 {
5126 const char *file = "/sys/bus/event_source/devices/uprobe/format/retprobe";
5127
5128 return parse_uint_from_file(file, "config:%d\n");
5129 }
5130
get_uprobe_offset(const void * addr)5131 static ssize_t get_uprobe_offset(const void *addr)
5132 {
5133 size_t start, base, end;
5134 bool found = false;
5135 char buf[256];
5136 FILE *f;
5137
5138 f = fopen("/proc/self/maps", "r");
5139 if (!f)
5140 return -1;
5141
5142 while (fscanf(f, "%zx-%zx %s %zx %*[^\n]\n", &start, &end, buf, &base) == 4) {
5143 if (buf[2] == 'x' && (uintptr_t)addr >= start && (uintptr_t)addr < end) {
5144 found = true;
5145 break;
5146 }
5147 }
5148 fclose(f);
5149 return found ? (uintptr_t)addr - start + base : -1;
5150 }
5151
FIXTURE(UPROBE)5152 FIXTURE(UPROBE) {
5153 int fd;
5154 };
5155
FIXTURE_VARIANT(UPROBE)5156 FIXTURE_VARIANT(UPROBE) {
5157 /*
5158 * All of the U(RET)PROBE behaviors can be tested with either
5159 * u(ret)probe attached or not
5160 */
5161 bool attach;
5162 /*
5163 * Test both uprobe and uretprobe.
5164 */
5165 bool uretprobe;
5166 };
5167
FIXTURE_VARIANT_ADD(UPROBE,not_attached)5168 FIXTURE_VARIANT_ADD(UPROBE, not_attached) {
5169 .attach = false,
5170 .uretprobe = false,
5171 };
5172
FIXTURE_VARIANT_ADD(UPROBE,uprobe_attached)5173 FIXTURE_VARIANT_ADD(UPROBE, uprobe_attached) {
5174 .attach = true,
5175 .uretprobe = false,
5176 };
5177
FIXTURE_VARIANT_ADD(UPROBE,uretprobe_attached)5178 FIXTURE_VARIANT_ADD(UPROBE, uretprobe_attached) {
5179 .attach = true,
5180 .uretprobe = true,
5181 };
5182
FIXTURE_SETUP(UPROBE)5183 FIXTURE_SETUP(UPROBE)
5184 {
5185 const size_t attr_sz = sizeof(struct perf_event_attr);
5186 struct perf_event_attr attr;
5187 ssize_t offset;
5188 int type, bit;
5189
5190 #if !defined(__NR_uprobe) || !defined(__NR_uretprobe)
5191 SKIP(return, "__NR_uprobe ot __NR_uretprobe syscalls not defined");
5192 #endif
5193
5194 if (!variant->attach)
5195 return;
5196
5197 memset(&attr, 0, attr_sz);
5198
5199 type = determine_uprobe_perf_type();
5200 ASSERT_GE(type, 0);
5201
5202 if (variant->uretprobe) {
5203 bit = determine_uprobe_retprobe_bit();
5204 ASSERT_GE(bit, 0);
5205 }
5206
5207 offset = get_uprobe_offset(variant->uretprobe ? (void *)probed_uretprobe
5208 : (void *)probed_uprobe);
5209 ASSERT_GE(offset, 0);
5210
5211 if (variant->uretprobe)
5212 attr.config |= 1 << bit;
5213 attr.size = attr_sz;
5214 attr.type = type;
5215 attr.config1 = ptr_to_u64("/proc/self/exe");
5216 attr.config2 = offset;
5217
5218 self->fd = syscall(__NR_perf_event_open, &attr,
5219 getpid() /* pid */, -1 /* cpu */, -1 /* group_fd */,
5220 PERF_FLAG_FD_CLOEXEC);
5221 }
5222
FIXTURE_TEARDOWN(UPROBE)5223 FIXTURE_TEARDOWN(UPROBE)
5224 {
5225 /* we could call close(self->fd), but we'd need extra filter for
5226 * that and since we are calling _exit right away..
5227 */
5228 }
5229
run_probed_with_filter(struct sock_fprog * prog)5230 static int run_probed_with_filter(struct sock_fprog *prog)
5231 {
5232 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) ||
5233 seccomp(SECCOMP_SET_MODE_FILTER, 0, prog)) {
5234 return -1;
5235 }
5236
5237 /*
5238 * Uprobe is optimized after first hit, so let's hit twice.
5239 */
5240 probed_uprobe();
5241 probed_uprobe();
5242
5243 probed_uretprobe();
5244 return 0;
5245 }
5246
TEST_F(UPROBE,uprobe_default_allow)5247 TEST_F(UPROBE, uprobe_default_allow)
5248 {
5249 struct sock_filter filter[] = {
5250 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
5251 };
5252 struct sock_fprog prog = {
5253 .len = (unsigned short)ARRAY_SIZE(filter),
5254 .filter = filter,
5255 };
5256
5257 ASSERT_EQ(0, run_probed_with_filter(&prog));
5258 }
5259
TEST_F(UPROBE,uprobe_default_block)5260 TEST_F(UPROBE, uprobe_default_block)
5261 {
5262 struct sock_filter filter[] = {
5263 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
5264 offsetof(struct seccomp_data, nr)),
5265 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_exit_group, 1, 0),
5266 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
5267 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
5268 };
5269 struct sock_fprog prog = {
5270 .len = (unsigned short)ARRAY_SIZE(filter),
5271 .filter = filter,
5272 };
5273
5274 ASSERT_EQ(0, run_probed_with_filter(&prog));
5275 }
5276
TEST_F(UPROBE,uprobe_block_syscall)5277 TEST_F(UPROBE, uprobe_block_syscall)
5278 {
5279 struct sock_filter filter[] = {
5280 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
5281 offsetof(struct seccomp_data, nr)),
5282 #ifdef __NR_uprobe
5283 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_uprobe, 1, 2),
5284 #endif
5285 #ifdef __NR_uretprobe
5286 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_uretprobe, 0, 1),
5287 #endif
5288 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
5289 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
5290 };
5291 struct sock_fprog prog = {
5292 .len = (unsigned short)ARRAY_SIZE(filter),
5293 .filter = filter,
5294 };
5295
5296 ASSERT_EQ(0, run_probed_with_filter(&prog));
5297 }
5298
TEST_F(UPROBE,uprobe_default_block_with_syscall)5299 TEST_F(UPROBE, uprobe_default_block_with_syscall)
5300 {
5301 struct sock_filter filter[] = {
5302 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
5303 offsetof(struct seccomp_data, nr)),
5304 #ifdef __NR_uprobe
5305 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_uprobe, 3, 0),
5306 #endif
5307 #ifdef __NR_uretprobe
5308 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_uretprobe, 2, 0),
5309 #endif
5310 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_exit_group, 1, 0),
5311 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
5312 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
5313 };
5314 struct sock_fprog prog = {
5315 .len = (unsigned short)ARRAY_SIZE(filter),
5316 .filter = filter,
5317 };
5318
5319 ASSERT_EQ(0, run_probed_with_filter(&prog));
5320 }
5321
5322 /*
5323 * TODO:
5324 * - expand NNP testing
5325 * - better arch-specific TRACE and TRAP handlers.
5326 * - endianness checking when appropriate
5327 * - 64-bit arg prodding
5328 * - arch value testing (x86 modes especially)
5329 * - verify that FILTER_FLAG_LOG filters generate log messages
5330 * - verify that RET_LOG generates log messages
5331 */
5332
5333 TEST_HARNESS_MAIN
5334