1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2012 The Chromium OS Authors. All rights reserved. 4 * 5 * Test code for seccomp bpf. 6 */ 7 8 #define _GNU_SOURCE 9 #include <sys/types.h> 10 11 /* 12 * glibc 2.26 and later have SIGSYS in siginfo_t. Before that, 13 * we need to use the kernel's siginfo.h file and trick glibc 14 * into accepting it. 15 */ 16 #if !__GLIBC_PREREQ(2, 26) 17 # include <asm/siginfo.h> 18 # define __have_siginfo_t 1 19 # define __have_sigval_t 1 20 # define __have_sigevent_t 1 21 #endif 22 23 #include <errno.h> 24 #include <linux/filter.h> 25 #include <sys/prctl.h> 26 #include <sys/ptrace.h> 27 #include <sys/time.h> 28 #include <sys/user.h> 29 #include <linux/prctl.h> 30 #include <linux/ptrace.h> 31 #include <linux/seccomp.h> 32 #include <pthread.h> 33 #include <semaphore.h> 34 #include <signal.h> 35 #include <stddef.h> 36 #include <stdbool.h> 37 #include <string.h> 38 #include <time.h> 39 #include <limits.h> 40 #include <linux/elf.h> 41 #include <sys/uio.h> 42 #include <sys/utsname.h> 43 #include <sys/fcntl.h> 44 #include <sys/mman.h> 45 #include <sys/times.h> 46 #include <sys/socket.h> 47 #include <sys/ioctl.h> 48 #include <linux/kcmp.h> 49 #include <sys/resource.h> 50 #include <sys/capability.h> 51 #include <linux/perf_event.h> 52 53 #include <unistd.h> 54 #include <sys/syscall.h> 55 #include <poll.h> 56 57 #include "kselftest_harness.h" 58 #include "../clone3/clone3_selftests.h" 59 60 /* Attempt to de-conflict with the selftests tree. */ 61 #ifndef SKIP 62 #define SKIP(s, ...) XFAIL(s, ##__VA_ARGS__) 63 #endif 64 65 #ifndef MIN 66 #define MIN(X, Y) ((X) < (Y) ? (X) : (Y)) 67 #endif 68 69 #ifndef PR_SET_PTRACER 70 # define PR_SET_PTRACER 0x59616d61 71 #endif 72 73 #ifndef noinline 74 #define noinline __attribute__((noinline)) 75 #endif 76 77 #ifndef __nocf_check 78 #define __nocf_check __attribute__((nocf_check)) 79 #endif 80 81 #ifndef __naked 82 #define __naked __attribute__((__naked__)) 83 #endif 84 85 #ifndef PR_SET_NO_NEW_PRIVS 86 #define PR_SET_NO_NEW_PRIVS 38 87 #define PR_GET_NO_NEW_PRIVS 39 88 #endif 89 90 #ifndef PR_SECCOMP_EXT 91 #define PR_SECCOMP_EXT 43 92 #endif 93 94 #ifndef SECCOMP_EXT_ACT 95 #define SECCOMP_EXT_ACT 1 96 #endif 97 98 #ifndef SECCOMP_EXT_ACT_TSYNC 99 #define SECCOMP_EXT_ACT_TSYNC 1 100 #endif 101 102 #ifndef SECCOMP_MODE_STRICT 103 #define SECCOMP_MODE_STRICT 1 104 #endif 105 106 #ifndef SECCOMP_MODE_FILTER 107 #define SECCOMP_MODE_FILTER 2 108 #endif 109 110 #ifndef SECCOMP_RET_ALLOW 111 struct seccomp_data { 112 int nr; 113 __u32 arch; 114 __u64 instruction_pointer; 115 __u64 args[6]; 116 }; 117 #endif 118 119 #ifndef SECCOMP_RET_KILL_PROCESS 120 #define SECCOMP_RET_KILL_PROCESS 0x80000000U /* kill the process */ 121 #define SECCOMP_RET_KILL_THREAD 0x00000000U /* kill the thread */ 122 #endif 123 #ifndef SECCOMP_RET_KILL 124 #define SECCOMP_RET_KILL SECCOMP_RET_KILL_THREAD 125 #define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */ 126 #define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */ 127 #define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */ 128 #define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */ 129 #endif 130 #ifndef SECCOMP_RET_LOG 131 #define SECCOMP_RET_LOG 0x7ffc0000U /* allow after logging */ 132 #endif 133 134 #ifndef __NR_seccomp 135 # if defined(__i386__) 136 # define __NR_seccomp 354 137 # elif defined(__x86_64__) 138 # define __NR_seccomp 317 139 # elif defined(__alpha__) 140 # define __NR_seccomp 514 141 # elif defined(__arm__) 142 # define __NR_seccomp 383 143 # elif defined(__aarch64__) 144 # define __NR_seccomp 277 145 # elif defined(__riscv) 146 # define __NR_seccomp 277 147 # elif defined(__csky__) 148 # define __NR_seccomp 277 149 # elif defined(__loongarch__) 150 # define __NR_seccomp 277 151 # elif defined(__hppa__) 152 # define __NR_seccomp 338 153 # elif defined(__powerpc__) 154 # define __NR_seccomp 358 155 # elif defined(__s390__) 156 # define __NR_seccomp 348 157 # elif defined(__xtensa__) 158 # define __NR_seccomp 337 159 # elif defined(__sh__) 160 # define __NR_seccomp 372 161 # elif defined(__mc68000__) 162 # define __NR_seccomp 380 163 # else 164 # warning "seccomp syscall number unknown for this architecture" 165 # define __NR_seccomp 0xffff 166 # endif 167 #endif 168 169 #ifndef __NR_uretprobe 170 # if defined(__x86_64__) 171 # define __NR_uretprobe 335 172 # endif 173 #endif 174 175 #ifndef __NR_uprobe 176 # if defined(__x86_64__) 177 # define __NR_uprobe 336 178 # endif 179 #endif 180 181 #ifndef SECCOMP_SET_MODE_STRICT 182 #define SECCOMP_SET_MODE_STRICT 0 183 #endif 184 185 #ifndef SECCOMP_SET_MODE_FILTER 186 #define SECCOMP_SET_MODE_FILTER 1 187 #endif 188 189 #ifndef SECCOMP_GET_ACTION_AVAIL 190 #define SECCOMP_GET_ACTION_AVAIL 2 191 #endif 192 193 #ifndef SECCOMP_GET_NOTIF_SIZES 194 #define SECCOMP_GET_NOTIF_SIZES 3 195 #endif 196 197 #ifndef SECCOMP_FILTER_FLAG_TSYNC 198 #define SECCOMP_FILTER_FLAG_TSYNC (1UL << 0) 199 #endif 200 201 #ifndef SECCOMP_FILTER_FLAG_LOG 202 #define SECCOMP_FILTER_FLAG_LOG (1UL << 1) 203 #endif 204 205 #ifndef SECCOMP_FILTER_FLAG_SPEC_ALLOW 206 #define SECCOMP_FILTER_FLAG_SPEC_ALLOW (1UL << 2) 207 #endif 208 209 #ifndef PTRACE_SECCOMP_GET_METADATA 210 #define PTRACE_SECCOMP_GET_METADATA 0x420d 211 212 struct seccomp_metadata { 213 __u64 filter_off; /* Input: which filter */ 214 __u64 flags; /* Output: filter's flags */ 215 }; 216 #endif 217 218 #ifndef SECCOMP_FILTER_FLAG_NEW_LISTENER 219 #define SECCOMP_FILTER_FLAG_NEW_LISTENER (1UL << 3) 220 #endif 221 222 #ifndef SECCOMP_RET_USER_NOTIF 223 #define SECCOMP_RET_USER_NOTIF 0x7fc00000U 224 225 #define SECCOMP_IOC_MAGIC '!' 226 #define SECCOMP_IO(nr) _IO(SECCOMP_IOC_MAGIC, nr) 227 #define SECCOMP_IOR(nr, type) _IOR(SECCOMP_IOC_MAGIC, nr, type) 228 #define SECCOMP_IOW(nr, type) _IOW(SECCOMP_IOC_MAGIC, nr, type) 229 #define SECCOMP_IOWR(nr, type) _IOWR(SECCOMP_IOC_MAGIC, nr, type) 230 231 /* Flags for seccomp notification fd ioctl. */ 232 #define SECCOMP_IOCTL_NOTIF_RECV SECCOMP_IOWR(0, struct seccomp_notif) 233 #define SECCOMP_IOCTL_NOTIF_SEND SECCOMP_IOWR(1, \ 234 struct seccomp_notif_resp) 235 #define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOW(2, __u64) 236 237 struct seccomp_notif { 238 __u64 id; 239 __u32 pid; 240 __u32 flags; 241 struct seccomp_data data; 242 }; 243 244 struct seccomp_notif_resp { 245 __u64 id; 246 __s64 val; 247 __s32 error; 248 __u32 flags; 249 }; 250 251 struct seccomp_notif_sizes { 252 __u16 seccomp_notif; 253 __u16 seccomp_notif_resp; 254 __u16 seccomp_data; 255 }; 256 #endif 257 258 #ifndef SECCOMP_IOCTL_NOTIF_ADDFD 259 /* On success, the return value is the remote process's added fd number */ 260 #define SECCOMP_IOCTL_NOTIF_ADDFD SECCOMP_IOW(3, \ 261 struct seccomp_notif_addfd) 262 263 /* valid flags for seccomp_notif_addfd */ 264 #define SECCOMP_ADDFD_FLAG_SETFD (1UL << 0) /* Specify remote fd */ 265 266 struct seccomp_notif_addfd { 267 __u64 id; 268 __u32 flags; 269 __u32 srcfd; 270 __u32 newfd; 271 __u32 newfd_flags; 272 }; 273 #endif 274 275 #ifndef SECCOMP_ADDFD_FLAG_SEND 276 #define SECCOMP_ADDFD_FLAG_SEND (1UL << 1) /* Addfd and return it, atomically */ 277 #endif 278 279 struct seccomp_notif_addfd_small { 280 __u64 id; 281 char weird[4]; 282 }; 283 #define SECCOMP_IOCTL_NOTIF_ADDFD_SMALL \ 284 SECCOMP_IOW(3, struct seccomp_notif_addfd_small) 285 286 struct seccomp_notif_addfd_big { 287 union { 288 struct seccomp_notif_addfd addfd; 289 char buf[sizeof(struct seccomp_notif_addfd) + 8]; 290 }; 291 }; 292 #define SECCOMP_IOCTL_NOTIF_ADDFD_BIG \ 293 SECCOMP_IOWR(3, struct seccomp_notif_addfd_big) 294 295 #ifndef PTRACE_EVENTMSG_SYSCALL_ENTRY 296 #define PTRACE_EVENTMSG_SYSCALL_ENTRY 1 297 #define PTRACE_EVENTMSG_SYSCALL_EXIT 2 298 #endif 299 300 #ifndef SECCOMP_USER_NOTIF_FLAG_CONTINUE 301 #define SECCOMP_USER_NOTIF_FLAG_CONTINUE 0x00000001 302 #endif 303 304 #ifndef SECCOMP_FILTER_FLAG_TSYNC_ESRCH 305 #define SECCOMP_FILTER_FLAG_TSYNC_ESRCH (1UL << 4) 306 #endif 307 308 #ifndef SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV 309 #define SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV (1UL << 5) 310 #endif 311 312 #ifndef SECCOMP_FILTER_FLAG_RESTART_BEFORE_RECV 313 #define SECCOMP_FILTER_FLAG_RESTART_BEFORE_RECV (1UL << 6) 314 #endif 315 316 #ifndef seccomp 317 int seccomp(unsigned int op, unsigned int flags, void *args) 318 { 319 errno = 0; 320 return syscall(__NR_seccomp, op, flags, args); 321 } 322 #endif 323 324 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ 325 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n])) 326 #elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ 327 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]) + sizeof(__u32)) 328 #else 329 #error "wut? Unknown __BYTE_ORDER__?!" 330 #endif 331 332 #define SIBLING_EXIT_UNKILLED 0xbadbeef 333 #define SIBLING_EXIT_FAILURE 0xbadface 334 #define SIBLING_EXIT_NEWPRIVS 0xbadfeed 335 336 static int __filecmp(pid_t pid1, pid_t pid2, int fd1, int fd2) 337 { 338 #ifdef __NR_kcmp 339 errno = 0; 340 return syscall(__NR_kcmp, pid1, pid2, KCMP_FILE, fd1, fd2); 341 #else 342 errno = ENOSYS; 343 return -1; 344 #endif 345 } 346 347 /* Have TH_LOG report actual location filecmp() is used. */ 348 #define filecmp(pid1, pid2, fd1, fd2) ({ \ 349 int _ret; \ 350 \ 351 _ret = __filecmp(pid1, pid2, fd1, fd2); \ 352 if (_ret != 0) { \ 353 if (_ret < 0 && errno == ENOSYS) { \ 354 TH_LOG("kcmp() syscall missing (test is less accurate)");\ 355 _ret = 0; \ 356 } \ 357 } \ 358 _ret; }) 359 360 TEST(kcmp) 361 { 362 int ret; 363 364 ret = __filecmp(getpid(), getpid(), 1, 1); 365 EXPECT_EQ(ret, 0); 366 if (ret != 0 && errno == ENOSYS) 367 SKIP(return, "Kernel does not support kcmp() (missing CONFIG_KCMP?)"); 368 } 369 370 TEST(mode_strict_support) 371 { 372 long ret; 373 374 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL); 375 ASSERT_EQ(0, ret) { 376 TH_LOG("Kernel does not support CONFIG_SECCOMP"); 377 } 378 syscall(__NR_exit, 0); 379 } 380 381 TEST_SIGNAL(mode_strict_cannot_call_prctl, SIGKILL) 382 { 383 long ret; 384 385 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL); 386 ASSERT_EQ(0, ret) { 387 TH_LOG("Kernel does not support CONFIG_SECCOMP"); 388 } 389 syscall(__NR_prctl, PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 390 NULL, NULL, NULL); 391 EXPECT_FALSE(true) { 392 TH_LOG("Unreachable!"); 393 } 394 } 395 396 /* Note! This doesn't test no new privs behavior */ 397 TEST(no_new_privs_support) 398 { 399 long ret; 400 401 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 402 EXPECT_EQ(0, ret) { 403 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 404 } 405 } 406 407 /* Tests kernel support by checking for a copy_from_user() fault on NULL. */ 408 TEST(mode_filter_support) 409 { 410 long ret; 411 412 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0); 413 ASSERT_EQ(0, ret) { 414 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 415 } 416 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, NULL, NULL); 417 EXPECT_EQ(-1, ret); 418 EXPECT_EQ(EFAULT, errno) { 419 TH_LOG("Kernel does not support CONFIG_SECCOMP_FILTER!"); 420 } 421 } 422 423 TEST(mode_filter_without_nnp) 424 { 425 struct sock_filter filter[] = { 426 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 427 }; 428 struct sock_fprog prog = { 429 .len = (unsigned short)ARRAY_SIZE(filter), 430 .filter = filter, 431 }; 432 long ret; 433 cap_t cap = cap_get_proc(); 434 cap_flag_value_t is_cap_sys_admin = 0; 435 436 ret = prctl(PR_GET_NO_NEW_PRIVS, 0, NULL, 0, 0); 437 ASSERT_LE(0, ret) { 438 TH_LOG("Expected 0 or unsupported for NO_NEW_PRIVS"); 439 } 440 errno = 0; 441 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); 442 /* Succeeds with CAP_SYS_ADMIN, fails without */ 443 cap_get_flag(cap, CAP_SYS_ADMIN, CAP_EFFECTIVE, &is_cap_sys_admin); 444 if (!is_cap_sys_admin) { 445 EXPECT_EQ(-1, ret); 446 EXPECT_EQ(EACCES, errno); 447 } else { 448 EXPECT_EQ(0, ret); 449 } 450 } 451 452 #define MAX_INSNS_PER_PATH 32768 453 454 TEST(filter_size_limits) 455 { 456 int i; 457 int count = BPF_MAXINSNS + 1; 458 struct sock_filter allow[] = { 459 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 460 }; 461 struct sock_filter *filter; 462 struct sock_fprog prog = { }; 463 long ret; 464 465 filter = calloc(count, sizeof(*filter)); 466 ASSERT_NE(NULL, filter); 467 468 for (i = 0; i < count; i++) 469 filter[i] = allow[0]; 470 471 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 472 ASSERT_EQ(0, ret); 473 474 prog.filter = filter; 475 prog.len = count; 476 477 /* Too many filter instructions in a single filter. */ 478 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); 479 ASSERT_NE(0, ret) { 480 TH_LOG("Installing %d insn filter was allowed", prog.len); 481 } 482 483 /* One less is okay, though. */ 484 prog.len -= 1; 485 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); 486 ASSERT_EQ(0, ret) { 487 TH_LOG("Installing %d insn filter wasn't allowed", prog.len); 488 } 489 } 490 491 TEST(filter_chain_limits) 492 { 493 int i; 494 int count = BPF_MAXINSNS; 495 struct sock_filter allow[] = { 496 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 497 }; 498 struct sock_filter *filter; 499 struct sock_fprog prog = { }; 500 long ret; 501 502 filter = calloc(count, sizeof(*filter)); 503 ASSERT_NE(NULL, filter); 504 505 for (i = 0; i < count; i++) 506 filter[i] = allow[0]; 507 508 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 509 ASSERT_EQ(0, ret); 510 511 prog.filter = filter; 512 prog.len = 1; 513 514 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); 515 ASSERT_EQ(0, ret); 516 517 prog.len = count; 518 519 /* Too many total filter instructions. */ 520 for (i = 0; i < MAX_INSNS_PER_PATH; i++) { 521 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); 522 if (ret != 0) 523 break; 524 } 525 ASSERT_NE(0, ret) { 526 TH_LOG("Allowed %d %d-insn filters (total with penalties:%d)", 527 i, count, i * (count + 4)); 528 } 529 } 530 531 TEST(mode_filter_cannot_move_to_strict) 532 { 533 struct sock_filter filter[] = { 534 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 535 }; 536 struct sock_fprog prog = { 537 .len = (unsigned short)ARRAY_SIZE(filter), 538 .filter = filter, 539 }; 540 long ret; 541 542 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 543 ASSERT_EQ(0, ret); 544 545 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); 546 ASSERT_EQ(0, ret); 547 548 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, 0, 0); 549 EXPECT_EQ(-1, ret); 550 EXPECT_EQ(EINVAL, errno); 551 } 552 553 554 TEST(mode_filter_get_seccomp) 555 { 556 struct sock_filter filter[] = { 557 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 558 }; 559 struct sock_fprog prog = { 560 .len = (unsigned short)ARRAY_SIZE(filter), 561 .filter = filter, 562 }; 563 long ret; 564 565 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 566 ASSERT_EQ(0, ret); 567 568 ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0); 569 EXPECT_EQ(0, ret); 570 571 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); 572 ASSERT_EQ(0, ret); 573 574 ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0); 575 EXPECT_EQ(2, ret); 576 } 577 578 579 TEST(ALLOW_all) 580 { 581 struct sock_filter filter[] = { 582 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 583 }; 584 struct sock_fprog prog = { 585 .len = (unsigned short)ARRAY_SIZE(filter), 586 .filter = filter, 587 }; 588 long ret; 589 590 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 591 ASSERT_EQ(0, ret); 592 593 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); 594 ASSERT_EQ(0, ret); 595 } 596 597 TEST(empty_prog) 598 { 599 struct sock_filter filter[] = { 600 }; 601 struct sock_fprog prog = { 602 .len = (unsigned short)ARRAY_SIZE(filter), 603 .filter = filter, 604 }; 605 long ret; 606 607 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 608 ASSERT_EQ(0, ret); 609 610 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); 611 EXPECT_EQ(-1, ret); 612 EXPECT_EQ(EINVAL, errno); 613 } 614 615 TEST(log_all) 616 { 617 struct sock_filter filter[] = { 618 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG), 619 }; 620 struct sock_fprog prog = { 621 .len = (unsigned short)ARRAY_SIZE(filter), 622 .filter = filter, 623 }; 624 long ret; 625 pid_t parent = getppid(); 626 627 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 628 ASSERT_EQ(0, ret); 629 630 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); 631 ASSERT_EQ(0, ret); 632 633 /* getppid() should succeed and be logged (no check for logging) */ 634 EXPECT_EQ(parent, syscall(__NR_getppid)); 635 } 636 637 TEST_SIGNAL(unknown_ret_is_kill_inside, SIGSYS) 638 { 639 struct sock_filter filter[] = { 640 BPF_STMT(BPF_RET|BPF_K, 0x10000000U), 641 }; 642 struct sock_fprog prog = { 643 .len = (unsigned short)ARRAY_SIZE(filter), 644 .filter = filter, 645 }; 646 long ret; 647 648 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 649 ASSERT_EQ(0, ret); 650 651 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); 652 ASSERT_EQ(0, ret); 653 EXPECT_EQ(0, syscall(__NR_getpid)) { 654 TH_LOG("getpid() shouldn't ever return"); 655 } 656 } 657 658 /* return code >= 0x80000000 is unused. */ 659 TEST_SIGNAL(unknown_ret_is_kill_above_allow, SIGSYS) 660 { 661 struct sock_filter filter[] = { 662 BPF_STMT(BPF_RET|BPF_K, 0x90000000U), 663 }; 664 struct sock_fprog prog = { 665 .len = (unsigned short)ARRAY_SIZE(filter), 666 .filter = filter, 667 }; 668 long ret; 669 670 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 671 ASSERT_EQ(0, ret); 672 673 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); 674 ASSERT_EQ(0, ret); 675 EXPECT_EQ(0, syscall(__NR_getpid)) { 676 TH_LOG("getpid() shouldn't ever return"); 677 } 678 } 679 680 TEST_SIGNAL(KILL_all, SIGSYS) 681 { 682 struct sock_filter filter[] = { 683 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), 684 }; 685 struct sock_fprog prog = { 686 .len = (unsigned short)ARRAY_SIZE(filter), 687 .filter = filter, 688 }; 689 long ret; 690 691 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 692 ASSERT_EQ(0, ret); 693 694 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); 695 ASSERT_EQ(0, ret); 696 } 697 698 TEST_SIGNAL(KILL_one, SIGSYS) 699 { 700 struct sock_filter filter[] = { 701 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 702 offsetof(struct seccomp_data, nr)), 703 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), 704 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), 705 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 706 }; 707 struct sock_fprog prog = { 708 .len = (unsigned short)ARRAY_SIZE(filter), 709 .filter = filter, 710 }; 711 long ret; 712 pid_t parent = getppid(); 713 714 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 715 ASSERT_EQ(0, ret); 716 717 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); 718 ASSERT_EQ(0, ret); 719 720 EXPECT_EQ(parent, syscall(__NR_getppid)); 721 /* getpid() should never return. */ 722 EXPECT_EQ(0, syscall(__NR_getpid)); 723 } 724 725 TEST_SIGNAL(KILL_one_arg_one, SIGSYS) 726 { 727 void *fatal_address; 728 struct sock_filter filter[] = { 729 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 730 offsetof(struct seccomp_data, nr)), 731 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_times, 1, 0), 732 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 733 /* Only both with lower 32-bit for now. */ 734 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(0)), 735 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 736 (unsigned long)&fatal_address, 0, 1), 737 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), 738 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 739 }; 740 struct sock_fprog prog = { 741 .len = (unsigned short)ARRAY_SIZE(filter), 742 .filter = filter, 743 }; 744 long ret; 745 pid_t parent = getppid(); 746 struct tms timebuf; 747 clock_t clock = times(&timebuf); 748 749 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 750 ASSERT_EQ(0, ret); 751 752 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); 753 ASSERT_EQ(0, ret); 754 755 EXPECT_EQ(parent, syscall(__NR_getppid)); 756 EXPECT_LE(clock, syscall(__NR_times, &timebuf)); 757 /* times() should never return. */ 758 EXPECT_EQ(0, syscall(__NR_times, &fatal_address)); 759 } 760 761 TEST_SIGNAL(KILL_one_arg_six, SIGSYS) 762 { 763 #ifndef __NR_mmap2 764 int sysno = __NR_mmap; 765 #else 766 int sysno = __NR_mmap2; 767 #endif 768 struct sock_filter filter[] = { 769 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 770 offsetof(struct seccomp_data, nr)), 771 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, sysno, 1, 0), 772 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 773 /* Only both with lower 32-bit for now. */ 774 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(5)), 775 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 0x0C0FFEE, 0, 1), 776 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), 777 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 778 }; 779 struct sock_fprog prog = { 780 .len = (unsigned short)ARRAY_SIZE(filter), 781 .filter = filter, 782 }; 783 long ret; 784 pid_t parent = getppid(); 785 int fd; 786 void *map1, *map2; 787 int page_size = sysconf(_SC_PAGESIZE); 788 789 ASSERT_LT(0, page_size); 790 791 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 792 ASSERT_EQ(0, ret); 793 794 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); 795 ASSERT_EQ(0, ret); 796 797 fd = open("/dev/zero", O_RDONLY); 798 ASSERT_NE(-1, fd); 799 800 EXPECT_EQ(parent, syscall(__NR_getppid)); 801 map1 = (void *)syscall(sysno, 802 NULL, page_size, PROT_READ, MAP_PRIVATE, fd, page_size); 803 EXPECT_NE(MAP_FAILED, map1); 804 /* mmap2() should never return. */ 805 map2 = (void *)syscall(sysno, 806 NULL, page_size, PROT_READ, MAP_PRIVATE, fd, 0x0C0FFEE); 807 EXPECT_EQ(MAP_FAILED, map2); 808 809 /* The test failed, so clean up the resources. */ 810 munmap(map1, page_size); 811 munmap(map2, page_size); 812 close(fd); 813 } 814 815 /* This is a thread task to die via seccomp filter violation. */ 816 void *kill_thread(void *data) 817 { 818 bool die = (bool)data; 819 820 if (die) { 821 syscall(__NR_getpid); 822 return (void *)SIBLING_EXIT_FAILURE; 823 } 824 825 return (void *)SIBLING_EXIT_UNKILLED; 826 } 827 828 enum kill_t { 829 KILL_THREAD, 830 KILL_PROCESS, 831 RET_UNKNOWN 832 }; 833 834 /* Prepare a thread that will kill itself or both of us. */ 835 void kill_thread_or_group(struct __test_metadata *_metadata, 836 enum kill_t kill_how) 837 { 838 pthread_t thread; 839 void *status; 840 /* Kill only when calling __NR_getpid. */ 841 struct sock_filter filter_thread[] = { 842 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 843 offsetof(struct seccomp_data, nr)), 844 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), 845 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_THREAD), 846 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 847 }; 848 struct sock_fprog prog_thread = { 849 .len = (unsigned short)ARRAY_SIZE(filter_thread), 850 .filter = filter_thread, 851 }; 852 int kill = kill_how == KILL_PROCESS ? SECCOMP_RET_KILL_PROCESS : 0xAAAAAAAA; 853 struct sock_filter filter_process[] = { 854 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 855 offsetof(struct seccomp_data, nr)), 856 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), 857 BPF_STMT(BPF_RET|BPF_K, kill), 858 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 859 }; 860 struct sock_fprog prog_process = { 861 .len = (unsigned short)ARRAY_SIZE(filter_process), 862 .filter = filter_process, 863 }; 864 865 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { 866 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 867 } 868 869 ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, 870 kill_how == KILL_THREAD ? &prog_thread 871 : &prog_process)); 872 873 /* 874 * Add the KILL_THREAD rule again to make sure that the KILL_PROCESS 875 * flag cannot be downgraded by a new filter. 876 */ 877 if (kill_how == KILL_PROCESS) 878 ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread)); 879 880 /* Start a thread that will exit immediately. */ 881 ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)false)); 882 ASSERT_EQ(0, pthread_join(thread, &status)); 883 ASSERT_EQ(SIBLING_EXIT_UNKILLED, (unsigned long)status); 884 885 /* Start a thread that will die immediately. */ 886 ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)true)); 887 ASSERT_EQ(0, pthread_join(thread, &status)); 888 ASSERT_NE(SIBLING_EXIT_FAILURE, (unsigned long)status); 889 890 /* 891 * If we get here, only the spawned thread died. Let the parent know 892 * the whole process didn't die (i.e. this thread, the spawner, 893 * stayed running). 894 */ 895 exit(42); 896 } 897 898 TEST(KILL_thread) 899 { 900 int status; 901 pid_t child_pid; 902 903 child_pid = fork(); 904 ASSERT_LE(0, child_pid); 905 if (child_pid == 0) { 906 kill_thread_or_group(_metadata, KILL_THREAD); 907 _exit(38); 908 } 909 910 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); 911 912 /* If only the thread was killed, we'll see exit 42. */ 913 ASSERT_TRUE(WIFEXITED(status)); 914 ASSERT_EQ(42, WEXITSTATUS(status)); 915 } 916 917 TEST(KILL_process) 918 { 919 int status; 920 pid_t child_pid; 921 922 child_pid = fork(); 923 ASSERT_LE(0, child_pid); 924 if (child_pid == 0) { 925 kill_thread_or_group(_metadata, KILL_PROCESS); 926 _exit(38); 927 } 928 929 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); 930 931 /* If the entire process was killed, we'll see SIGSYS. */ 932 ASSERT_TRUE(WIFSIGNALED(status)); 933 ASSERT_EQ(SIGSYS, WTERMSIG(status)); 934 } 935 936 TEST(KILL_unknown) 937 { 938 int status; 939 pid_t child_pid; 940 941 child_pid = fork(); 942 ASSERT_LE(0, child_pid); 943 if (child_pid == 0) { 944 kill_thread_or_group(_metadata, RET_UNKNOWN); 945 _exit(38); 946 } 947 948 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); 949 950 /* If the entire process was killed, we'll see SIGSYS. */ 951 EXPECT_TRUE(WIFSIGNALED(status)) { 952 TH_LOG("Unknown SECCOMP_RET is only killing the thread?"); 953 } 954 ASSERT_EQ(SIGSYS, WTERMSIG(status)); 955 } 956 957 /* TODO(wad) add 64-bit versus 32-bit arg tests. */ 958 TEST(arg_out_of_range) 959 { 960 struct sock_filter filter[] = { 961 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(6)), 962 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 963 }; 964 struct sock_fprog prog = { 965 .len = (unsigned short)ARRAY_SIZE(filter), 966 .filter = filter, 967 }; 968 long ret; 969 970 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 971 ASSERT_EQ(0, ret); 972 973 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); 974 EXPECT_EQ(-1, ret); 975 EXPECT_EQ(EINVAL, errno); 976 } 977 978 #define ERRNO_FILTER(name, errno) \ 979 struct sock_filter _read_filter_##name[] = { \ 980 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, \ 981 offsetof(struct seccomp_data, nr)), \ 982 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1), \ 983 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | errno), \ 984 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), \ 985 }; \ 986 struct sock_fprog prog_##name = { \ 987 .len = (unsigned short)ARRAY_SIZE(_read_filter_##name), \ 988 .filter = _read_filter_##name, \ 989 } 990 991 /* Make sure basic errno values are correctly passed through a filter. */ 992 TEST(ERRNO_valid) 993 { 994 ERRNO_FILTER(valid, E2BIG); 995 long ret; 996 pid_t parent = getppid(); 997 998 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 999 ASSERT_EQ(0, ret); 1000 1001 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_valid); 1002 ASSERT_EQ(0, ret); 1003 1004 EXPECT_EQ(parent, syscall(__NR_getppid)); 1005 EXPECT_EQ(-1, read(-1, NULL, 0)); 1006 EXPECT_EQ(E2BIG, errno); 1007 } 1008 1009 /* Make sure an errno of zero is correctly handled by the arch code. */ 1010 TEST(ERRNO_zero) 1011 { 1012 ERRNO_FILTER(zero, 0); 1013 long ret; 1014 pid_t parent = getppid(); 1015 1016 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1017 ASSERT_EQ(0, ret); 1018 1019 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_zero); 1020 ASSERT_EQ(0, ret); 1021 1022 EXPECT_EQ(parent, syscall(__NR_getppid)); 1023 /* "errno" of 0 is ok. */ 1024 EXPECT_EQ(0, read(-1, NULL, 0)); 1025 } 1026 1027 /* 1028 * The SECCOMP_RET_DATA mask is 16 bits wide, but errno is smaller. 1029 * This tests that the errno value gets capped correctly, fixed by 1030 * 580c57f10768 ("seccomp: cap SECCOMP_RET_ERRNO data to MAX_ERRNO"). 1031 */ 1032 TEST(ERRNO_capped) 1033 { 1034 ERRNO_FILTER(capped, 4096); 1035 long ret; 1036 pid_t parent = getppid(); 1037 1038 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1039 ASSERT_EQ(0, ret); 1040 1041 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_capped); 1042 ASSERT_EQ(0, ret); 1043 1044 EXPECT_EQ(parent, syscall(__NR_getppid)); 1045 EXPECT_EQ(-1, read(-1, NULL, 0)); 1046 EXPECT_EQ(4095, errno); 1047 } 1048 1049 /* 1050 * Filters are processed in reverse order: last applied is executed first. 1051 * Since only the SECCOMP_RET_ACTION mask is tested for return values, the 1052 * SECCOMP_RET_DATA mask results will follow the most recently applied 1053 * matching filter return (and not the lowest or highest value). 1054 */ 1055 TEST(ERRNO_order) 1056 { 1057 ERRNO_FILTER(first, 11); 1058 ERRNO_FILTER(second, 13); 1059 ERRNO_FILTER(third, 12); 1060 long ret; 1061 pid_t parent = getppid(); 1062 1063 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1064 ASSERT_EQ(0, ret); 1065 1066 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_first); 1067 ASSERT_EQ(0, ret); 1068 1069 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_second); 1070 ASSERT_EQ(0, ret); 1071 1072 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_third); 1073 ASSERT_EQ(0, ret); 1074 1075 EXPECT_EQ(parent, syscall(__NR_getppid)); 1076 EXPECT_EQ(-1, read(-1, NULL, 0)); 1077 EXPECT_EQ(12, errno); 1078 } 1079 1080 FIXTURE(TRAP) { 1081 struct sock_fprog prog; 1082 }; 1083 1084 FIXTURE_SETUP(TRAP) 1085 { 1086 struct sock_filter filter[] = { 1087 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 1088 offsetof(struct seccomp_data, nr)), 1089 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), 1090 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP), 1091 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 1092 }; 1093 1094 memset(&self->prog, 0, sizeof(self->prog)); 1095 self->prog.filter = malloc(sizeof(filter)); 1096 ASSERT_NE(NULL, self->prog.filter); 1097 memcpy(self->prog.filter, filter, sizeof(filter)); 1098 self->prog.len = (unsigned short)ARRAY_SIZE(filter); 1099 } 1100 1101 FIXTURE_TEARDOWN(TRAP) 1102 { 1103 if (self->prog.filter) 1104 free(self->prog.filter); 1105 } 1106 1107 TEST_F_SIGNAL(TRAP, dfl, SIGSYS) 1108 { 1109 long ret; 1110 1111 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1112 ASSERT_EQ(0, ret); 1113 1114 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog); 1115 ASSERT_EQ(0, ret); 1116 syscall(__NR_getpid); 1117 } 1118 1119 /* Ensure that SIGSYS overrides SIG_IGN */ 1120 TEST_F_SIGNAL(TRAP, ign, SIGSYS) 1121 { 1122 long ret; 1123 1124 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1125 ASSERT_EQ(0, ret); 1126 1127 signal(SIGSYS, SIG_IGN); 1128 1129 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog); 1130 ASSERT_EQ(0, ret); 1131 syscall(__NR_getpid); 1132 } 1133 1134 static siginfo_t TRAP_info; 1135 static volatile int TRAP_nr; 1136 static void TRAP_action(int nr, siginfo_t *info, void *void_context) 1137 { 1138 memcpy(&TRAP_info, info, sizeof(TRAP_info)); 1139 TRAP_nr = nr; 1140 } 1141 1142 TEST_F(TRAP, handler) 1143 { 1144 int ret, test; 1145 struct sigaction act; 1146 sigset_t mask; 1147 1148 memset(&act, 0, sizeof(act)); 1149 sigemptyset(&mask); 1150 sigaddset(&mask, SIGSYS); 1151 1152 act.sa_sigaction = &TRAP_action; 1153 act.sa_flags = SA_SIGINFO; 1154 ret = sigaction(SIGSYS, &act, NULL); 1155 ASSERT_EQ(0, ret) { 1156 TH_LOG("sigaction failed"); 1157 } 1158 ret = sigprocmask(SIG_UNBLOCK, &mask, NULL); 1159 ASSERT_EQ(0, ret) { 1160 TH_LOG("sigprocmask failed"); 1161 } 1162 1163 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1164 ASSERT_EQ(0, ret); 1165 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog); 1166 ASSERT_EQ(0, ret); 1167 TRAP_nr = 0; 1168 memset(&TRAP_info, 0, sizeof(TRAP_info)); 1169 /* Expect the registers to be rolled back. (nr = error) may vary 1170 * based on arch. */ 1171 ret = syscall(__NR_getpid); 1172 /* Silence gcc warning about volatile. */ 1173 test = TRAP_nr; 1174 EXPECT_EQ(SIGSYS, test); 1175 struct local_sigsys { 1176 void *_call_addr; /* calling user insn */ 1177 int _syscall; /* triggering system call number */ 1178 unsigned int _arch; /* AUDIT_ARCH_* of syscall */ 1179 } *sigsys = (struct local_sigsys *) 1180 #ifdef si_syscall 1181 &(TRAP_info.si_call_addr); 1182 #else 1183 &TRAP_info.si_pid; 1184 #endif 1185 EXPECT_EQ(__NR_getpid, sigsys->_syscall); 1186 /* Make sure arch is non-zero. */ 1187 EXPECT_NE(0, sigsys->_arch); 1188 EXPECT_NE(0, (unsigned long)sigsys->_call_addr); 1189 } 1190 1191 FIXTURE(precedence) { 1192 struct sock_fprog allow; 1193 struct sock_fprog log; 1194 struct sock_fprog trace; 1195 struct sock_fprog error; 1196 struct sock_fprog trap; 1197 struct sock_fprog kill; 1198 }; 1199 1200 FIXTURE_SETUP(precedence) 1201 { 1202 struct sock_filter allow_insns[] = { 1203 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 1204 }; 1205 struct sock_filter log_insns[] = { 1206 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 1207 offsetof(struct seccomp_data, nr)), 1208 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), 1209 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 1210 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG), 1211 }; 1212 struct sock_filter trace_insns[] = { 1213 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 1214 offsetof(struct seccomp_data, nr)), 1215 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), 1216 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 1217 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE), 1218 }; 1219 struct sock_filter error_insns[] = { 1220 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 1221 offsetof(struct seccomp_data, nr)), 1222 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), 1223 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 1224 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO), 1225 }; 1226 struct sock_filter trap_insns[] = { 1227 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 1228 offsetof(struct seccomp_data, nr)), 1229 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), 1230 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 1231 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP), 1232 }; 1233 struct sock_filter kill_insns[] = { 1234 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 1235 offsetof(struct seccomp_data, nr)), 1236 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0), 1237 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 1238 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), 1239 }; 1240 1241 memset(self, 0, sizeof(*self)); 1242 #define FILTER_ALLOC(_x) \ 1243 self->_x.filter = malloc(sizeof(_x##_insns)); \ 1244 ASSERT_NE(NULL, self->_x.filter); \ 1245 memcpy(self->_x.filter, &_x##_insns, sizeof(_x##_insns)); \ 1246 self->_x.len = (unsigned short)ARRAY_SIZE(_x##_insns) 1247 FILTER_ALLOC(allow); 1248 FILTER_ALLOC(log); 1249 FILTER_ALLOC(trace); 1250 FILTER_ALLOC(error); 1251 FILTER_ALLOC(trap); 1252 FILTER_ALLOC(kill); 1253 } 1254 1255 FIXTURE_TEARDOWN(precedence) 1256 { 1257 #define FILTER_FREE(_x) if (self->_x.filter) free(self->_x.filter) 1258 FILTER_FREE(allow); 1259 FILTER_FREE(log); 1260 FILTER_FREE(trace); 1261 FILTER_FREE(error); 1262 FILTER_FREE(trap); 1263 FILTER_FREE(kill); 1264 } 1265 1266 TEST_F(precedence, allow_ok) 1267 { 1268 pid_t parent, res = 0; 1269 long ret; 1270 1271 parent = getppid(); 1272 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1273 ASSERT_EQ(0, ret); 1274 1275 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); 1276 ASSERT_EQ(0, ret); 1277 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); 1278 ASSERT_EQ(0, ret); 1279 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); 1280 ASSERT_EQ(0, ret); 1281 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); 1282 ASSERT_EQ(0, ret); 1283 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); 1284 ASSERT_EQ(0, ret); 1285 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill); 1286 ASSERT_EQ(0, ret); 1287 /* Should work just fine. */ 1288 res = syscall(__NR_getppid); 1289 EXPECT_EQ(parent, res); 1290 } 1291 1292 TEST_F_SIGNAL(precedence, kill_is_highest, SIGSYS) 1293 { 1294 pid_t parent, res = 0; 1295 long ret; 1296 1297 parent = getppid(); 1298 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1299 ASSERT_EQ(0, ret); 1300 1301 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); 1302 ASSERT_EQ(0, ret); 1303 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); 1304 ASSERT_EQ(0, ret); 1305 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); 1306 ASSERT_EQ(0, ret); 1307 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); 1308 ASSERT_EQ(0, ret); 1309 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); 1310 ASSERT_EQ(0, ret); 1311 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill); 1312 ASSERT_EQ(0, ret); 1313 /* Should work just fine. */ 1314 res = syscall(__NR_getppid); 1315 EXPECT_EQ(parent, res); 1316 /* getpid() should never return. */ 1317 res = syscall(__NR_getpid); 1318 EXPECT_EQ(0, res); 1319 } 1320 1321 TEST_F_SIGNAL(precedence, kill_is_highest_in_any_order, SIGSYS) 1322 { 1323 pid_t parent; 1324 long ret; 1325 1326 parent = getppid(); 1327 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1328 ASSERT_EQ(0, ret); 1329 1330 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); 1331 ASSERT_EQ(0, ret); 1332 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill); 1333 ASSERT_EQ(0, ret); 1334 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); 1335 ASSERT_EQ(0, ret); 1336 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); 1337 ASSERT_EQ(0, ret); 1338 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); 1339 ASSERT_EQ(0, ret); 1340 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); 1341 ASSERT_EQ(0, ret); 1342 /* Should work just fine. */ 1343 EXPECT_EQ(parent, syscall(__NR_getppid)); 1344 /* getpid() should never return. */ 1345 EXPECT_EQ(0, syscall(__NR_getpid)); 1346 } 1347 1348 TEST_F_SIGNAL(precedence, trap_is_second, SIGSYS) 1349 { 1350 pid_t parent; 1351 long ret; 1352 1353 parent = getppid(); 1354 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1355 ASSERT_EQ(0, ret); 1356 1357 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); 1358 ASSERT_EQ(0, ret); 1359 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); 1360 ASSERT_EQ(0, ret); 1361 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); 1362 ASSERT_EQ(0, ret); 1363 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); 1364 ASSERT_EQ(0, ret); 1365 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); 1366 ASSERT_EQ(0, ret); 1367 /* Should work just fine. */ 1368 EXPECT_EQ(parent, syscall(__NR_getppid)); 1369 /* getpid() should never return. */ 1370 EXPECT_EQ(0, syscall(__NR_getpid)); 1371 } 1372 1373 TEST_F_SIGNAL(precedence, trap_is_second_in_any_order, SIGSYS) 1374 { 1375 pid_t parent; 1376 long ret; 1377 1378 parent = getppid(); 1379 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1380 ASSERT_EQ(0, ret); 1381 1382 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); 1383 ASSERT_EQ(0, ret); 1384 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap); 1385 ASSERT_EQ(0, ret); 1386 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); 1387 ASSERT_EQ(0, ret); 1388 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); 1389 ASSERT_EQ(0, ret); 1390 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); 1391 ASSERT_EQ(0, ret); 1392 /* Should work just fine. */ 1393 EXPECT_EQ(parent, syscall(__NR_getppid)); 1394 /* getpid() should never return. */ 1395 EXPECT_EQ(0, syscall(__NR_getpid)); 1396 } 1397 1398 TEST_F(precedence, errno_is_third) 1399 { 1400 pid_t parent; 1401 long ret; 1402 1403 parent = getppid(); 1404 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1405 ASSERT_EQ(0, ret); 1406 1407 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); 1408 ASSERT_EQ(0, ret); 1409 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); 1410 ASSERT_EQ(0, ret); 1411 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); 1412 ASSERT_EQ(0, ret); 1413 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); 1414 ASSERT_EQ(0, ret); 1415 /* Should work just fine. */ 1416 EXPECT_EQ(parent, syscall(__NR_getppid)); 1417 EXPECT_EQ(0, syscall(__NR_getpid)); 1418 } 1419 1420 TEST_F(precedence, errno_is_third_in_any_order) 1421 { 1422 pid_t parent; 1423 long ret; 1424 1425 parent = getppid(); 1426 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1427 ASSERT_EQ(0, ret); 1428 1429 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); 1430 ASSERT_EQ(0, ret); 1431 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error); 1432 ASSERT_EQ(0, ret); 1433 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); 1434 ASSERT_EQ(0, ret); 1435 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); 1436 ASSERT_EQ(0, ret); 1437 /* Should work just fine. */ 1438 EXPECT_EQ(parent, syscall(__NR_getppid)); 1439 EXPECT_EQ(0, syscall(__NR_getpid)); 1440 } 1441 1442 TEST_F(precedence, trace_is_fourth) 1443 { 1444 pid_t parent; 1445 long ret; 1446 1447 parent = getppid(); 1448 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1449 ASSERT_EQ(0, ret); 1450 1451 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); 1452 ASSERT_EQ(0, ret); 1453 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); 1454 ASSERT_EQ(0, ret); 1455 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); 1456 ASSERT_EQ(0, ret); 1457 /* Should work just fine. */ 1458 EXPECT_EQ(parent, syscall(__NR_getppid)); 1459 /* No ptracer */ 1460 EXPECT_EQ(-1, syscall(__NR_getpid)); 1461 } 1462 1463 TEST_F(precedence, trace_is_fourth_in_any_order) 1464 { 1465 pid_t parent; 1466 long ret; 1467 1468 parent = getppid(); 1469 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1470 ASSERT_EQ(0, ret); 1471 1472 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace); 1473 ASSERT_EQ(0, ret); 1474 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); 1475 ASSERT_EQ(0, ret); 1476 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); 1477 ASSERT_EQ(0, ret); 1478 /* Should work just fine. */ 1479 EXPECT_EQ(parent, syscall(__NR_getppid)); 1480 /* No ptracer */ 1481 EXPECT_EQ(-1, syscall(__NR_getpid)); 1482 } 1483 1484 TEST_F(precedence, log_is_fifth) 1485 { 1486 pid_t mypid, parent; 1487 long ret; 1488 1489 mypid = getpid(); 1490 parent = getppid(); 1491 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1492 ASSERT_EQ(0, ret); 1493 1494 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); 1495 ASSERT_EQ(0, ret); 1496 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); 1497 ASSERT_EQ(0, ret); 1498 /* Should work just fine. */ 1499 EXPECT_EQ(parent, syscall(__NR_getppid)); 1500 /* Should also work just fine */ 1501 EXPECT_EQ(mypid, syscall(__NR_getpid)); 1502 } 1503 1504 TEST_F(precedence, log_is_fifth_in_any_order) 1505 { 1506 pid_t mypid, parent; 1507 long ret; 1508 1509 mypid = getpid(); 1510 parent = getppid(); 1511 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1512 ASSERT_EQ(0, ret); 1513 1514 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log); 1515 ASSERT_EQ(0, ret); 1516 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow); 1517 ASSERT_EQ(0, ret); 1518 /* Should work just fine. */ 1519 EXPECT_EQ(parent, syscall(__NR_getppid)); 1520 /* Should also work just fine */ 1521 EXPECT_EQ(mypid, syscall(__NR_getpid)); 1522 } 1523 1524 #ifndef PTRACE_O_TRACESECCOMP 1525 #define PTRACE_O_TRACESECCOMP 0x00000080 1526 #endif 1527 1528 /* Catch the Ubuntu 12.04 value error. */ 1529 #if PTRACE_EVENT_SECCOMP != 7 1530 #undef PTRACE_EVENT_SECCOMP 1531 #endif 1532 1533 #ifndef PTRACE_EVENT_SECCOMP 1534 #define PTRACE_EVENT_SECCOMP 7 1535 #endif 1536 1537 #define PTRACE_EVENT_MASK(status) ((status) >> 16) 1538 bool tracer_running; 1539 void tracer_stop(int sig) 1540 { 1541 tracer_running = false; 1542 } 1543 1544 typedef void tracer_func_t(struct __test_metadata *_metadata, 1545 pid_t tracee, int status, void *args); 1546 1547 void start_tracer(struct __test_metadata *_metadata, int fd, pid_t tracee, 1548 tracer_func_t tracer_func, void *args, bool ptrace_syscall) 1549 { 1550 int ret = -1; 1551 struct sigaction action = { 1552 .sa_handler = tracer_stop, 1553 }; 1554 1555 /* Allow external shutdown. */ 1556 tracer_running = true; 1557 ASSERT_EQ(0, sigaction(SIGUSR1, &action, NULL)); 1558 1559 errno = 0; 1560 while (ret == -1 && errno != EINVAL) 1561 ret = ptrace(PTRACE_ATTACH, tracee, NULL, 0); 1562 ASSERT_EQ(0, ret) { 1563 kill(tracee, SIGKILL); 1564 } 1565 /* Wait for attach stop */ 1566 wait(NULL); 1567 1568 ret = ptrace(PTRACE_SETOPTIONS, tracee, NULL, ptrace_syscall ? 1569 PTRACE_O_TRACESYSGOOD : 1570 PTRACE_O_TRACESECCOMP); 1571 ASSERT_EQ(0, ret) { 1572 TH_LOG("Failed to set PTRACE_O_TRACESECCOMP"); 1573 kill(tracee, SIGKILL); 1574 } 1575 ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT, 1576 tracee, NULL, 0); 1577 ASSERT_EQ(0, ret); 1578 1579 /* Unblock the tracee */ 1580 ASSERT_EQ(1, write(fd, "A", 1)); 1581 ASSERT_EQ(0, close(fd)); 1582 1583 /* Run until we're shut down. Must assert to stop execution. */ 1584 while (tracer_running) { 1585 int status; 1586 1587 if (wait(&status) != tracee) 1588 continue; 1589 1590 if (WIFSIGNALED(status)) { 1591 /* Child caught a fatal signal. */ 1592 return; 1593 } 1594 if (WIFEXITED(status)) { 1595 /* Child exited with code. */ 1596 return; 1597 } 1598 1599 /* Check if we got an expected event. */ 1600 ASSERT_EQ(WIFCONTINUED(status), false); 1601 ASSERT_EQ(WIFSTOPPED(status), true); 1602 ASSERT_EQ(WSTOPSIG(status) & SIGTRAP, SIGTRAP) { 1603 TH_LOG("Unexpected WSTOPSIG: %d", WSTOPSIG(status)); 1604 } 1605 1606 tracer_func(_metadata, tracee, status, args); 1607 1608 ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT, 1609 tracee, NULL, 0); 1610 ASSERT_EQ(0, ret); 1611 } 1612 /* Directly report the status of our test harness results. */ 1613 syscall(__NR_exit, _metadata->exit_code); 1614 } 1615 1616 /* Common tracer setup/teardown functions. */ 1617 void cont_handler(int num) 1618 { } 1619 pid_t setup_trace_fixture(struct __test_metadata *_metadata, 1620 tracer_func_t func, void *args, bool ptrace_syscall) 1621 { 1622 char sync; 1623 int pipefd[2]; 1624 pid_t tracer_pid; 1625 pid_t tracee = getpid(); 1626 1627 /* Setup a pipe for clean synchronization. */ 1628 ASSERT_EQ(0, pipe(pipefd)); 1629 1630 /* Fork a child which we'll promote to tracer */ 1631 tracer_pid = fork(); 1632 ASSERT_LE(0, tracer_pid); 1633 signal(SIGALRM, cont_handler); 1634 if (tracer_pid == 0) { 1635 close(pipefd[0]); 1636 start_tracer(_metadata, pipefd[1], tracee, func, args, 1637 ptrace_syscall); 1638 syscall(__NR_exit, 0); 1639 } 1640 close(pipefd[1]); 1641 prctl(PR_SET_PTRACER, tracer_pid, 0, 0, 0); 1642 read(pipefd[0], &sync, 1); 1643 close(pipefd[0]); 1644 1645 return tracer_pid; 1646 } 1647 1648 void teardown_trace_fixture(struct __test_metadata *_metadata, 1649 pid_t tracer) 1650 { 1651 if (tracer) { 1652 int status; 1653 ASSERT_EQ(0, kill(tracer, SIGUSR1)); 1654 ASSERT_EQ(tracer, waitpid(tracer, &status, 0)); 1655 } 1656 } 1657 1658 /* "poke" tracer arguments and function. */ 1659 struct tracer_args_poke_t { 1660 unsigned long poke_addr; 1661 }; 1662 1663 void tracer_poke(struct __test_metadata *_metadata, pid_t tracee, int status, 1664 void *args) 1665 { 1666 int ret; 1667 unsigned long msg; 1668 struct tracer_args_poke_t *info = (struct tracer_args_poke_t *)args; 1669 1670 ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg); 1671 EXPECT_EQ(0, ret); 1672 /* If this fails, don't try to recover. */ 1673 ASSERT_EQ(0x1001, msg) { 1674 kill(tracee, SIGKILL); 1675 } 1676 /* 1677 * Poke in the message. 1678 * Registers are not touched to try to keep this relatively arch 1679 * agnostic. 1680 */ 1681 ret = ptrace(PTRACE_POKEDATA, tracee, info->poke_addr, 0x1001); 1682 EXPECT_EQ(0, ret); 1683 } 1684 1685 FIXTURE(TRACE_poke) { 1686 struct sock_fprog prog; 1687 pid_t tracer; 1688 long poked; 1689 struct tracer_args_poke_t tracer_args; 1690 }; 1691 1692 FIXTURE_SETUP(TRACE_poke) 1693 { 1694 struct sock_filter filter[] = { 1695 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 1696 offsetof(struct seccomp_data, nr)), 1697 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1), 1698 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1001), 1699 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 1700 }; 1701 1702 self->poked = 0; 1703 memset(&self->prog, 0, sizeof(self->prog)); 1704 self->prog.filter = malloc(sizeof(filter)); 1705 ASSERT_NE(NULL, self->prog.filter); 1706 memcpy(self->prog.filter, filter, sizeof(filter)); 1707 self->prog.len = (unsigned short)ARRAY_SIZE(filter); 1708 1709 /* Set up tracer args. */ 1710 self->tracer_args.poke_addr = (unsigned long)&self->poked; 1711 1712 /* Launch tracer. */ 1713 self->tracer = setup_trace_fixture(_metadata, tracer_poke, 1714 &self->tracer_args, false); 1715 } 1716 1717 FIXTURE_TEARDOWN(TRACE_poke) 1718 { 1719 teardown_trace_fixture(_metadata, self->tracer); 1720 if (self->prog.filter) 1721 free(self->prog.filter); 1722 } 1723 1724 TEST_F(TRACE_poke, read_has_side_effects) 1725 { 1726 ssize_t ret; 1727 1728 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1729 ASSERT_EQ(0, ret); 1730 1731 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); 1732 ASSERT_EQ(0, ret); 1733 1734 EXPECT_EQ(0, self->poked); 1735 ret = read(-1, NULL, 0); 1736 EXPECT_EQ(-1, ret); 1737 EXPECT_EQ(0x1001, self->poked); 1738 } 1739 1740 TEST_F(TRACE_poke, getpid_runs_normally) 1741 { 1742 long ret; 1743 1744 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 1745 ASSERT_EQ(0, ret); 1746 1747 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0); 1748 ASSERT_EQ(0, ret); 1749 1750 EXPECT_EQ(0, self->poked); 1751 EXPECT_NE(0, syscall(__NR_getpid)); 1752 EXPECT_EQ(0, self->poked); 1753 } 1754 1755 #if defined(__x86_64__) 1756 # define ARCH_REGS struct user_regs_struct 1757 # define SYSCALL_NUM(_regs) (_regs).orig_rax 1758 # define SYSCALL_RET(_regs) (_regs).rax 1759 #elif defined(__i386__) 1760 # define ARCH_REGS struct user_regs_struct 1761 # define SYSCALL_NUM(_regs) (_regs).orig_eax 1762 # define SYSCALL_RET(_regs) (_regs).eax 1763 #elif defined(__alpha__) 1764 /* NT_PRSTATUS contains r0-r30, pc and unique, not struct pt_regs. */ 1765 struct alpha_regs { 1766 unsigned long regs[33]; 1767 }; 1768 1769 # define ARCH_REGS struct alpha_regs 1770 /* The kernel keeps the mutable syscall number in r1. */ 1771 # define SYSCALL_NUM(_regs) ((_regs).regs[1]) 1772 # define SYSCALL_RET(_regs) ((_regs).regs[0]) 1773 /* 1774 * Alpha returns positive errno in r0 with the r19/a3 error flag set. 1775 * At a syscall-entry stop, r19 is still the fourth syscall argument. 1776 * Callers must also set the syscall number to -1 to skip the syscall 1777 * before replacing r19 with the error flag. 1778 */ 1779 # define SYSCALL_RET_SET(_regs, _val) \ 1780 do { \ 1781 struct alpha_regs *__regs = &(_regs); \ 1782 long __ret = (_val); \ 1783 \ 1784 __regs->regs[0] = __ret < 0 ? -__ret : __ret; \ 1785 __regs->regs[19] = __ret < 0; \ 1786 } while (0) 1787 #elif defined(__arm__) 1788 # define ARCH_REGS struct pt_regs 1789 # define SYSCALL_NUM(_regs) (_regs).ARM_r7 1790 # ifndef PTRACE_SET_SYSCALL 1791 # define PTRACE_SET_SYSCALL 23 1792 # endif 1793 # define SYSCALL_NUM_SET(_regs, _nr) \ 1794 EXPECT_EQ(0, ptrace(PTRACE_SET_SYSCALL, tracee, NULL, _nr)) 1795 # define SYSCALL_RET(_regs) (_regs).ARM_r0 1796 #elif defined(__aarch64__) 1797 # define ARCH_REGS struct user_pt_regs 1798 # define SYSCALL_NUM(_regs) (_regs).regs[8] 1799 # ifndef NT_ARM_SYSTEM_CALL 1800 # define NT_ARM_SYSTEM_CALL 0x404 1801 # endif 1802 # define SYSCALL_NUM_SET(_regs, _nr) \ 1803 do { \ 1804 struct iovec __v; \ 1805 typeof(_nr) __nr = (_nr); \ 1806 __v.iov_base = &__nr; \ 1807 __v.iov_len = sizeof(__nr); \ 1808 EXPECT_EQ(0, ptrace(PTRACE_SETREGSET, tracee, \ 1809 NT_ARM_SYSTEM_CALL, &__v)); \ 1810 } while (0) 1811 # define SYSCALL_RET(_regs) (_regs).regs[0] 1812 #elif defined(__loongarch__) 1813 # define ARCH_REGS struct user_pt_regs 1814 # define SYSCALL_NUM(_regs) (_regs).regs[11] 1815 # define SYSCALL_RET(_regs) (_regs).regs[4] 1816 #elif defined(__riscv) && __riscv_xlen == 64 1817 # define ARCH_REGS struct user_regs_struct 1818 # define SYSCALL_NUM(_regs) (_regs).a7 1819 # define SYSCALL_RET(_regs) (_regs).a0 1820 #elif defined(__csky__) 1821 # define ARCH_REGS struct pt_regs 1822 # if defined(__CSKYABIV2__) 1823 # define SYSCALL_NUM(_regs) (_regs).regs[3] 1824 # else 1825 # define SYSCALL_NUM(_regs) (_regs).regs[9] 1826 # endif 1827 # define SYSCALL_RET(_regs) (_regs).a0 1828 #elif defined(__hppa__) 1829 # define ARCH_REGS struct user_regs_struct 1830 # define SYSCALL_NUM(_regs) (_regs).gr[20] 1831 # define SYSCALL_RET(_regs) (_regs).gr[28] 1832 #elif defined(__powerpc__) 1833 # define ARCH_REGS struct pt_regs 1834 # define SYSCALL_NUM(_regs) (_regs).gpr[0] 1835 # define SYSCALL_RET(_regs) (_regs).gpr[3] 1836 # define SYSCALL_RET_SET(_regs, _val) \ 1837 do { \ 1838 typeof(_val) _result = (_val); \ 1839 if ((_regs.trap & 0xfff0) == 0x3000) { \ 1840 /* \ 1841 * scv 0 system call uses -ve result \ 1842 * for error, so no need to adjust. \ 1843 */ \ 1844 SYSCALL_RET(_regs) = _result; \ 1845 } else { \ 1846 /* \ 1847 * A syscall error is signaled by the \ 1848 * CR0 SO bit and the code is stored as \ 1849 * a positive value. \ 1850 */ \ 1851 if (_result < 0) { \ 1852 SYSCALL_RET(_regs) = -_result; \ 1853 (_regs).ccr |= 0x10000000; \ 1854 } else { \ 1855 SYSCALL_RET(_regs) = _result; \ 1856 (_regs).ccr &= ~0x10000000; \ 1857 } \ 1858 } \ 1859 } while (0) 1860 # define SYSCALL_RET_SET_ON_PTRACE_EXIT 1861 #elif defined(__s390__) 1862 # define ARCH_REGS s390_regs 1863 # define SYSCALL_NUM(_regs) (_regs).gprs[2] 1864 # define SYSCALL_RET_SET(_regs, _val) \ 1865 TH_LOG("Can't modify syscall return on this architecture") 1866 #elif defined(__mips__) 1867 # include <asm/unistd_nr_n32.h> 1868 # include <asm/unistd_nr_n64.h> 1869 # include <asm/unistd_nr_o32.h> 1870 # define ARCH_REGS struct pt_regs 1871 # define SYSCALL_NUM(_regs) \ 1872 ({ \ 1873 typeof((_regs).regs[2]) _nr; \ 1874 if ((_regs).regs[2] == __NR_O32_Linux) \ 1875 _nr = (_regs).regs[4]; \ 1876 else \ 1877 _nr = (_regs).regs[2]; \ 1878 _nr; \ 1879 }) 1880 # define SYSCALL_NUM_SET(_regs, _nr) \ 1881 do { \ 1882 if ((_regs).regs[2] == __NR_O32_Linux) \ 1883 (_regs).regs[4] = _nr; \ 1884 else \ 1885 (_regs).regs[2] = _nr; \ 1886 } while (0) 1887 # define SYSCALL_RET_SET(_regs, _val) \ 1888 TH_LOG("Can't modify syscall return on this architecture") 1889 #elif defined(__xtensa__) 1890 # define ARCH_REGS struct user_pt_regs 1891 # define SYSCALL_NUM(_regs) (_regs).syscall 1892 /* 1893 * On xtensa syscall return value is in the register 1894 * a2 of the current window which is not fixed. 1895 */ 1896 #define SYSCALL_RET(_regs) (_regs).a[(_regs).windowbase * 4 + 2] 1897 #elif defined(__sh__) 1898 # define ARCH_REGS struct pt_regs 1899 # define SYSCALL_NUM(_regs) (_regs).regs[3] 1900 # define SYSCALL_RET(_regs) (_regs).regs[0] 1901 #elif defined(__mc68000__) 1902 # define ARCH_REGS struct user_regs_struct 1903 # define SYSCALL_NUM(_regs) (_regs).orig_d0 1904 # define SYSCALL_RET(_regs) (_regs).d0 1905 #else 1906 # error "Do not know how to find your architecture's registers and syscalls" 1907 #endif 1908 1909 /* 1910 * Most architectures can change the syscall by just updating the 1911 * associated register. This is the default if not defined above. 1912 */ 1913 #ifndef SYSCALL_NUM_SET 1914 # define SYSCALL_NUM_SET(_regs, _nr) \ 1915 do { \ 1916 SYSCALL_NUM(_regs) = (_nr); \ 1917 } while (0) 1918 #endif 1919 /* 1920 * Most architectures can change the syscall return value by just 1921 * writing to the SYSCALL_RET register. This is the default if not 1922 * defined above. If an architecture cannot set the return value 1923 * (for example when the syscall and return value register is 1924 * shared), report it with TH_LOG() in an arch-specific definition 1925 * of SYSCALL_RET_SET() above, and leave SYSCALL_RET undefined. 1926 */ 1927 #if !defined(SYSCALL_RET) && !defined(SYSCALL_RET_SET) 1928 # error "One of SYSCALL_RET or SYSCALL_RET_SET is needed for this arch" 1929 #endif 1930 #ifndef SYSCALL_RET_SET 1931 # define SYSCALL_RET_SET(_regs, _val) \ 1932 do { \ 1933 SYSCALL_RET(_regs) = (_val); \ 1934 } while (0) 1935 #endif 1936 1937 /* When the syscall return can't be changed, stub out the tests for it. */ 1938 #ifndef SYSCALL_RET 1939 # define EXPECT_SYSCALL_RETURN(val, action) EXPECT_EQ(-1, action) 1940 #else 1941 # define EXPECT_SYSCALL_RETURN(val, action) \ 1942 do { \ 1943 errno = 0; \ 1944 if (val < 0) { \ 1945 EXPECT_EQ(-1, action); \ 1946 EXPECT_EQ(-(val), errno); \ 1947 } else { \ 1948 EXPECT_EQ(val, action); \ 1949 } \ 1950 } while (0) 1951 #endif 1952 1953 /* 1954 * Some architectures (e.g. powerpc) can only set syscall 1955 * return values on syscall exit during ptrace. 1956 */ 1957 const bool ptrace_entry_set_syscall_nr = true; 1958 const bool ptrace_entry_set_syscall_ret = 1959 #ifndef SYSCALL_RET_SET_ON_PTRACE_EXIT 1960 true; 1961 #else 1962 false; 1963 #endif 1964 1965 /* 1966 * Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for 1967 * architectures without HAVE_ARCH_TRACEHOOK (e.g. User-mode Linux). 1968 */ 1969 #if defined(__x86_64__) || defined(__i386__) || defined(__mips__) || defined(__mc68000__) 1970 # define ARCH_GETREGS(_regs) ptrace(PTRACE_GETREGS, tracee, 0, &(_regs)) 1971 # define ARCH_SETREGS(_regs) ptrace(PTRACE_SETREGS, tracee, 0, &(_regs)) 1972 #else 1973 # define ARCH_GETREGS(_regs) ({ \ 1974 struct iovec __v; \ 1975 __v.iov_base = &(_regs); \ 1976 __v.iov_len = sizeof(_regs); \ 1977 ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &__v); \ 1978 }) 1979 # define ARCH_SETREGS(_regs) ({ \ 1980 struct iovec __v; \ 1981 __v.iov_base = &(_regs); \ 1982 __v.iov_len = sizeof(_regs); \ 1983 ptrace(PTRACE_SETREGSET, tracee, NT_PRSTATUS, &__v); \ 1984 }) 1985 #endif 1986 1987 /* Architecture-specific syscall fetching routine. */ 1988 int get_syscall(struct __test_metadata *_metadata, pid_t tracee) 1989 { 1990 ARCH_REGS regs; 1991 1992 EXPECT_EQ(0, ARCH_GETREGS(regs)) { 1993 return -1; 1994 } 1995 1996 return SYSCALL_NUM(regs); 1997 } 1998 1999 /* Architecture-specific syscall changing routine. */ 2000 void __change_syscall(struct __test_metadata *_metadata, 2001 pid_t tracee, long *syscall, long *ret) 2002 { 2003 ARCH_REGS orig, regs; 2004 2005 /* Do not get/set registers if we have nothing to do. */ 2006 if (!syscall && !ret) 2007 return; 2008 2009 EXPECT_EQ(0, ARCH_GETREGS(regs)) { 2010 return; 2011 } 2012 orig = regs; 2013 2014 if (syscall) 2015 SYSCALL_NUM_SET(regs, *syscall); 2016 2017 if (ret) 2018 SYSCALL_RET_SET(regs, *ret); 2019 2020 /* Flush any register changes made. */ 2021 if (memcmp(&orig, ®s, sizeof(orig)) != 0) 2022 EXPECT_EQ(0, ARCH_SETREGS(regs)); 2023 } 2024 2025 /* Change only syscall number. */ 2026 void change_syscall_nr(struct __test_metadata *_metadata, 2027 pid_t tracee, long syscall) 2028 { 2029 __change_syscall(_metadata, tracee, &syscall, NULL); 2030 } 2031 2032 /* Change syscall return value (and set syscall number to -1). */ 2033 void change_syscall_ret(struct __test_metadata *_metadata, 2034 pid_t tracee, long ret) 2035 { 2036 long syscall = -1; 2037 2038 __change_syscall(_metadata, tracee, &syscall, &ret); 2039 } 2040 2041 void tracer_seccomp(struct __test_metadata *_metadata, pid_t tracee, 2042 int status, void *args) 2043 { 2044 int ret; 2045 unsigned long msg; 2046 2047 EXPECT_EQ(PTRACE_EVENT_MASK(status), PTRACE_EVENT_SECCOMP) { 2048 TH_LOG("Unexpected ptrace event: %d", PTRACE_EVENT_MASK(status)); 2049 return; 2050 } 2051 2052 /* Make sure we got the right message. */ 2053 ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg); 2054 EXPECT_EQ(0, ret); 2055 2056 /* Validate and take action on expected syscalls. */ 2057 switch (msg) { 2058 case 0x1002: 2059 /* change getpid to getppid. */ 2060 EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee)); 2061 change_syscall_nr(_metadata, tracee, __NR_getppid); 2062 break; 2063 case 0x1003: 2064 /* skip gettid with valid return code. */ 2065 EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee)); 2066 change_syscall_ret(_metadata, tracee, 45000); 2067 break; 2068 case 0x1004: 2069 /* skip openat with error. */ 2070 EXPECT_EQ(__NR_openat, get_syscall(_metadata, tracee)); 2071 change_syscall_ret(_metadata, tracee, -ESRCH); 2072 break; 2073 case 0x1005: 2074 /* do nothing (allow getppid) */ 2075 EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee)); 2076 break; 2077 default: 2078 EXPECT_EQ(0, msg) { 2079 TH_LOG("Unknown PTRACE_GETEVENTMSG: 0x%lx", msg); 2080 kill(tracee, SIGKILL); 2081 } 2082 } 2083 2084 } 2085 2086 FIXTURE(TRACE_syscall) { 2087 struct sock_fprog prog; 2088 pid_t tracer, mytid, mypid, parent; 2089 long syscall_nr; 2090 }; 2091 2092 void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee, 2093 int status, void *args) 2094 { 2095 int ret; 2096 unsigned long msg; 2097 static bool entry; 2098 long syscall_nr_val, syscall_ret_val; 2099 long *syscall_nr = NULL, *syscall_ret = NULL; 2100 FIXTURE_DATA(TRACE_syscall) *self = args; 2101 2102 EXPECT_EQ(WSTOPSIG(status) & 0x80, 0x80) { 2103 TH_LOG("Unexpected WSTOPSIG: %d", WSTOPSIG(status)); 2104 return; 2105 } 2106 2107 /* 2108 * The traditional way to tell PTRACE_SYSCALL entry/exit 2109 * is by counting. 2110 */ 2111 entry = !entry; 2112 2113 /* Make sure we got an appropriate message. */ 2114 ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg); 2115 EXPECT_EQ(0, ret); 2116 EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY 2117 : PTRACE_EVENTMSG_SYSCALL_EXIT, msg); 2118 2119 /* 2120 * Some architectures only support setting return values during 2121 * syscall exit under ptrace, and on exit the syscall number may 2122 * no longer be available. Therefore, save the initial sycall 2123 * number here, so it can be examined during both entry and exit 2124 * phases. 2125 */ 2126 if (entry) 2127 self->syscall_nr = get_syscall(_metadata, tracee); 2128 2129 /* 2130 * Depending on the architecture's syscall setting abilities, we 2131 * pick which things to set during this phase (entry or exit). 2132 */ 2133 if (entry == ptrace_entry_set_syscall_nr) 2134 syscall_nr = &syscall_nr_val; 2135 if (entry == ptrace_entry_set_syscall_ret) 2136 syscall_ret = &syscall_ret_val; 2137 2138 /* Now handle the actual rewriting cases. */ 2139 switch (self->syscall_nr) { 2140 case __NR_getpid: 2141 syscall_nr_val = __NR_getppid; 2142 /* Never change syscall return for this case. */ 2143 syscall_ret = NULL; 2144 break; 2145 case __NR_gettid: 2146 syscall_nr_val = -1; 2147 syscall_ret_val = 45000; 2148 break; 2149 case __NR_openat: 2150 syscall_nr_val = -1; 2151 syscall_ret_val = -ESRCH; 2152 break; 2153 default: 2154 /* Unhandled, do nothing. */ 2155 return; 2156 } 2157 2158 __change_syscall(_metadata, tracee, syscall_nr, syscall_ret); 2159 } 2160 2161 FIXTURE_VARIANT(TRACE_syscall) { 2162 /* 2163 * All of the SECCOMP_RET_TRACE behaviors can be tested with either 2164 * SECCOMP_RET_TRACE+PTRACE_CONT or plain ptrace()+PTRACE_SYSCALL. 2165 * This indicates if we should use SECCOMP_RET_TRACE (false), or 2166 * ptrace (true). 2167 */ 2168 bool use_ptrace; 2169 }; 2170 2171 FIXTURE_VARIANT_ADD(TRACE_syscall, ptrace) { 2172 .use_ptrace = true, 2173 }; 2174 2175 FIXTURE_VARIANT_ADD(TRACE_syscall, seccomp) { 2176 .use_ptrace = false, 2177 }; 2178 2179 FIXTURE_SETUP(TRACE_syscall) 2180 { 2181 struct sock_filter filter[] = { 2182 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 2183 offsetof(struct seccomp_data, nr)), 2184 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), 2185 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002), 2186 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1), 2187 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003), 2188 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_openat, 0, 1), 2189 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004), 2190 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1), 2191 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1005), 2192 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 2193 }; 2194 struct sock_fprog prog = { 2195 .len = (unsigned short)ARRAY_SIZE(filter), 2196 .filter = filter, 2197 }; 2198 long ret; 2199 2200 /* Prepare some testable syscall results. */ 2201 self->mytid = syscall(__NR_gettid); 2202 ASSERT_GT(self->mytid, 0); 2203 ASSERT_NE(self->mytid, 1) { 2204 TH_LOG("Running this test as init is not supported. :)"); 2205 } 2206 2207 self->mypid = getpid(); 2208 ASSERT_GT(self->mypid, 0); 2209 ASSERT_EQ(self->mytid, self->mypid); 2210 2211 self->parent = getppid(); 2212 ASSERT_GT(self->parent, 0); 2213 ASSERT_NE(self->parent, self->mypid); 2214 2215 /* Launch tracer. */ 2216 self->tracer = setup_trace_fixture(_metadata, 2217 variant->use_ptrace ? tracer_ptrace 2218 : tracer_seccomp, 2219 self, variant->use_ptrace); 2220 2221 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 2222 ASSERT_EQ(0, ret); 2223 2224 /* Do not install seccomp rewrite filters, as we'll use ptrace instead. */ 2225 if (variant->use_ptrace) 2226 return; 2227 2228 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); 2229 ASSERT_EQ(0, ret); 2230 } 2231 2232 FIXTURE_TEARDOWN(TRACE_syscall) 2233 { 2234 teardown_trace_fixture(_metadata, self->tracer); 2235 } 2236 2237 TEST(negative_ENOSYS) 2238 { 2239 #if defined(__arm__) 2240 SKIP(return, "arm32 does not support calling syscall -1"); 2241 #endif 2242 /* 2243 * There should be no difference between an "internal" skip 2244 * and userspace asking for syscall "-1". 2245 */ 2246 errno = 0; 2247 EXPECT_EQ(-1, syscall(-1)); 2248 EXPECT_EQ(errno, ENOSYS); 2249 /* And no difference for "still not valid but not -1". */ 2250 errno = 0; 2251 EXPECT_EQ(-1, syscall(-101)); 2252 EXPECT_EQ(errno, ENOSYS); 2253 } 2254 2255 TEST_F(TRACE_syscall, negative_ENOSYS) 2256 { 2257 negative_ENOSYS(_metadata); 2258 } 2259 2260 TEST_F(TRACE_syscall, syscall_allowed) 2261 { 2262 /* getppid works as expected (no changes). */ 2263 EXPECT_EQ(self->parent, syscall(__NR_getppid)); 2264 EXPECT_NE(self->mypid, syscall(__NR_getppid)); 2265 } 2266 2267 TEST_F(TRACE_syscall, syscall_redirected) 2268 { 2269 /* getpid has been redirected to getppid as expected. */ 2270 EXPECT_EQ(self->parent, syscall(__NR_getpid)); 2271 EXPECT_NE(self->mypid, syscall(__NR_getpid)); 2272 } 2273 2274 TEST_F(TRACE_syscall, syscall_errno) 2275 { 2276 /* Tracer should skip the open syscall, resulting in ESRCH. */ 2277 EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat)); 2278 } 2279 2280 TEST_F(TRACE_syscall, syscall_faked) 2281 { 2282 /* Tracer skips the gettid syscall and store altered return value. */ 2283 EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid)); 2284 } 2285 2286 TEST_F_SIGNAL(TRACE_syscall, kill_immediate, SIGSYS) 2287 { 2288 struct sock_filter filter[] = { 2289 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 2290 offsetof(struct seccomp_data, nr)), 2291 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_mknodat, 0, 1), 2292 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_THREAD), 2293 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 2294 }; 2295 struct sock_fprog prog = { 2296 .len = (unsigned short)ARRAY_SIZE(filter), 2297 .filter = filter, 2298 }; 2299 long ret; 2300 2301 /* Install "kill on mknodat" filter. */ 2302 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); 2303 ASSERT_EQ(0, ret); 2304 2305 /* This should immediately die with SIGSYS, regardless of tracer. */ 2306 EXPECT_EQ(-1, syscall(__NR_mknodat, -1, NULL, 0, 0)); 2307 } 2308 2309 TEST_F(TRACE_syscall, skip_after) 2310 { 2311 struct sock_filter filter[] = { 2312 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 2313 offsetof(struct seccomp_data, nr)), 2314 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1), 2315 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EPERM), 2316 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 2317 }; 2318 struct sock_fprog prog = { 2319 .len = (unsigned short)ARRAY_SIZE(filter), 2320 .filter = filter, 2321 }; 2322 long ret; 2323 2324 /* Install additional "errno on getppid" filter. */ 2325 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); 2326 ASSERT_EQ(0, ret); 2327 2328 /* Tracer will redirect getpid to getppid, and we should see EPERM. */ 2329 errno = 0; 2330 EXPECT_EQ(-1, syscall(__NR_getpid)); 2331 EXPECT_EQ(EPERM, errno); 2332 } 2333 2334 TEST_F_SIGNAL(TRACE_syscall, kill_after, SIGSYS) 2335 { 2336 struct sock_filter filter[] = { 2337 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 2338 offsetof(struct seccomp_data, nr)), 2339 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1), 2340 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), 2341 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 2342 }; 2343 struct sock_fprog prog = { 2344 .len = (unsigned short)ARRAY_SIZE(filter), 2345 .filter = filter, 2346 }; 2347 long ret; 2348 2349 /* Install additional "death on getppid" filter. */ 2350 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); 2351 ASSERT_EQ(0, ret); 2352 2353 /* Tracer will redirect getpid to getppid, and we should die. */ 2354 EXPECT_NE(self->mypid, syscall(__NR_getpid)); 2355 } 2356 2357 TEST(seccomp_syscall) 2358 { 2359 struct sock_filter filter[] = { 2360 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 2361 }; 2362 struct sock_fprog prog = { 2363 .len = (unsigned short)ARRAY_SIZE(filter), 2364 .filter = filter, 2365 }; 2366 long ret; 2367 2368 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 2369 ASSERT_EQ(0, ret) { 2370 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 2371 } 2372 2373 /* Reject insane operation. */ 2374 ret = seccomp(-1, 0, &prog); 2375 ASSERT_NE(ENOSYS, errno) { 2376 TH_LOG("Kernel does not support seccomp syscall!"); 2377 } 2378 EXPECT_EQ(EINVAL, errno) { 2379 TH_LOG("Did not reject crazy op value!"); 2380 } 2381 2382 /* Reject strict with flags or pointer. */ 2383 ret = seccomp(SECCOMP_SET_MODE_STRICT, -1, NULL); 2384 EXPECT_EQ(EINVAL, errno) { 2385 TH_LOG("Did not reject mode strict with flags!"); 2386 } 2387 ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, &prog); 2388 EXPECT_EQ(EINVAL, errno) { 2389 TH_LOG("Did not reject mode strict with uargs!"); 2390 } 2391 2392 /* Reject insane args for filter. */ 2393 ret = seccomp(SECCOMP_SET_MODE_FILTER, -1, &prog); 2394 EXPECT_EQ(EINVAL, errno) { 2395 TH_LOG("Did not reject crazy filter flags!"); 2396 } 2397 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, NULL); 2398 EXPECT_EQ(EFAULT, errno) { 2399 TH_LOG("Did not reject NULL filter!"); 2400 } 2401 2402 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog); 2403 EXPECT_EQ(0, errno) { 2404 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER: %s", 2405 strerror(errno)); 2406 } 2407 } 2408 2409 TEST(seccomp_syscall_mode_lock) 2410 { 2411 struct sock_filter filter[] = { 2412 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 2413 }; 2414 struct sock_fprog prog = { 2415 .len = (unsigned short)ARRAY_SIZE(filter), 2416 .filter = filter, 2417 }; 2418 long ret; 2419 2420 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0); 2421 ASSERT_EQ(0, ret) { 2422 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 2423 } 2424 2425 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog); 2426 ASSERT_NE(ENOSYS, errno) { 2427 TH_LOG("Kernel does not support seccomp syscall!"); 2428 } 2429 EXPECT_EQ(0, ret) { 2430 TH_LOG("Could not install filter!"); 2431 } 2432 2433 /* Make sure neither entry point will switch to strict. */ 2434 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, 0, 0, 0); 2435 EXPECT_EQ(EINVAL, errno) { 2436 TH_LOG("Switched to mode strict!"); 2437 } 2438 2439 ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, NULL); 2440 EXPECT_EQ(EINVAL, errno) { 2441 TH_LOG("Switched to mode strict!"); 2442 } 2443 } 2444 2445 /* 2446 * Test detection of known and unknown filter flags. Userspace needs to be able 2447 * to check if a filter flag is supported by the current kernel and a good way 2448 * of doing that is by attempting to enter filter mode, with the flag bit in 2449 * question set, and a NULL pointer for the _args_ parameter. EFAULT indicates 2450 * that the flag is valid and EINVAL indicates that the flag is invalid. 2451 */ 2452 TEST(detect_seccomp_filter_flags) 2453 { 2454 unsigned int flags[] = { SECCOMP_FILTER_FLAG_TSYNC, 2455 SECCOMP_FILTER_FLAG_LOG, 2456 SECCOMP_FILTER_FLAG_SPEC_ALLOW, 2457 SECCOMP_FILTER_FLAG_NEW_LISTENER, 2458 SECCOMP_FILTER_FLAG_TSYNC_ESRCH }; 2459 unsigned int exclusive[] = { 2460 SECCOMP_FILTER_FLAG_TSYNC, 2461 SECCOMP_FILTER_FLAG_NEW_LISTENER }; 2462 unsigned int flag, all_flags, exclusive_mask; 2463 int i; 2464 long ret; 2465 2466 /* Test detection of individual known-good filter flags */ 2467 for (i = 0, all_flags = 0; i < ARRAY_SIZE(flags); i++) { 2468 int bits = 0; 2469 2470 flag = flags[i]; 2471 /* Make sure the flag is a single bit! */ 2472 while (flag) { 2473 if (flag & 0x1) 2474 bits ++; 2475 flag >>= 1; 2476 } 2477 ASSERT_EQ(1, bits); 2478 flag = flags[i]; 2479 2480 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); 2481 ASSERT_NE(ENOSYS, errno) { 2482 TH_LOG("Kernel does not support seccomp syscall!"); 2483 } 2484 EXPECT_EQ(-1, ret); 2485 EXPECT_EQ(EFAULT, errno) { 2486 TH_LOG("Failed to detect that a known-good filter flag (0x%X) is supported!", 2487 flag); 2488 } 2489 2490 all_flags |= flag; 2491 } 2492 2493 /* 2494 * Test detection of all known-good filter flags combined. But 2495 * for the exclusive flags we need to mask them out and try them 2496 * individually for the "all flags" testing. 2497 */ 2498 exclusive_mask = 0; 2499 for (i = 0; i < ARRAY_SIZE(exclusive); i++) 2500 exclusive_mask |= exclusive[i]; 2501 for (i = 0; i < ARRAY_SIZE(exclusive); i++) { 2502 flag = all_flags & ~exclusive_mask; 2503 flag |= exclusive[i]; 2504 2505 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); 2506 EXPECT_EQ(-1, ret); 2507 EXPECT_EQ(EFAULT, errno) { 2508 TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!", 2509 flag); 2510 } 2511 } 2512 2513 /* Test detection of an unknown filter flags, without exclusives. */ 2514 flag = -1; 2515 flag &= ~exclusive_mask; 2516 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); 2517 EXPECT_EQ(-1, ret); 2518 EXPECT_EQ(EINVAL, errno) { 2519 TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported!", 2520 flag); 2521 } 2522 2523 /* 2524 * Test detection of an unknown filter flag that may simply need to be 2525 * added to this test 2526 */ 2527 flag = flags[ARRAY_SIZE(flags) - 1] << 1; 2528 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); 2529 EXPECT_EQ(-1, ret); 2530 EXPECT_EQ(EINVAL, errno) { 2531 TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported! Does a new flag need to be added to this test?", 2532 flag); 2533 } 2534 } 2535 2536 TEST(TSYNC_first) 2537 { 2538 struct sock_filter filter[] = { 2539 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 2540 }; 2541 struct sock_fprog prog = { 2542 .len = (unsigned short)ARRAY_SIZE(filter), 2543 .filter = filter, 2544 }; 2545 long ret; 2546 2547 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0); 2548 ASSERT_EQ(0, ret) { 2549 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 2550 } 2551 2552 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, 2553 &prog); 2554 ASSERT_NE(ENOSYS, errno) { 2555 TH_LOG("Kernel does not support seccomp syscall!"); 2556 } 2557 EXPECT_EQ(0, ret) { 2558 TH_LOG("Could not install initial filter with TSYNC!"); 2559 } 2560 } 2561 2562 #define TSYNC_SIBLINGS 2 2563 struct tsync_sibling { 2564 pthread_t tid; 2565 pid_t system_tid; 2566 sem_t *started; 2567 pthread_cond_t *cond; 2568 pthread_mutex_t *mutex; 2569 int diverge; 2570 int num_waits; 2571 struct sock_fprog *prog; 2572 struct __test_metadata *metadata; 2573 }; 2574 2575 /* 2576 * To avoid joining joined threads (which is not allowed by Bionic), 2577 * make sure we both successfully join and clear the tid to skip a 2578 * later join attempt during fixture teardown. Any remaining threads 2579 * will be directly killed during teardown. 2580 */ 2581 #define PTHREAD_JOIN(tid, status) \ 2582 do { \ 2583 int _rc = pthread_join(tid, status); \ 2584 if (_rc) { \ 2585 TH_LOG("pthread_join of tid %u failed: %d\n", \ 2586 (unsigned int)tid, _rc); \ 2587 } else { \ 2588 tid = 0; \ 2589 } \ 2590 } while (0) 2591 2592 FIXTURE(TSYNC) { 2593 struct sock_fprog root_prog, apply_prog; 2594 struct tsync_sibling sibling[TSYNC_SIBLINGS]; 2595 sem_t started; 2596 pthread_cond_t cond; 2597 pthread_mutex_t mutex; 2598 int sibling_count; 2599 }; 2600 2601 FIXTURE_SETUP(TSYNC) 2602 { 2603 struct sock_filter root_filter[] = { 2604 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 2605 }; 2606 struct sock_filter apply_filter[] = { 2607 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 2608 offsetof(struct seccomp_data, nr)), 2609 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1), 2610 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), 2611 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 2612 }; 2613 2614 memset(&self->root_prog, 0, sizeof(self->root_prog)); 2615 memset(&self->apply_prog, 0, sizeof(self->apply_prog)); 2616 memset(&self->sibling, 0, sizeof(self->sibling)); 2617 self->root_prog.filter = malloc(sizeof(root_filter)); 2618 ASSERT_NE(NULL, self->root_prog.filter); 2619 memcpy(self->root_prog.filter, &root_filter, sizeof(root_filter)); 2620 self->root_prog.len = (unsigned short)ARRAY_SIZE(root_filter); 2621 2622 self->apply_prog.filter = malloc(sizeof(apply_filter)); 2623 ASSERT_NE(NULL, self->apply_prog.filter); 2624 memcpy(self->apply_prog.filter, &apply_filter, sizeof(apply_filter)); 2625 self->apply_prog.len = (unsigned short)ARRAY_SIZE(apply_filter); 2626 2627 self->sibling_count = 0; 2628 pthread_mutex_init(&self->mutex, NULL); 2629 pthread_cond_init(&self->cond, NULL); 2630 sem_init(&self->started, 0, 0); 2631 self->sibling[0].tid = 0; 2632 self->sibling[0].cond = &self->cond; 2633 self->sibling[0].started = &self->started; 2634 self->sibling[0].mutex = &self->mutex; 2635 self->sibling[0].diverge = 0; 2636 self->sibling[0].num_waits = 1; 2637 self->sibling[0].prog = &self->root_prog; 2638 self->sibling[0].metadata = _metadata; 2639 self->sibling[1].tid = 0; 2640 self->sibling[1].cond = &self->cond; 2641 self->sibling[1].started = &self->started; 2642 self->sibling[1].mutex = &self->mutex; 2643 self->sibling[1].diverge = 0; 2644 self->sibling[1].prog = &self->root_prog; 2645 self->sibling[1].num_waits = 1; 2646 self->sibling[1].metadata = _metadata; 2647 } 2648 2649 FIXTURE_TEARDOWN(TSYNC) 2650 { 2651 int sib = 0; 2652 2653 if (self->root_prog.filter) 2654 free(self->root_prog.filter); 2655 if (self->apply_prog.filter) 2656 free(self->apply_prog.filter); 2657 2658 for ( ; sib < self->sibling_count; ++sib) { 2659 struct tsync_sibling *s = &self->sibling[sib]; 2660 2661 if (!s->tid) 2662 continue; 2663 /* 2664 * If a thread is still running, it may be stuck, so hit 2665 * it over the head really hard. 2666 */ 2667 pthread_kill(s->tid, 9); 2668 } 2669 pthread_mutex_destroy(&self->mutex); 2670 pthread_cond_destroy(&self->cond); 2671 sem_destroy(&self->started); 2672 } 2673 2674 void *tsync_sibling(void *data) 2675 { 2676 long ret = 0; 2677 struct tsync_sibling *me = data; 2678 2679 me->system_tid = syscall(__NR_gettid); 2680 2681 pthread_mutex_lock(me->mutex); 2682 if (me->diverge) { 2683 /* Just re-apply the root prog to fork the tree */ 2684 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 2685 me->prog, 0, 0); 2686 } 2687 sem_post(me->started); 2688 /* Return outside of started so parent notices failures. */ 2689 if (ret) { 2690 pthread_mutex_unlock(me->mutex); 2691 return (void *)SIBLING_EXIT_FAILURE; 2692 } 2693 do { 2694 pthread_cond_wait(me->cond, me->mutex); 2695 me->num_waits = me->num_waits - 1; 2696 } while (me->num_waits); 2697 pthread_mutex_unlock(me->mutex); 2698 2699 ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0); 2700 if (!ret) 2701 return (void *)SIBLING_EXIT_NEWPRIVS; 2702 read(-1, NULL, 0); 2703 return (void *)SIBLING_EXIT_UNKILLED; 2704 } 2705 2706 void tsync_start_sibling(struct tsync_sibling *sibling) 2707 { 2708 pthread_create(&sibling->tid, NULL, tsync_sibling, (void *)sibling); 2709 } 2710 2711 TEST_F(TSYNC, siblings_fail_prctl) 2712 { 2713 long ret; 2714 void *status; 2715 struct sock_filter filter[] = { 2716 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 2717 offsetof(struct seccomp_data, nr)), 2718 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1), 2719 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EINVAL), 2720 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 2721 }; 2722 struct sock_fprog prog = { 2723 .len = (unsigned short)ARRAY_SIZE(filter), 2724 .filter = filter, 2725 }; 2726 2727 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { 2728 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 2729 } 2730 2731 /* Check prctl failure detection by requesting sib 0 diverge. */ 2732 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog); 2733 ASSERT_NE(ENOSYS, errno) { 2734 TH_LOG("Kernel does not support seccomp syscall!"); 2735 } 2736 ASSERT_EQ(0, ret) { 2737 TH_LOG("setting filter failed"); 2738 } 2739 2740 self->sibling[0].diverge = 1; 2741 tsync_start_sibling(&self->sibling[0]); 2742 tsync_start_sibling(&self->sibling[1]); 2743 2744 while (self->sibling_count < TSYNC_SIBLINGS) { 2745 sem_wait(&self->started); 2746 self->sibling_count++; 2747 } 2748 2749 /* Signal the threads to clean up*/ 2750 pthread_mutex_lock(&self->mutex); 2751 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { 2752 TH_LOG("cond broadcast non-zero"); 2753 } 2754 pthread_mutex_unlock(&self->mutex); 2755 2756 /* Ensure diverging sibling failed to call prctl. */ 2757 PTHREAD_JOIN(self->sibling[0].tid, &status); 2758 EXPECT_EQ(SIBLING_EXIT_FAILURE, (long)status); 2759 PTHREAD_JOIN(self->sibling[1].tid, &status); 2760 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); 2761 } 2762 2763 TEST_F(TSYNC, two_siblings_with_ancestor) 2764 { 2765 long ret; 2766 void *status; 2767 2768 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { 2769 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 2770 } 2771 2772 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog); 2773 ASSERT_NE(ENOSYS, errno) { 2774 TH_LOG("Kernel does not support seccomp syscall!"); 2775 } 2776 ASSERT_EQ(0, ret) { 2777 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!"); 2778 } 2779 tsync_start_sibling(&self->sibling[0]); 2780 tsync_start_sibling(&self->sibling[1]); 2781 2782 while (self->sibling_count < TSYNC_SIBLINGS) { 2783 sem_wait(&self->started); 2784 self->sibling_count++; 2785 } 2786 2787 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, 2788 &self->apply_prog); 2789 ASSERT_EQ(0, ret) { 2790 TH_LOG("Could install filter on all threads!"); 2791 } 2792 /* Tell the siblings to test the policy */ 2793 pthread_mutex_lock(&self->mutex); 2794 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { 2795 TH_LOG("cond broadcast non-zero"); 2796 } 2797 pthread_mutex_unlock(&self->mutex); 2798 /* Ensure they are both killed and don't exit cleanly. */ 2799 PTHREAD_JOIN(self->sibling[0].tid, &status); 2800 EXPECT_EQ(0x0, (long)status); 2801 PTHREAD_JOIN(self->sibling[1].tid, &status); 2802 EXPECT_EQ(0x0, (long)status); 2803 } 2804 2805 TEST_F(TSYNC, two_sibling_want_nnp) 2806 { 2807 void *status; 2808 2809 /* start siblings before any prctl() operations */ 2810 tsync_start_sibling(&self->sibling[0]); 2811 tsync_start_sibling(&self->sibling[1]); 2812 while (self->sibling_count < TSYNC_SIBLINGS) { 2813 sem_wait(&self->started); 2814 self->sibling_count++; 2815 } 2816 2817 /* Tell the siblings to test no policy */ 2818 pthread_mutex_lock(&self->mutex); 2819 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { 2820 TH_LOG("cond broadcast non-zero"); 2821 } 2822 pthread_mutex_unlock(&self->mutex); 2823 2824 /* Ensure they are both upset about lacking nnp. */ 2825 PTHREAD_JOIN(self->sibling[0].tid, &status); 2826 EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status); 2827 PTHREAD_JOIN(self->sibling[1].tid, &status); 2828 EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status); 2829 } 2830 2831 TEST_F(TSYNC, two_siblings_with_no_filter) 2832 { 2833 long ret; 2834 void *status; 2835 2836 /* start siblings before any prctl() operations */ 2837 tsync_start_sibling(&self->sibling[0]); 2838 tsync_start_sibling(&self->sibling[1]); 2839 while (self->sibling_count < TSYNC_SIBLINGS) { 2840 sem_wait(&self->started); 2841 self->sibling_count++; 2842 } 2843 2844 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { 2845 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 2846 } 2847 2848 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, 2849 &self->apply_prog); 2850 ASSERT_NE(ENOSYS, errno) { 2851 TH_LOG("Kernel does not support seccomp syscall!"); 2852 } 2853 ASSERT_EQ(0, ret) { 2854 TH_LOG("Could install filter on all threads!"); 2855 } 2856 2857 /* Tell the siblings to test the policy */ 2858 pthread_mutex_lock(&self->mutex); 2859 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { 2860 TH_LOG("cond broadcast non-zero"); 2861 } 2862 pthread_mutex_unlock(&self->mutex); 2863 2864 /* Ensure they are both killed and don't exit cleanly. */ 2865 PTHREAD_JOIN(self->sibling[0].tid, &status); 2866 EXPECT_EQ(0x0, (long)status); 2867 PTHREAD_JOIN(self->sibling[1].tid, &status); 2868 EXPECT_EQ(0x0, (long)status); 2869 } 2870 2871 TEST_F(TSYNC, two_siblings_with_one_divergence) 2872 { 2873 long ret; 2874 void *status; 2875 2876 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { 2877 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 2878 } 2879 2880 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog); 2881 ASSERT_NE(ENOSYS, errno) { 2882 TH_LOG("Kernel does not support seccomp syscall!"); 2883 } 2884 ASSERT_EQ(0, ret) { 2885 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!"); 2886 } 2887 self->sibling[0].diverge = 1; 2888 tsync_start_sibling(&self->sibling[0]); 2889 tsync_start_sibling(&self->sibling[1]); 2890 2891 while (self->sibling_count < TSYNC_SIBLINGS) { 2892 sem_wait(&self->started); 2893 self->sibling_count++; 2894 } 2895 2896 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, 2897 &self->apply_prog); 2898 ASSERT_EQ(self->sibling[0].system_tid, ret) { 2899 TH_LOG("Did not fail on diverged sibling."); 2900 } 2901 2902 /* Wake the threads */ 2903 pthread_mutex_lock(&self->mutex); 2904 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { 2905 TH_LOG("cond broadcast non-zero"); 2906 } 2907 pthread_mutex_unlock(&self->mutex); 2908 2909 /* Ensure they are both unkilled. */ 2910 PTHREAD_JOIN(self->sibling[0].tid, &status); 2911 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); 2912 PTHREAD_JOIN(self->sibling[1].tid, &status); 2913 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); 2914 } 2915 2916 TEST_F(TSYNC, two_siblings_with_one_divergence_no_tid_in_err) 2917 { 2918 long ret, flags; 2919 void *status; 2920 2921 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { 2922 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 2923 } 2924 2925 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog); 2926 ASSERT_NE(ENOSYS, errno) { 2927 TH_LOG("Kernel does not support seccomp syscall!"); 2928 } 2929 ASSERT_EQ(0, ret) { 2930 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!"); 2931 } 2932 self->sibling[0].diverge = 1; 2933 tsync_start_sibling(&self->sibling[0]); 2934 tsync_start_sibling(&self->sibling[1]); 2935 2936 while (self->sibling_count < TSYNC_SIBLINGS) { 2937 sem_wait(&self->started); 2938 self->sibling_count++; 2939 } 2940 2941 flags = SECCOMP_FILTER_FLAG_TSYNC | \ 2942 SECCOMP_FILTER_FLAG_TSYNC_ESRCH; 2943 ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &self->apply_prog); 2944 ASSERT_EQ(ESRCH, errno) { 2945 TH_LOG("Did not return ESRCH for diverged sibling."); 2946 } 2947 ASSERT_EQ(-1, ret) { 2948 TH_LOG("Did not fail on diverged sibling."); 2949 } 2950 2951 /* Wake the threads */ 2952 pthread_mutex_lock(&self->mutex); 2953 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { 2954 TH_LOG("cond broadcast non-zero"); 2955 } 2956 pthread_mutex_unlock(&self->mutex); 2957 2958 /* Ensure they are both unkilled. */ 2959 PTHREAD_JOIN(self->sibling[0].tid, &status); 2960 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); 2961 PTHREAD_JOIN(self->sibling[1].tid, &status); 2962 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); 2963 } 2964 2965 TEST_F(TSYNC, two_siblings_not_under_filter) 2966 { 2967 long ret, sib; 2968 void *status; 2969 struct timespec delay = { .tv_nsec = 100000000 }; 2970 2971 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { 2972 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 2973 } 2974 2975 /* 2976 * Sibling 0 will have its own seccomp policy 2977 * and Sibling 1 will not be under seccomp at 2978 * all. Sibling 1 will enter seccomp and 0 2979 * will cause failure. 2980 */ 2981 self->sibling[0].diverge = 1; 2982 tsync_start_sibling(&self->sibling[0]); 2983 tsync_start_sibling(&self->sibling[1]); 2984 2985 while (self->sibling_count < TSYNC_SIBLINGS) { 2986 sem_wait(&self->started); 2987 self->sibling_count++; 2988 } 2989 2990 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog); 2991 ASSERT_NE(ENOSYS, errno) { 2992 TH_LOG("Kernel does not support seccomp syscall!"); 2993 } 2994 ASSERT_EQ(0, ret) { 2995 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!"); 2996 } 2997 2998 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, 2999 &self->apply_prog); 3000 ASSERT_EQ(ret, self->sibling[0].system_tid) { 3001 TH_LOG("Did not fail on diverged sibling."); 3002 } 3003 sib = 1; 3004 if (ret == self->sibling[0].system_tid) 3005 sib = 0; 3006 3007 pthread_mutex_lock(&self->mutex); 3008 3009 /* Increment the other siblings num_waits so we can clean up 3010 * the one we just saw. 3011 */ 3012 self->sibling[!sib].num_waits += 1; 3013 3014 /* Signal the thread to clean up*/ 3015 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { 3016 TH_LOG("cond broadcast non-zero"); 3017 } 3018 pthread_mutex_unlock(&self->mutex); 3019 PTHREAD_JOIN(self->sibling[sib].tid, &status); 3020 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status); 3021 /* Poll for actual task death. pthread_join doesn't guarantee it. */ 3022 while (!kill(self->sibling[sib].system_tid, 0)) 3023 nanosleep(&delay, NULL); 3024 /* Switch to the remaining sibling */ 3025 sib = !sib; 3026 3027 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, 3028 &self->apply_prog); 3029 ASSERT_EQ(0, ret) { 3030 TH_LOG("Expected the remaining sibling to sync"); 3031 }; 3032 3033 pthread_mutex_lock(&self->mutex); 3034 3035 /* If remaining sibling didn't have a chance to wake up during 3036 * the first broadcast, manually reduce the num_waits now. 3037 */ 3038 if (self->sibling[sib].num_waits > 1) 3039 self->sibling[sib].num_waits = 1; 3040 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) { 3041 TH_LOG("cond broadcast non-zero"); 3042 } 3043 pthread_mutex_unlock(&self->mutex); 3044 PTHREAD_JOIN(self->sibling[sib].tid, &status); 3045 EXPECT_EQ(0, (long)status); 3046 /* Poll for actual task death. pthread_join doesn't guarantee it. */ 3047 while (!kill(self->sibling[sib].system_tid, 0)) 3048 nanosleep(&delay, NULL); 3049 3050 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, 3051 &self->apply_prog); 3052 ASSERT_EQ(0, ret); /* just us chickens */ 3053 } 3054 3055 /* Make sure restarted syscalls are seen directly as "restart_syscall". */ 3056 TEST(syscall_restart) 3057 { 3058 long ret; 3059 unsigned long msg; 3060 pid_t child_pid; 3061 int pipefd[2]; 3062 int status; 3063 siginfo_t info = { }; 3064 struct sock_filter filter[] = { 3065 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 3066 offsetof(struct seccomp_data, nr)), 3067 3068 #ifdef __NR_sigreturn 3069 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_sigreturn, 7, 0), 3070 #endif 3071 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 6, 0), 3072 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_exit, 5, 0), 3073 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_rt_sigreturn, 4, 0), 3074 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_nanosleep, 5, 0), 3075 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_clock_nanosleep, 4, 0), 3076 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_restart_syscall, 4, 0), 3077 3078 /* Allow __NR_write for easy logging. */ 3079 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_write, 0, 1), 3080 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 3081 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), 3082 /* The nanosleep jump target. */ 3083 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x100), 3084 /* The restart_syscall jump target. */ 3085 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x200), 3086 }; 3087 struct sock_fprog prog = { 3088 .len = (unsigned short)ARRAY_SIZE(filter), 3089 .filter = filter, 3090 }; 3091 #if defined(__arm__) 3092 struct utsname utsbuf; 3093 #endif 3094 3095 ASSERT_EQ(0, pipe(pipefd)); 3096 3097 child_pid = fork(); 3098 ASSERT_LE(0, child_pid); 3099 if (child_pid == 0) { 3100 /* Child uses EXPECT not ASSERT to deliver status correctly. */ 3101 char buf = ' '; 3102 struct timespec timeout = { }; 3103 3104 /* Attach parent as tracer and stop. */ 3105 EXPECT_EQ(0, ptrace(PTRACE_TRACEME)); 3106 EXPECT_EQ(0, raise(SIGSTOP)); 3107 3108 EXPECT_EQ(0, close(pipefd[1])); 3109 3110 EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { 3111 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 3112 } 3113 3114 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0); 3115 EXPECT_EQ(0, ret) { 3116 TH_LOG("Failed to install filter!"); 3117 } 3118 3119 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) { 3120 TH_LOG("Failed to read() sync from parent"); 3121 } 3122 EXPECT_EQ('.', buf) { 3123 TH_LOG("Failed to get sync data from read()"); 3124 } 3125 3126 /* Start nanosleep to be interrupted. */ 3127 timeout.tv_sec = 1; 3128 errno = 0; 3129 EXPECT_EQ(0, nanosleep(&timeout, NULL)) { 3130 TH_LOG("Call to nanosleep() failed (errno %d: %s)", 3131 errno, strerror(errno)); 3132 } 3133 3134 /* Read final sync from parent. */ 3135 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) { 3136 TH_LOG("Failed final read() from parent"); 3137 } 3138 EXPECT_EQ('!', buf) { 3139 TH_LOG("Failed to get final data from read()"); 3140 } 3141 3142 /* Directly report the status of our test harness results. */ 3143 syscall(__NR_exit, _metadata->exit_code); 3144 } 3145 EXPECT_EQ(0, close(pipefd[0])); 3146 3147 /* Attach to child, setup options, and release. */ 3148 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); 3149 ASSERT_EQ(true, WIFSTOPPED(status)); 3150 ASSERT_EQ(0, ptrace(PTRACE_SETOPTIONS, child_pid, NULL, 3151 PTRACE_O_TRACESECCOMP)); 3152 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); 3153 ASSERT_EQ(1, write(pipefd[1], ".", 1)); 3154 3155 /* Wait for nanosleep() to start. */ 3156 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); 3157 ASSERT_EQ(true, WIFSTOPPED(status)); 3158 ASSERT_EQ(SIGTRAP, WSTOPSIG(status)); 3159 ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16)); 3160 ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg)); 3161 ASSERT_EQ(0x100, msg); 3162 ret = get_syscall(_metadata, child_pid); 3163 EXPECT_TRUE(ret == __NR_nanosleep || ret == __NR_clock_nanosleep); 3164 3165 /* Might as well check siginfo for sanity while we're here. */ 3166 ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info)); 3167 ASSERT_EQ(SIGTRAP, info.si_signo); 3168 ASSERT_EQ(SIGTRAP | (PTRACE_EVENT_SECCOMP << 8), info.si_code); 3169 EXPECT_EQ(0, info.si_errno); 3170 EXPECT_EQ(getuid(), info.si_uid); 3171 /* Verify signal delivery came from child (seccomp-triggered). */ 3172 EXPECT_EQ(child_pid, info.si_pid); 3173 3174 /* Interrupt nanosleep with SIGSTOP (which we'll need to handle). */ 3175 ASSERT_EQ(0, kill(child_pid, SIGSTOP)); 3176 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); 3177 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); 3178 ASSERT_EQ(true, WIFSTOPPED(status)); 3179 ASSERT_EQ(SIGSTOP, WSTOPSIG(status)); 3180 ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info)); 3181 /* 3182 * There is no siginfo on SIGSTOP any more, so we can't verify 3183 * signal delivery came from parent now (getpid() == info.si_pid). 3184 * https://lkml.kernel.org/r/CAGXu5jJaZAOzP1qFz66tYrtbuywqb+UN2SOA1VLHpCCOiYvYeg@mail.gmail.com 3185 * At least verify the SIGSTOP via PTRACE_GETSIGINFO. 3186 */ 3187 EXPECT_EQ(SIGSTOP, info.si_signo); 3188 3189 /* Restart nanosleep with SIGCONT, which triggers restart_syscall. */ 3190 ASSERT_EQ(0, kill(child_pid, SIGCONT)); 3191 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); 3192 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); 3193 ASSERT_EQ(true, WIFSTOPPED(status)); 3194 ASSERT_EQ(SIGCONT, WSTOPSIG(status)); 3195 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); 3196 3197 /* Wait for restart_syscall() to start. */ 3198 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); 3199 ASSERT_EQ(true, WIFSTOPPED(status)); 3200 ASSERT_EQ(SIGTRAP, WSTOPSIG(status)); 3201 ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16)); 3202 ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg)); 3203 3204 ASSERT_EQ(0x200, msg); 3205 ret = get_syscall(_metadata, child_pid); 3206 #if defined(__arm__) 3207 /* 3208 * - native ARM registers do NOT expose true syscall. 3209 * - compat ARM registers on ARM64 DO expose true syscall. 3210 * - values of utsbuf.machine include 'armv8l' or 'armb8b' 3211 * for ARM64 running in compat mode. 3212 */ 3213 ASSERT_EQ(0, uname(&utsbuf)); 3214 if ((strncmp(utsbuf.machine, "arm", 3) == 0) && 3215 (strncmp(utsbuf.machine, "armv8l", 6) != 0) && 3216 (strncmp(utsbuf.machine, "armv8b", 6) != 0)) { 3217 EXPECT_EQ(__NR_nanosleep, ret); 3218 } else 3219 #endif 3220 { 3221 EXPECT_EQ(__NR_restart_syscall, ret); 3222 } 3223 3224 /* Write again to end test. */ 3225 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0)); 3226 ASSERT_EQ(1, write(pipefd[1], "!", 1)); 3227 EXPECT_EQ(0, close(pipefd[1])); 3228 3229 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0)); 3230 if (WIFSIGNALED(status) || WEXITSTATUS(status)) 3231 _metadata->exit_code = KSFT_FAIL; 3232 } 3233 3234 TEST_SIGNAL(filter_flag_log, SIGSYS) 3235 { 3236 struct sock_filter allow_filter[] = { 3237 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 3238 }; 3239 struct sock_filter kill_filter[] = { 3240 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 3241 offsetof(struct seccomp_data, nr)), 3242 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1), 3243 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), 3244 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 3245 }; 3246 struct sock_fprog allow_prog = { 3247 .len = (unsigned short)ARRAY_SIZE(allow_filter), 3248 .filter = allow_filter, 3249 }; 3250 struct sock_fprog kill_prog = { 3251 .len = (unsigned short)ARRAY_SIZE(kill_filter), 3252 .filter = kill_filter, 3253 }; 3254 long ret; 3255 pid_t parent = getppid(); 3256 3257 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 3258 ASSERT_EQ(0, ret); 3259 3260 /* Verify that the FILTER_FLAG_LOG flag isn't accepted in strict mode */ 3261 ret = seccomp(SECCOMP_SET_MODE_STRICT, SECCOMP_FILTER_FLAG_LOG, 3262 &allow_prog); 3263 ASSERT_NE(ENOSYS, errno) { 3264 TH_LOG("Kernel does not support seccomp syscall!"); 3265 } 3266 EXPECT_NE(0, ret) { 3267 TH_LOG("Kernel accepted FILTER_FLAG_LOG flag in strict mode!"); 3268 } 3269 EXPECT_EQ(EINVAL, errno) { 3270 TH_LOG("Kernel returned unexpected errno for FILTER_FLAG_LOG flag in strict mode!"); 3271 } 3272 3273 /* Verify that a simple, permissive filter can be added with no flags */ 3274 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &allow_prog); 3275 EXPECT_EQ(0, ret); 3276 3277 /* See if the same filter can be added with the FILTER_FLAG_LOG flag */ 3278 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG, 3279 &allow_prog); 3280 ASSERT_NE(EINVAL, errno) { 3281 TH_LOG("Kernel does not support the FILTER_FLAG_LOG flag!"); 3282 } 3283 EXPECT_EQ(0, ret); 3284 3285 /* Ensure that the kill filter works with the FILTER_FLAG_LOG flag */ 3286 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG, 3287 &kill_prog); 3288 EXPECT_EQ(0, ret); 3289 3290 EXPECT_EQ(parent, syscall(__NR_getppid)); 3291 /* getpid() should never return. */ 3292 EXPECT_EQ(0, syscall(__NR_getpid)); 3293 } 3294 3295 TEST(get_action_avail) 3296 { 3297 __u32 actions[] = { SECCOMP_RET_KILL_THREAD, SECCOMP_RET_TRAP, 3298 SECCOMP_RET_ERRNO, SECCOMP_RET_TRACE, 3299 SECCOMP_RET_LOG, SECCOMP_RET_ALLOW }; 3300 __u32 unknown_action = 0x10000000U; 3301 int i; 3302 long ret; 3303 3304 ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[0]); 3305 ASSERT_NE(ENOSYS, errno) { 3306 TH_LOG("Kernel does not support seccomp syscall!"); 3307 } 3308 ASSERT_NE(EINVAL, errno) { 3309 TH_LOG("Kernel does not support SECCOMP_GET_ACTION_AVAIL operation!"); 3310 } 3311 EXPECT_EQ(ret, 0); 3312 3313 for (i = 0; i < ARRAY_SIZE(actions); i++) { 3314 ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[i]); 3315 EXPECT_EQ(ret, 0) { 3316 TH_LOG("Expected action (0x%X) not available!", 3317 actions[i]); 3318 } 3319 } 3320 3321 /* Check that an unknown action is handled properly (EOPNOTSUPP) */ 3322 ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &unknown_action); 3323 EXPECT_EQ(ret, -1); 3324 EXPECT_EQ(errno, EOPNOTSUPP); 3325 } 3326 3327 TEST(get_metadata) 3328 { 3329 pid_t pid; 3330 int pipefd[2]; 3331 char buf; 3332 struct seccomp_metadata md; 3333 long ret; 3334 3335 /* Only real root can get metadata. */ 3336 if (geteuid()) { 3337 SKIP(return, "get_metadata requires real root"); 3338 return; 3339 } 3340 3341 ASSERT_EQ(0, pipe(pipefd)); 3342 3343 pid = fork(); 3344 ASSERT_GE(pid, 0); 3345 if (pid == 0) { 3346 struct sock_filter filter[] = { 3347 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 3348 }; 3349 struct sock_fprog prog = { 3350 .len = (unsigned short)ARRAY_SIZE(filter), 3351 .filter = filter, 3352 }; 3353 3354 /* one with log, one without */ 3355 EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 3356 SECCOMP_FILTER_FLAG_LOG, &prog)); 3357 EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog)); 3358 3359 EXPECT_EQ(0, close(pipefd[0])); 3360 ASSERT_EQ(1, write(pipefd[1], "1", 1)); 3361 ASSERT_EQ(0, close(pipefd[1])); 3362 3363 while (1) 3364 sleep(100); 3365 } 3366 3367 ASSERT_EQ(0, close(pipefd[1])); 3368 ASSERT_EQ(1, read(pipefd[0], &buf, 1)); 3369 3370 ASSERT_EQ(0, ptrace(PTRACE_ATTACH, pid)); 3371 ASSERT_EQ(pid, waitpid(pid, NULL, 0)); 3372 3373 /* Past here must not use ASSERT or child process is never killed. */ 3374 3375 md.filter_off = 0; 3376 errno = 0; 3377 ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md); 3378 EXPECT_EQ(sizeof(md), ret) { 3379 if (errno == EINVAL) 3380 SKIP(goto skip, "Kernel does not support PTRACE_SECCOMP_GET_METADATA (missing CONFIG_CHECKPOINT_RESTORE?)"); 3381 } 3382 3383 EXPECT_EQ(md.flags, SECCOMP_FILTER_FLAG_LOG); 3384 EXPECT_EQ(md.filter_off, 0); 3385 3386 md.filter_off = 1; 3387 ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md); 3388 EXPECT_EQ(sizeof(md), ret); 3389 EXPECT_EQ(md.flags, 0); 3390 EXPECT_EQ(md.filter_off, 1); 3391 3392 skip: 3393 ASSERT_EQ(0, kill(pid, SIGKILL)); 3394 } 3395 3396 static int user_notif_syscall(int nr, unsigned int flags) 3397 { 3398 struct sock_filter filter[] = { 3399 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 3400 offsetof(struct seccomp_data, nr)), 3401 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, nr, 0, 1), 3402 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_USER_NOTIF), 3403 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 3404 }; 3405 3406 struct sock_fprog prog = { 3407 .len = (unsigned short)ARRAY_SIZE(filter), 3408 .filter = filter, 3409 }; 3410 3411 return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog); 3412 } 3413 3414 #define USER_NOTIF_MAGIC INT_MAX 3415 TEST(user_notification_basic) 3416 { 3417 pid_t pid; 3418 long ret; 3419 int status, listener; 3420 struct seccomp_notif req = {}; 3421 struct seccomp_notif_resp resp = {}; 3422 struct pollfd pollfd; 3423 3424 struct sock_filter filter[] = { 3425 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 3426 }; 3427 struct sock_fprog prog = { 3428 .len = (unsigned short)ARRAY_SIZE(filter), 3429 .filter = filter, 3430 }; 3431 3432 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 3433 ASSERT_EQ(0, ret) { 3434 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 3435 } 3436 3437 pid = fork(); 3438 ASSERT_GE(pid, 0); 3439 3440 /* Check that we get -ENOSYS with no listener attached */ 3441 if (pid == 0) { 3442 if (user_notif_syscall(__NR_getppid, 0) < 0) 3443 exit(1); 3444 ret = syscall(__NR_getppid); 3445 exit(ret >= 0 || errno != ENOSYS); 3446 } 3447 3448 EXPECT_EQ(waitpid(pid, &status, 0), pid); 3449 EXPECT_EQ(true, WIFEXITED(status)); 3450 EXPECT_EQ(0, WEXITSTATUS(status)); 3451 3452 /* Add some no-op filters for grins. */ 3453 EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0); 3454 EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0); 3455 EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0); 3456 EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0); 3457 3458 /* Check that the basic notification machinery works */ 3459 listener = user_notif_syscall(__NR_getppid, 3460 SECCOMP_FILTER_FLAG_NEW_LISTENER); 3461 ASSERT_GE(listener, 0); 3462 3463 /* Installing a second listener in the chain should EBUSY */ 3464 EXPECT_EQ(user_notif_syscall(__NR_getppid, 3465 SECCOMP_FILTER_FLAG_NEW_LISTENER), 3466 -1); 3467 EXPECT_EQ(errno, EBUSY); 3468 3469 pid = fork(); 3470 ASSERT_GE(pid, 0); 3471 3472 if (pid == 0) { 3473 ret = syscall(__NR_getppid); 3474 exit(ret != USER_NOTIF_MAGIC); 3475 } 3476 3477 pollfd.fd = listener; 3478 pollfd.events = POLLIN | POLLOUT; 3479 3480 EXPECT_GT(poll(&pollfd, 1, -1), 0); 3481 EXPECT_EQ(pollfd.revents, POLLIN); 3482 3483 /* Test that we can't pass garbage to the kernel. */ 3484 memset(&req, 0, sizeof(req)); 3485 req.pid = -1; 3486 errno = 0; 3487 ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req); 3488 EXPECT_EQ(-1, ret); 3489 EXPECT_EQ(EINVAL, errno); 3490 3491 if (ret) { 3492 req.pid = 0; 3493 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 3494 } 3495 3496 pollfd.fd = listener; 3497 pollfd.events = POLLIN | POLLOUT; 3498 3499 EXPECT_GT(poll(&pollfd, 1, -1), 0); 3500 EXPECT_EQ(pollfd.revents, POLLOUT); 3501 3502 EXPECT_EQ(req.data.nr, __NR_getppid); 3503 3504 resp.id = req.id; 3505 resp.error = 0; 3506 resp.val = USER_NOTIF_MAGIC; 3507 3508 /* check that we make sure flags == 0 */ 3509 resp.flags = 1; 3510 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1); 3511 EXPECT_EQ(errno, EINVAL); 3512 3513 resp.flags = 0; 3514 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 3515 3516 EXPECT_EQ(waitpid(pid, &status, 0), pid); 3517 EXPECT_EQ(true, WIFEXITED(status)); 3518 EXPECT_EQ(0, WEXITSTATUS(status)); 3519 } 3520 3521 TEST(user_notification_with_tsync) 3522 { 3523 int ret; 3524 unsigned int flags; 3525 3526 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 3527 ASSERT_EQ(0, ret) { 3528 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 3529 } 3530 3531 /* these were exclusive */ 3532 flags = SECCOMP_FILTER_FLAG_NEW_LISTENER | 3533 SECCOMP_FILTER_FLAG_TSYNC; 3534 ASSERT_EQ(-1, user_notif_syscall(__NR_getppid, flags)); 3535 ASSERT_EQ(EINVAL, errno); 3536 3537 /* but now they're not */ 3538 flags |= SECCOMP_FILTER_FLAG_TSYNC_ESRCH; 3539 ret = user_notif_syscall(__NR_getppid, flags); 3540 close(ret); 3541 ASSERT_LE(0, ret); 3542 } 3543 3544 TEST(user_notification_kill_in_middle) 3545 { 3546 pid_t pid; 3547 long ret; 3548 int listener; 3549 struct seccomp_notif req = {}; 3550 struct seccomp_notif_resp resp = {}; 3551 3552 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 3553 ASSERT_EQ(0, ret) { 3554 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 3555 } 3556 3557 listener = user_notif_syscall(__NR_getppid, 3558 SECCOMP_FILTER_FLAG_NEW_LISTENER); 3559 ASSERT_GE(listener, 0); 3560 3561 /* 3562 * Check that nothing bad happens when we kill the task in the middle 3563 * of a syscall. 3564 */ 3565 pid = fork(); 3566 ASSERT_GE(pid, 0); 3567 3568 if (pid == 0) { 3569 ret = syscall(__NR_getppid); 3570 exit(ret != USER_NOTIF_MAGIC); 3571 } 3572 3573 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 3574 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id), 0); 3575 3576 EXPECT_EQ(kill(pid, SIGKILL), 0); 3577 EXPECT_EQ(waitpid(pid, NULL, 0), pid); 3578 3579 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id), -1); 3580 3581 resp.id = req.id; 3582 ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp); 3583 EXPECT_EQ(ret, -1); 3584 EXPECT_EQ(errno, ENOENT); 3585 } 3586 3587 static int handled = -1; 3588 3589 static void signal_handler(int signal) 3590 { 3591 if (write(handled, "c", 1) != 1) 3592 perror("write from signal"); 3593 } 3594 3595 static void signal_handler_nop(int signal) 3596 { 3597 } 3598 3599 TEST(user_notification_signal) 3600 { 3601 pid_t pid; 3602 long ret; 3603 int status, listener, sk_pair[2]; 3604 struct seccomp_notif req = {}; 3605 struct seccomp_notif_resp resp = {}; 3606 char c; 3607 3608 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 3609 ASSERT_EQ(0, ret) { 3610 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 3611 } 3612 3613 ASSERT_EQ(socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair), 0); 3614 3615 listener = user_notif_syscall(__NR_gettid, 3616 SECCOMP_FILTER_FLAG_NEW_LISTENER); 3617 ASSERT_GE(listener, 0); 3618 3619 pid = fork(); 3620 ASSERT_GE(pid, 0); 3621 3622 if (pid == 0) { 3623 close(sk_pair[0]); 3624 handled = sk_pair[1]; 3625 if (signal(SIGUSR1, signal_handler) == SIG_ERR) { 3626 perror("signal"); 3627 exit(1); 3628 } 3629 /* 3630 * ERESTARTSYS behavior is a bit hard to test, because we need 3631 * to rely on a signal that has not yet been handled. Let's at 3632 * least check that the error code gets propagated through, and 3633 * hope that it doesn't break when there is actually a signal :) 3634 */ 3635 ret = syscall(__NR_gettid); 3636 exit(!(ret == -1 && errno == 512)); 3637 } 3638 3639 close(sk_pair[1]); 3640 3641 memset(&req, 0, sizeof(req)); 3642 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 3643 3644 EXPECT_EQ(kill(pid, SIGUSR1), 0); 3645 3646 /* 3647 * Make sure the signal really is delivered, which means we're not 3648 * stuck in the user notification code any more and the notification 3649 * should be dead. 3650 */ 3651 EXPECT_EQ(read(sk_pair[0], &c, 1), 1); 3652 3653 resp.id = req.id; 3654 resp.error = -EPERM; 3655 resp.val = 0; 3656 3657 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1); 3658 EXPECT_EQ(errno, ENOENT); 3659 3660 memset(&req, 0, sizeof(req)); 3661 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 3662 3663 resp.id = req.id; 3664 resp.error = -512; /* -ERESTARTSYS */ 3665 resp.val = 0; 3666 3667 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 3668 3669 EXPECT_EQ(waitpid(pid, &status, 0), pid); 3670 EXPECT_EQ(true, WIFEXITED(status)); 3671 EXPECT_EQ(0, WEXITSTATUS(status)); 3672 } 3673 3674 TEST(user_notification_closed_listener) 3675 { 3676 pid_t pid; 3677 long ret; 3678 int status, listener; 3679 3680 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 3681 ASSERT_EQ(0, ret) { 3682 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 3683 } 3684 3685 listener = user_notif_syscall(__NR_getppid, 3686 SECCOMP_FILTER_FLAG_NEW_LISTENER); 3687 ASSERT_GE(listener, 0); 3688 3689 /* 3690 * Check that we get an ENOSYS when the listener is closed. 3691 */ 3692 pid = fork(); 3693 ASSERT_GE(pid, 0); 3694 if (pid == 0) { 3695 close(listener); 3696 ret = syscall(__NR_getppid); 3697 exit(ret != -1 && errno != ENOSYS); 3698 } 3699 3700 close(listener); 3701 3702 EXPECT_EQ(waitpid(pid, &status, 0), pid); 3703 EXPECT_EQ(true, WIFEXITED(status)); 3704 EXPECT_EQ(0, WEXITSTATUS(status)); 3705 } 3706 3707 /* 3708 * Check that a pid in a child namespace still shows up as valid in ours. 3709 */ 3710 TEST(user_notification_child_pid_ns) 3711 { 3712 pid_t pid; 3713 int status, listener; 3714 struct seccomp_notif req = {}; 3715 struct seccomp_notif_resp resp = {}; 3716 3717 ASSERT_EQ(unshare(CLONE_NEWUSER | CLONE_NEWPID), 0) { 3718 if (errno == EINVAL) 3719 SKIP(return, "kernel missing CLONE_NEWUSER support"); 3720 }; 3721 3722 listener = user_notif_syscall(__NR_getppid, 3723 SECCOMP_FILTER_FLAG_NEW_LISTENER); 3724 ASSERT_GE(listener, 0); 3725 3726 pid = fork(); 3727 ASSERT_GE(pid, 0); 3728 3729 if (pid == 0) 3730 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC); 3731 3732 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 3733 EXPECT_EQ(req.pid, pid); 3734 3735 resp.id = req.id; 3736 resp.error = 0; 3737 resp.val = USER_NOTIF_MAGIC; 3738 3739 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 3740 3741 EXPECT_EQ(waitpid(pid, &status, 0), pid); 3742 EXPECT_EQ(true, WIFEXITED(status)); 3743 EXPECT_EQ(0, WEXITSTATUS(status)); 3744 close(listener); 3745 } 3746 3747 /* 3748 * Check that a pid in a sibling (i.e. unrelated) namespace shows up as 0, i.e. 3749 * invalid. 3750 */ 3751 TEST(user_notification_sibling_pid_ns) 3752 { 3753 pid_t pid, pid2; 3754 int status, listener; 3755 struct seccomp_notif req = {}; 3756 struct seccomp_notif_resp resp = {}; 3757 3758 ASSERT_EQ(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0) { 3759 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 3760 } 3761 3762 listener = user_notif_syscall(__NR_getppid, 3763 SECCOMP_FILTER_FLAG_NEW_LISTENER); 3764 ASSERT_GE(listener, 0); 3765 3766 pid = fork(); 3767 ASSERT_GE(pid, 0); 3768 3769 if (pid == 0) { 3770 ASSERT_EQ(unshare(CLONE_NEWPID), 0) { 3771 if (errno == EPERM) 3772 SKIP(return, "CLONE_NEWPID requires CAP_SYS_ADMIN"); 3773 else if (errno == EINVAL) 3774 SKIP(return, "CLONE_NEWPID is invalid (missing CONFIG_PID_NS?)"); 3775 } 3776 3777 pid2 = fork(); 3778 ASSERT_GE(pid2, 0); 3779 3780 if (pid2 == 0) 3781 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC); 3782 3783 EXPECT_EQ(waitpid(pid2, &status, 0), pid2); 3784 EXPECT_EQ(true, WIFEXITED(status)); 3785 EXPECT_EQ(0, WEXITSTATUS(status)); 3786 exit(WEXITSTATUS(status)); 3787 } 3788 3789 /* Create the sibling ns, and sibling in it. */ 3790 ASSERT_EQ(unshare(CLONE_NEWPID), 0) { 3791 if (errno == EPERM) 3792 SKIP(return, "CLONE_NEWPID requires CAP_SYS_ADMIN"); 3793 else if (errno == EINVAL) 3794 SKIP(return, "CLONE_NEWPID is invalid (missing CONFIG_PID_NS?)"); 3795 } 3796 ASSERT_EQ(errno, 0); 3797 3798 pid2 = fork(); 3799 ASSERT_GE(pid2, 0); 3800 3801 if (pid2 == 0) { 3802 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 3803 /* 3804 * The pid should be 0, i.e. the task is in some namespace that 3805 * we can't "see". 3806 */ 3807 EXPECT_EQ(req.pid, 0); 3808 3809 resp.id = req.id; 3810 resp.error = 0; 3811 resp.val = USER_NOTIF_MAGIC; 3812 3813 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 3814 exit(0); 3815 } 3816 3817 close(listener); 3818 3819 EXPECT_EQ(waitpid(pid, &status, 0), pid); 3820 EXPECT_EQ(true, WIFEXITED(status)); 3821 EXPECT_EQ(0, WEXITSTATUS(status)); 3822 3823 EXPECT_EQ(waitpid(pid2, &status, 0), pid2); 3824 EXPECT_EQ(true, WIFEXITED(status)); 3825 EXPECT_EQ(0, WEXITSTATUS(status)); 3826 } 3827 3828 TEST(user_notification_fault_recv) 3829 { 3830 pid_t pid; 3831 int status, listener; 3832 struct seccomp_notif req = {}; 3833 struct seccomp_notif_resp resp = {}; 3834 3835 ASSERT_EQ(unshare(CLONE_NEWUSER), 0) { 3836 if (errno == EINVAL) 3837 SKIP(return, "kernel missing CLONE_NEWUSER support"); 3838 } 3839 3840 listener = user_notif_syscall(__NR_getppid, 3841 SECCOMP_FILTER_FLAG_NEW_LISTENER); 3842 ASSERT_GE(listener, 0); 3843 3844 pid = fork(); 3845 ASSERT_GE(pid, 0); 3846 3847 if (pid == 0) 3848 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC); 3849 3850 /* Do a bad recv() */ 3851 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, NULL), -1); 3852 EXPECT_EQ(errno, EFAULT); 3853 3854 /* We should still be able to receive this notification, though. */ 3855 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 3856 EXPECT_EQ(req.pid, pid); 3857 3858 resp.id = req.id; 3859 resp.error = 0; 3860 resp.val = USER_NOTIF_MAGIC; 3861 3862 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 3863 3864 EXPECT_EQ(waitpid(pid, &status, 0), pid); 3865 EXPECT_EQ(true, WIFEXITED(status)); 3866 EXPECT_EQ(0, WEXITSTATUS(status)); 3867 } 3868 3869 TEST(seccomp_get_notif_sizes) 3870 { 3871 struct seccomp_notif_sizes sizes; 3872 3873 ASSERT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0); 3874 EXPECT_EQ(sizes.seccomp_notif, sizeof(struct seccomp_notif)); 3875 EXPECT_EQ(sizes.seccomp_notif_resp, sizeof(struct seccomp_notif_resp)); 3876 } 3877 3878 TEST(user_notification_continue) 3879 { 3880 pid_t pid; 3881 long ret; 3882 int status, listener; 3883 struct seccomp_notif req = {}; 3884 struct seccomp_notif_resp resp = {}; 3885 struct pollfd pollfd; 3886 3887 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 3888 ASSERT_EQ(0, ret) { 3889 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 3890 } 3891 3892 listener = user_notif_syscall(__NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER); 3893 ASSERT_GE(listener, 0); 3894 3895 pid = fork(); 3896 ASSERT_GE(pid, 0); 3897 3898 if (pid == 0) { 3899 int dup_fd, pipe_fds[2]; 3900 pid_t self; 3901 3902 ASSERT_GE(pipe(pipe_fds), 0); 3903 3904 dup_fd = dup(pipe_fds[0]); 3905 ASSERT_GE(dup_fd, 0); 3906 EXPECT_NE(pipe_fds[0], dup_fd); 3907 3908 self = getpid(); 3909 ASSERT_EQ(filecmp(self, self, pipe_fds[0], dup_fd), 0); 3910 exit(0); 3911 } 3912 3913 pollfd.fd = listener; 3914 pollfd.events = POLLIN | POLLOUT; 3915 3916 EXPECT_GT(poll(&pollfd, 1, -1), 0); 3917 EXPECT_EQ(pollfd.revents, POLLIN); 3918 3919 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 3920 3921 pollfd.fd = listener; 3922 pollfd.events = POLLIN | POLLOUT; 3923 3924 EXPECT_GT(poll(&pollfd, 1, -1), 0); 3925 EXPECT_EQ(pollfd.revents, POLLOUT); 3926 3927 EXPECT_EQ(req.data.nr, __NR_dup); 3928 3929 resp.id = req.id; 3930 resp.flags = SECCOMP_USER_NOTIF_FLAG_CONTINUE; 3931 3932 /* 3933 * Verify that setting SECCOMP_USER_NOTIF_FLAG_CONTINUE enforces other 3934 * args be set to 0. 3935 */ 3936 resp.error = 0; 3937 resp.val = USER_NOTIF_MAGIC; 3938 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1); 3939 EXPECT_EQ(errno, EINVAL); 3940 3941 resp.error = USER_NOTIF_MAGIC; 3942 resp.val = 0; 3943 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1); 3944 EXPECT_EQ(errno, EINVAL); 3945 3946 resp.error = 0; 3947 resp.val = 0; 3948 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0) { 3949 if (errno == EINVAL) 3950 SKIP(goto skip, "Kernel does not support SECCOMP_USER_NOTIF_FLAG_CONTINUE"); 3951 } 3952 3953 skip: 3954 EXPECT_EQ(waitpid(pid, &status, 0), pid); 3955 EXPECT_EQ(true, WIFEXITED(status)); 3956 EXPECT_EQ(0, WEXITSTATUS(status)) { 3957 if (WEXITSTATUS(status) == 2) { 3958 SKIP(return, "Kernel does not support kcmp() syscall"); 3959 return; 3960 } 3961 } 3962 } 3963 3964 TEST(user_notification_filter_empty) 3965 { 3966 pid_t pid; 3967 long ret; 3968 int status; 3969 struct pollfd pollfd; 3970 struct __clone_args args = { 3971 .flags = CLONE_FILES, 3972 .exit_signal = SIGCHLD, 3973 }; 3974 3975 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 3976 ASSERT_EQ(0, ret) { 3977 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 3978 } 3979 3980 if (__NR_clone3 < 0) 3981 SKIP(return, "Test not built with clone3 support"); 3982 3983 pid = sys_clone3(&args, sizeof(args)); 3984 ASSERT_GE(pid, 0); 3985 3986 if (pid == 0) { 3987 int listener; 3988 3989 listener = user_notif_syscall(__NR_mknodat, SECCOMP_FILTER_FLAG_NEW_LISTENER); 3990 if (listener < 0) 3991 _exit(EXIT_FAILURE); 3992 3993 if (dup2(listener, 200) != 200) 3994 _exit(EXIT_FAILURE); 3995 3996 close(listener); 3997 3998 _exit(EXIT_SUCCESS); 3999 } 4000 4001 EXPECT_EQ(waitpid(pid, &status, 0), pid); 4002 EXPECT_EQ(true, WIFEXITED(status)); 4003 EXPECT_EQ(0, WEXITSTATUS(status)); 4004 4005 /* 4006 * The seccomp filter has become unused so we should be notified once 4007 * the kernel gets around to cleaning up task struct. 4008 */ 4009 pollfd.fd = 200; 4010 pollfd.events = POLLHUP; 4011 4012 EXPECT_GT(poll(&pollfd, 1, 2000), 0); 4013 EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0); 4014 } 4015 4016 TEST(user_ioctl_notification_filter_empty) 4017 { 4018 pid_t pid; 4019 long ret; 4020 int status, p[2]; 4021 struct __clone_args args = { 4022 .flags = CLONE_FILES, 4023 .exit_signal = SIGCHLD, 4024 }; 4025 struct seccomp_notif req = {}; 4026 4027 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 4028 ASSERT_EQ(0, ret) { 4029 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 4030 } 4031 4032 if (__NR_clone3 < 0) 4033 SKIP(return, "Test not built with clone3 support"); 4034 4035 ASSERT_EQ(0, pipe(p)); 4036 4037 pid = sys_clone3(&args, sizeof(args)); 4038 ASSERT_GE(pid, 0); 4039 4040 if (pid == 0) { 4041 int listener; 4042 4043 listener = user_notif_syscall(__NR_mknodat, SECCOMP_FILTER_FLAG_NEW_LISTENER); 4044 if (listener < 0) 4045 _exit(EXIT_FAILURE); 4046 4047 if (dup2(listener, 200) != 200) 4048 _exit(EXIT_FAILURE); 4049 close(p[1]); 4050 close(listener); 4051 sleep(1); 4052 4053 _exit(EXIT_SUCCESS); 4054 } 4055 if (read(p[0], &status, 1) != 0) 4056 _exit(EXIT_SUCCESS); 4057 close(p[0]); 4058 /* 4059 * The seccomp filter has become unused so we should be notified once 4060 * the kernel gets around to cleaning up task struct. 4061 */ 4062 EXPECT_EQ(ioctl(200, SECCOMP_IOCTL_NOTIF_RECV, &req), -1); 4063 EXPECT_EQ(errno, ENOENT); 4064 4065 EXPECT_EQ(waitpid(pid, &status, 0), pid); 4066 EXPECT_EQ(true, WIFEXITED(status)); 4067 EXPECT_EQ(0, WEXITSTATUS(status)); 4068 } 4069 4070 static void *do_thread(void *data) 4071 { 4072 return NULL; 4073 } 4074 4075 TEST(user_notification_filter_empty_threaded) 4076 { 4077 pid_t pid; 4078 long ret; 4079 int status; 4080 struct pollfd pollfd; 4081 struct __clone_args args = { 4082 .flags = CLONE_FILES, 4083 .exit_signal = SIGCHLD, 4084 }; 4085 4086 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 4087 ASSERT_EQ(0, ret) { 4088 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 4089 } 4090 4091 if (__NR_clone3 < 0) 4092 SKIP(return, "Test not built with clone3 support"); 4093 4094 pid = sys_clone3(&args, sizeof(args)); 4095 ASSERT_GE(pid, 0); 4096 4097 if (pid == 0) { 4098 pid_t pid1, pid2; 4099 int listener, status; 4100 pthread_t thread; 4101 4102 listener = user_notif_syscall(__NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER); 4103 if (listener < 0) 4104 _exit(EXIT_FAILURE); 4105 4106 if (dup2(listener, 200) != 200) 4107 _exit(EXIT_FAILURE); 4108 4109 close(listener); 4110 4111 pid1 = fork(); 4112 if (pid1 < 0) 4113 _exit(EXIT_FAILURE); 4114 4115 if (pid1 == 0) 4116 _exit(EXIT_SUCCESS); 4117 4118 pid2 = fork(); 4119 if (pid2 < 0) 4120 _exit(EXIT_FAILURE); 4121 4122 if (pid2 == 0) 4123 _exit(EXIT_SUCCESS); 4124 4125 if (pthread_create(&thread, NULL, do_thread, NULL) || 4126 pthread_join(thread, NULL)) 4127 _exit(EXIT_FAILURE); 4128 4129 if (pthread_create(&thread, NULL, do_thread, NULL) || 4130 pthread_join(thread, NULL)) 4131 _exit(EXIT_FAILURE); 4132 4133 if (waitpid(pid1, &status, 0) != pid1 || !WIFEXITED(status) || 4134 WEXITSTATUS(status)) 4135 _exit(EXIT_FAILURE); 4136 4137 if (waitpid(pid2, &status, 0) != pid2 || !WIFEXITED(status) || 4138 WEXITSTATUS(status)) 4139 _exit(EXIT_FAILURE); 4140 4141 exit(EXIT_SUCCESS); 4142 } 4143 4144 EXPECT_EQ(waitpid(pid, &status, 0), pid); 4145 EXPECT_EQ(true, WIFEXITED(status)); 4146 EXPECT_EQ(0, WEXITSTATUS(status)); 4147 4148 /* 4149 * The seccomp filter has become unused so we should be notified once 4150 * the kernel gets around to cleaning up task struct. 4151 */ 4152 pollfd.fd = 200; 4153 pollfd.events = POLLHUP; 4154 4155 EXPECT_GT(poll(&pollfd, 1, 2000), 0); 4156 EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0); 4157 } 4158 4159 4160 int get_next_fd(int prev_fd) 4161 { 4162 for (int i = prev_fd + 1; i < FD_SETSIZE; ++i) { 4163 if (fcntl(i, F_GETFD) == -1) 4164 return i; 4165 } 4166 _exit(EXIT_FAILURE); 4167 } 4168 4169 TEST(user_notification_addfd) 4170 { 4171 pid_t pid; 4172 long ret; 4173 int status, listener, memfd, fd, nextfd; 4174 struct seccomp_notif_addfd addfd = {}; 4175 struct seccomp_notif_addfd_small small = {}; 4176 struct seccomp_notif_addfd_big big = {}; 4177 struct seccomp_notif req = {}; 4178 struct seccomp_notif_resp resp = {}; 4179 /* 100 ms */ 4180 struct timespec delay = { .tv_nsec = 100000000 }; 4181 4182 /* There may be arbitrary already-open fds at test start. */ 4183 memfd = memfd_create("test", 0); 4184 ASSERT_GE(memfd, 0); 4185 nextfd = get_next_fd(memfd); 4186 4187 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 4188 ASSERT_EQ(0, ret) { 4189 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 4190 } 4191 4192 /* fd: 4 */ 4193 /* Check that the basic notification machinery works */ 4194 listener = user_notif_syscall(__NR_getppid, 4195 SECCOMP_FILTER_FLAG_NEW_LISTENER); 4196 ASSERT_EQ(listener, nextfd); 4197 nextfd = get_next_fd(nextfd); 4198 4199 pid = fork(); 4200 ASSERT_GE(pid, 0); 4201 4202 if (pid == 0) { 4203 /* fds will be added and this value is expected */ 4204 if (syscall(__NR_getppid) != USER_NOTIF_MAGIC) 4205 exit(1); 4206 4207 /* Atomic addfd+send is received here. Check it is a valid fd */ 4208 if (fcntl(syscall(__NR_getppid), F_GETFD) == -1) 4209 exit(1); 4210 4211 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC); 4212 } 4213 4214 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 4215 4216 addfd.srcfd = memfd; 4217 addfd.newfd = 0; 4218 addfd.id = req.id; 4219 addfd.flags = 0x0; 4220 4221 /* Verify bad newfd_flags cannot be set */ 4222 addfd.newfd_flags = ~O_CLOEXEC; 4223 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1); 4224 EXPECT_EQ(errno, EINVAL); 4225 addfd.newfd_flags = O_CLOEXEC; 4226 4227 /* Verify bad flags cannot be set */ 4228 addfd.flags = 0xff; 4229 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1); 4230 EXPECT_EQ(errno, EINVAL); 4231 addfd.flags = 0; 4232 4233 /* Verify that remote_fd cannot be set without setting flags */ 4234 addfd.newfd = 1; 4235 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1); 4236 EXPECT_EQ(errno, EINVAL); 4237 addfd.newfd = 0; 4238 4239 /* Verify small size cannot be set */ 4240 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_SMALL, &small), -1); 4241 EXPECT_EQ(errno, EINVAL); 4242 4243 /* Verify we can't send bits filled in unknown buffer area */ 4244 memset(&big, 0xAA, sizeof(big)); 4245 big.addfd = addfd; 4246 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_BIG, &big), -1); 4247 EXPECT_EQ(errno, E2BIG); 4248 4249 4250 /* Verify we can set an arbitrary remote fd */ 4251 fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd); 4252 EXPECT_EQ(fd, nextfd); 4253 nextfd = get_next_fd(nextfd); 4254 EXPECT_EQ(filecmp(getpid(), pid, memfd, fd), 0); 4255 4256 /* Verify we can set an arbitrary remote fd with large size */ 4257 memset(&big, 0x0, sizeof(big)); 4258 big.addfd = addfd; 4259 fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_BIG, &big); 4260 EXPECT_EQ(fd, nextfd); 4261 nextfd = get_next_fd(nextfd); 4262 4263 /* Verify we can set a specific remote fd */ 4264 addfd.newfd = 42; 4265 addfd.flags = SECCOMP_ADDFD_FLAG_SETFD; 4266 fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd); 4267 EXPECT_EQ(fd, 42); 4268 EXPECT_EQ(filecmp(getpid(), pid, memfd, fd), 0); 4269 4270 /* Resume syscall */ 4271 resp.id = req.id; 4272 resp.error = 0; 4273 resp.val = USER_NOTIF_MAGIC; 4274 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 4275 4276 /* 4277 * This sets the ID of the ADD FD to the last request plus 1. The 4278 * notification ID increments 1 per notification. 4279 */ 4280 addfd.id = req.id + 1; 4281 4282 /* This spins until the underlying notification is generated */ 4283 while (ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd) != -1 && 4284 errno != -EINPROGRESS) 4285 nanosleep(&delay, NULL); 4286 4287 memset(&req, 0, sizeof(req)); 4288 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 4289 ASSERT_EQ(addfd.id, req.id); 4290 4291 /* Verify we can do an atomic addfd and send */ 4292 addfd.newfd = 0; 4293 addfd.flags = SECCOMP_ADDFD_FLAG_SEND; 4294 fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd); 4295 /* 4296 * Child has earlier "low" fds and now 42, so we expect the next 4297 * lowest available fd to be assigned here. 4298 */ 4299 EXPECT_EQ(fd, nextfd); 4300 nextfd = get_next_fd(nextfd); 4301 ASSERT_EQ(filecmp(getpid(), pid, memfd, fd), 0); 4302 4303 /* 4304 * This sets the ID of the ADD FD to the last request plus 1. The 4305 * notification ID increments 1 per notification. 4306 */ 4307 addfd.id = req.id + 1; 4308 4309 /* This spins until the underlying notification is generated */ 4310 while (ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd) != -1 && 4311 errno != -EINPROGRESS) 4312 nanosleep(&delay, NULL); 4313 4314 memset(&req, 0, sizeof(req)); 4315 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 4316 ASSERT_EQ(addfd.id, req.id); 4317 4318 resp.id = req.id; 4319 resp.error = 0; 4320 resp.val = USER_NOTIF_MAGIC; 4321 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 4322 4323 /* Wait for child to finish. */ 4324 EXPECT_EQ(waitpid(pid, &status, 0), pid); 4325 EXPECT_EQ(true, WIFEXITED(status)); 4326 EXPECT_EQ(0, WEXITSTATUS(status)); 4327 4328 close(memfd); 4329 } 4330 4331 TEST(user_notification_addfd_opath) 4332 { 4333 struct seccomp_notif req = {}; 4334 struct seccomp_notif_addfd addfd = {}; 4335 struct seccomp_notif_resp resp = {}; 4336 pid_t pid; 4337 int listener, pathfd, fd, status; 4338 4339 pathfd = open("/dev/null", O_PATH | O_CLOEXEC); 4340 ASSERT_GE(pathfd, 0); 4341 ASSERT_EQ(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0); 4342 listener = user_notif_syscall(__NR_getppid, 4343 SECCOMP_FILTER_FLAG_NEW_LISTENER); 4344 ASSERT_GE(listener, 0); 4345 4346 pid = fork(); 4347 ASSERT_GE(pid, 0); 4348 if (pid == 0) { 4349 int flags; 4350 char byte; 4351 4352 close(pathfd); 4353 fd = syscall(__NR_getppid); 4354 if (fd < 0) 4355 _exit(1); 4356 flags = fcntl(fd, F_GETFL); 4357 if (flags < 0 || !(flags & O_PATH)) 4358 _exit(2); 4359 flags = fcntl(fd, F_GETFD); 4360 if (flags < 0 || !(flags & FD_CLOEXEC)) 4361 _exit(3); 4362 errno = 0; 4363 if (read(fd, &byte, 1) != -1 || errno != EBADF) 4364 _exit(4); 4365 _exit(0); 4366 } 4367 4368 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 4369 addfd.id = req.id; 4370 addfd.flags = SECCOMP_ADDFD_FLAG_SEND; 4371 addfd.srcfd = pathfd; 4372 addfd.newfd_flags = O_CLOEXEC; 4373 fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd); 4374 if (fd < 0) { 4375 resp.id = req.id; 4376 resp.error = -errno; 4377 TH_LOG("ADDFD failed with errno %d", -resp.error); 4378 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 4379 } 4380 4381 ASSERT_EQ(waitpid(pid, &status, 0), pid); 4382 EXPECT_GE(fd, 0); 4383 EXPECT_EQ(true, WIFEXITED(status)); 4384 if (WIFEXITED(status)) 4385 EXPECT_EQ(0, WEXITSTATUS(status)); 4386 close(pathfd); 4387 close(listener); 4388 } 4389 4390 TEST(user_notification_addfd_rlimit) 4391 { 4392 pid_t pid; 4393 long ret; 4394 int status, listener, memfd; 4395 struct seccomp_notif_addfd addfd = {}; 4396 struct seccomp_notif req = {}; 4397 struct seccomp_notif_resp resp = {}; 4398 const struct rlimit lim = { 4399 .rlim_cur = 0, 4400 .rlim_max = 0, 4401 }; 4402 4403 memfd = memfd_create("test", 0); 4404 ASSERT_GE(memfd, 0); 4405 4406 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 4407 ASSERT_EQ(0, ret) { 4408 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 4409 } 4410 4411 /* Check that the basic notification machinery works */ 4412 listener = user_notif_syscall(__NR_getppid, 4413 SECCOMP_FILTER_FLAG_NEW_LISTENER); 4414 ASSERT_GE(listener, 0); 4415 4416 pid = fork(); 4417 ASSERT_GE(pid, 0); 4418 4419 if (pid == 0) 4420 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC); 4421 4422 4423 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 4424 4425 ASSERT_EQ(prlimit(pid, RLIMIT_NOFILE, &lim, NULL), 0); 4426 4427 addfd.srcfd = memfd; 4428 addfd.newfd_flags = O_CLOEXEC; 4429 addfd.newfd = 0; 4430 addfd.id = req.id; 4431 addfd.flags = 0; 4432 4433 /* Should probably spot check /proc/sys/fs/file-nr */ 4434 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1); 4435 EXPECT_EQ(errno, EMFILE); 4436 4437 addfd.flags = SECCOMP_ADDFD_FLAG_SEND; 4438 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1); 4439 EXPECT_EQ(errno, EMFILE); 4440 4441 addfd.newfd = 100; 4442 addfd.flags = SECCOMP_ADDFD_FLAG_SETFD; 4443 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1); 4444 EXPECT_EQ(errno, EBADF); 4445 4446 resp.id = req.id; 4447 resp.error = 0; 4448 resp.val = USER_NOTIF_MAGIC; 4449 4450 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 4451 4452 /* Wait for child to finish. */ 4453 EXPECT_EQ(waitpid(pid, &status, 0), pid); 4454 EXPECT_EQ(true, WIFEXITED(status)); 4455 EXPECT_EQ(0, WEXITSTATUS(status)); 4456 4457 close(memfd); 4458 } 4459 4460 /* Just take a signal and do nothing else. */ 4461 static void empty_handler(int signo) 4462 { 4463 } 4464 4465 /* 4466 * Verify that when SECCOMP_IOCTL_NOTIF_ADDFD with SECCOMP_ADDFD_FLAG_SEND is 4467 * interrupted by a signal before the tracee dequeues the addfd request, 4468 * knotif->state is restored from SECCOMP_NOTIFY_REPLIED back to 4469 * SECCOMP_NOTIFY_SENT so that: 4470 * 1. The woken tracee sees knotif->state == SECCOMP_NOTIFY_SENT in 4471 * do_user_notif() and goes back to sleep instead of prematurely 4472 * returning 0 from the trapped syscall without the FD installed. 4473 * 2. The supervisor can retry SECCOMP_IOCTL_NOTIF_ADDFD (or 4474 * SECCOMP_IOCTL_NOTIF_SEND) instead of failing with -EINPROGRESS. 4475 * 4476 * To deterministically hit the race window where the supervisor sleeps in 4477 * wait_for_completion_interruptible(&kaddfd.completion) after waking the 4478 * tracee (complete(&knotif->ready)) but before the tracee runs 4479 * seccomp_handle_addfd(), pin all processes to a single CPU and enforce a 4480 * strict 3-tier scheduling priority hierarchy on that CPU: 4481 * - Supervisor: SCHED_FIFO priority 99 (highest) 4482 * - Signal helper (sig_pid): SCHED_FIFO priority 50 (middle) 4483 * - Tracee (pid): SCHED_IDLE (lowest) 4484 */ 4485 TEST(user_notification_addfd_send_interrupted) 4486 { 4487 /* 4488 * Save parent_pid before user_notif_syscall(__NR_getppid, ...) installs 4489 * the seccomp filter on the calling process; children inherit that 4490 * filter, so sig_pid must not call getppid(). 4491 */ 4492 pid_t tracee_pid, sig_pid, parent_pid = getpid(); 4493 long ret; 4494 int status, listener, memfd, err; 4495 struct seccomp_notif_addfd addfd = {}; 4496 struct seccomp_notif req = {}; 4497 struct sigaction sa = {}; 4498 struct sched_param sp_zero = { .sched_priority = 0 }; 4499 struct sched_param sp_fifo_high = { .sched_priority = 99 }; 4500 struct sched_param sp_fifo_mid = { .sched_priority = 50 }; 4501 struct timespec delay = { .tv_nsec = 15000000 }; 4502 cpu_set_t cpuset; 4503 int cpu; 4504 4505 /* Pin the supervisor (and its future child processes) to one CPU. */ 4506 cpu = sched_getcpu(); 4507 if (cpu >= 0) { 4508 CPU_ZERO(&cpuset); 4509 CPU_SET(cpu, &cpuset); 4510 sched_setaffinity(0, sizeof(cpuset), &cpuset); 4511 } 4512 4513 sa.sa_handler = empty_handler; 4514 ASSERT_EQ(sigaction(SIGUSR1, &sa, NULL), 0); 4515 4516 memfd = memfd_create("test", 0); 4517 ASSERT_GE(memfd, 0); 4518 4519 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 4520 ASSERT_EQ(0, ret) { 4521 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 4522 } 4523 4524 /* 4525 * Follow the convention of other user_notification_* tests in this 4526 * file by trapping __NR_getppid: because the filter is installed on 4527 * the supervisor before fork(), the trapped syscall must be a 4528 * side-effect-free syscall that the supervisor itself never invokes. 4529 * Even though getppid() does not normally return an FD, 4530 * SECCOMP_ADDFD_FLAG_SEND replaces the trapped syscall's return value 4531 * with the newly installed FD number (42). 4532 */ 4533 listener = user_notif_syscall(__NR_getppid, 4534 SECCOMP_FILTER_FLAG_NEW_LISTENER); 4535 ASSERT_GE(listener, 0); 4536 4537 tracee_pid = fork(); 4538 ASSERT_GE(tracee_pid, 0); 4539 4540 if (tracee_pid == 0) { 4541 /* 4542 * Tracee: invoke __NR_getppid as a dummy trigger syscall to 4543 * trap into do_user_notif(). Verify that the syscall returns 4544 * the injected FD number (42) and that FD 42 is open. 4545 */ 4546 ret = syscall(__NR_getppid); 4547 exit(ret != 42 || fcntl(42, F_GETFD) < 0); 4548 } 4549 4550 /* Wait for the tracee to trap in do_user_notif(). */ 4551 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 4552 4553 /* 4554 * Demote the tracee to SCHED_IDLE and promote the supervisor to 4555 * SCHED_FIFO(99) on the same CPU. 4556 */ 4557 ASSERT_EQ(sched_setscheduler(tracee_pid, SCHED_IDLE, &sp_zero), 0); 4558 if (sched_setscheduler(0, SCHED_FIFO, &sp_fifo_high) != 0) { 4559 kill(tracee_pid, SIGKILL); 4560 waitpid(tracee_pid, NULL, 0); 4561 SKIP(return, "SCHED_FIFO requires CAP_SYS_NICE"); 4562 } 4563 4564 addfd.srcfd = memfd; 4565 addfd.newfd_flags = O_CLOEXEC; 4566 addfd.newfd = 42; 4567 addfd.id = req.id; 4568 addfd.flags = SECCOMP_ADDFD_FLAG_SETFD | SECCOMP_ADDFD_FLAG_SEND; 4569 4570 /* 4571 * Fork a signal helper on the same CPU and set it to SCHED_FIFO(50). 4572 * Because the supervisor is currently running at SCHED_FIFO(99) on 4573 * this CPU, sig_pid is queued on the runqueue but cannot run until the 4574 * supervisor blocks inside the kernel. 4575 * 4576 * When the supervisor invokes ioctl(SECCOMP_IOCTL_NOTIF_ADDFD) below: 4577 * 1. seccomp_notify_addfd() sets knotif->state = SECCOMP_NOTIFY_REPLIED, 4578 * wakes the tracee (SCHED_IDLE), and blocks in 4579 * wait_for_completion_interruptible(&kaddfd.completion). 4580 * 2. The CPU scheduler immediately runs sig_pid (SCHED_FIFO 50) 4581 * ahead of the woken tracee (SCHED_IDLE). 4582 * 3. sig_pid sends SIGUSR1 to parent_pid, waking the supervisor 4583 * (SCHED_FIFO 99), which immediately preempts sig_pid, aborts the 4584 * wait with -ERESTARTSYS (-EINTR), removes kaddfd from 4585 * knotif->addfd, and restores knotif->state = SECCOMP_NOTIFY_SENT 4586 * before the tracee has executed a single instruction. 4587 */ 4588 sig_pid = fork(); 4589 if (sig_pid < 0) { 4590 sched_setscheduler(0, SCHED_OTHER, &sp_zero); 4591 kill(tracee_pid, SIGKILL); 4592 waitpid(tracee_pid, NULL, 0); 4593 } 4594 ASSERT_GE(sig_pid, 0); 4595 if (sig_pid == 0) { 4596 if (sched_setscheduler(0, SCHED_FIFO, &sp_fifo_mid) != 0) 4597 _exit(1); 4598 kill(parent_pid, SIGUSR1); 4599 _exit(0); 4600 } 4601 4602 ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd); 4603 err = errno; 4604 4605 /* 4606 * Restore normal scheduling ASAP so the supervisor does not remain 4607 * SCHED_FIFO on a single-CPU machine/VM/CI, then sleep briefly so the 4608 * woken tracee runs in do_user_notif(). With knotif->state restored to 4609 * SECCOMP_NOTIFY_SENT, the tracee must loop back to sleep waiting for 4610 * the notification reply rather than returning 0 from __NR_getppid. 4611 */ 4612 ASSERT_EQ(sched_setscheduler(0, SCHED_OTHER, &sp_zero), 0); 4613 ASSERT_EQ(sched_setscheduler(tracee_pid, SCHED_OTHER, &sp_zero), 0); 4614 4615 EXPECT_EQ(ret, -1); 4616 EXPECT_EQ(err, EINTR); 4617 EXPECT_EQ(waitpid(sig_pid, &status, 0), sig_pid); 4618 EXPECT_EQ(true, WIFEXITED(status)); 4619 EXPECT_EQ(0, WEXITSTATUS(status)); 4620 4621 nanosleep(&delay, NULL); 4622 4623 /* 4624 * Retry SECCOMP_IOCTL_NOTIF_ADDFD. Because knotif->state is 4625 * SECCOMP_NOTIFY_SENT, the retry succeeds (returns 42) instead of 4626 * failing with -EINPROGRESS, installs FD 42 into the tracee, and wakes 4627 * the tracee to complete the syscall with return value 42. 4628 */ 4629 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), 42); 4630 4631 EXPECT_EQ(waitpid(tracee_pid, &status, 0), tracee_pid); 4632 EXPECT_EQ(true, WIFEXITED(status)); 4633 EXPECT_EQ(0, WEXITSTATUS(status)); 4634 4635 close(listener); 4636 close(memfd); 4637 } 4638 4639 #ifndef SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP 4640 #define SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP (1UL << 0) 4641 #define SECCOMP_IOCTL_NOTIF_SET_FLAGS SECCOMP_IOW(4, __u64) 4642 #endif 4643 4644 TEST(user_notification_sync) 4645 { 4646 struct seccomp_notif req = {}; 4647 struct seccomp_notif_resp resp = {}; 4648 int status, listener; 4649 pid_t pid; 4650 long ret; 4651 4652 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 4653 ASSERT_EQ(0, ret) { 4654 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 4655 } 4656 4657 listener = user_notif_syscall(__NR_getppid, 4658 SECCOMP_FILTER_FLAG_NEW_LISTENER); 4659 ASSERT_GE(listener, 0); 4660 4661 /* Try to set invalid flags. */ 4662 EXPECT_SYSCALL_RETURN(-EINVAL, 4663 ioctl(listener, SECCOMP_IOCTL_NOTIF_SET_FLAGS, 0xffffffff, 0)); 4664 4665 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SET_FLAGS, 4666 SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP, 0), 0); 4667 4668 pid = fork(); 4669 ASSERT_GE(pid, 0); 4670 if (pid == 0) { 4671 ret = syscall(__NR_getppid); 4672 ASSERT_EQ(ret, USER_NOTIF_MAGIC) { 4673 _exit(1); 4674 } 4675 _exit(0); 4676 } 4677 4678 req.pid = 0; 4679 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 4680 4681 ASSERT_EQ(req.data.nr, __NR_getppid); 4682 4683 resp.id = req.id; 4684 resp.error = 0; 4685 resp.val = USER_NOTIF_MAGIC; 4686 resp.flags = 0; 4687 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 4688 4689 ASSERT_EQ(waitpid(pid, &status, 0), pid); 4690 ASSERT_EQ(status, 0); 4691 } 4692 4693 4694 /* Make sure PTRACE_O_SUSPEND_SECCOMP requires CAP_SYS_ADMIN. */ 4695 FIXTURE(O_SUSPEND_SECCOMP) { 4696 pid_t pid; 4697 }; 4698 4699 FIXTURE_SETUP(O_SUSPEND_SECCOMP) 4700 { 4701 ERRNO_FILTER(block_read, E2BIG); 4702 cap_value_t cap_list[] = { CAP_SYS_ADMIN }; 4703 cap_t caps; 4704 4705 self->pid = 0; 4706 4707 /* make sure we don't have CAP_SYS_ADMIN */ 4708 caps = cap_get_proc(); 4709 ASSERT_NE(NULL, caps); 4710 ASSERT_EQ(0, cap_set_flag(caps, CAP_EFFECTIVE, 1, cap_list, CAP_CLEAR)); 4711 ASSERT_EQ(0, cap_set_proc(caps)); 4712 cap_free(caps); 4713 4714 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); 4715 ASSERT_EQ(0, prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_block_read)); 4716 4717 self->pid = fork(); 4718 ASSERT_GE(self->pid, 0); 4719 4720 if (self->pid == 0) { 4721 while (1) 4722 pause(); 4723 _exit(127); 4724 } 4725 } 4726 4727 FIXTURE_TEARDOWN(O_SUSPEND_SECCOMP) 4728 { 4729 if (self->pid) 4730 kill(self->pid, SIGKILL); 4731 } 4732 4733 TEST_F(O_SUSPEND_SECCOMP, setoptions) 4734 { 4735 int wstatus; 4736 4737 ASSERT_EQ(0, ptrace(PTRACE_ATTACH, self->pid, NULL, 0)); 4738 ASSERT_EQ(self->pid, wait(&wstatus)); 4739 ASSERT_EQ(-1, ptrace(PTRACE_SETOPTIONS, self->pid, NULL, PTRACE_O_SUSPEND_SECCOMP)); 4740 if (errno == EINVAL) 4741 SKIP(return, "Kernel does not support PTRACE_O_SUSPEND_SECCOMP (missing CONFIG_CHECKPOINT_RESTORE?)"); 4742 ASSERT_EQ(EPERM, errno); 4743 } 4744 4745 TEST_F(O_SUSPEND_SECCOMP, seize) 4746 { 4747 int ret; 4748 4749 ret = ptrace(PTRACE_SEIZE, self->pid, NULL, PTRACE_O_SUSPEND_SECCOMP); 4750 ASSERT_EQ(-1, ret); 4751 if (errno == EINVAL) 4752 SKIP(return, "Kernel does not support PTRACE_O_SUSPEND_SECCOMP (missing CONFIG_CHECKPOINT_RESTORE?)"); 4753 ASSERT_EQ(EPERM, errno); 4754 } 4755 4756 /* 4757 * get_nth - Get the nth, space separated entry in a file. 4758 * 4759 * Returns the length of the read field. 4760 * Throws error if field is zero-lengthed. 4761 */ 4762 static ssize_t get_nth(struct __test_metadata *_metadata, const char *path, 4763 const unsigned int position, char **entry) 4764 { 4765 char *line = NULL; 4766 unsigned int i; 4767 ssize_t nread; 4768 size_t len = 0; 4769 FILE *f; 4770 4771 f = fopen(path, "r"); 4772 ASSERT_NE(f, NULL) { 4773 TH_LOG("Could not open %s: %s", path, strerror(errno)); 4774 } 4775 4776 for (i = 0; i < position; i++) { 4777 nread = getdelim(&line, &len, ' ', f); 4778 ASSERT_GE(nread, 0) { 4779 TH_LOG("Failed to read %d entry in file %s", i, path); 4780 } 4781 } 4782 fclose(f); 4783 4784 ASSERT_GT(nread, 0) { 4785 TH_LOG("Entry in file %s had zero length", path); 4786 } 4787 4788 *entry = line; 4789 return nread - 1; 4790 } 4791 4792 /* For a given PID, get the task state (D, R, etc...) */ 4793 static char get_proc_stat(struct __test_metadata *_metadata, pid_t pid) 4794 { 4795 char proc_path[100] = {0}; 4796 char status; 4797 char *line; 4798 4799 snprintf(proc_path, sizeof(proc_path), "/proc/%d/stat", pid); 4800 ASSERT_EQ(get_nth(_metadata, proc_path, 3, &line), 1); 4801 4802 status = *line; 4803 free(line); 4804 4805 return status; 4806 } 4807 4808 TEST(user_notification_fifo) 4809 { 4810 struct seccomp_notif_resp resp = {}; 4811 struct seccomp_notif req = {}; 4812 int i, status, listener; 4813 pid_t pid, pids[3]; 4814 __u64 baseid; 4815 long ret; 4816 /* 100 ms */ 4817 struct timespec delay = { .tv_nsec = 100000000 }; 4818 4819 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 4820 ASSERT_EQ(0, ret) { 4821 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 4822 } 4823 4824 /* Setup a listener */ 4825 listener = user_notif_syscall(__NR_getppid, 4826 SECCOMP_FILTER_FLAG_NEW_LISTENER); 4827 ASSERT_GE(listener, 0); 4828 4829 pid = fork(); 4830 ASSERT_GE(pid, 0); 4831 4832 if (pid == 0) { 4833 ret = syscall(__NR_getppid); 4834 exit(ret != USER_NOTIF_MAGIC); 4835 } 4836 4837 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 4838 baseid = req.id + 1; 4839 4840 resp.id = req.id; 4841 resp.error = 0; 4842 resp.val = USER_NOTIF_MAGIC; 4843 4844 /* check that we make sure flags == 0 */ 4845 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 4846 4847 EXPECT_EQ(waitpid(pid, &status, 0), pid); 4848 EXPECT_EQ(true, WIFEXITED(status)); 4849 EXPECT_EQ(0, WEXITSTATUS(status)); 4850 4851 /* Start children, and generate notifications */ 4852 for (i = 0; i < ARRAY_SIZE(pids); i++) { 4853 pid = fork(); 4854 if (pid == 0) { 4855 ret = syscall(__NR_getppid); 4856 exit(ret != USER_NOTIF_MAGIC); 4857 } 4858 pids[i] = pid; 4859 } 4860 4861 /* This spins until all of the children are sleeping */ 4862 restart_wait: 4863 for (i = 0; i < ARRAY_SIZE(pids); i++) { 4864 if (get_proc_stat(_metadata, pids[i]) != 'S') { 4865 nanosleep(&delay, NULL); 4866 goto restart_wait; 4867 } 4868 } 4869 4870 /* Read the notifications in order (and respond) */ 4871 for (i = 0; i < ARRAY_SIZE(pids); i++) { 4872 memset(&req, 0, sizeof(req)); 4873 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 4874 EXPECT_EQ(req.id, baseid + i); 4875 resp.id = req.id; 4876 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 4877 } 4878 4879 /* Make sure notifications were received */ 4880 for (i = 0; i < ARRAY_SIZE(pids); i++) { 4881 EXPECT_EQ(waitpid(pids[i], &status, 0), pids[i]); 4882 EXPECT_EQ(true, WIFEXITED(status)); 4883 EXPECT_EQ(0, WEXITSTATUS(status)); 4884 } 4885 } 4886 4887 /* get_proc_syscall - Get the syscall in progress for a given pid 4888 * 4889 * Returns the current syscall number for a given process 4890 * Returns -1 if not in syscall (running or blocked) 4891 */ 4892 static long get_proc_syscall(struct __test_metadata *_metadata, int pid) 4893 { 4894 char proc_path[100] = {0}; 4895 long ret = -1; 4896 ssize_t nread; 4897 char *line; 4898 4899 snprintf(proc_path, sizeof(proc_path), "/proc/%d/syscall", pid); 4900 nread = get_nth(_metadata, proc_path, 1, &line); 4901 ASSERT_GT(nread, 0); 4902 4903 if (!strncmp("running", line, MIN(7, nread))) 4904 ret = strtol(line, NULL, 16); 4905 4906 free(line); 4907 return ret; 4908 } 4909 4910 4911 static void notification_restart_handler(int sig) 4912 { 4913 char c; 4914 int saved_errno = errno; 4915 4916 if (write(handled, "s", 1) != 1 || read(handled, &c, 1) != 1) 4917 _exit(1); 4918 errno = saved_errno; 4919 } 4920 4921 FIXTURE(notification_restart) { 4922 int listener; 4923 int sync[2]; 4924 pid_t pid; 4925 }; 4926 4927 FIXTURE_VARIANT(notification_restart) { 4928 bool restart; 4929 bool killable; 4930 }; 4931 4932 FIXTURE_VARIANT_ADD(notification_restart, neither) { 4933 .restart = false, .killable = false, 4934 }; 4935 FIXTURE_VARIANT_ADD(notification_restart, restart) { 4936 .restart = true, .killable = false, 4937 }; 4938 FIXTURE_VARIANT_ADD(notification_restart, killable) { 4939 .restart = false, .killable = true, 4940 }; 4941 FIXTURE_VARIANT_ADD(notification_restart, both) { 4942 .restart = true, .killable = true, 4943 }; 4944 4945 static unsigned int 4946 notification_restart_flags(const FIXTURE_VARIANT(notification_restart) *variant) 4947 { 4948 unsigned int flags = SECCOMP_FILTER_FLAG_NEW_LISTENER; 4949 4950 if (variant->restart) 4951 flags |= SECCOMP_FILTER_FLAG_RESTART_BEFORE_RECV; 4952 if (variant->killable) 4953 flags |= SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV; 4954 return flags; 4955 } 4956 4957 FIXTURE_SETUP(notification_restart) 4958 { 4959 self->pid = -1; 4960 self->listener = -1; 4961 self->sync[0] = self->sync[1] = -1; 4962 ASSERT_EQ(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0); 4963 ASSERT_EQ(socketpair(AF_UNIX, SOCK_STREAM, 0, self->sync), 0); 4964 self->listener = user_notif_syscall(__NR_getppid, 4965 notification_restart_flags(variant)); 4966 ASSERT_GE(self->listener, 0); 4967 } 4968 4969 FIXTURE_TEARDOWN(notification_restart) 4970 { 4971 if (self->pid > 0) { 4972 kill(self->pid, SIGKILL); 4973 waitpid(self->pid, NULL, 0); 4974 } 4975 close(self->listener); 4976 close(self->sync[0]); 4977 close(self->sync[1]); 4978 } 4979 4980 /* 4981 * Fork the notifying child with SIGUSR1 handled. Returns true in the 4982 * child, which sends its result with notification_report(). 4983 */ 4984 static bool notification_restart_fork(struct __test_metadata *_metadata, 4985 struct _test_data_notification_restart *self) 4986 { 4987 struct sigaction action = { .sa_handler = notification_restart_handler }; 4988 4989 self->pid = fork(); 4990 ASSERT_GE(self->pid, 0); 4991 if (self->pid) 4992 return false; 4993 4994 close(self->sync[0]); 4995 handled = self->sync[1]; 4996 if (sigemptyset(&action.sa_mask) || sigaction(SIGUSR1, &action, NULL)) 4997 _exit(1); 4998 return true; 4999 } 5000 5001 /* Send the child's syscall result to notification_result(), and exit. */ 5002 static __noreturn void notification_report(long ret, int err) 5003 { 5004 long result[2] = { ret, err }; 5005 5006 if (write(handled, result, sizeof(result)) != sizeof(result)) 5007 _exit(1); 5008 _exit(0); 5009 } 5010 5011 static void notification_restart_child(struct __test_metadata *_metadata, 5012 struct _test_data_notification_restart *self) 5013 { 5014 long ret; 5015 5016 if (!notification_restart_fork(_metadata, self)) 5017 return; 5018 5019 close(self->listener); 5020 ret = syscall(__NR_getppid); 5021 notification_report(ret, errno); 5022 } 5023 5024 static void notification_pending(struct __test_metadata *_metadata, int fd) 5025 { 5026 struct pollfd pfd = { .fd = fd, .events = POLLIN }; 5027 5028 ASSERT_EQ(poll(&pfd, 1, 5000), 1); 5029 ASSERT_TRUE(pfd.revents & POLLIN); 5030 } 5031 5032 static void notification_signal(struct __test_metadata *_metadata, 5033 struct _test_data_notification_restart *self) 5034 { 5035 struct pollfd pfd = { .fd = self->sync[0], .events = POLLIN }; 5036 char c; 5037 5038 ASSERT_EQ(kill(self->pid, SIGUSR1), 0); 5039 ASSERT_EQ(poll(&pfd, 1, 5000), 1); 5040 ASSERT_EQ(read(self->sync[0], &c, 1), 1); 5041 ASSERT_EQ(c, 's'); 5042 /* The handler holds the task until the abandoned request is checked. */ 5043 pfd.fd = self->listener; 5044 ASSERT_EQ(poll(&pfd, 1, 0), 0); 5045 ASSERT_EQ(write(self->sync[0], "r", 1), 1); 5046 } 5047 5048 static void notification_result(struct __test_metadata *_metadata, 5049 struct _test_data_notification_restart *self, 5050 long value, int error) 5051 { 5052 long result[2]; 5053 int status; 5054 5055 ASSERT_EQ(read(self->sync[0], result, sizeof(result)), sizeof(result)); 5056 EXPECT_EQ(result[0], value); 5057 if (value == -1) 5058 EXPECT_EQ(result[1], error); 5059 ASSERT_EQ(waitpid(self->pid, &status, 0), self->pid); 5060 self->pid = -1; 5061 ASSERT_TRUE(WIFEXITED(status)); 5062 EXPECT_EQ(WEXITSTATUS(status), 0); 5063 } 5064 5065 TEST_F(notification_restart, before_receive) 5066 { 5067 struct seccomp_notif req = {}; 5068 struct seccomp_notif_resp resp = {}; 5069 int i; 5070 5071 notification_restart_child(_metadata, self); 5072 for (i = 0; i < 3; i++) { 5073 notification_pending(_metadata, self->listener); 5074 notification_signal(_metadata, self); 5075 if (!variant->restart) { 5076 notification_result(_metadata, self, -1, EINTR); 5077 return; 5078 } 5079 } 5080 notification_pending(_metadata, self->listener); 5081 ASSERT_EQ(ioctl(self->listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 5082 resp.id = req.id; 5083 resp.flags = SECCOMP_USER_NOTIF_FLAG_CONTINUE; 5084 ASSERT_EQ(ioctl(self->listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 5085 notification_result(_metadata, self, getpid(), 0); 5086 } 5087 5088 TEST_F(notification_restart, failed_receive) 5089 { 5090 struct seccomp_notif_resp resp = {}; 5091 struct seccomp_notif req = {}; 5092 void *buf; 5093 5094 buf = mmap(NULL, sizeof(req), PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 5095 ASSERT_NE(buf, MAP_FAILED); 5096 notification_restart_child(_metadata, self); 5097 notification_pending(_metadata, self->listener); 5098 ASSERT_EQ(ioctl(self->listener, SECCOMP_IOCTL_NOTIF_RECV, buf), -1); 5099 ASSERT_EQ(errno, EFAULT); 5100 ASSERT_EQ(munmap(buf, sizeof(req)), 0); 5101 notification_signal(_metadata, self); 5102 if (!variant->restart) { 5103 notification_result(_metadata, self, -1, EINTR); 5104 return; 5105 } 5106 notification_pending(_metadata, self->listener); 5107 ASSERT_EQ(ioctl(self->listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 5108 resp.id = req.id; 5109 resp.error = -EAGAIN; 5110 ASSERT_EQ(ioctl(self->listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 5111 notification_result(_metadata, self, -1, EAGAIN); 5112 } 5113 5114 TEST_F(notification_restart, after_receive) 5115 { 5116 struct seccomp_notif req = {}; 5117 struct seccomp_notif_resp resp = {}; 5118 char c; 5119 5120 notification_restart_child(_metadata, self); 5121 notification_pending(_metadata, self->listener); 5122 ASSERT_EQ(ioctl(self->listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 5123 if (!variant->killable) { 5124 notification_signal(_metadata, self); 5125 notification_result(_metadata, self, -1, EINTR); 5126 ASSERT_EQ(ioctl(self->listener, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id), -1); 5127 EXPECT_EQ(errno, ENOENT); 5128 return; 5129 } 5130 ASSERT_EQ(kill(self->pid, SIGUSR1), 0); 5131 /* Either ordering of signal delivery and reply must preserve the response. */ 5132 resp.id = req.id; 5133 resp.val = USER_NOTIF_MAGIC; 5134 ASSERT_EQ(ioctl(self->listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 5135 ASSERT_EQ(read(self->sync[0], &c, 1), 1); 5136 ASSERT_EQ(c, 's'); 5137 ASSERT_EQ(write(self->sync[0], "r", 1), 1); 5138 notification_result(_metadata, self, USER_NOTIF_MAGIC, 0); 5139 } 5140 5141 /* 5142 * Fork a child that installs its own filter notifying on @nr, so that the 5143 * test process is not mediated, and receive the child's listener. Returns 5144 * true in the child. 5145 */ 5146 static bool 5147 notification_restart_filtered(struct __test_metadata *_metadata, 5148 struct _test_data_notification_restart *self, 5149 const FIXTURE_VARIANT(notification_restart) *variant, 5150 int nr) 5151 { 5152 char control[CMSG_SPACE(sizeof(int))] = {}; 5153 char c = 'f'; 5154 struct iovec iov = { .iov_base = &c, .iov_len = 1 }; 5155 struct msghdr msg = { 5156 .msg_iov = &iov, .msg_iovlen = 1, 5157 .msg_control = control, .msg_controllen = sizeof(control), 5158 }; 5159 struct cmsghdr *cmsg; 5160 int listener; 5161 5162 /* A filter chain may hold only one listener. */ 5163 ASSERT_EQ(close(self->listener), 0); 5164 self->listener = -1; 5165 if (notification_restart_fork(_metadata, self)) { 5166 listener = user_notif_syscall(nr, notification_restart_flags(variant)); 5167 if (listener < 0) 5168 _exit(1); 5169 cmsg = CMSG_FIRSTHDR(&msg); 5170 cmsg->cmsg_level = SOL_SOCKET; 5171 cmsg->cmsg_type = SCM_RIGHTS; 5172 cmsg->cmsg_len = CMSG_LEN(sizeof(listener)); 5173 memcpy(CMSG_DATA(cmsg), &listener, sizeof(listener)); 5174 if (sendmsg(handled, &msg, 0) != 1) 5175 _exit(1); 5176 return true; 5177 } 5178 5179 ASSERT_EQ(recvmsg(self->sync[0], &msg, 0), 1); 5180 ASSERT_FALSE(msg.msg_flags & MSG_CTRUNC); 5181 cmsg = CMSG_FIRSTHDR(&msg); 5182 ASSERT_NE(cmsg, NULL); 5183 ASSERT_EQ(cmsg->cmsg_level, SOL_SOCKET); 5184 ASSERT_EQ(cmsg->cmsg_type, SCM_RIGHTS); 5185 ASSERT_EQ(cmsg->cmsg_len, CMSG_LEN(sizeof(listener))); 5186 memcpy(&self->listener, CMSG_DATA(cmsg), sizeof(self->listener)); 5187 return false; 5188 } 5189 5190 /* 5191 * Interrupt the child's notification before it is received. Without the 5192 * restart flag the syscall fails with EINTR. With it, the restarted 5193 * syscall is notified again, allowed to continue, and succeeds. 5194 */ 5195 static void 5196 notification_restart_interrupt(struct __test_metadata *_metadata, 5197 struct _test_data_notification_restart *self, 5198 const FIXTURE_VARIANT(notification_restart) *variant) 5199 { 5200 struct seccomp_notif req = {}; 5201 struct seccomp_notif_resp resp = {}; 5202 5203 notification_pending(_metadata, self->listener); 5204 notification_signal(_metadata, self); 5205 if (!variant->restart) { 5206 notification_result(_metadata, self, -1, EINTR); 5207 return; 5208 } 5209 notification_pending(_metadata, self->listener); 5210 ASSERT_EQ(ioctl(self->listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 5211 EXPECT_EQ(req.pid, self->pid); 5212 resp.id = req.id; 5213 resp.flags = SECCOMP_USER_NOTIF_FLAG_CONTINUE; 5214 ASSERT_EQ(ioctl(self->listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 5215 notification_result(_metadata, self, 0, 0); 5216 } 5217 5218 /* A successful clone3() must have created exactly one child. */ 5219 static __noreturn void notification_restart_clone_child(void) 5220 { 5221 /* 5222 * glibc's fork() blocks all signals across clone(), so the 5223 * notification wait could not be interrupted: call clone3() 5224 * directly instead. 5225 */ 5226 struct __clone_args args = { .exit_signal = SIGCHLD }; 5227 int status; 5228 long ret; 5229 5230 ret = sys_clone3(&args, sizeof(args)); 5231 if (ret == 0) 5232 _exit(0); 5233 if (ret > 0) { 5234 if (waitpid(ret, &status, 0) != ret || !WIFEXITED(status) || 5235 WEXITSTATUS(status) != 0) 5236 _exit(2); 5237 if (waitpid(-1, NULL, WNOHANG) != -1 || errno != ECHILD) 5238 _exit(3); 5239 ret = 0; 5240 } 5241 notification_report(ret, errno); 5242 } 5243 5244 /* close() must release the descriptor exactly when it succeeds. */ 5245 static __noreturn void notification_restart_close_child(void) 5246 { 5247 int fd, err; 5248 long ret; 5249 5250 fd = open("/dev/null", O_RDONLY); 5251 if (fd < 0) 5252 _exit(1); 5253 ret = close(fd); 5254 err = errno; 5255 if ((fcntl(fd, F_GETFD) == -1) != (ret == 0)) 5256 _exit(2); 5257 notification_report(ret, err); 5258 } 5259 5260 TEST_F(notification_restart, clone) 5261 { 5262 if (__NR_clone3 < 0) 5263 SKIP(return, "Test not built with clone3 support"); 5264 /* Some container profiles reject clone3() with ENOSYS. */ 5265 if (sys_clone3(NULL, 0) == -1 && errno == ENOSYS) 5266 SKIP(return, "clone3() is not available"); 5267 5268 if (notification_restart_filtered(_metadata, self, variant, __NR_clone3)) 5269 notification_restart_clone_child(); 5270 notification_restart_interrupt(_metadata, self, variant); 5271 } 5272 5273 TEST_F(notification_restart, close) 5274 { 5275 if (notification_restart_filtered(_metadata, self, variant, __NR_close)) 5276 notification_restart_close_child(); 5277 notification_restart_interrupt(_metadata, self, variant); 5278 } 5279 5280 TEST_F(notification_restart, fatal_signal) 5281 { 5282 int status; 5283 5284 notification_restart_child(_metadata, self); 5285 notification_pending(_metadata, self->listener); 5286 ASSERT_EQ(kill(self->pid, SIGKILL), 0); 5287 ASSERT_EQ(waitpid(self->pid, &status, 0), self->pid); 5288 self->pid = -1; 5289 ASSERT_TRUE(WIFSIGNALED(status)); 5290 EXPECT_EQ(WTERMSIG(status), SIGKILL); 5291 } 5292 5293 TEST_F(notification_restart, listener_closed) 5294 { 5295 notification_restart_child(_metadata, self); 5296 notification_pending(_metadata, self->listener); 5297 ASSERT_EQ(close(self->listener), 0); 5298 self->listener = -1; 5299 notification_result(_metadata, self, -1, ENOSYS); 5300 } 5301 5302 TEST(user_notification_restart_requires_listener) 5303 { 5304 ASSERT_EQ(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0); 5305 EXPECT_EQ(user_notif_syscall(__NR_getppid, 5306 SECCOMP_FILTER_FLAG_RESTART_BEFORE_RECV), -1); 5307 EXPECT_EQ(errno, EINVAL); 5308 } 5309 5310 /* Ensure non-fatal signals prior to receive are unmodified */ 5311 TEST(user_notification_wait_killable_pre_notification) 5312 { 5313 struct sigaction new_action = { 5314 .sa_handler = signal_handler, 5315 }; 5316 int listener, status, sk_pair[2]; 5317 pid_t pid; 5318 long ret; 5319 char c; 5320 /* 100 ms */ 5321 struct timespec delay = { .tv_nsec = 100000000 }; 5322 5323 ASSERT_EQ(sigemptyset(&new_action.sa_mask), 0); 5324 5325 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 5326 ASSERT_EQ(0, ret) 5327 { 5328 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 5329 } 5330 5331 ASSERT_EQ(socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair), 0); 5332 5333 listener = user_notif_syscall( 5334 __NR_getppid, SECCOMP_FILTER_FLAG_NEW_LISTENER | 5335 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV); 5336 ASSERT_GE(listener, 0); 5337 5338 /* 5339 * Check that we can kill the process with SIGUSR1 prior to receiving 5340 * the notification. SIGUSR1 is wired up to a custom signal handler, 5341 * and make sure it gets called. 5342 */ 5343 pid = fork(); 5344 ASSERT_GE(pid, 0); 5345 5346 if (pid == 0) { 5347 close(sk_pair[0]); 5348 handled = sk_pair[1]; 5349 5350 /* Setup the non-fatal sigaction without SA_RESTART */ 5351 if (sigaction(SIGUSR1, &new_action, NULL)) { 5352 perror("sigaction"); 5353 exit(1); 5354 } 5355 5356 ret = syscall(__NR_getppid); 5357 /* Make sure we got a return from a signal interruption */ 5358 exit(ret != -1 || errno != EINTR); 5359 } 5360 5361 /* 5362 * Make sure we've gotten to the seccomp user notification wait 5363 * from getppid prior to sending any signals 5364 */ 5365 while (get_proc_syscall(_metadata, pid) != __NR_getppid && 5366 get_proc_stat(_metadata, pid) != 'S') 5367 nanosleep(&delay, NULL); 5368 5369 /* Send non-fatal kill signal */ 5370 EXPECT_EQ(kill(pid, SIGUSR1), 0); 5371 5372 /* wait for process to exit (exit checks for EINTR) */ 5373 EXPECT_EQ(waitpid(pid, &status, 0), pid); 5374 EXPECT_EQ(true, WIFEXITED(status)); 5375 EXPECT_EQ(0, WEXITSTATUS(status)); 5376 5377 EXPECT_EQ(read(sk_pair[0], &c, 1), 1); 5378 } 5379 5380 /* Ensure non-fatal signals after receive are blocked */ 5381 TEST(user_notification_wait_killable) 5382 { 5383 struct sigaction new_action = { 5384 .sa_handler = signal_handler, 5385 }; 5386 struct seccomp_notif_resp resp = {}; 5387 struct seccomp_notif req = {}; 5388 int listener, status, sk_pair[2]; 5389 pid_t pid; 5390 long ret; 5391 char c; 5392 /* 100 ms */ 5393 struct timespec delay = { .tv_nsec = 100000000 }; 5394 5395 ASSERT_EQ(sigemptyset(&new_action.sa_mask), 0); 5396 5397 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 5398 ASSERT_EQ(0, ret) 5399 { 5400 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 5401 } 5402 5403 ASSERT_EQ(socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair), 0); 5404 5405 listener = user_notif_syscall( 5406 __NR_getppid, SECCOMP_FILTER_FLAG_NEW_LISTENER | 5407 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV); 5408 ASSERT_GE(listener, 0); 5409 5410 pid = fork(); 5411 ASSERT_GE(pid, 0); 5412 5413 if (pid == 0) { 5414 close(sk_pair[0]); 5415 handled = sk_pair[1]; 5416 5417 /* Setup the sigaction without SA_RESTART */ 5418 if (sigaction(SIGUSR1, &new_action, NULL)) { 5419 perror("sigaction"); 5420 exit(1); 5421 } 5422 5423 /* Make sure that the syscall is completed (no EINTR) */ 5424 ret = syscall(__NR_getppid); 5425 exit(ret != USER_NOTIF_MAGIC); 5426 } 5427 5428 /* 5429 * Get the notification, to make move the notifying process into a 5430 * non-preemptible (TASK_KILLABLE) state. 5431 */ 5432 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 5433 /* Send non-fatal kill signal */ 5434 EXPECT_EQ(kill(pid, SIGUSR1), 0); 5435 5436 /* 5437 * Make sure the task enters moves to TASK_KILLABLE by waiting for 5438 * D (Disk Sleep) state after receiving non-fatal signal. 5439 */ 5440 while (get_proc_stat(_metadata, pid) != 'D') 5441 nanosleep(&delay, NULL); 5442 5443 resp.id = req.id; 5444 resp.val = USER_NOTIF_MAGIC; 5445 /* Make sure the notification is found and able to be replied to */ 5446 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); 5447 5448 /* 5449 * Make sure that the signal handler does get called once we're back in 5450 * userspace. 5451 */ 5452 EXPECT_EQ(read(sk_pair[0], &c, 1), 1); 5453 /* wait for process to exit (exit checks for USER_NOTIF_MAGIC) */ 5454 EXPECT_EQ(waitpid(pid, &status, 0), pid); 5455 EXPECT_EQ(true, WIFEXITED(status)); 5456 EXPECT_EQ(0, WEXITSTATUS(status)); 5457 } 5458 5459 /* Ensure fatal signals after receive are not blocked */ 5460 TEST(user_notification_wait_killable_fatal) 5461 { 5462 struct seccomp_notif req = {}; 5463 int listener, status; 5464 pid_t pid; 5465 long ret; 5466 /* 100 ms */ 5467 struct timespec delay = { .tv_nsec = 100000000 }; 5468 5469 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 5470 ASSERT_EQ(0, ret) 5471 { 5472 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 5473 } 5474 5475 listener = user_notif_syscall( 5476 __NR_getppid, SECCOMP_FILTER_FLAG_NEW_LISTENER | 5477 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV); 5478 ASSERT_GE(listener, 0); 5479 5480 pid = fork(); 5481 ASSERT_GE(pid, 0); 5482 5483 if (pid == 0) { 5484 /* This should never complete as it should get a SIGTERM */ 5485 syscall(__NR_getppid); 5486 exit(1); 5487 } 5488 5489 while (get_proc_stat(_metadata, pid) != 'S') 5490 nanosleep(&delay, NULL); 5491 5492 /* 5493 * Get the notification, to make move the notifying process into a 5494 * non-preemptible (TASK_KILLABLE) state. 5495 */ 5496 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); 5497 /* Kill the process with a fatal signal */ 5498 EXPECT_EQ(kill(pid, SIGTERM), 0); 5499 5500 /* 5501 * Wait for the process to exit, and make sure the process terminated 5502 * due to the SIGTERM signal. 5503 */ 5504 EXPECT_EQ(waitpid(pid, &status, 0), pid); 5505 EXPECT_EQ(true, WIFSIGNALED(status)); 5506 EXPECT_EQ(SIGTERM, WTERMSIG(status)); 5507 } 5508 5509 /* Ensure signals after the reply do not interrupt */ 5510 TEST(user_notification_wait_killable_after_reply) 5511 { 5512 int i, max_iter = 100000; 5513 int listener, status; 5514 int pipe_fds[2]; 5515 pid_t pid; 5516 long ret; 5517 5518 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 5519 ASSERT_EQ(0, ret) 5520 { 5521 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 5522 } 5523 5524 listener = user_notif_syscall( 5525 __NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER | 5526 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV); 5527 ASSERT_GE(listener, 0); 5528 5529 /* 5530 * Used to count invocations. One token is transferred from the child 5531 * to the parent per syscall invocation, the parent tries to take 5532 * one token per successful RECV. If the syscall is restarted after 5533 * RECV the parent will try to get two tokens while the child only 5534 * provided one. 5535 */ 5536 ASSERT_EQ(pipe(pipe_fds), 0); 5537 5538 pid = fork(); 5539 ASSERT_GE(pid, 0); 5540 5541 if (pid == 0) { 5542 struct sigaction new_action = { 5543 .sa_handler = signal_handler_nop, 5544 .sa_flags = SA_RESTART, 5545 }; 5546 struct itimerval timer = { 5547 .it_value = { .tv_usec = 1000 }, 5548 .it_interval = { .tv_usec = 1000 }, 5549 }; 5550 char c = 'a'; 5551 5552 close(pipe_fds[0]); 5553 5554 /* Setup the sigaction with SA_RESTART */ 5555 if (sigaction(SIGALRM, &new_action, NULL)) { 5556 perror("sigaction"); 5557 exit(1); 5558 } 5559 5560 /* 5561 * Kill with SIGALRM repeatedly, to try to hit the race when 5562 * handling the syscall. 5563 */ 5564 if (setitimer(ITIMER_REAL, &timer, NULL) < 0) 5565 perror("setitimer"); 5566 5567 for (i = 0; i < max_iter; ++i) { 5568 int fd; 5569 5570 /* Send one token per iteration to catch repeats. */ 5571 if (write(pipe_fds[1], &c, sizeof(c)) != 1) { 5572 perror("write"); 5573 exit(1); 5574 } 5575 5576 fd = syscall(__NR_dup, 0); 5577 if (fd < 0) { 5578 perror("dup"); 5579 exit(1); 5580 } 5581 close(fd); 5582 } 5583 5584 exit(0); 5585 } 5586 5587 close(pipe_fds[1]); 5588 5589 for (i = 0; i < max_iter; ++i) { 5590 struct seccomp_notif req = {}; 5591 struct seccomp_notif_addfd addfd = {}; 5592 struct pollfd pfd = { 5593 .fd = pipe_fds[0], 5594 .events = POLLIN, 5595 }; 5596 char c; 5597 5598 /* 5599 * Try to receive one token. If it failed, one child syscall 5600 * was restarted after RECV and needed to be handled twice. 5601 */ 5602 ASSERT_EQ(poll(&pfd, 1, 1000), 1) 5603 kill(pid, SIGKILL); 5604 5605 ASSERT_EQ(read(pipe_fds[0], &c, sizeof(c)), 1) 5606 kill(pid, SIGKILL); 5607 5608 /* 5609 * Get the notification, reply to it as fast as possible to test 5610 * whether the child wrongly skips going into the non-preemptible 5611 * (TASK_KILLABLE) state. 5612 */ 5613 do 5614 ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req); 5615 while (ret < 0 && errno == ENOENT); /* Accept interruptions before RECV */ 5616 ASSERT_EQ(ret, 0) 5617 kill(pid, SIGKILL); 5618 5619 addfd.id = req.id; 5620 addfd.flags = SECCOMP_ADDFD_FLAG_SEND; 5621 addfd.srcfd = 0; 5622 ASSERT_GE(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), 0) 5623 kill(pid, SIGKILL); 5624 } 5625 5626 /* 5627 * Wait for the process to exit, and make sure the process terminated 5628 * with a zero exit code.. 5629 */ 5630 EXPECT_EQ(waitpid(pid, &status, 0), pid); 5631 EXPECT_EQ(true, WIFEXITED(status)); 5632 EXPECT_EQ(0, WEXITSTATUS(status)); 5633 } 5634 5635 struct tsync_vs_thread_leader_args { 5636 pthread_t leader; 5637 }; 5638 5639 static void *tsync_vs_dead_thread_leader_sibling(void *_args) 5640 { 5641 struct sock_filter allow_filter[] = { 5642 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 5643 }; 5644 struct sock_fprog allow_prog = { 5645 .len = (unsigned short)ARRAY_SIZE(allow_filter), 5646 .filter = allow_filter, 5647 }; 5648 struct tsync_vs_thread_leader_args *args = _args; 5649 void *retval; 5650 long ret; 5651 5652 ret = pthread_join(args->leader, &retval); 5653 if (ret) 5654 exit(1); 5655 if (retval != _args) 5656 exit(2); 5657 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, &allow_prog); 5658 if (ret) 5659 exit(3); 5660 5661 exit(0); 5662 } 5663 5664 /* 5665 * Ensure that a dead thread leader doesn't prevent installing new filters with 5666 * SECCOMP_FILTER_FLAG_TSYNC from other threads. 5667 */ 5668 TEST(tsync_vs_dead_thread_leader) 5669 { 5670 int status; 5671 pid_t pid; 5672 long ret; 5673 5674 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 5675 ASSERT_EQ(0, ret) { 5676 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); 5677 } 5678 5679 pid = fork(); 5680 ASSERT_GE(pid, 0); 5681 5682 if (pid == 0) { 5683 struct sock_filter allow_filter[] = { 5684 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 5685 }; 5686 struct sock_fprog allow_prog = { 5687 .len = (unsigned short)ARRAY_SIZE(allow_filter), 5688 .filter = allow_filter, 5689 }; 5690 struct tsync_vs_thread_leader_args *args; 5691 pthread_t sibling; 5692 5693 args = malloc(sizeof(*args)); 5694 ASSERT_NE(NULL, args); 5695 args->leader = pthread_self(); 5696 5697 ret = pthread_create(&sibling, NULL, 5698 tsync_vs_dead_thread_leader_sibling, args); 5699 ASSERT_EQ(0, ret); 5700 5701 /* Install a new filter just to the leader thread. */ 5702 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &allow_prog); 5703 ASSERT_EQ(0, ret); 5704 pthread_exit(args); 5705 exit(1); 5706 } 5707 5708 EXPECT_EQ(pid, waitpid(pid, &status, 0)); 5709 EXPECT_EQ(0, status); 5710 } 5711 5712 #ifdef __x86_64__ 5713 5714 /* 5715 * We need naked probed_uprobe function. Using __nocf_check 5716 * check to skip possible endbr64 instruction and ignoring 5717 * -Wattributes, otherwise the compilation might fail. 5718 */ 5719 #pragma GCC diagnostic push 5720 #pragma GCC diagnostic ignored "-Wattributes" 5721 5722 __naked __nocf_check noinline int probed_uprobe(void) 5723 { 5724 /* 5725 * Optimized uprobe is possible only on top of nop5 instruction. 5726 */ 5727 asm volatile (" \n" 5728 ".byte 0x0f, 0x1f, 0x44, 0x00, 0x00 \n" 5729 "ret \n" 5730 ); 5731 } 5732 #pragma GCC diagnostic pop 5733 5734 #else 5735 noinline int probed_uprobe(void) 5736 { 5737 return 1; 5738 } 5739 #endif 5740 5741 noinline int probed_uretprobe(void) 5742 { 5743 return 1; 5744 } 5745 5746 static int parse_uint_from_file(const char *file, const char *fmt) 5747 { 5748 int err = -1, ret; 5749 FILE *f; 5750 5751 f = fopen(file, "re"); 5752 if (f) { 5753 err = fscanf(f, fmt, &ret); 5754 fclose(f); 5755 } 5756 return err == 1 ? ret : err; 5757 } 5758 5759 static int determine_uprobe_perf_type(void) 5760 { 5761 const char *file = "/sys/bus/event_source/devices/uprobe/type"; 5762 5763 return parse_uint_from_file(file, "%d\n"); 5764 } 5765 5766 static int determine_uprobe_retprobe_bit(void) 5767 { 5768 const char *file = "/sys/bus/event_source/devices/uprobe/format/retprobe"; 5769 5770 return parse_uint_from_file(file, "config:%d\n"); 5771 } 5772 5773 static ssize_t get_uprobe_offset(const void *addr) 5774 { 5775 size_t start, base, end; 5776 bool found = false; 5777 char buf[256]; 5778 FILE *f; 5779 5780 f = fopen("/proc/self/maps", "r"); 5781 if (!f) 5782 return -1; 5783 5784 while (fscanf(f, "%zx-%zx %s %zx %*[^\n]\n", &start, &end, buf, &base) == 4) { 5785 if (buf[2] == 'x' && (uintptr_t)addr >= start && (uintptr_t)addr < end) { 5786 found = true; 5787 break; 5788 } 5789 } 5790 fclose(f); 5791 return found ? (uintptr_t)addr - start + base : -1; 5792 } 5793 5794 FIXTURE(UPROBE) { 5795 int fd; 5796 }; 5797 5798 FIXTURE_VARIANT(UPROBE) { 5799 /* 5800 * All of the U(RET)PROBE behaviors can be tested with either 5801 * u(ret)probe attached or not 5802 */ 5803 bool attach; 5804 /* 5805 * Test both uprobe and uretprobe. 5806 */ 5807 bool uretprobe; 5808 }; 5809 5810 FIXTURE_VARIANT_ADD(UPROBE, not_attached) { 5811 .attach = false, 5812 .uretprobe = false, 5813 }; 5814 5815 FIXTURE_VARIANT_ADD(UPROBE, uprobe_attached) { 5816 .attach = true, 5817 .uretprobe = false, 5818 }; 5819 5820 FIXTURE_VARIANT_ADD(UPROBE, uretprobe_attached) { 5821 .attach = true, 5822 .uretprobe = true, 5823 }; 5824 5825 FIXTURE_SETUP(UPROBE) 5826 { 5827 const size_t attr_sz = sizeof(struct perf_event_attr); 5828 struct perf_event_attr attr; 5829 ssize_t offset; 5830 int type, bit; 5831 5832 #if !defined(__NR_uprobe) || !defined(__NR_uretprobe) 5833 SKIP(return, "__NR_uprobe ot __NR_uretprobe syscalls not defined"); 5834 #endif 5835 5836 if (!variant->attach) 5837 return; 5838 5839 memset(&attr, 0, attr_sz); 5840 5841 type = determine_uprobe_perf_type(); 5842 ASSERT_GE(type, 0); 5843 5844 if (variant->uretprobe) { 5845 bit = determine_uprobe_retprobe_bit(); 5846 ASSERT_GE(bit, 0); 5847 } 5848 5849 offset = get_uprobe_offset(variant->uretprobe ? (void *)probed_uretprobe 5850 : (void *)probed_uprobe); 5851 ASSERT_GE(offset, 0); 5852 5853 if (variant->uretprobe) 5854 attr.config |= 1 << bit; 5855 attr.size = attr_sz; 5856 attr.type = type; 5857 attr.config1 = ptr_to_u64("/proc/self/exe"); 5858 attr.config2 = offset; 5859 5860 self->fd = syscall(__NR_perf_event_open, &attr, 5861 getpid() /* pid */, -1 /* cpu */, -1 /* group_fd */, 5862 PERF_FLAG_FD_CLOEXEC); 5863 } 5864 5865 FIXTURE_TEARDOWN(UPROBE) 5866 { 5867 /* we could call close(self->fd), but we'd need extra filter for 5868 * that and since we are calling _exit right away.. 5869 */ 5870 } 5871 5872 static int run_probed_with_filter(struct sock_fprog *prog) 5873 { 5874 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) || 5875 seccomp(SECCOMP_SET_MODE_FILTER, 0, prog)) { 5876 return -1; 5877 } 5878 5879 /* 5880 * Uprobe is optimized after first hit, so let's hit twice. 5881 */ 5882 probed_uprobe(); 5883 probed_uprobe(); 5884 5885 probed_uretprobe(); 5886 return 0; 5887 } 5888 5889 TEST_F(UPROBE, uprobe_default_allow) 5890 { 5891 struct sock_filter filter[] = { 5892 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 5893 }; 5894 struct sock_fprog prog = { 5895 .len = (unsigned short)ARRAY_SIZE(filter), 5896 .filter = filter, 5897 }; 5898 5899 ASSERT_EQ(0, run_probed_with_filter(&prog)); 5900 } 5901 5902 TEST_F(UPROBE, uprobe_default_block) 5903 { 5904 struct sock_filter filter[] = { 5905 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 5906 offsetof(struct seccomp_data, nr)), 5907 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_exit_group, 1, 0), 5908 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), 5909 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 5910 }; 5911 struct sock_fprog prog = { 5912 .len = (unsigned short)ARRAY_SIZE(filter), 5913 .filter = filter, 5914 }; 5915 5916 ASSERT_EQ(0, run_probed_with_filter(&prog)); 5917 } 5918 5919 TEST_F(UPROBE, uprobe_block_syscall) 5920 { 5921 struct sock_filter filter[] = { 5922 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 5923 offsetof(struct seccomp_data, nr)), 5924 #ifdef __NR_uprobe 5925 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_uprobe, 1, 2), 5926 #endif 5927 #ifdef __NR_uretprobe 5928 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_uretprobe, 0, 1), 5929 #endif 5930 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), 5931 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 5932 }; 5933 struct sock_fprog prog = { 5934 .len = (unsigned short)ARRAY_SIZE(filter), 5935 .filter = filter, 5936 }; 5937 5938 ASSERT_EQ(0, run_probed_with_filter(&prog)); 5939 } 5940 5941 TEST_F(UPROBE, uprobe_default_block_with_syscall) 5942 { 5943 struct sock_filter filter[] = { 5944 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 5945 offsetof(struct seccomp_data, nr)), 5946 #ifdef __NR_uprobe 5947 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_uprobe, 3, 0), 5948 #endif 5949 #ifdef __NR_uretprobe 5950 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_uretprobe, 2, 0), 5951 #endif 5952 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_exit_group, 1, 0), 5953 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL), 5954 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 5955 }; 5956 struct sock_fprog prog = { 5957 .len = (unsigned short)ARRAY_SIZE(filter), 5958 .filter = filter, 5959 }; 5960 5961 ASSERT_EQ(0, run_probed_with_filter(&prog)); 5962 } 5963 5964 /* 5965 * TODO: 5966 * - expand NNP testing 5967 * - better arch-specific TRACE and TRAP handlers. 5968 * - endianness checking when appropriate 5969 * - 64-bit arg prodding 5970 * - arch value testing (x86 modes especially) 5971 * - verify that FILTER_FLAG_LOG filters generate log messages 5972 * - verify that RET_LOG generates log messages 5973 */ 5974 5975 TEST_HARNESS_MAIN 5976