selftests/seccomp/seccomp_bpf.c

1060 	memset(&self->prog, 0, sizeof(self->prog));
1061 	self->prog.filter = malloc(sizeof(filter));
1062 	ASSERT_NE(NULL, self->prog.filter);
1063 	memcpy(self->prog.filter, filter, sizeof(filter));
1064 	self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1069 	if (self->prog.filter)
1070 		free(self->prog.filter);
1080 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1095 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1131 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1207 	memset(self, 0, sizeof(*self));
1209 	self->_x.filter = malloc(sizeof(_x##_insns)); \
1210 	ASSERT_NE(NULL, self->_x.filter); \
1211 	memcpy(self->_x.filter, &_x##_insns, sizeof(_x##_insns)); \
1212 	self->_x.len = (unsigned short)ARRAY_SIZE(_x##_insns)
1223 #define FILTER_FREE(_x) if (self->_x.filter) free(self->_x.filter)
1241 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1243 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1245 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1247 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1249 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1251 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1267 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1269 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1271 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1273 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1275 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1277 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1296 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1298 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1300 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1302 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1304 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1306 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1323 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1325 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1327 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1329 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1331 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1348 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1350 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1352 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1354 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1356 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1373 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1375 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1377 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1379 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1395 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1397 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1399 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1401 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1417 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1419 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1421 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1438 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1440 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1442 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1460 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1462 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1480 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1482 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1674 	self->poked = 0;
1675 	memset(&self->prog, 0, sizeof(self->prog));
1676 	self->prog.filter = malloc(sizeof(filter));
1677 	ASSERT_NE(NULL, self->prog.filter);
1678 	memcpy(self->prog.filter, filter, sizeof(filter));
1679 	self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1682 	self->tracer_args.poke_addr = (unsigned long)&self->poked;
1685 	self->tracer = setup_trace_fixture(_metadata, tracer_poke,
1686 					   &self->tracer_args, false);
1691 	teardown_trace_fixture(_metadata, self->tracer);
1692 	if (self->prog.filter)
1693 		free(self->prog.filter);
1703 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1706 	EXPECT_EQ(0, self->poked);
1709 	EXPECT_EQ(0x1001, self->poked);
1719 	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1722 	EXPECT_EQ(0, self->poked);
1724 	EXPECT_EQ(0, self->poked);
2048 	FIXTURE_DATA(TRACE_syscall) *self = args;
2075 		self->syscall_nr = get_syscall(_metadata, tracee);
2087 	switch (self->syscall_nr) {
2149 	self->mytid = syscall(__NR_gettid);
2150 	ASSERT_GT(self->mytid, 0);
2151 	ASSERT_NE(self->mytid, 1) {
2155 	self->mypid = getpid();
2156 	ASSERT_GT(self->mypid, 0);
2157 	ASSERT_EQ(self->mytid, self->mypid);
2159 	self->parent = getppid();
2160 	ASSERT_GT(self->parent, 0);
2161 	ASSERT_NE(self->parent, self->mypid);
2164 	self->tracer = setup_trace_fixture(_metadata,
2167 					   self, variant->use_ptrace);
2182 	teardown_trace_fixture(_metadata, self->tracer);
2211 	EXPECT_EQ(self->parent, syscall(__NR_getppid));
2212 	EXPECT_NE(self->mypid, syscall(__NR_getppid));
2218 	EXPECT_EQ(self->parent, syscall(__NR_getpid));
2219 	EXPECT_NE(self->mypid, syscall(__NR_getpid));
2302 	EXPECT_NE(self->mypid, syscall(__NR_getpid));
2562 	memset(&self->root_prog, 0, sizeof(self->root_prog));
2563 	memset(&self->apply_prog, 0, sizeof(self->apply_prog));
2564 	memset(&self->sibling, 0, sizeof(self->sibling));
2565 	self->root_prog.filter = malloc(sizeof(root_filter));
2566 	ASSERT_NE(NULL, self->root_prog.filter);
2567 	memcpy(self->root_prog.filter, &root_filter, sizeof(root_filter));
2568 	self->root_prog.len = (unsigned short)ARRAY_SIZE(root_filter);
2570 	self->apply_prog.filter = malloc(sizeof(apply_filter));
2571 	ASSERT_NE(NULL, self->apply_prog.filter);
2572 	memcpy(self->apply_prog.filter, &apply_filter, sizeof(apply_filter));
2573 	self->apply_prog.len = (unsigned short)ARRAY_SIZE(apply_filter);
2575 	self->sibling_count = 0;
2576 	pthread_mutex_init(&self->mutex, NULL);
2577 	pthread_cond_init(&self->cond, NULL);
2578 	sem_init(&self->started, 0, 0);
2579 	self->sibling[0].tid = 0;
2580 	self->sibling[0].cond = &self->cond;
2581 	self->sibling[0].started = &self->started;
2582 	self->sibling[0].mutex = &self->mutex;
2583 	self->sibling[0].diverge = 0;
2584 	self->sibling[0].num_waits = 1;
2585 	self->sibling[0].prog = &self->root_prog;
2586 	self->sibling[0].metadata = _metadata;
2587 	self->sibling[1].tid = 0;
2588 	self->sibling[1].cond = &self->cond;
2589 	self->sibling[1].started = &self->started;
2590 	self->sibling[1].mutex = &self->mutex;
2591 	self->sibling[1].diverge = 0;
2592 	self->sibling[1].prog = &self->root_prog;
2593 	self->sibling[1].num_waits = 1;
2594 	self->sibling[1].metadata = _metadata;
2601 	if (self->root_prog.filter)
2602 		free(self->root_prog.filter);
2603 	if (self->apply_prog.filter)
2604 		free(self->apply_prog.filter);
2606 	for ( ; sib < self->sibling_count; ++sib) {
2607 		struct tsync_sibling *s = &self->sibling[sib];
2617 	pthread_mutex_destroy(&self->mutex);
2618 	pthread_cond_destroy(&self->cond);
2619 	sem_destroy(&self->started);
2688 	self->sibling[0].diverge = 1;
2689 	tsync_start_sibling(&self->sibling[0]);
2690 	tsync_start_sibling(&self->sibling[1]);
2692 	while (self->sibling_count < TSYNC_SIBLINGS) {
2693 		sem_wait(&self->started);
2694 		self->sibling_count++;
2698 	pthread_mutex_lock(&self->mutex);
2699 	ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2702 	pthread_mutex_unlock(&self->mutex);
2705 	PTHREAD_JOIN(self->sibling[0].tid, &status);
2707 	PTHREAD_JOIN(self->sibling[1].tid, &status);
2720 	ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2727 	tsync_start_sibling(&self->sibling[0]);
2728 	tsync_start_sibling(&self->sibling[1]);
2730 	while (self->sibling_count < TSYNC_SIBLINGS) {
2731 		sem_wait(&self->started);
2732 		self->sibling_count++;
2736 		      &self->apply_prog);
2741 	pthread_mutex_lock(&self->mutex);
2742 	ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2745 	pthread_mutex_unlock(&self->mutex);
2747 	PTHREAD_JOIN(self->sibling[0].tid, &status);
2749 	PTHREAD_JOIN(self->sibling[1].tid, &status);
2758 	tsync_start_sibling(&self->sibling[0]);
2759 	tsync_start_sibling(&self->sibling[1]);
2760 	while (self->sibling_count < TSYNC_SIBLINGS) {
2761 		sem_wait(&self->started);
2762 		self->sibling_count++;
2766 	pthread_mutex_lock(&self->mutex);
2767 	ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2770 	pthread_mutex_unlock(&self->mutex);
2773 	PTHREAD_JOIN(self->sibling[0].tid, &status);
2775 	PTHREAD_JOIN(self->sibling[1].tid, &status);
2785 	tsync_start_sibling(&self->sibling[0]);
2786 	tsync_start_sibling(&self->sibling[1]);
2787 	while (self->sibling_count < TSYNC_SIBLINGS) {
2788 		sem_wait(&self->started);
2789 		self->sibling_count++;
2797 		      &self->apply_prog);
2806 	pthread_mutex_lock(&self->mutex);
2807 	ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2810 	pthread_mutex_unlock(&self->mutex);
2813 	PTHREAD_JOIN(self->sibling[0].tid, &status);
2815 	PTHREAD_JOIN(self->sibling[1].tid, &status);
2828 	ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2835 	self->sibling[0].diverge = 1;
2836 	tsync_start_sibling(&self->sibling[0]);
2837 	tsync_start_sibling(&self->sibling[1]);
2839 	while (self->sibling_count < TSYNC_SIBLINGS) {
2840 		sem_wait(&self->started);
2841 		self->sibling_count++;
2845 		      &self->apply_prog);
2846 	ASSERT_EQ(self->sibling[0].system_tid, ret) {
2851 	pthread_mutex_lock(&self->mutex);
2852 	ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2855 	pthread_mutex_unlock(&self->mutex);
2858 	PTHREAD_JOIN(self->sibling[0].tid, &status);
2860 	PTHREAD_JOIN(self->sibling[1].tid, &status);
2873 	ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2880 	self->sibling[0].diverge = 1;
2881 	tsync_start_sibling(&self->sibling[0]);
2882 	tsync_start_sibling(&self->sibling[1]);
2884 	while (self->sibling_count < TSYNC_SIBLINGS) {
2885 		sem_wait(&self->started);
2886 		self->sibling_count++;
2891 	ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &self->apply_prog);
2900 	pthread_mutex_lock(&self->mutex);
2901 	ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2904 	pthread_mutex_unlock(&self->mutex);
2907 	PTHREAD_JOIN(self->sibling[0].tid, &status);
2909 	PTHREAD_JOIN(self->sibling[1].tid, &status);
2929 	self->sibling[0].diverge = 1;
2930 	tsync_start_sibling(&self->sibling[0]);
2931 	tsync_start_sibling(&self->sibling[1]);
2933 	while (self->sibling_count < TSYNC_SIBLINGS) {
2934 		sem_wait(&self->started);
2935 		self->sibling_count++;
2938 	ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2947 		      &self->apply_prog);
2948 	ASSERT_EQ(ret, self->sibling[0].system_tid) {
2952 	if (ret == self->sibling[0].system_tid)
2955 	pthread_mutex_lock(&self->mutex);
2960 	self->sibling[!sib].num_waits += 1;
2963 	ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2966 	pthread_mutex_unlock(&self->mutex);
2967 	PTHREAD_JOIN(self->sibling[sib].tid, &status);
2970 	while (!kill(self->sibling[sib].system_tid, 0))
2976 		      &self->apply_prog);
2981 	pthread_mutex_lock(&self->mutex);
2986 	if (self->sibling[sib].num_waits > 1)
2987 		self->sibling[sib].num_waits = 1;
2988 	ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2991 	pthread_mutex_unlock(&self->mutex);
2992 	PTHREAD_JOIN(self->sibling[sib].tid, &status);
2995 	while (!kill(self->sibling[sib].system_tid, 0))
2999 		      &self->apply_prog);
3841 		pid_t self;
3849 		self = getpid();
3850 		ASSERT_EQ(filecmp(self, self, pipe_fds[0], dup_fd), 0);
4354 	self->pid = 0;
4366 	self->pid = fork();
4367 	ASSERT_GE(self->pid, 0);
4369 	if (self->pid == 0) {
4378 	if (self->pid)
4379 		kill(self->pid, SIGKILL);
4386 	ASSERT_EQ(0, ptrace(PTRACE_ATTACH, self->pid, NULL, 0));
4387 	ASSERT_EQ(self->pid, wait(&wstatus));
4388 	ASSERT_EQ(-1, ptrace(PTRACE_SETOPTIONS, self->pid, NULL, PTRACE_O_SUSPEND_SECCOMP));
4398 	ret = ptrace(PTRACE_SEIZE, self->pid, NULL, PTRACE_O_SUSPEND_SECCOMP);