1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
4 *
5 * Test code for seccomp bpf.
6 */
7
8 #define _GNU_SOURCE
9 #include <sys/types.h>
10
11 /*
12 * glibc 2.26 and later have SIGSYS in siginfo_t. Before that,
13 * we need to use the kernel's siginfo.h file and trick glibc
14 * into accepting it.
15 */
16 #if defined(__GLIBC_PREREQ)
17 #if !__GLIBC_PREREQ(2, 26)
18 # include <asm/siginfo.h>
19 # define __have_siginfo_t 1
20 # define __have_sigval_t 1
21 # define __have_sigevent_t 1
22 #endif
23 #endif
24
25 #include <errno.h>
26 #include <linux/filter.h>
27 #include <sys/prctl.h>
28 #include <sys/ptrace.h>
29 #include <sys/user.h>
30 #include <linux/prctl.h>
31 #include <linux/ptrace.h>
32 #include <linux/seccomp.h>
33 #include <pthread.h>
34 #include <semaphore.h>
35 #include <signal.h>
36 #include <stddef.h>
37 #include <stdbool.h>
38 #include <string.h>
39 #include <time.h>
40 #include <limits.h>
41 #include <linux/elf.h>
42 #include <sys/uio.h>
43 #include <sys/utsname.h>
44 #include <sys/fcntl.h>
45 #include <sys/mman.h>
46 #include <sys/times.h>
47 #include <sys/socket.h>
48 #include <sys/ioctl.h>
49 #include <linux/kcmp.h>
50 #include <sys/resource.h>
51
52 #include <unistd.h>
53 #include <sys/syscall.h>
54 #include <poll.h>
55
56 #include "../kselftest_harness.h"
57 #include "../clone3/clone3_selftests.h"
58
59 /* Attempt to de-conflict with the selftests tree. */
60 #ifndef SKIP
61 #define SKIP(s, ...) XFAIL(s, ##__VA_ARGS__)
62 #endif
63
64 #ifndef PR_SET_PTRACER
65 # define PR_SET_PTRACER 0x59616d61
66 #endif
67
68 #ifndef PR_SET_NO_NEW_PRIVS
69 #define PR_SET_NO_NEW_PRIVS 38
70 #define PR_GET_NO_NEW_PRIVS 39
71 #endif
72
73 #ifndef PR_SECCOMP_EXT
74 #define PR_SECCOMP_EXT 43
75 #endif
76
77 #ifndef SECCOMP_EXT_ACT
78 #define SECCOMP_EXT_ACT 1
79 #endif
80
81 #ifndef SECCOMP_EXT_ACT_TSYNC
82 #define SECCOMP_EXT_ACT_TSYNC 1
83 #endif
84
85 #ifndef SECCOMP_MODE_STRICT
86 #define SECCOMP_MODE_STRICT 1
87 #endif
88
89 #ifndef SECCOMP_MODE_FILTER
90 #define SECCOMP_MODE_FILTER 2
91 #endif
92
93 #ifndef SECCOMP_RET_ALLOW
94 struct seccomp_data {
95 int nr;
96 __u32 arch;
97 __u64 instruction_pointer;
98 __u64 args[6];
99 };
100 #endif
101
102 #ifndef SECCOMP_RET_KILL_PROCESS
103 #define SECCOMP_RET_KILL_PROCESS 0x80000000U /* kill the process */
104 #define SECCOMP_RET_KILL_THREAD 0x00000000U /* kill the thread */
105 #endif
106 #ifndef SECCOMP_RET_KILL
107 #define SECCOMP_RET_KILL SECCOMP_RET_KILL_THREAD
108 #define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */
109 #define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */
110 #define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */
111 #define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */
112 #endif
113 #ifndef SECCOMP_RET_LOG
114 #define SECCOMP_RET_LOG 0x7ffc0000U /* allow after logging */
115 #endif
116
117 #ifndef __NR_seccomp
118 # if defined(__i386__)
119 # define __NR_seccomp 354
120 # elif defined(__x86_64__)
121 # define __NR_seccomp 317
122 # elif defined(__arm__)
123 # define __NR_seccomp 383
124 # elif defined(__aarch64__)
125 # define __NR_seccomp 277
126 # elif defined(__riscv)
127 # define __NR_seccomp 277
128 # elif defined(__csky__)
129 # define __NR_seccomp 277
130 # elif defined(__hppa__)
131 # define __NR_seccomp 338
132 # elif defined(__powerpc__)
133 # define __NR_seccomp 358
134 # elif defined(__s390__)
135 # define __NR_seccomp 348
136 # elif defined(__xtensa__)
137 # define __NR_seccomp 337
138 # elif defined(__sh__)
139 # define __NR_seccomp 372
140 # else
141 # warning "seccomp syscall number unknown for this architecture"
142 # define __NR_seccomp 0xffff
143 # endif
144 #endif
145
146 #ifndef SECCOMP_SET_MODE_STRICT
147 #define SECCOMP_SET_MODE_STRICT 0
148 #endif
149
150 #ifndef SECCOMP_SET_MODE_FILTER
151 #define SECCOMP_SET_MODE_FILTER 1
152 #endif
153
154 #ifndef SECCOMP_GET_ACTION_AVAIL
155 #define SECCOMP_GET_ACTION_AVAIL 2
156 #endif
157
158 #ifndef SECCOMP_GET_NOTIF_SIZES
159 #define SECCOMP_GET_NOTIF_SIZES 3
160 #endif
161
162 #ifndef SECCOMP_FILTER_FLAG_TSYNC
163 #define SECCOMP_FILTER_FLAG_TSYNC (1UL << 0)
164 #endif
165
166 #ifndef SECCOMP_FILTER_FLAG_LOG
167 #define SECCOMP_FILTER_FLAG_LOG (1UL << 1)
168 #endif
169
170 #ifndef SECCOMP_FILTER_FLAG_SPEC_ALLOW
171 #define SECCOMP_FILTER_FLAG_SPEC_ALLOW (1UL << 2)
172 #endif
173
174 #ifndef PTRACE_SECCOMP_GET_METADATA
175 #define PTRACE_SECCOMP_GET_METADATA 0x420d
176
177 struct seccomp_metadata {
178 __u64 filter_off; /* Input: which filter */
179 __u64 flags; /* Output: filter's flags */
180 };
181 #endif
182
183 #ifndef SECCOMP_FILTER_FLAG_NEW_LISTENER
184 #define SECCOMP_FILTER_FLAG_NEW_LISTENER (1UL << 3)
185 #endif
186
187 #ifndef SECCOMP_RET_USER_NOTIF
188 #define SECCOMP_RET_USER_NOTIF 0x7fc00000U
189
190 #define SECCOMP_IOC_MAGIC '!'
191 #define SECCOMP_IO(nr) _IO(SECCOMP_IOC_MAGIC, nr)
192 #define SECCOMP_IOR(nr, type) _IOR(SECCOMP_IOC_MAGIC, nr, type)
193 #define SECCOMP_IOW(nr, type) _IOW(SECCOMP_IOC_MAGIC, nr, type)
194 #define SECCOMP_IOWR(nr, type) _IOWR(SECCOMP_IOC_MAGIC, nr, type)
195
196 /* Flags for seccomp notification fd ioctl. */
197 #define SECCOMP_IOCTL_NOTIF_RECV SECCOMP_IOWR(0, struct seccomp_notif)
198 #define SECCOMP_IOCTL_NOTIF_SEND SECCOMP_IOWR(1, \
199 struct seccomp_notif_resp)
200 #define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOW(2, __u64)
201
202 struct seccomp_notif {
203 __u64 id;
204 __u32 pid;
205 __u32 flags;
206 struct seccomp_data data;
207 };
208
209 struct seccomp_notif_resp {
210 __u64 id;
211 __s64 val;
212 __s32 error;
213 __u32 flags;
214 };
215
216 struct seccomp_notif_sizes {
217 __u16 seccomp_notif;
218 __u16 seccomp_notif_resp;
219 __u16 seccomp_data;
220 };
221 #endif
222
223 #ifndef SECCOMP_IOCTL_NOTIF_ADDFD
224 /* On success, the return value is the remote process's added fd number */
225 #define SECCOMP_IOCTL_NOTIF_ADDFD SECCOMP_IOW(3, \
226 struct seccomp_notif_addfd)
227
228 /* valid flags for seccomp_notif_addfd */
229 #define SECCOMP_ADDFD_FLAG_SETFD (1UL << 0) /* Specify remote fd */
230
231 struct seccomp_notif_addfd {
232 __u64 id;
233 __u32 flags;
234 __u32 srcfd;
235 __u32 newfd;
236 __u32 newfd_flags;
237 };
238 #endif
239
240 #ifndef SECCOMP_ADDFD_FLAG_SEND
241 #define SECCOMP_ADDFD_FLAG_SEND (1UL << 1) /* Addfd and return it, atomically */
242 #endif
243
244 struct seccomp_notif_addfd_small {
245 __u64 id;
246 char weird[4];
247 };
248 #define SECCOMP_IOCTL_NOTIF_ADDFD_SMALL \
249 SECCOMP_IOW(3, struct seccomp_notif_addfd_small)
250
251 struct seccomp_notif_addfd_big {
252 union {
253 struct seccomp_notif_addfd addfd;
254 char buf[sizeof(struct seccomp_notif_addfd) + 8];
255 };
256 };
257 #define SECCOMP_IOCTL_NOTIF_ADDFD_BIG \
258 SECCOMP_IOWR(3, struct seccomp_notif_addfd_big)
259
260 #ifndef PTRACE_EVENTMSG_SYSCALL_ENTRY
261 #define PTRACE_EVENTMSG_SYSCALL_ENTRY 1
262 #define PTRACE_EVENTMSG_SYSCALL_EXIT 2
263 #endif
264
265 #ifndef SECCOMP_USER_NOTIF_FLAG_CONTINUE
266 #define SECCOMP_USER_NOTIF_FLAG_CONTINUE 0x00000001
267 #endif
268
269 #ifndef SECCOMP_FILTER_FLAG_TSYNC_ESRCH
270 #define SECCOMP_FILTER_FLAG_TSYNC_ESRCH (1UL << 4)
271 #endif
272
273 #ifndef seccomp
seccomp(unsigned int op,unsigned int flags,void * args)274 int seccomp(unsigned int op, unsigned int flags, void *args)
275 {
276 errno = 0;
277 return syscall(__NR_seccomp, op, flags, args);
278 }
279 #endif
280
281 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
282 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
283 #elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
284 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]) + sizeof(__u32))
285 #else
286 #error "wut? Unknown __BYTE_ORDER__?!"
287 #endif
288
289 #define SIBLING_EXIT_UNKILLED 0xbadbeef
290 #define SIBLING_EXIT_FAILURE 0xbadface
291 #define SIBLING_EXIT_NEWPRIVS 0xbadfeed
292
__filecmp(pid_t pid1,pid_t pid2,int fd1,int fd2)293 static int __filecmp(pid_t pid1, pid_t pid2, int fd1, int fd2)
294 {
295 #ifdef __NR_kcmp
296 errno = 0;
297 return syscall(__NR_kcmp, pid1, pid2, KCMP_FILE, fd1, fd2);
298 #else
299 errno = ENOSYS;
300 return -1;
301 #endif
302 }
303
304 /* Have TH_LOG report actual location filecmp() is used. */
305 #define filecmp(pid1, pid2, fd1, fd2) ({ \
306 int _ret; \
307 \
308 _ret = __filecmp(pid1, pid2, fd1, fd2); \
309 if (_ret != 0) { \
310 if (_ret < 0 && errno == ENOSYS) { \
311 TH_LOG("kcmp() syscall missing (test is less accurate)");\
312 _ret = 0; \
313 } \
314 } \
315 _ret; })
316
TEST(kcmp)317 TEST(kcmp)
318 {
319 int ret;
320
321 ret = __filecmp(getpid(), getpid(), 1, 1);
322 EXPECT_EQ(ret, 0);
323 if (ret != 0 && errno == ENOSYS)
324 SKIP(return, "Kernel does not support kcmp() (missing CONFIG_KCMP?)");
325 }
326
TEST(mode_strict_support)327 TEST(mode_strict_support)
328 {
329 long ret;
330
331 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL);
332 ASSERT_EQ(0, ret) {
333 TH_LOG("Kernel does not support CONFIG_SECCOMP");
334 }
335 syscall(__NR_exit, 0);
336 }
337
TEST_SIGNAL(mode_strict_cannot_call_prctl,SIGKILL)338 TEST_SIGNAL(mode_strict_cannot_call_prctl, SIGKILL)
339 {
340 long ret;
341
342 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL);
343 ASSERT_EQ(0, ret) {
344 TH_LOG("Kernel does not support CONFIG_SECCOMP");
345 }
346 syscall(__NR_prctl, PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
347 NULL, NULL, NULL);
348 EXPECT_FALSE(true) {
349 TH_LOG("Unreachable!");
350 }
351 }
352
353 /* Note! This doesn't test no new privs behavior */
TEST(no_new_privs_support)354 TEST(no_new_privs_support)
355 {
356 long ret;
357
358 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
359 EXPECT_EQ(0, ret) {
360 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
361 }
362 }
363
364 /* Tests kernel support by checking for a copy_from_user() fault on NULL. */
TEST(mode_filter_support)365 TEST(mode_filter_support)
366 {
367 long ret;
368
369 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
370 ASSERT_EQ(0, ret) {
371 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
372 }
373 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, NULL, NULL);
374 EXPECT_EQ(-1, ret);
375 EXPECT_EQ(EFAULT, errno) {
376 TH_LOG("Kernel does not support CONFIG_SECCOMP_FILTER!");
377 }
378 }
379
TEST(mode_filter_without_nnp)380 TEST(mode_filter_without_nnp)
381 {
382 struct sock_filter filter[] = {
383 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
384 };
385 struct sock_fprog prog = {
386 .len = (unsigned short)ARRAY_SIZE(filter),
387 .filter = filter,
388 };
389 long ret;
390
391 ret = prctl(PR_GET_NO_NEW_PRIVS, 0, NULL, 0, 0);
392 ASSERT_LE(0, ret) {
393 TH_LOG("Expected 0 or unsupported for NO_NEW_PRIVS");
394 }
395 errno = 0;
396 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
397 /* Succeeds with CAP_SYS_ADMIN, fails without */
398 /* TODO(wad) check caps not euid */
399 if (geteuid()) {
400 EXPECT_EQ(-1, ret);
401 EXPECT_EQ(EACCES, errno);
402 } else {
403 EXPECT_EQ(0, ret);
404 }
405 }
406
407 #define MAX_INSNS_PER_PATH 32768
408
TEST(filter_size_limits)409 TEST(filter_size_limits)
410 {
411 int i;
412 int count = BPF_MAXINSNS + 1;
413 struct sock_filter allow[] = {
414 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
415 };
416 struct sock_filter *filter;
417 struct sock_fprog prog = { };
418 long ret;
419
420 filter = calloc(count, sizeof(*filter));
421 ASSERT_NE(NULL, filter);
422
423 for (i = 0; i < count; i++)
424 filter[i] = allow[0];
425
426 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
427 ASSERT_EQ(0, ret);
428
429 prog.filter = filter;
430 prog.len = count;
431
432 /* Too many filter instructions in a single filter. */
433 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
434 ASSERT_NE(0, ret) {
435 TH_LOG("Installing %d insn filter was allowed", prog.len);
436 }
437
438 /* One less is okay, though. */
439 prog.len -= 1;
440 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
441 ASSERT_EQ(0, ret) {
442 TH_LOG("Installing %d insn filter wasn't allowed", prog.len);
443 }
444 }
445
TEST(filter_chain_limits)446 TEST(filter_chain_limits)
447 {
448 int i;
449 int count = BPF_MAXINSNS;
450 struct sock_filter allow[] = {
451 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
452 };
453 struct sock_filter *filter;
454 struct sock_fprog prog = { };
455 long ret;
456
457 filter = calloc(count, sizeof(*filter));
458 ASSERT_NE(NULL, filter);
459
460 for (i = 0; i < count; i++)
461 filter[i] = allow[0];
462
463 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
464 ASSERT_EQ(0, ret);
465
466 prog.filter = filter;
467 prog.len = 1;
468
469 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
470 ASSERT_EQ(0, ret);
471
472 prog.len = count;
473
474 /* Too many total filter instructions. */
475 for (i = 0; i < MAX_INSNS_PER_PATH; i++) {
476 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
477 if (ret != 0)
478 break;
479 }
480 ASSERT_NE(0, ret) {
481 TH_LOG("Allowed %d %d-insn filters (total with penalties:%d)",
482 i, count, i * (count + 4));
483 }
484 }
485
TEST(mode_filter_cannot_move_to_strict)486 TEST(mode_filter_cannot_move_to_strict)
487 {
488 struct sock_filter filter[] = {
489 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
490 };
491 struct sock_fprog prog = {
492 .len = (unsigned short)ARRAY_SIZE(filter),
493 .filter = filter,
494 };
495 long ret;
496
497 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
498 ASSERT_EQ(0, ret);
499
500 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
501 ASSERT_EQ(0, ret);
502
503 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, 0, 0);
504 EXPECT_EQ(-1, ret);
505 EXPECT_EQ(EINVAL, errno);
506 }
507
508
TEST(mode_filter_get_seccomp)509 TEST(mode_filter_get_seccomp)
510 {
511 struct sock_filter filter[] = {
512 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
513 };
514 struct sock_fprog prog = {
515 .len = (unsigned short)ARRAY_SIZE(filter),
516 .filter = filter,
517 };
518 long ret;
519
520 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
521 ASSERT_EQ(0, ret);
522
523 ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
524 EXPECT_EQ(0, ret);
525
526 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
527 ASSERT_EQ(0, ret);
528
529 ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
530 EXPECT_EQ(2, ret);
531 }
532
533
TEST(ALLOW_all)534 TEST(ALLOW_all)
535 {
536 struct sock_filter filter[] = {
537 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
538 };
539 struct sock_fprog prog = {
540 .len = (unsigned short)ARRAY_SIZE(filter),
541 .filter = filter,
542 };
543 long ret;
544
545 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
546 ASSERT_EQ(0, ret);
547
548 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
549 ASSERT_EQ(0, ret);
550 }
551
TEST(empty_prog)552 TEST(empty_prog)
553 {
554 struct sock_filter filter[] = {
555 };
556 struct sock_fprog prog = {
557 .len = (unsigned short)ARRAY_SIZE(filter),
558 .filter = filter,
559 };
560 long ret;
561
562 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
563 ASSERT_EQ(0, ret);
564
565 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
566 EXPECT_EQ(-1, ret);
567 EXPECT_EQ(EINVAL, errno);
568 }
569
TEST(log_all)570 TEST(log_all)
571 {
572 struct sock_filter filter[] = {
573 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG),
574 };
575 struct sock_fprog prog = {
576 .len = (unsigned short)ARRAY_SIZE(filter),
577 .filter = filter,
578 };
579 long ret;
580 pid_t parent = getppid();
581
582 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
583 ASSERT_EQ(0, ret);
584
585 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
586 ASSERT_EQ(0, ret);
587
588 /* getppid() should succeed and be logged (no check for logging) */
589 EXPECT_EQ(parent, syscall(__NR_getppid));
590 }
591
TEST_SIGNAL(unknown_ret_is_kill_inside,SIGSYS)592 TEST_SIGNAL(unknown_ret_is_kill_inside, SIGSYS)
593 {
594 struct sock_filter filter[] = {
595 BPF_STMT(BPF_RET|BPF_K, 0x10000000U),
596 };
597 struct sock_fprog prog = {
598 .len = (unsigned short)ARRAY_SIZE(filter),
599 .filter = filter,
600 };
601 long ret;
602
603 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
604 ASSERT_EQ(0, ret);
605
606 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
607 ASSERT_EQ(0, ret);
608 EXPECT_EQ(0, syscall(__NR_getpid)) {
609 TH_LOG("getpid() shouldn't ever return");
610 }
611 }
612
613 /* return code >= 0x80000000 is unused. */
TEST_SIGNAL(unknown_ret_is_kill_above_allow,SIGSYS)614 TEST_SIGNAL(unknown_ret_is_kill_above_allow, SIGSYS)
615 {
616 struct sock_filter filter[] = {
617 BPF_STMT(BPF_RET|BPF_K, 0x90000000U),
618 };
619 struct sock_fprog prog = {
620 .len = (unsigned short)ARRAY_SIZE(filter),
621 .filter = filter,
622 };
623 long ret;
624
625 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
626 ASSERT_EQ(0, ret);
627
628 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
629 ASSERT_EQ(0, ret);
630 EXPECT_EQ(0, syscall(__NR_getpid)) {
631 TH_LOG("getpid() shouldn't ever return");
632 }
633 }
634
TEST_SIGNAL(KILL_all,SIGSYS)635 TEST_SIGNAL(KILL_all, SIGSYS)
636 {
637 struct sock_filter filter[] = {
638 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
639 };
640 struct sock_fprog prog = {
641 .len = (unsigned short)ARRAY_SIZE(filter),
642 .filter = filter,
643 };
644 long ret;
645
646 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
647 ASSERT_EQ(0, ret);
648
649 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
650 ASSERT_EQ(0, ret);
651 }
652
TEST_SIGNAL(KILL_one,SIGSYS)653 TEST_SIGNAL(KILL_one, SIGSYS)
654 {
655 struct sock_filter filter[] = {
656 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
657 offsetof(struct seccomp_data, nr)),
658 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
659 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
660 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
661 };
662 struct sock_fprog prog = {
663 .len = (unsigned short)ARRAY_SIZE(filter),
664 .filter = filter,
665 };
666 long ret;
667 pid_t parent = getppid();
668
669 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
670 ASSERT_EQ(0, ret);
671
672 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
673 ASSERT_EQ(0, ret);
674
675 EXPECT_EQ(parent, syscall(__NR_getppid));
676 /* getpid() should never return. */
677 EXPECT_EQ(0, syscall(__NR_getpid));
678 }
679
TEST_SIGNAL(KILL_one_arg_one,SIGSYS)680 TEST_SIGNAL(KILL_one_arg_one, SIGSYS)
681 {
682 void *fatal_address;
683 struct sock_filter filter[] = {
684 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
685 offsetof(struct seccomp_data, nr)),
686 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_times, 1, 0),
687 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
688 /* Only both with lower 32-bit for now. */
689 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(0)),
690 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K,
691 (unsigned long)&fatal_address, 0, 1),
692 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
693 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
694 };
695 struct sock_fprog prog = {
696 .len = (unsigned short)ARRAY_SIZE(filter),
697 .filter = filter,
698 };
699 long ret;
700 pid_t parent = getppid();
701 struct tms timebuf;
702 clock_t clock = times(&timebuf);
703
704 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
705 ASSERT_EQ(0, ret);
706
707 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
708 ASSERT_EQ(0, ret);
709
710 EXPECT_EQ(parent, syscall(__NR_getppid));
711 EXPECT_LE(clock, syscall(__NR_times, &timebuf));
712 /* times() should never return. */
713 EXPECT_EQ(0, syscall(__NR_times, &fatal_address));
714 }
715
TEST_SIGNAL(KILL_one_arg_six,SIGSYS)716 TEST_SIGNAL(KILL_one_arg_six, SIGSYS)
717 {
718 #ifndef __NR_mmap2
719 int sysno = __NR_mmap;
720 #else
721 int sysno = __NR_mmap2;
722 #endif
723 struct sock_filter filter[] = {
724 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
725 offsetof(struct seccomp_data, nr)),
726 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, sysno, 1, 0),
727 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
728 /* Only both with lower 32-bit for now. */
729 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(5)),
730 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 0x0C0FFEE, 0, 1),
731 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
732 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
733 };
734 struct sock_fprog prog = {
735 .len = (unsigned short)ARRAY_SIZE(filter),
736 .filter = filter,
737 };
738 long ret;
739 pid_t parent = getppid();
740 int fd;
741 void *map1, *map2;
742 int page_size = sysconf(_SC_PAGESIZE);
743
744 ASSERT_LT(0, page_size);
745
746 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
747 ASSERT_EQ(0, ret);
748
749 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
750 ASSERT_EQ(0, ret);
751
752 fd = open("/dev/zero", O_RDONLY);
753 ASSERT_NE(-1, fd);
754
755 EXPECT_EQ(parent, syscall(__NR_getppid));
756 map1 = (void *)syscall(sysno,
757 NULL, page_size, PROT_READ, MAP_PRIVATE, fd, page_size);
758 EXPECT_NE(MAP_FAILED, map1);
759 /* mmap2() should never return. */
760 map2 = (void *)syscall(sysno,
761 NULL, page_size, PROT_READ, MAP_PRIVATE, fd, 0x0C0FFEE);
762 EXPECT_EQ(MAP_FAILED, map2);
763
764 /* The test failed, so clean up the resources. */
765 munmap(map1, page_size);
766 munmap(map2, page_size);
767 close(fd);
768 }
769
770 /* This is a thread task to die via seccomp filter violation. */
kill_thread(void * data)771 void *kill_thread(void *data)
772 {
773 bool die = (bool)data;
774
775 if (die) {
776 prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
777 return (void *)SIBLING_EXIT_FAILURE;
778 }
779
780 return (void *)SIBLING_EXIT_UNKILLED;
781 }
782
783 enum kill_t {
784 KILL_THREAD,
785 KILL_PROCESS,
786 RET_UNKNOWN
787 };
788
789 /* Prepare a thread that will kill itself or both of us. */
kill_thread_or_group(struct __test_metadata * _metadata,enum kill_t kill_how)790 void kill_thread_or_group(struct __test_metadata *_metadata,
791 enum kill_t kill_how)
792 {
793 pthread_t thread;
794 void *status;
795 /* Kill only when calling __NR_prctl. */
796 struct sock_filter filter_thread[] = {
797 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
798 offsetof(struct seccomp_data, nr)),
799 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
800 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_THREAD),
801 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
802 };
803 struct sock_fprog prog_thread = {
804 .len = (unsigned short)ARRAY_SIZE(filter_thread),
805 .filter = filter_thread,
806 };
807 int kill = kill_how == KILL_PROCESS ? SECCOMP_RET_KILL_PROCESS : 0xAAAAAAAA;
808 struct sock_filter filter_process[] = {
809 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
810 offsetof(struct seccomp_data, nr)),
811 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
812 BPF_STMT(BPF_RET|BPF_K, kill),
813 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
814 };
815 struct sock_fprog prog_process = {
816 .len = (unsigned short)ARRAY_SIZE(filter_process),
817 .filter = filter_process,
818 };
819
820 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
821 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
822 }
823
824 ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0,
825 kill_how == KILL_THREAD ? &prog_thread
826 : &prog_process));
827
828 /*
829 * Add the KILL_THREAD rule again to make sure that the KILL_PROCESS
830 * flag cannot be downgraded by a new filter.
831 */
832 if (kill_how == KILL_PROCESS)
833 ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread));
834
835 /* Start a thread that will exit immediately. */
836 ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)false));
837 ASSERT_EQ(0, pthread_join(thread, &status));
838 ASSERT_EQ(SIBLING_EXIT_UNKILLED, (unsigned long)status);
839
840 /* Start a thread that will die immediately. */
841 ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)true));
842 ASSERT_EQ(0, pthread_join(thread, &status));
843 ASSERT_NE(SIBLING_EXIT_FAILURE, (unsigned long)status);
844
845 /*
846 * If we get here, only the spawned thread died. Let the parent know
847 * the whole process didn't die (i.e. this thread, the spawner,
848 * stayed running).
849 */
850 exit(42);
851 }
852
853 /* b/147676645 */
854 #ifndef __ANDROID__
TEST(KILL_thread)855 TEST(KILL_thread)
856 {
857 int status;
858 pid_t child_pid;
859
860 child_pid = fork();
861 ASSERT_LE(0, child_pid);
862 if (child_pid == 0) {
863 kill_thread_or_group(_metadata, KILL_THREAD);
864 _exit(38);
865 }
866
867 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
868
869 /* If only the thread was killed, we'll see exit 42. */
870 ASSERT_TRUE(WIFEXITED(status));
871 ASSERT_EQ(42, WEXITSTATUS(status));
872 }
873 #endif
874
TEST(KILL_process)875 TEST(KILL_process)
876 {
877 int status;
878 pid_t child_pid;
879
880 child_pid = fork();
881 ASSERT_LE(0, child_pid);
882 if (child_pid == 0) {
883 kill_thread_or_group(_metadata, KILL_PROCESS);
884 _exit(38);
885 }
886
887 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
888
889 /* If the entire process was killed, we'll see SIGSYS. */
890 ASSERT_TRUE(WIFSIGNALED(status));
891 ASSERT_EQ(SIGSYS, WTERMSIG(status));
892 }
893
TEST(KILL_unknown)894 TEST(KILL_unknown)
895 {
896 int status;
897 pid_t child_pid;
898
899 child_pid = fork();
900 ASSERT_LE(0, child_pid);
901 if (child_pid == 0) {
902 kill_thread_or_group(_metadata, RET_UNKNOWN);
903 _exit(38);
904 }
905
906 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
907
908 /* If the entire process was killed, we'll see SIGSYS. */
909 EXPECT_TRUE(WIFSIGNALED(status)) {
910 TH_LOG("Unknown SECCOMP_RET is only killing the thread?");
911 }
912 ASSERT_EQ(SIGSYS, WTERMSIG(status));
913 }
914
915 /* TODO(wad) add 64-bit versus 32-bit arg tests. */
TEST(arg_out_of_range)916 TEST(arg_out_of_range)
917 {
918 struct sock_filter filter[] = {
919 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(6)),
920 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
921 };
922 struct sock_fprog prog = {
923 .len = (unsigned short)ARRAY_SIZE(filter),
924 .filter = filter,
925 };
926 long ret;
927
928 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
929 ASSERT_EQ(0, ret);
930
931 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
932 EXPECT_EQ(-1, ret);
933 EXPECT_EQ(EINVAL, errno);
934 }
935
936 #define ERRNO_FILTER(name, errno) \
937 struct sock_filter _read_filter_##name[] = { \
938 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, \
939 offsetof(struct seccomp_data, nr)), \
940 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1), \
941 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | errno), \
942 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), \
943 }; \
944 struct sock_fprog prog_##name = { \
945 .len = (unsigned short)ARRAY_SIZE(_read_filter_##name), \
946 .filter = _read_filter_##name, \
947 }
948
949 /* Make sure basic errno values are correctly passed through a filter. */
TEST(ERRNO_valid)950 TEST(ERRNO_valid)
951 {
952 ERRNO_FILTER(valid, E2BIG);
953 long ret;
954 pid_t parent = getppid();
955
956 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
957 ASSERT_EQ(0, ret);
958
959 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_valid);
960 ASSERT_EQ(0, ret);
961
962 EXPECT_EQ(parent, syscall(__NR_getppid));
963 EXPECT_EQ(-1, read(0, NULL, 0));
964 EXPECT_EQ(E2BIG, errno);
965 }
966
967 /* Make sure an errno of zero is correctly handled by the arch code. */
TEST(ERRNO_zero)968 TEST(ERRNO_zero)
969 {
970 ERRNO_FILTER(zero, 0);
971 long ret;
972 pid_t parent = getppid();
973
974 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
975 ASSERT_EQ(0, ret);
976
977 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_zero);
978 ASSERT_EQ(0, ret);
979
980 EXPECT_EQ(parent, syscall(__NR_getppid));
981 /* "errno" of 0 is ok. */
982 EXPECT_EQ(0, read(0, NULL, 0));
983 }
984
985 /*
986 * The SECCOMP_RET_DATA mask is 16 bits wide, but errno is smaller.
987 * This tests that the errno value gets capped correctly, fixed by
988 * 580c57f10768 ("seccomp: cap SECCOMP_RET_ERRNO data to MAX_ERRNO").
989 */
TEST(ERRNO_capped)990 TEST(ERRNO_capped)
991 {
992 ERRNO_FILTER(capped, 4096);
993 long ret;
994 pid_t parent = getppid();
995
996 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
997 ASSERT_EQ(0, ret);
998
999 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_capped);
1000 ASSERT_EQ(0, ret);
1001
1002 EXPECT_EQ(parent, syscall(__NR_getppid));
1003 EXPECT_EQ(-1, read(0, NULL, 0));
1004 EXPECT_EQ(4095, errno);
1005 }
1006
1007 /*
1008 * Filters are processed in reverse order: last applied is executed first.
1009 * Since only the SECCOMP_RET_ACTION mask is tested for return values, the
1010 * SECCOMP_RET_DATA mask results will follow the most recently applied
1011 * matching filter return (and not the lowest or highest value).
1012 */
TEST(ERRNO_order)1013 TEST(ERRNO_order)
1014 {
1015 ERRNO_FILTER(first, 11);
1016 ERRNO_FILTER(second, 13);
1017 ERRNO_FILTER(third, 12);
1018 long ret;
1019 pid_t parent = getppid();
1020
1021 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1022 ASSERT_EQ(0, ret);
1023
1024 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_first);
1025 ASSERT_EQ(0, ret);
1026
1027 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_second);
1028 ASSERT_EQ(0, ret);
1029
1030 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_third);
1031 ASSERT_EQ(0, ret);
1032
1033 EXPECT_EQ(parent, syscall(__NR_getppid));
1034 EXPECT_EQ(-1, read(0, NULL, 0));
1035 EXPECT_EQ(12, errno);
1036 }
1037
FIXTURE(TRAP)1038 FIXTURE(TRAP) {
1039 struct sock_fprog prog;
1040 };
1041
FIXTURE_SETUP(TRAP)1042 FIXTURE_SETUP(TRAP)
1043 {
1044 struct sock_filter filter[] = {
1045 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1046 offsetof(struct seccomp_data, nr)),
1047 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
1048 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
1049 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1050 };
1051
1052 memset(&self->prog, 0, sizeof(self->prog));
1053 self->prog.filter = malloc(sizeof(filter));
1054 ASSERT_NE(NULL, self->prog.filter);
1055 memcpy(self->prog.filter, filter, sizeof(filter));
1056 self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1057 }
1058
FIXTURE_TEARDOWN(TRAP)1059 FIXTURE_TEARDOWN(TRAP)
1060 {
1061 if (self->prog.filter)
1062 free(self->prog.filter);
1063 }
1064
TEST_F_SIGNAL(TRAP,dfl,SIGSYS)1065 TEST_F_SIGNAL(TRAP, dfl, SIGSYS)
1066 {
1067 long ret;
1068
1069 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1070 ASSERT_EQ(0, ret);
1071
1072 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1073 ASSERT_EQ(0, ret);
1074 syscall(__NR_getpid);
1075 }
1076
1077 /* Ensure that SIGSYS overrides SIG_IGN */
TEST_F_SIGNAL(TRAP,ign,SIGSYS)1078 TEST_F_SIGNAL(TRAP, ign, SIGSYS)
1079 {
1080 long ret;
1081
1082 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1083 ASSERT_EQ(0, ret);
1084
1085 signal(SIGSYS, SIG_IGN);
1086
1087 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1088 ASSERT_EQ(0, ret);
1089 syscall(__NR_getpid);
1090 }
1091
1092 static siginfo_t TRAP_info;
1093 static volatile int TRAP_nr;
TRAP_action(int nr,siginfo_t * info,void * void_context)1094 static void TRAP_action(int nr, siginfo_t *info, void *void_context)
1095 {
1096 memcpy(&TRAP_info, info, sizeof(TRAP_info));
1097 TRAP_nr = nr;
1098 }
1099
TEST_F(TRAP,handler)1100 TEST_F(TRAP, handler)
1101 {
1102 int ret, test;
1103 struct sigaction act;
1104 sigset_t mask;
1105
1106 memset(&act, 0, sizeof(act));
1107 sigemptyset(&mask);
1108 sigaddset(&mask, SIGSYS);
1109
1110 act.sa_sigaction = &TRAP_action;
1111 act.sa_flags = SA_SIGINFO;
1112 ret = sigaction(SIGSYS, &act, NULL);
1113 ASSERT_EQ(0, ret) {
1114 TH_LOG("sigaction failed");
1115 }
1116 ret = sigprocmask(SIG_UNBLOCK, &mask, NULL);
1117 ASSERT_EQ(0, ret) {
1118 TH_LOG("sigprocmask failed");
1119 }
1120
1121 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1122 ASSERT_EQ(0, ret);
1123 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1124 ASSERT_EQ(0, ret);
1125 TRAP_nr = 0;
1126 memset(&TRAP_info, 0, sizeof(TRAP_info));
1127 /* Expect the registers to be rolled back. (nr = error) may vary
1128 * based on arch. */
1129 ret = syscall(__NR_getpid);
1130 /* Silence gcc warning about volatile. */
1131 test = TRAP_nr;
1132 EXPECT_EQ(SIGSYS, test);
1133 struct local_sigsys {
1134 void *_call_addr; /* calling user insn */
1135 int _syscall; /* triggering system call number */
1136 unsigned int _arch; /* AUDIT_ARCH_* of syscall */
1137 } *sigsys = (struct local_sigsys *)
1138 #ifdef si_syscall
1139 &(TRAP_info.si_call_addr);
1140 #else
1141 &TRAP_info.si_pid;
1142 #endif
1143 EXPECT_EQ(__NR_getpid, sigsys->_syscall);
1144 /* Make sure arch is non-zero. */
1145 EXPECT_NE(0, sigsys->_arch);
1146 EXPECT_NE(0, (unsigned long)sigsys->_call_addr);
1147 }
1148
FIXTURE(precedence)1149 FIXTURE(precedence) {
1150 struct sock_fprog allow;
1151 struct sock_fprog log;
1152 struct sock_fprog trace;
1153 struct sock_fprog error;
1154 struct sock_fprog trap;
1155 struct sock_fprog kill;
1156 };
1157
FIXTURE_SETUP(precedence)1158 FIXTURE_SETUP(precedence)
1159 {
1160 struct sock_filter allow_insns[] = {
1161 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1162 };
1163 struct sock_filter log_insns[] = {
1164 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1165 offsetof(struct seccomp_data, nr)),
1166 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1167 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1168 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG),
1169 };
1170 struct sock_filter trace_insns[] = {
1171 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1172 offsetof(struct seccomp_data, nr)),
1173 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1174 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1175 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE),
1176 };
1177 struct sock_filter error_insns[] = {
1178 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1179 offsetof(struct seccomp_data, nr)),
1180 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1181 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1182 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO),
1183 };
1184 struct sock_filter trap_insns[] = {
1185 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1186 offsetof(struct seccomp_data, nr)),
1187 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1188 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1189 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
1190 };
1191 struct sock_filter kill_insns[] = {
1192 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1193 offsetof(struct seccomp_data, nr)),
1194 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1195 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1196 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
1197 };
1198
1199 memset(self, 0, sizeof(*self));
1200 #define FILTER_ALLOC(_x) \
1201 self->_x.filter = malloc(sizeof(_x##_insns)); \
1202 ASSERT_NE(NULL, self->_x.filter); \
1203 memcpy(self->_x.filter, &_x##_insns, sizeof(_x##_insns)); \
1204 self->_x.len = (unsigned short)ARRAY_SIZE(_x##_insns)
1205 FILTER_ALLOC(allow);
1206 FILTER_ALLOC(log);
1207 FILTER_ALLOC(trace);
1208 FILTER_ALLOC(error);
1209 FILTER_ALLOC(trap);
1210 FILTER_ALLOC(kill);
1211 }
1212
FIXTURE_TEARDOWN(precedence)1213 FIXTURE_TEARDOWN(precedence)
1214 {
1215 #define FILTER_FREE(_x) if (self->_x.filter) free(self->_x.filter)
1216 FILTER_FREE(allow);
1217 FILTER_FREE(log);
1218 FILTER_FREE(trace);
1219 FILTER_FREE(error);
1220 FILTER_FREE(trap);
1221 FILTER_FREE(kill);
1222 }
1223
TEST_F(precedence,allow_ok)1224 TEST_F(precedence, allow_ok)
1225 {
1226 pid_t parent, res = 0;
1227 long ret;
1228
1229 parent = getppid();
1230 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1231 ASSERT_EQ(0, ret);
1232
1233 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1234 ASSERT_EQ(0, ret);
1235 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1236 ASSERT_EQ(0, ret);
1237 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1238 ASSERT_EQ(0, ret);
1239 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1240 ASSERT_EQ(0, ret);
1241 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1242 ASSERT_EQ(0, ret);
1243 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1244 ASSERT_EQ(0, ret);
1245 /* Should work just fine. */
1246 res = syscall(__NR_getppid);
1247 EXPECT_EQ(parent, res);
1248 }
1249
TEST_F_SIGNAL(precedence,kill_is_highest,SIGSYS)1250 TEST_F_SIGNAL(precedence, kill_is_highest, SIGSYS)
1251 {
1252 pid_t parent, res = 0;
1253 long ret;
1254
1255 parent = getppid();
1256 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1257 ASSERT_EQ(0, ret);
1258
1259 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1260 ASSERT_EQ(0, ret);
1261 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1262 ASSERT_EQ(0, ret);
1263 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1264 ASSERT_EQ(0, ret);
1265 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1266 ASSERT_EQ(0, ret);
1267 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1268 ASSERT_EQ(0, ret);
1269 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1270 ASSERT_EQ(0, ret);
1271 /* Should work just fine. */
1272 res = syscall(__NR_getppid);
1273 EXPECT_EQ(parent, res);
1274 /* getpid() should never return. */
1275 res = syscall(__NR_getpid);
1276 EXPECT_EQ(0, res);
1277 }
1278
TEST_F_SIGNAL(precedence,kill_is_highest_in_any_order,SIGSYS)1279 TEST_F_SIGNAL(precedence, kill_is_highest_in_any_order, SIGSYS)
1280 {
1281 pid_t parent;
1282 long ret;
1283
1284 parent = getppid();
1285 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1286 ASSERT_EQ(0, ret);
1287
1288 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1289 ASSERT_EQ(0, ret);
1290 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1291 ASSERT_EQ(0, ret);
1292 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1293 ASSERT_EQ(0, ret);
1294 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1295 ASSERT_EQ(0, ret);
1296 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1297 ASSERT_EQ(0, ret);
1298 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1299 ASSERT_EQ(0, ret);
1300 /* Should work just fine. */
1301 EXPECT_EQ(parent, syscall(__NR_getppid));
1302 /* getpid() should never return. */
1303 EXPECT_EQ(0, syscall(__NR_getpid));
1304 }
1305
TEST_F_SIGNAL(precedence,trap_is_second,SIGSYS)1306 TEST_F_SIGNAL(precedence, trap_is_second, SIGSYS)
1307 {
1308 pid_t parent;
1309 long ret;
1310
1311 parent = getppid();
1312 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1313 ASSERT_EQ(0, ret);
1314
1315 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1316 ASSERT_EQ(0, ret);
1317 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1318 ASSERT_EQ(0, ret);
1319 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1320 ASSERT_EQ(0, ret);
1321 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1322 ASSERT_EQ(0, ret);
1323 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1324 ASSERT_EQ(0, ret);
1325 /* Should work just fine. */
1326 EXPECT_EQ(parent, syscall(__NR_getppid));
1327 /* getpid() should never return. */
1328 EXPECT_EQ(0, syscall(__NR_getpid));
1329 }
1330
TEST_F_SIGNAL(precedence,trap_is_second_in_any_order,SIGSYS)1331 TEST_F_SIGNAL(precedence, trap_is_second_in_any_order, SIGSYS)
1332 {
1333 pid_t parent;
1334 long ret;
1335
1336 parent = getppid();
1337 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1338 ASSERT_EQ(0, ret);
1339
1340 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1341 ASSERT_EQ(0, ret);
1342 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1343 ASSERT_EQ(0, ret);
1344 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1345 ASSERT_EQ(0, ret);
1346 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1347 ASSERT_EQ(0, ret);
1348 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1349 ASSERT_EQ(0, ret);
1350 /* Should work just fine. */
1351 EXPECT_EQ(parent, syscall(__NR_getppid));
1352 /* getpid() should never return. */
1353 EXPECT_EQ(0, syscall(__NR_getpid));
1354 }
1355
TEST_F(precedence,errno_is_third)1356 TEST_F(precedence, errno_is_third)
1357 {
1358 pid_t parent;
1359 long ret;
1360
1361 parent = getppid();
1362 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1363 ASSERT_EQ(0, ret);
1364
1365 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1366 ASSERT_EQ(0, ret);
1367 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1368 ASSERT_EQ(0, ret);
1369 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1370 ASSERT_EQ(0, ret);
1371 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1372 ASSERT_EQ(0, ret);
1373 /* Should work just fine. */
1374 EXPECT_EQ(parent, syscall(__NR_getppid));
1375 EXPECT_EQ(0, syscall(__NR_getpid));
1376 }
1377
TEST_F(precedence,errno_is_third_in_any_order)1378 TEST_F(precedence, errno_is_third_in_any_order)
1379 {
1380 pid_t parent;
1381 long ret;
1382
1383 parent = getppid();
1384 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1385 ASSERT_EQ(0, ret);
1386
1387 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1388 ASSERT_EQ(0, ret);
1389 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1390 ASSERT_EQ(0, ret);
1391 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1392 ASSERT_EQ(0, ret);
1393 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1394 ASSERT_EQ(0, ret);
1395 /* Should work just fine. */
1396 EXPECT_EQ(parent, syscall(__NR_getppid));
1397 EXPECT_EQ(0, syscall(__NR_getpid));
1398 }
1399
TEST_F(precedence,trace_is_fourth)1400 TEST_F(precedence, trace_is_fourth)
1401 {
1402 pid_t parent;
1403 long ret;
1404
1405 parent = getppid();
1406 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1407 ASSERT_EQ(0, ret);
1408
1409 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1410 ASSERT_EQ(0, ret);
1411 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1412 ASSERT_EQ(0, ret);
1413 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1414 ASSERT_EQ(0, ret);
1415 /* Should work just fine. */
1416 EXPECT_EQ(parent, syscall(__NR_getppid));
1417 /* No ptracer */
1418 EXPECT_EQ(-1, syscall(__NR_getpid));
1419 }
1420
TEST_F(precedence,trace_is_fourth_in_any_order)1421 TEST_F(precedence, trace_is_fourth_in_any_order)
1422 {
1423 pid_t parent;
1424 long ret;
1425
1426 parent = getppid();
1427 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1428 ASSERT_EQ(0, ret);
1429
1430 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1431 ASSERT_EQ(0, ret);
1432 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1433 ASSERT_EQ(0, ret);
1434 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1435 ASSERT_EQ(0, ret);
1436 /* Should work just fine. */
1437 EXPECT_EQ(parent, syscall(__NR_getppid));
1438 /* No ptracer */
1439 EXPECT_EQ(-1, syscall(__NR_getpid));
1440 }
1441
TEST_F(precedence,log_is_fifth)1442 TEST_F(precedence, log_is_fifth)
1443 {
1444 pid_t mypid, parent;
1445 long ret;
1446
1447 mypid = getpid();
1448 parent = getppid();
1449 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1450 ASSERT_EQ(0, ret);
1451
1452 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1453 ASSERT_EQ(0, ret);
1454 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1455 ASSERT_EQ(0, ret);
1456 /* Should work just fine. */
1457 EXPECT_EQ(parent, syscall(__NR_getppid));
1458 /* Should also work just fine */
1459 EXPECT_EQ(mypid, syscall(__NR_getpid));
1460 }
1461
TEST_F(precedence,log_is_fifth_in_any_order)1462 TEST_F(precedence, log_is_fifth_in_any_order)
1463 {
1464 pid_t mypid, parent;
1465 long ret;
1466
1467 mypid = getpid();
1468 parent = getppid();
1469 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1470 ASSERT_EQ(0, ret);
1471
1472 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1473 ASSERT_EQ(0, ret);
1474 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1475 ASSERT_EQ(0, ret);
1476 /* Should work just fine. */
1477 EXPECT_EQ(parent, syscall(__NR_getppid));
1478 /* Should also work just fine */
1479 EXPECT_EQ(mypid, syscall(__NR_getpid));
1480 }
1481
1482 #ifndef PTRACE_O_TRACESECCOMP
1483 #define PTRACE_O_TRACESECCOMP 0x00000080
1484 #endif
1485
1486 /* Catch the Ubuntu 12.04 value error. */
1487 #if PTRACE_EVENT_SECCOMP != 7
1488 #undef PTRACE_EVENT_SECCOMP
1489 #endif
1490
1491 #ifndef PTRACE_EVENT_SECCOMP
1492 #define PTRACE_EVENT_SECCOMP 7
1493 #endif
1494
1495 #define PTRACE_EVENT_MASK(status) ((status) >> 16)
1496 bool tracer_running;
tracer_stop(int sig)1497 void tracer_stop(int sig)
1498 {
1499 tracer_running = false;
1500 }
1501
1502 typedef void tracer_func_t(struct __test_metadata *_metadata,
1503 pid_t tracee, int status, void *args);
1504
start_tracer(struct __test_metadata * _metadata,int fd,pid_t tracee,tracer_func_t tracer_func,void * args,bool ptrace_syscall)1505 void start_tracer(struct __test_metadata *_metadata, int fd, pid_t tracee,
1506 tracer_func_t tracer_func, void *args, bool ptrace_syscall)
1507 {
1508 int ret = -1;
1509 struct sigaction action = {
1510 .sa_handler = tracer_stop,
1511 };
1512
1513 /* Allow external shutdown. */
1514 tracer_running = true;
1515 ASSERT_EQ(0, sigaction(SIGUSR1, &action, NULL));
1516
1517 errno = 0;
1518 while (ret == -1 && errno != EINVAL)
1519 ret = ptrace(PTRACE_ATTACH, tracee, NULL, 0);
1520 ASSERT_EQ(0, ret) {
1521 kill(tracee, SIGKILL);
1522 }
1523 /* Wait for attach stop */
1524 wait(NULL);
1525
1526 ret = ptrace(PTRACE_SETOPTIONS, tracee, NULL, ptrace_syscall ?
1527 PTRACE_O_TRACESYSGOOD :
1528 PTRACE_O_TRACESECCOMP);
1529 ASSERT_EQ(0, ret) {
1530 TH_LOG("Failed to set PTRACE_O_TRACESECCOMP");
1531 kill(tracee, SIGKILL);
1532 }
1533 ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT,
1534 tracee, NULL, 0);
1535 ASSERT_EQ(0, ret);
1536
1537 /* Unblock the tracee */
1538 ASSERT_EQ(1, write(fd, "A", 1));
1539 ASSERT_EQ(0, close(fd));
1540
1541 /* Run until we're shut down. Must assert to stop execution. */
1542 while (tracer_running) {
1543 int status;
1544
1545 if (wait(&status) != tracee)
1546 continue;
1547
1548 if (WIFSIGNALED(status)) {
1549 /* Child caught a fatal signal. */
1550 return;
1551 }
1552 if (WIFEXITED(status)) {
1553 /* Child exited with code. */
1554 return;
1555 }
1556
1557 /* Check if we got an expected event. */
1558 ASSERT_EQ(WIFCONTINUED(status), false);
1559 ASSERT_EQ(WIFSTOPPED(status), true);
1560 ASSERT_EQ(WSTOPSIG(status) & SIGTRAP, SIGTRAP) {
1561 TH_LOG("Unexpected WSTOPSIG: %d", WSTOPSIG(status));
1562 }
1563
1564 tracer_func(_metadata, tracee, status, args);
1565
1566 ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT,
1567 tracee, NULL, 0);
1568 ASSERT_EQ(0, ret);
1569 }
1570 /* Directly report the status of our test harness results. */
1571 syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);
1572 }
1573
1574 /* Common tracer setup/teardown functions. */
cont_handler(int num)1575 void cont_handler(int num)
1576 { }
setup_trace_fixture(struct __test_metadata * _metadata,tracer_func_t func,void * args,bool ptrace_syscall)1577 pid_t setup_trace_fixture(struct __test_metadata *_metadata,
1578 tracer_func_t func, void *args, bool ptrace_syscall)
1579 {
1580 char sync;
1581 int pipefd[2];
1582 pid_t tracer_pid;
1583 pid_t tracee = getpid();
1584
1585 /* Setup a pipe for clean synchronization. */
1586 ASSERT_EQ(0, pipe(pipefd));
1587
1588 /* Fork a child which we'll promote to tracer */
1589 tracer_pid = fork();
1590 ASSERT_LE(0, tracer_pid);
1591 signal(SIGALRM, cont_handler);
1592 if (tracer_pid == 0) {
1593 close(pipefd[0]);
1594 start_tracer(_metadata, pipefd[1], tracee, func, args,
1595 ptrace_syscall);
1596 syscall(__NR_exit, 0);
1597 }
1598 close(pipefd[1]);
1599 prctl(PR_SET_PTRACER, tracer_pid, 0, 0, 0);
1600 read(pipefd[0], &sync, 1);
1601 close(pipefd[0]);
1602
1603 return tracer_pid;
1604 }
1605
teardown_trace_fixture(struct __test_metadata * _metadata,pid_t tracer)1606 void teardown_trace_fixture(struct __test_metadata *_metadata,
1607 pid_t tracer)
1608 {
1609 if (tracer) {
1610 int status;
1611 /*
1612 * Extract the exit code from the other process and
1613 * adopt it for ourselves in case its asserts failed.
1614 */
1615 ASSERT_EQ(0, kill(tracer, SIGUSR1));
1616 ASSERT_EQ(tracer, waitpid(tracer, &status, 0));
1617 if (WEXITSTATUS(status))
1618 _metadata->passed = 0;
1619 }
1620 }
1621
1622 /* "poke" tracer arguments and function. */
1623 struct tracer_args_poke_t {
1624 unsigned long poke_addr;
1625 };
1626
tracer_poke(struct __test_metadata * _metadata,pid_t tracee,int status,void * args)1627 void tracer_poke(struct __test_metadata *_metadata, pid_t tracee, int status,
1628 void *args)
1629 {
1630 int ret;
1631 unsigned long msg;
1632 struct tracer_args_poke_t *info = (struct tracer_args_poke_t *)args;
1633
1634 ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
1635 EXPECT_EQ(0, ret);
1636 /* If this fails, don't try to recover. */
1637 ASSERT_EQ(0x1001, msg) {
1638 kill(tracee, SIGKILL);
1639 }
1640 /*
1641 * Poke in the message.
1642 * Registers are not touched to try to keep this relatively arch
1643 * agnostic.
1644 */
1645 ret = ptrace(PTRACE_POKEDATA, tracee, info->poke_addr, 0x1001);
1646 EXPECT_EQ(0, ret);
1647 }
1648
FIXTURE(TRACE_poke)1649 FIXTURE(TRACE_poke) {
1650 struct sock_fprog prog;
1651 pid_t tracer;
1652 long poked;
1653 struct tracer_args_poke_t tracer_args;
1654 };
1655
FIXTURE_SETUP(TRACE_poke)1656 FIXTURE_SETUP(TRACE_poke)
1657 {
1658 struct sock_filter filter[] = {
1659 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1660 offsetof(struct seccomp_data, nr)),
1661 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
1662 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1001),
1663 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1664 };
1665
1666 self->poked = 0;
1667 memset(&self->prog, 0, sizeof(self->prog));
1668 self->prog.filter = malloc(sizeof(filter));
1669 ASSERT_NE(NULL, self->prog.filter);
1670 memcpy(self->prog.filter, filter, sizeof(filter));
1671 self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1672
1673 /* Set up tracer args. */
1674 self->tracer_args.poke_addr = (unsigned long)&self->poked;
1675
1676 /* Launch tracer. */
1677 self->tracer = setup_trace_fixture(_metadata, tracer_poke,
1678 &self->tracer_args, false);
1679 }
1680
FIXTURE_TEARDOWN(TRACE_poke)1681 FIXTURE_TEARDOWN(TRACE_poke)
1682 {
1683 teardown_trace_fixture(_metadata, self->tracer);
1684 if (self->prog.filter)
1685 free(self->prog.filter);
1686 }
1687
TEST_F(TRACE_poke,read_has_side_effects)1688 TEST_F(TRACE_poke, read_has_side_effects)
1689 {
1690 ssize_t ret;
1691
1692 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1693 ASSERT_EQ(0, ret);
1694
1695 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1696 ASSERT_EQ(0, ret);
1697
1698 EXPECT_EQ(0, self->poked);
1699 ret = read(-1, NULL, 0);
1700 EXPECT_EQ(-1, ret);
1701 EXPECT_EQ(0x1001, self->poked);
1702 }
1703
TEST_F(TRACE_poke,getpid_runs_normally)1704 TEST_F(TRACE_poke, getpid_runs_normally)
1705 {
1706 long ret;
1707
1708 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1709 ASSERT_EQ(0, ret);
1710
1711 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1712 ASSERT_EQ(0, ret);
1713
1714 EXPECT_EQ(0, self->poked);
1715 EXPECT_NE(0, syscall(__NR_getpid));
1716 EXPECT_EQ(0, self->poked);
1717 }
1718
1719 #if defined(__x86_64__)
1720 # define ARCH_REGS struct user_regs_struct
1721 # define SYSCALL_NUM(_regs) (_regs).orig_rax
1722 # define SYSCALL_RET(_regs) (_regs).rax
1723 #elif defined(__i386__)
1724 # define ARCH_REGS struct user_regs_struct
1725 # define SYSCALL_NUM(_regs) (_regs).orig_eax
1726 # define SYSCALL_RET(_regs) (_regs).eax
1727 #elif defined(__arm__)
1728 # define ARCH_REGS struct pt_regs
1729 # define SYSCALL_NUM(_regs) (_regs).ARM_r7
1730 # ifndef PTRACE_SET_SYSCALL
1731 # define PTRACE_SET_SYSCALL 23
1732 # endif
1733 # define SYSCALL_NUM_SET(_regs, _nr) \
1734 EXPECT_EQ(0, ptrace(PTRACE_SET_SYSCALL, tracee, NULL, _nr))
1735 # define SYSCALL_RET(_regs) (_regs).ARM_r0
1736 #elif defined(__aarch64__)
1737 # define ARCH_REGS struct user_pt_regs
1738 # define SYSCALL_NUM(_regs) (_regs).regs[8]
1739 # ifndef NT_ARM_SYSTEM_CALL
1740 # define NT_ARM_SYSTEM_CALL 0x404
1741 # endif
1742 # define SYSCALL_NUM_SET(_regs, _nr) \
1743 do { \
1744 struct iovec __v; \
1745 typeof(_nr) __nr = (_nr); \
1746 __v.iov_base = &__nr; \
1747 __v.iov_len = sizeof(__nr); \
1748 EXPECT_EQ(0, ptrace(PTRACE_SETREGSET, tracee, \
1749 NT_ARM_SYSTEM_CALL, &__v)); \
1750 } while (0)
1751 # define SYSCALL_RET(_regs) (_regs).regs[0]
1752 #elif defined(__riscv) && __riscv_xlen == 64
1753 # define ARCH_REGS struct user_regs_struct
1754 # define SYSCALL_NUM(_regs) (_regs).a7
1755 # define SYSCALL_RET(_regs) (_regs).a0
1756 #elif defined(__csky__)
1757 # define ARCH_REGS struct pt_regs
1758 # if defined(__CSKYABIV2__)
1759 # define SYSCALL_NUM(_regs) (_regs).regs[3]
1760 # else
1761 # define SYSCALL_NUM(_regs) (_regs).regs[9]
1762 # endif
1763 # define SYSCALL_RET(_regs) (_regs).a0
1764 #elif defined(__hppa__)
1765 # define ARCH_REGS struct user_regs_struct
1766 # define SYSCALL_NUM(_regs) (_regs).gr[20]
1767 # define SYSCALL_RET(_regs) (_regs).gr[28]
1768 #elif defined(__powerpc__)
1769 # define ARCH_REGS struct pt_regs
1770 # define SYSCALL_NUM(_regs) (_regs).gpr[0]
1771 # define SYSCALL_RET(_regs) (_regs).gpr[3]
1772 # define SYSCALL_RET_SET(_regs, _val) \
1773 do { \
1774 typeof(_val) _result = (_val); \
1775 if ((_regs.trap & 0xfff0) == 0x3000) { \
1776 /* \
1777 * scv 0 system call uses -ve result \
1778 * for error, so no need to adjust. \
1779 */ \
1780 SYSCALL_RET(_regs) = _result; \
1781 } else { \
1782 /* \
1783 * A syscall error is signaled by the \
1784 * CR0 SO bit and the code is stored as \
1785 * a positive value. \
1786 */ \
1787 if (_result < 0) { \
1788 SYSCALL_RET(_regs) = -_result; \
1789 (_regs).ccr |= 0x10000000; \
1790 } else { \
1791 SYSCALL_RET(_regs) = _result; \
1792 (_regs).ccr &= ~0x10000000; \
1793 } \
1794 } \
1795 } while (0)
1796 # define SYSCALL_RET_SET_ON_PTRACE_EXIT
1797 #elif defined(__s390__)
1798 # define ARCH_REGS s390_regs
1799 # define SYSCALL_NUM(_regs) (_regs).gprs[2]
1800 # define SYSCALL_RET_SET(_regs, _val) \
1801 TH_LOG("Can't modify syscall return on this architecture")
1802 #elif defined(__mips__)
1803 # include <asm/unistd_nr_n32.h>
1804 # include <asm/unistd_nr_n64.h>
1805 # include <asm/unistd_nr_o32.h>
1806 # define ARCH_REGS struct pt_regs
1807 # define SYSCALL_NUM(_regs) \
1808 ({ \
1809 typeof((_regs).regs[2]) _nr; \
1810 if ((_regs).regs[2] == __NR_O32_Linux) \
1811 _nr = (_regs).regs[4]; \
1812 else \
1813 _nr = (_regs).regs[2]; \
1814 _nr; \
1815 })
1816 # define SYSCALL_NUM_SET(_regs, _nr) \
1817 do { \
1818 if ((_regs).regs[2] == __NR_O32_Linux) \
1819 (_regs).regs[4] = _nr; \
1820 else \
1821 (_regs).regs[2] = _nr; \
1822 } while (0)
1823 # define SYSCALL_RET_SET(_regs, _val) \
1824 TH_LOG("Can't modify syscall return on this architecture")
1825 #elif defined(__xtensa__)
1826 # define ARCH_REGS struct user_pt_regs
1827 # define SYSCALL_NUM(_regs) (_regs).syscall
1828 /*
1829 * On xtensa syscall return value is in the register
1830 * a2 of the current window which is not fixed.
1831 */
1832 #define SYSCALL_RET(_regs) (_regs).a[(_regs).windowbase * 4 + 2]
1833 #elif defined(__sh__)
1834 # define ARCH_REGS struct pt_regs
1835 # define SYSCALL_NUM(_regs) (_regs).regs[3]
1836 # define SYSCALL_RET(_regs) (_regs).regs[0]
1837 #else
1838 # error "Do not know how to find your architecture's registers and syscalls"
1839 #endif
1840
1841 /*
1842 * Most architectures can change the syscall by just updating the
1843 * associated register. This is the default if not defined above.
1844 */
1845 #ifndef SYSCALL_NUM_SET
1846 # define SYSCALL_NUM_SET(_regs, _nr) \
1847 do { \
1848 SYSCALL_NUM(_regs) = (_nr); \
1849 } while (0)
1850 #endif
1851 /*
1852 * Most architectures can change the syscall return value by just
1853 * writing to the SYSCALL_RET register. This is the default if not
1854 * defined above. If an architecture cannot set the return value
1855 * (for example when the syscall and return value register is
1856 * shared), report it with TH_LOG() in an arch-specific definition
1857 * of SYSCALL_RET_SET() above, and leave SYSCALL_RET undefined.
1858 */
1859 #if !defined(SYSCALL_RET) && !defined(SYSCALL_RET_SET)
1860 # error "One of SYSCALL_RET or SYSCALL_RET_SET is needed for this arch"
1861 #endif
1862 #ifndef SYSCALL_RET_SET
1863 # define SYSCALL_RET_SET(_regs, _val) \
1864 do { \
1865 SYSCALL_RET(_regs) = (_val); \
1866 } while (0)
1867 #endif
1868
1869 /* When the syscall return can't be changed, stub out the tests for it. */
1870 #ifndef SYSCALL_RET
1871 # define EXPECT_SYSCALL_RETURN(val, action) EXPECT_EQ(-1, action)
1872 #else
1873 # define EXPECT_SYSCALL_RETURN(val, action) \
1874 do { \
1875 errno = 0; \
1876 if (val < 0) { \
1877 EXPECT_EQ(-1, action); \
1878 EXPECT_EQ(-(val), errno); \
1879 } else { \
1880 EXPECT_EQ(val, action); \
1881 } \
1882 } while (0)
1883 #endif
1884
1885 /*
1886 * Some architectures (e.g. powerpc) can only set syscall
1887 * return values on syscall exit during ptrace.
1888 */
1889 const bool ptrace_entry_set_syscall_nr = true;
1890 const bool ptrace_entry_set_syscall_ret =
1891 #ifndef SYSCALL_RET_SET_ON_PTRACE_EXIT
1892 true;
1893 #else
1894 false;
1895 #endif
1896
1897 /*
1898 * Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
1899 * architectures without HAVE_ARCH_TRACEHOOK (e.g. User-mode Linux).
1900 */
1901 #if defined(__x86_64__) || defined(__i386__) || defined(__mips__)
1902 # define ARCH_GETREGS(_regs) ptrace(PTRACE_GETREGS, tracee, 0, &(_regs))
1903 # define ARCH_SETREGS(_regs) ptrace(PTRACE_SETREGS, tracee, 0, &(_regs))
1904 #else
1905 # define ARCH_GETREGS(_regs) ({ \
1906 struct iovec __v; \
1907 __v.iov_base = &(_regs); \
1908 __v.iov_len = sizeof(_regs); \
1909 ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &__v); \
1910 })
1911 # define ARCH_SETREGS(_regs) ({ \
1912 struct iovec __v; \
1913 __v.iov_base = &(_regs); \
1914 __v.iov_len = sizeof(_regs); \
1915 ptrace(PTRACE_SETREGSET, tracee, NT_PRSTATUS, &__v); \
1916 })
1917 #endif
1918
1919 /* Architecture-specific syscall fetching routine. */
get_syscall(struct __test_metadata * _metadata,pid_t tracee)1920 int get_syscall(struct __test_metadata *_metadata, pid_t tracee)
1921 {
1922 ARCH_REGS regs;
1923
1924 EXPECT_EQ(0, ARCH_GETREGS(regs)) {
1925 return -1;
1926 }
1927
1928 return SYSCALL_NUM(regs);
1929 }
1930
1931 /* Architecture-specific syscall changing routine. */
__change_syscall(struct __test_metadata * _metadata,pid_t tracee,long * syscall,long * ret)1932 void __change_syscall(struct __test_metadata *_metadata,
1933 pid_t tracee, long *syscall, long *ret)
1934 {
1935 ARCH_REGS orig, regs;
1936
1937 /* Do not get/set registers if we have nothing to do. */
1938 if (!syscall && !ret)
1939 return;
1940
1941 EXPECT_EQ(0, ARCH_GETREGS(regs)) {
1942 return;
1943 }
1944 orig = regs;
1945
1946 if (syscall)
1947 SYSCALL_NUM_SET(regs, *syscall);
1948
1949 if (ret)
1950 SYSCALL_RET_SET(regs, *ret);
1951
1952 /* Flush any register changes made. */
1953 if (memcmp(&orig, ®s, sizeof(orig)) != 0)
1954 EXPECT_EQ(0, ARCH_SETREGS(regs));
1955 }
1956
1957 /* Change only syscall number. */
change_syscall_nr(struct __test_metadata * _metadata,pid_t tracee,long syscall)1958 void change_syscall_nr(struct __test_metadata *_metadata,
1959 pid_t tracee, long syscall)
1960 {
1961 __change_syscall(_metadata, tracee, &syscall, NULL);
1962 }
1963
1964 /* Change syscall return value (and set syscall number to -1). */
change_syscall_ret(struct __test_metadata * _metadata,pid_t tracee,long ret)1965 void change_syscall_ret(struct __test_metadata *_metadata,
1966 pid_t tracee, long ret)
1967 {
1968 long syscall = -1;
1969
1970 __change_syscall(_metadata, tracee, &syscall, &ret);
1971 }
1972
tracer_seccomp(struct __test_metadata * _metadata,pid_t tracee,int status,void * args)1973 void tracer_seccomp(struct __test_metadata *_metadata, pid_t tracee,
1974 int status, void *args)
1975 {
1976 int ret;
1977 unsigned long msg;
1978
1979 EXPECT_EQ(PTRACE_EVENT_MASK(status), PTRACE_EVENT_SECCOMP) {
1980 TH_LOG("Unexpected ptrace event: %d", PTRACE_EVENT_MASK(status));
1981 return;
1982 }
1983
1984 /* Make sure we got the right message. */
1985 ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
1986 EXPECT_EQ(0, ret);
1987
1988 /* Validate and take action on expected syscalls. */
1989 switch (msg) {
1990 case 0x1002:
1991 /* change getpid to getppid. */
1992 EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee));
1993 change_syscall_nr(_metadata, tracee, __NR_getppid);
1994 break;
1995 case 0x1003:
1996 /* skip gettid with valid return code. */
1997 EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee));
1998 change_syscall_ret(_metadata, tracee, 45000);
1999 break;
2000 case 0x1004:
2001 /* skip openat with error. */
2002 EXPECT_EQ(__NR_openat, get_syscall(_metadata, tracee));
2003 change_syscall_ret(_metadata, tracee, -ESRCH);
2004 break;
2005 case 0x1005:
2006 /* do nothing (allow getppid) */
2007 EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee));
2008 break;
2009 default:
2010 EXPECT_EQ(0, msg) {
2011 TH_LOG("Unknown PTRACE_GETEVENTMSG: 0x%lx", msg);
2012 kill(tracee, SIGKILL);
2013 }
2014 }
2015
2016 }
2017
FIXTURE(TRACE_syscall)2018 FIXTURE(TRACE_syscall) {
2019 struct sock_fprog prog;
2020 pid_t tracer, mytid, mypid, parent;
2021 long syscall_nr;
2022 };
2023
tracer_ptrace(struct __test_metadata * _metadata,pid_t tracee,int status,void * args)2024 void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
2025 int status, void *args)
2026 {
2027 int ret;
2028 unsigned long msg;
2029 static bool entry;
2030 long syscall_nr_val, syscall_ret_val;
2031 long *syscall_nr = NULL, *syscall_ret = NULL;
2032 FIXTURE_DATA(TRACE_syscall) *self = args;
2033
2034 EXPECT_EQ(WSTOPSIG(status) & 0x80, 0x80) {
2035 TH_LOG("Unexpected WSTOPSIG: %d", WSTOPSIG(status));
2036 return;
2037 }
2038
2039 /*
2040 * The traditional way to tell PTRACE_SYSCALL entry/exit
2041 * is by counting.
2042 */
2043 entry = !entry;
2044
2045 /* Make sure we got an appropriate message. */
2046 ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
2047 EXPECT_EQ(0, ret);
2048
2049 /*
2050 * TODO: b/33027081
2051 * PTRACE_EVENTMSG_SYSCALL_ENTRY and PTRACE_EVENTMSG_SYSCALL_EXIT not
2052 * compatible < 5.3 (see 201766a)
2053 *
2054 * EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY
2055 * : PTRACE_EVENTMSG_SYSCALL_EXIT, msg);
2056 */
2057
2058 /*
2059 * Some architectures only support setting return values during
2060 * syscall exit under ptrace, and on exit the syscall number may
2061 * no longer be available. Therefore, save the initial sycall
2062 * number here, so it can be examined during both entry and exit
2063 * phases.
2064 */
2065 if (entry)
2066 self->syscall_nr = get_syscall(_metadata, tracee);
2067
2068 /*
2069 * Depending on the architecture's syscall setting abilities, we
2070 * pick which things to set during this phase (entry or exit).
2071 */
2072 if (entry == ptrace_entry_set_syscall_nr)
2073 syscall_nr = &syscall_nr_val;
2074 if (entry == ptrace_entry_set_syscall_ret)
2075 syscall_ret = &syscall_ret_val;
2076
2077 /* Now handle the actual rewriting cases. */
2078 switch (self->syscall_nr) {
2079 case __NR_getpid:
2080 syscall_nr_val = __NR_getppid;
2081 /* Never change syscall return for this case. */
2082 syscall_ret = NULL;
2083 break;
2084 case __NR_gettid:
2085 syscall_nr_val = -1;
2086 syscall_ret_val = 45000;
2087 break;
2088 case __NR_openat:
2089 syscall_nr_val = -1;
2090 syscall_ret_val = -ESRCH;
2091 break;
2092 default:
2093 /* Unhandled, do nothing. */
2094 return;
2095 }
2096
2097 __change_syscall(_metadata, tracee, syscall_nr, syscall_ret);
2098 }
2099
FIXTURE_VARIANT(TRACE_syscall)2100 FIXTURE_VARIANT(TRACE_syscall) {
2101 /*
2102 * All of the SECCOMP_RET_TRACE behaviors can be tested with either
2103 * SECCOMP_RET_TRACE+PTRACE_CONT or plain ptrace()+PTRACE_SYSCALL.
2104 * This indicates if we should use SECCOMP_RET_TRACE (false), or
2105 * ptrace (true).
2106 */
2107 bool use_ptrace;
2108 };
2109
FIXTURE_VARIANT_ADD(TRACE_syscall,ptrace)2110 FIXTURE_VARIANT_ADD(TRACE_syscall, ptrace) {
2111 .use_ptrace = true,
2112 };
2113
FIXTURE_VARIANT_ADD(TRACE_syscall,seccomp)2114 FIXTURE_VARIANT_ADD(TRACE_syscall, seccomp) {
2115 .use_ptrace = false,
2116 };
2117
FIXTURE_SETUP(TRACE_syscall)2118 FIXTURE_SETUP(TRACE_syscall)
2119 {
2120 struct sock_filter filter[] = {
2121 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2122 offsetof(struct seccomp_data, nr)),
2123 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
2124 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002),
2125 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1),
2126 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003),
2127 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_openat, 0, 1),
2128 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004),
2129 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
2130 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1005),
2131 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2132 };
2133 struct sock_fprog prog = {
2134 .len = (unsigned short)ARRAY_SIZE(filter),
2135 .filter = filter,
2136 };
2137 long ret;
2138
2139 /* Prepare some testable syscall results. */
2140 self->mytid = syscall(__NR_gettid);
2141 ASSERT_GT(self->mytid, 0);
2142 ASSERT_NE(self->mytid, 1) {
2143 TH_LOG("Running this test as init is not supported. :)");
2144 }
2145
2146 self->mypid = getpid();
2147 ASSERT_GT(self->mypid, 0);
2148 ASSERT_EQ(self->mytid, self->mypid);
2149
2150 self->parent = getppid();
2151 ASSERT_GT(self->parent, 0);
2152 ASSERT_NE(self->parent, self->mypid);
2153
2154 /* Launch tracer. */
2155 self->tracer = setup_trace_fixture(_metadata,
2156 variant->use_ptrace ? tracer_ptrace
2157 : tracer_seccomp,
2158 self, variant->use_ptrace);
2159
2160 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
2161 ASSERT_EQ(0, ret);
2162
2163 /* Do not install seccomp rewrite filters, as we'll use ptrace instead. */
2164 if (variant->use_ptrace)
2165 return;
2166
2167 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2168 ASSERT_EQ(0, ret);
2169 }
2170
FIXTURE_TEARDOWN(TRACE_syscall)2171 FIXTURE_TEARDOWN(TRACE_syscall)
2172 {
2173 teardown_trace_fixture(_metadata, self->tracer);
2174 }
2175
TEST(negative_ENOSYS)2176 TEST(negative_ENOSYS)
2177 {
2178 #if defined(__arm__)
2179 SKIP(return, "arm32 does not handle negative syscalls");
2180 #endif
2181 /*
2182 * There should be no difference between an "internal" skip
2183 * and userspace asking for syscall "-1".
2184 */
2185 errno = 0;
2186 EXPECT_EQ(-1, syscall(-1));
2187 EXPECT_EQ(errno, ENOSYS);
2188 /* And no difference for "still not valid but not -1". */
2189 errno = 0;
2190 EXPECT_EQ(-1, syscall(-101));
2191 EXPECT_EQ(errno, ENOSYS);
2192 }
2193
TEST_F(TRACE_syscall,negative_ENOSYS)2194 TEST_F(TRACE_syscall, negative_ENOSYS)
2195 {
2196 negative_ENOSYS(_metadata);
2197 }
2198
TEST_F(TRACE_syscall,syscall_allowed)2199 TEST_F(TRACE_syscall, syscall_allowed)
2200 {
2201 /* getppid works as expected (no changes). */
2202 EXPECT_EQ(self->parent, syscall(__NR_getppid));
2203 EXPECT_NE(self->mypid, syscall(__NR_getppid));
2204 }
2205
TEST_F(TRACE_syscall,syscall_redirected)2206 TEST_F(TRACE_syscall, syscall_redirected)
2207 {
2208 /* getpid has been redirected to getppid as expected. */
2209 EXPECT_EQ(self->parent, syscall(__NR_getpid));
2210 EXPECT_NE(self->mypid, syscall(__NR_getpid));
2211 }
2212
TEST_F(TRACE_syscall,syscall_errno)2213 TEST_F(TRACE_syscall, syscall_errno)
2214 {
2215 /* Tracer should skip the open syscall, resulting in ESRCH. */
2216 EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
2217 }
2218
TEST_F(TRACE_syscall,syscall_faked)2219 TEST_F(TRACE_syscall, syscall_faked)
2220 {
2221 /* Tracer skips the gettid syscall and store altered return value. */
2222 EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
2223 }
2224
TEST_F_SIGNAL(TRACE_syscall,kill_immediate,SIGSYS)2225 TEST_F_SIGNAL(TRACE_syscall, kill_immediate, SIGSYS)
2226 {
2227 struct sock_filter filter[] = {
2228 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2229 offsetof(struct seccomp_data, nr)),
2230 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_mknodat, 0, 1),
2231 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_THREAD),
2232 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2233 };
2234 struct sock_fprog prog = {
2235 .len = (unsigned short)ARRAY_SIZE(filter),
2236 .filter = filter,
2237 };
2238 long ret;
2239
2240 /* Install "kill on mknodat" filter. */
2241 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2242 ASSERT_EQ(0, ret);
2243
2244 /* This should immediately die with SIGSYS, regardless of tracer. */
2245 EXPECT_EQ(-1, syscall(__NR_mknodat, -1, NULL, 0, 0));
2246 }
2247
TEST_F(TRACE_syscall,skip_after)2248 TEST_F(TRACE_syscall, skip_after)
2249 {
2250 struct sock_filter filter[] = {
2251 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2252 offsetof(struct seccomp_data, nr)),
2253 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
2254 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EPERM),
2255 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2256 };
2257 struct sock_fprog prog = {
2258 .len = (unsigned short)ARRAY_SIZE(filter),
2259 .filter = filter,
2260 };
2261 long ret;
2262
2263 /* Install additional "errno on getppid" filter. */
2264 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2265 ASSERT_EQ(0, ret);
2266
2267 /* Tracer will redirect getpid to getppid, and we should see EPERM. */
2268 errno = 0;
2269 EXPECT_EQ(-1, syscall(__NR_getpid));
2270 EXPECT_EQ(EPERM, errno);
2271 }
2272
TEST_F_SIGNAL(TRACE_syscall,kill_after,SIGSYS)2273 TEST_F_SIGNAL(TRACE_syscall, kill_after, SIGSYS)
2274 {
2275 struct sock_filter filter[] = {
2276 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2277 offsetof(struct seccomp_data, nr)),
2278 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
2279 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
2280 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2281 };
2282 struct sock_fprog prog = {
2283 .len = (unsigned short)ARRAY_SIZE(filter),
2284 .filter = filter,
2285 };
2286 long ret;
2287
2288 /* Install additional "death on getppid" filter. */
2289 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2290 ASSERT_EQ(0, ret);
2291
2292 /* Tracer will redirect getpid to getppid, and we should die. */
2293 EXPECT_NE(self->mypid, syscall(__NR_getpid));
2294 }
2295
TEST(seccomp_syscall)2296 TEST(seccomp_syscall)
2297 {
2298 struct sock_filter filter[] = {
2299 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2300 };
2301 struct sock_fprog prog = {
2302 .len = (unsigned short)ARRAY_SIZE(filter),
2303 .filter = filter,
2304 };
2305 long ret;
2306
2307 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
2308 ASSERT_EQ(0, ret) {
2309 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2310 }
2311
2312 /* Reject insane operation. */
2313 ret = seccomp(-1, 0, &prog);
2314 ASSERT_NE(ENOSYS, errno) {
2315 TH_LOG("Kernel does not support seccomp syscall!");
2316 }
2317 EXPECT_EQ(EINVAL, errno) {
2318 TH_LOG("Did not reject crazy op value!");
2319 }
2320
2321 /* Reject strict with flags or pointer. */
2322 ret = seccomp(SECCOMP_SET_MODE_STRICT, -1, NULL);
2323 EXPECT_EQ(EINVAL, errno) {
2324 TH_LOG("Did not reject mode strict with flags!");
2325 }
2326 ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, &prog);
2327 EXPECT_EQ(EINVAL, errno) {
2328 TH_LOG("Did not reject mode strict with uargs!");
2329 }
2330
2331 /* Reject insane args for filter. */
2332 ret = seccomp(SECCOMP_SET_MODE_FILTER, -1, &prog);
2333 EXPECT_EQ(EINVAL, errno) {
2334 TH_LOG("Did not reject crazy filter flags!");
2335 }
2336 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, NULL);
2337 EXPECT_EQ(EFAULT, errno) {
2338 TH_LOG("Did not reject NULL filter!");
2339 }
2340
2341 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
2342 EXPECT_EQ(0, errno) {
2343 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER: %s",
2344 strerror(errno));
2345 }
2346 }
2347
TEST(seccomp_syscall_mode_lock)2348 TEST(seccomp_syscall_mode_lock)
2349 {
2350 struct sock_filter filter[] = {
2351 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2352 };
2353 struct sock_fprog prog = {
2354 .len = (unsigned short)ARRAY_SIZE(filter),
2355 .filter = filter,
2356 };
2357 long ret;
2358
2359 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
2360 ASSERT_EQ(0, ret) {
2361 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2362 }
2363
2364 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
2365 ASSERT_NE(ENOSYS, errno) {
2366 TH_LOG("Kernel does not support seccomp syscall!");
2367 }
2368 EXPECT_EQ(0, ret) {
2369 TH_LOG("Could not install filter!");
2370 }
2371
2372 /* Make sure neither entry point will switch to strict. */
2373 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, 0, 0, 0);
2374 EXPECT_EQ(EINVAL, errno) {
2375 TH_LOG("Switched to mode strict!");
2376 }
2377
2378 ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, NULL);
2379 EXPECT_EQ(EINVAL, errno) {
2380 TH_LOG("Switched to mode strict!");
2381 }
2382 }
2383
2384 /*
2385 * b/147676645
2386 * SECCOMP_FILTER_FLAG_TSYNC_ESRCH not compatible < 5.7
2387 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
2388 * SECCOMP_FILTER_FLAG_SPEC_ALLOW not compatible < 4.17
2389 * SECCOMP_FILTER_FLAG_LOG not compatible < 4.14
2390 */
2391 #ifndef __ANDROID__
2392 /*
2393 * Test detection of known and unknown filter flags. Userspace needs to be able
2394 * to check if a filter flag is supported by the current kernel and a good way
2395 * of doing that is by attempting to enter filter mode, with the flag bit in
2396 * question set, and a NULL pointer for the _args_ parameter. EFAULT indicates
2397 * that the flag is valid and EINVAL indicates that the flag is invalid.
2398 */
TEST(detect_seccomp_filter_flags)2399 TEST(detect_seccomp_filter_flags)
2400 {
2401 unsigned int flags[] = { SECCOMP_FILTER_FLAG_TSYNC,
2402 SECCOMP_FILTER_FLAG_LOG,
2403 SECCOMP_FILTER_FLAG_SPEC_ALLOW,
2404 SECCOMP_FILTER_FLAG_NEW_LISTENER,
2405 SECCOMP_FILTER_FLAG_TSYNC_ESRCH };
2406 unsigned int exclusive[] = {
2407 SECCOMP_FILTER_FLAG_TSYNC,
2408 SECCOMP_FILTER_FLAG_NEW_LISTENER };
2409 unsigned int flag, all_flags, exclusive_mask;
2410 int i;
2411 long ret;
2412
2413 /* Test detection of individual known-good filter flags */
2414 for (i = 0, all_flags = 0; i < ARRAY_SIZE(flags); i++) {
2415 int bits = 0;
2416
2417 flag = flags[i];
2418 /* Make sure the flag is a single bit! */
2419 while (flag) {
2420 if (flag & 0x1)
2421 bits ++;
2422 flag >>= 1;
2423 }
2424 ASSERT_EQ(1, bits);
2425 flag = flags[i];
2426
2427 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2428 ASSERT_NE(ENOSYS, errno) {
2429 TH_LOG("Kernel does not support seccomp syscall!");
2430 }
2431 EXPECT_EQ(-1, ret);
2432 EXPECT_EQ(EFAULT, errno) {
2433 TH_LOG("Failed to detect that a known-good filter flag (0x%X) is supported!",
2434 flag);
2435 }
2436
2437 all_flags |= flag;
2438 }
2439
2440 /*
2441 * Test detection of all known-good filter flags combined. But
2442 * for the exclusive flags we need to mask them out and try them
2443 * individually for the "all flags" testing.
2444 */
2445 exclusive_mask = 0;
2446 for (i = 0; i < ARRAY_SIZE(exclusive); i++)
2447 exclusive_mask |= exclusive[i];
2448 for (i = 0; i < ARRAY_SIZE(exclusive); i++) {
2449 flag = all_flags & ~exclusive_mask;
2450 flag |= exclusive[i];
2451
2452 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2453 EXPECT_EQ(-1, ret);
2454 EXPECT_EQ(EFAULT, errno) {
2455 TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!",
2456 flag);
2457 }
2458 }
2459
2460 /* Test detection of an unknown filter flags, without exclusives. */
2461 flag = -1;
2462 flag &= ~exclusive_mask;
2463 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2464 EXPECT_EQ(-1, ret);
2465 EXPECT_EQ(EINVAL, errno) {
2466 TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported!",
2467 flag);
2468 }
2469
2470 /*
2471 * Test detection of an unknown filter flag that may simply need to be
2472 * added to this test
2473 */
2474 flag = flags[ARRAY_SIZE(flags) - 1] << 1;
2475 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2476 EXPECT_EQ(-1, ret);
2477 EXPECT_EQ(EINVAL, errno) {
2478 TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported! Does a new flag need to be added to this test?",
2479 flag);
2480 }
2481 }
2482 #endif
2483
TEST(TSYNC_first)2484 TEST(TSYNC_first)
2485 {
2486 struct sock_filter filter[] = {
2487 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2488 };
2489 struct sock_fprog prog = {
2490 .len = (unsigned short)ARRAY_SIZE(filter),
2491 .filter = filter,
2492 };
2493 long ret;
2494
2495 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
2496 ASSERT_EQ(0, ret) {
2497 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2498 }
2499
2500 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2501 &prog);
2502 ASSERT_NE(ENOSYS, errno) {
2503 TH_LOG("Kernel does not support seccomp syscall!");
2504 }
2505 EXPECT_EQ(0, ret) {
2506 TH_LOG("Could not install initial filter with TSYNC!");
2507 }
2508 }
2509
2510 #define TSYNC_SIBLINGS 2
2511 struct tsync_sibling {
2512 pthread_t tid;
2513 pid_t system_tid;
2514 sem_t *started;
2515 pthread_cond_t *cond;
2516 pthread_mutex_t *mutex;
2517 int diverge;
2518 int num_waits;
2519 struct sock_fprog *prog;
2520 struct __test_metadata *metadata;
2521 };
2522
2523 /*
2524 * To avoid joining joined threads (which is not allowed by Bionic),
2525 * make sure we both successfully join and clear the tid to skip a
2526 * later join attempt during fixture teardown. Any remaining threads
2527 * will be directly killed during teardown.
2528 */
2529 #define PTHREAD_JOIN(tid, status) \
2530 do { \
2531 int _rc = pthread_join(tid, status); \
2532 if (_rc) { \
2533 TH_LOG("pthread_join of tid %u failed: %d\n", \
2534 (unsigned int)tid, _rc); \
2535 } else { \
2536 tid = 0; \
2537 } \
2538 } while (0)
2539
FIXTURE(TSYNC)2540 FIXTURE(TSYNC) {
2541 struct sock_fprog root_prog, apply_prog;
2542 struct tsync_sibling sibling[TSYNC_SIBLINGS];
2543 sem_t started;
2544 pthread_cond_t cond;
2545 pthread_mutex_t mutex;
2546 int sibling_count;
2547 };
2548
FIXTURE_SETUP(TSYNC)2549 FIXTURE_SETUP(TSYNC)
2550 {
2551 struct sock_filter root_filter[] = {
2552 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2553 };
2554 struct sock_filter apply_filter[] = {
2555 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2556 offsetof(struct seccomp_data, nr)),
2557 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
2558 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
2559 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2560 };
2561
2562 memset(&self->root_prog, 0, sizeof(self->root_prog));
2563 memset(&self->apply_prog, 0, sizeof(self->apply_prog));
2564 memset(&self->sibling, 0, sizeof(self->sibling));
2565 self->root_prog.filter = malloc(sizeof(root_filter));
2566 ASSERT_NE(NULL, self->root_prog.filter);
2567 memcpy(self->root_prog.filter, &root_filter, sizeof(root_filter));
2568 self->root_prog.len = (unsigned short)ARRAY_SIZE(root_filter);
2569
2570 self->apply_prog.filter = malloc(sizeof(apply_filter));
2571 ASSERT_NE(NULL, self->apply_prog.filter);
2572 memcpy(self->apply_prog.filter, &apply_filter, sizeof(apply_filter));
2573 self->apply_prog.len = (unsigned short)ARRAY_SIZE(apply_filter);
2574
2575 self->sibling_count = 0;
2576 pthread_mutex_init(&self->mutex, NULL);
2577 pthread_cond_init(&self->cond, NULL);
2578 sem_init(&self->started, 0, 0);
2579 self->sibling[0].tid = 0;
2580 self->sibling[0].cond = &self->cond;
2581 self->sibling[0].started = &self->started;
2582 self->sibling[0].mutex = &self->mutex;
2583 self->sibling[0].diverge = 0;
2584 self->sibling[0].num_waits = 1;
2585 self->sibling[0].prog = &self->root_prog;
2586 self->sibling[0].metadata = _metadata;
2587 self->sibling[1].tid = 0;
2588 self->sibling[1].cond = &self->cond;
2589 self->sibling[1].started = &self->started;
2590 self->sibling[1].mutex = &self->mutex;
2591 self->sibling[1].diverge = 0;
2592 self->sibling[1].prog = &self->root_prog;
2593 self->sibling[1].num_waits = 1;
2594 self->sibling[1].metadata = _metadata;
2595 }
2596
FIXTURE_TEARDOWN(TSYNC)2597 FIXTURE_TEARDOWN(TSYNC)
2598 {
2599 int sib = 0;
2600
2601 if (self->root_prog.filter)
2602 free(self->root_prog.filter);
2603 if (self->apply_prog.filter)
2604 free(self->apply_prog.filter);
2605
2606 for ( ; sib < self->sibling_count; ++sib) {
2607 struct tsync_sibling *s = &self->sibling[sib];
2608
2609 if (!s->tid)
2610 continue;
2611 /*
2612 * If a thread is still running, it may be stuck, so hit
2613 * it over the head really hard.
2614 */
2615 pthread_kill(s->tid, 9);
2616 }
2617 pthread_mutex_destroy(&self->mutex);
2618 pthread_cond_destroy(&self->cond);
2619 sem_destroy(&self->started);
2620 }
2621
tsync_sibling(void * data)2622 void *tsync_sibling(void *data)
2623 {
2624 long ret = 0;
2625 struct tsync_sibling *me = data;
2626
2627 me->system_tid = syscall(__NR_gettid);
2628
2629 pthread_mutex_lock(me->mutex);
2630 if (me->diverge) {
2631 /* Just re-apply the root prog to fork the tree */
2632 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
2633 me->prog, 0, 0);
2634 }
2635 sem_post(me->started);
2636 /* Return outside of started so parent notices failures. */
2637 if (ret) {
2638 pthread_mutex_unlock(me->mutex);
2639 return (void *)SIBLING_EXIT_FAILURE;
2640 }
2641 do {
2642 pthread_cond_wait(me->cond, me->mutex);
2643 me->num_waits = me->num_waits - 1;
2644 } while (me->num_waits);
2645 pthread_mutex_unlock(me->mutex);
2646
2647 ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
2648 if (!ret)
2649 return (void *)SIBLING_EXIT_NEWPRIVS;
2650 read(0, NULL, 0);
2651 return (void *)SIBLING_EXIT_UNKILLED;
2652 }
2653
tsync_start_sibling(struct tsync_sibling * sibling)2654 void tsync_start_sibling(struct tsync_sibling *sibling)
2655 {
2656 pthread_create(&sibling->tid, NULL, tsync_sibling, (void *)sibling);
2657 }
2658
TEST_F(TSYNC,siblings_fail_prctl)2659 TEST_F(TSYNC, siblings_fail_prctl)
2660 {
2661 long ret;
2662 void *status;
2663 struct sock_filter filter[] = {
2664 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2665 offsetof(struct seccomp_data, nr)),
2666 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
2667 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EINVAL),
2668 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2669 };
2670 struct sock_fprog prog = {
2671 .len = (unsigned short)ARRAY_SIZE(filter),
2672 .filter = filter,
2673 };
2674
2675 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2676 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2677 }
2678
2679 /* Check prctl failure detection by requesting sib 0 diverge. */
2680 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
2681 ASSERT_NE(ENOSYS, errno) {
2682 TH_LOG("Kernel does not support seccomp syscall!");
2683 }
2684 ASSERT_EQ(0, ret) {
2685 TH_LOG("setting filter failed");
2686 }
2687
2688 self->sibling[0].diverge = 1;
2689 tsync_start_sibling(&self->sibling[0]);
2690 tsync_start_sibling(&self->sibling[1]);
2691
2692 while (self->sibling_count < TSYNC_SIBLINGS) {
2693 sem_wait(&self->started);
2694 self->sibling_count++;
2695 }
2696
2697 /* Signal the threads to clean up*/
2698 pthread_mutex_lock(&self->mutex);
2699 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2700 TH_LOG("cond broadcast non-zero");
2701 }
2702 pthread_mutex_unlock(&self->mutex);
2703
2704 /* Ensure diverging sibling failed to call prctl. */
2705 PTHREAD_JOIN(self->sibling[0].tid, &status);
2706 EXPECT_EQ(SIBLING_EXIT_FAILURE, (long)status);
2707 PTHREAD_JOIN(self->sibling[1].tid, &status);
2708 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2709 }
2710
TEST_F(TSYNC,two_siblings_with_ancestor)2711 TEST_F(TSYNC, two_siblings_with_ancestor)
2712 {
2713 long ret;
2714 void *status;
2715
2716 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2717 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2718 }
2719
2720 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2721 ASSERT_NE(ENOSYS, errno) {
2722 TH_LOG("Kernel does not support seccomp syscall!");
2723 }
2724 ASSERT_EQ(0, ret) {
2725 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2726 }
2727 tsync_start_sibling(&self->sibling[0]);
2728 tsync_start_sibling(&self->sibling[1]);
2729
2730 while (self->sibling_count < TSYNC_SIBLINGS) {
2731 sem_wait(&self->started);
2732 self->sibling_count++;
2733 }
2734
2735 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2736 &self->apply_prog);
2737 ASSERT_EQ(0, ret) {
2738 TH_LOG("Could install filter on all threads!");
2739 }
2740 /* Tell the siblings to test the policy */
2741 pthread_mutex_lock(&self->mutex);
2742 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2743 TH_LOG("cond broadcast non-zero");
2744 }
2745 pthread_mutex_unlock(&self->mutex);
2746 /* Ensure they are both killed and don't exit cleanly. */
2747 PTHREAD_JOIN(self->sibling[0].tid, &status);
2748 EXPECT_EQ(0x0, (long)status);
2749 PTHREAD_JOIN(self->sibling[1].tid, &status);
2750 EXPECT_EQ(0x0, (long)status);
2751 }
2752
TEST_F(TSYNC,two_sibling_want_nnp)2753 TEST_F(TSYNC, two_sibling_want_nnp)
2754 {
2755 void *status;
2756
2757 /* start siblings before any prctl() operations */
2758 tsync_start_sibling(&self->sibling[0]);
2759 tsync_start_sibling(&self->sibling[1]);
2760 while (self->sibling_count < TSYNC_SIBLINGS) {
2761 sem_wait(&self->started);
2762 self->sibling_count++;
2763 }
2764
2765 /* Tell the siblings to test no policy */
2766 pthread_mutex_lock(&self->mutex);
2767 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2768 TH_LOG("cond broadcast non-zero");
2769 }
2770 pthread_mutex_unlock(&self->mutex);
2771
2772 /* Ensure they are both upset about lacking nnp. */
2773 PTHREAD_JOIN(self->sibling[0].tid, &status);
2774 EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status);
2775 PTHREAD_JOIN(self->sibling[1].tid, &status);
2776 EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status);
2777 }
2778
TEST_F(TSYNC,two_siblings_with_no_filter)2779 TEST_F(TSYNC, two_siblings_with_no_filter)
2780 {
2781 long ret;
2782 void *status;
2783
2784 /* start siblings before any prctl() operations */
2785 tsync_start_sibling(&self->sibling[0]);
2786 tsync_start_sibling(&self->sibling[1]);
2787 while (self->sibling_count < TSYNC_SIBLINGS) {
2788 sem_wait(&self->started);
2789 self->sibling_count++;
2790 }
2791
2792 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2793 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2794 }
2795
2796 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2797 &self->apply_prog);
2798 ASSERT_NE(ENOSYS, errno) {
2799 TH_LOG("Kernel does not support seccomp syscall!");
2800 }
2801 ASSERT_EQ(0, ret) {
2802 TH_LOG("Could install filter on all threads!");
2803 }
2804
2805 /* Tell the siblings to test the policy */
2806 pthread_mutex_lock(&self->mutex);
2807 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2808 TH_LOG("cond broadcast non-zero");
2809 }
2810 pthread_mutex_unlock(&self->mutex);
2811
2812 /* Ensure they are both killed and don't exit cleanly. */
2813 PTHREAD_JOIN(self->sibling[0].tid, &status);
2814 EXPECT_EQ(0x0, (long)status);
2815 PTHREAD_JOIN(self->sibling[1].tid, &status);
2816 EXPECT_EQ(0x0, (long)status);
2817 }
2818
TEST_F(TSYNC,two_siblings_with_one_divergence)2819 TEST_F(TSYNC, two_siblings_with_one_divergence)
2820 {
2821 long ret;
2822 void *status;
2823
2824 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2825 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2826 }
2827
2828 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2829 ASSERT_NE(ENOSYS, errno) {
2830 TH_LOG("Kernel does not support seccomp syscall!");
2831 }
2832 ASSERT_EQ(0, ret) {
2833 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2834 }
2835 self->sibling[0].diverge = 1;
2836 tsync_start_sibling(&self->sibling[0]);
2837 tsync_start_sibling(&self->sibling[1]);
2838
2839 while (self->sibling_count < TSYNC_SIBLINGS) {
2840 sem_wait(&self->started);
2841 self->sibling_count++;
2842 }
2843
2844 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2845 &self->apply_prog);
2846 ASSERT_EQ(self->sibling[0].system_tid, ret) {
2847 TH_LOG("Did not fail on diverged sibling.");
2848 }
2849
2850 /* Wake the threads */
2851 pthread_mutex_lock(&self->mutex);
2852 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2853 TH_LOG("cond broadcast non-zero");
2854 }
2855 pthread_mutex_unlock(&self->mutex);
2856
2857 /* Ensure they are both unkilled. */
2858 PTHREAD_JOIN(self->sibling[0].tid, &status);
2859 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2860 PTHREAD_JOIN(self->sibling[1].tid, &status);
2861 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2862 }
2863
2864 /*
2865 * b/147676645
2866 * SECCOMP_FILTER_FLAG_TSYNC_ESRCH not compatible < 5.7
2867 */
2868 #ifndef __ANDROID__
TEST_F(TSYNC,two_siblings_with_one_divergence_no_tid_in_err)2869 TEST_F(TSYNC, two_siblings_with_one_divergence_no_tid_in_err)
2870 {
2871 long ret, flags;
2872 void *status;
2873
2874 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2875 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2876 }
2877
2878 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2879 ASSERT_NE(ENOSYS, errno) {
2880 TH_LOG("Kernel does not support seccomp syscall!");
2881 }
2882 ASSERT_EQ(0, ret) {
2883 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2884 }
2885 self->sibling[0].diverge = 1;
2886 tsync_start_sibling(&self->sibling[0]);
2887 tsync_start_sibling(&self->sibling[1]);
2888
2889 while (self->sibling_count < TSYNC_SIBLINGS) {
2890 sem_wait(&self->started);
2891 self->sibling_count++;
2892 }
2893
2894 flags = SECCOMP_FILTER_FLAG_TSYNC | \
2895 SECCOMP_FILTER_FLAG_TSYNC_ESRCH;
2896 ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &self->apply_prog);
2897 ASSERT_EQ(ESRCH, errno) {
2898 TH_LOG("Did not return ESRCH for diverged sibling.");
2899 }
2900 ASSERT_EQ(-1, ret) {
2901 TH_LOG("Did not fail on diverged sibling.");
2902 }
2903
2904 /* Wake the threads */
2905 pthread_mutex_lock(&self->mutex);
2906 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2907 TH_LOG("cond broadcast non-zero");
2908 }
2909 pthread_mutex_unlock(&self->mutex);
2910
2911 /* Ensure they are both unkilled. */
2912 PTHREAD_JOIN(self->sibling[0].tid, &status);
2913 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2914 PTHREAD_JOIN(self->sibling[1].tid, &status);
2915 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2916 }
2917 #endif
2918
TEST_F(TSYNC,two_siblings_not_under_filter)2919 TEST_F(TSYNC, two_siblings_not_under_filter)
2920 {
2921 long ret, sib;
2922 void *status;
2923 struct timespec delay = { .tv_nsec = 100000000 };
2924
2925 ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2926 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2927 }
2928
2929 /*
2930 * Sibling 0 will have its own seccomp policy
2931 * and Sibling 1 will not be under seccomp at
2932 * all. Sibling 1 will enter seccomp and 0
2933 * will cause failure.
2934 */
2935 self->sibling[0].diverge = 1;
2936 tsync_start_sibling(&self->sibling[0]);
2937 tsync_start_sibling(&self->sibling[1]);
2938
2939 while (self->sibling_count < TSYNC_SIBLINGS) {
2940 sem_wait(&self->started);
2941 self->sibling_count++;
2942 }
2943
2944 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2945 ASSERT_NE(ENOSYS, errno) {
2946 TH_LOG("Kernel does not support seccomp syscall!");
2947 }
2948 ASSERT_EQ(0, ret) {
2949 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2950 }
2951
2952 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2953 &self->apply_prog);
2954 ASSERT_EQ(ret, self->sibling[0].system_tid) {
2955 TH_LOG("Did not fail on diverged sibling.");
2956 }
2957 sib = 1;
2958 if (ret == self->sibling[0].system_tid)
2959 sib = 0;
2960
2961 pthread_mutex_lock(&self->mutex);
2962
2963 /* Increment the other siblings num_waits so we can clean up
2964 * the one we just saw.
2965 */
2966 self->sibling[!sib].num_waits += 1;
2967
2968 /* Signal the thread to clean up*/
2969 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2970 TH_LOG("cond broadcast non-zero");
2971 }
2972 pthread_mutex_unlock(&self->mutex);
2973 PTHREAD_JOIN(self->sibling[sib].tid, &status);
2974 EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2975 /* Poll for actual task death. pthread_join doesn't guarantee it. */
2976 while (!kill(self->sibling[sib].system_tid, 0))
2977 nanosleep(&delay, NULL);
2978 /* Switch to the remaining sibling */
2979 sib = !sib;
2980
2981 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2982 &self->apply_prog);
2983 ASSERT_EQ(0, ret) {
2984 TH_LOG("Expected the remaining sibling to sync");
2985 };
2986
2987 pthread_mutex_lock(&self->mutex);
2988
2989 /* If remaining sibling didn't have a chance to wake up during
2990 * the first broadcast, manually reduce the num_waits now.
2991 */
2992 if (self->sibling[sib].num_waits > 1)
2993 self->sibling[sib].num_waits = 1;
2994 ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2995 TH_LOG("cond broadcast non-zero");
2996 }
2997 pthread_mutex_unlock(&self->mutex);
2998 PTHREAD_JOIN(self->sibling[sib].tid, &status);
2999 EXPECT_EQ(0, (long)status);
3000 /* Poll for actual task death. pthread_join doesn't guarantee it. */
3001 while (!kill(self->sibling[sib].system_tid, 0))
3002 nanosleep(&delay, NULL);
3003
3004 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
3005 &self->apply_prog);
3006 ASSERT_EQ(0, ret); /* just us chickens */
3007 }
3008
3009 /* Make sure restarted syscalls are seen directly as "restart_syscall". */
TEST(syscall_restart)3010 TEST(syscall_restart)
3011 {
3012 long ret;
3013 unsigned long msg;
3014 pid_t child_pid;
3015 int pipefd[2];
3016 int status;
3017 siginfo_t info = { };
3018 struct sock_filter filter[] = {
3019 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
3020 offsetof(struct seccomp_data, nr)),
3021
3022 #ifdef __NR_sigreturn
3023 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_sigreturn, 7, 0),
3024 #endif
3025 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 6, 0),
3026 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_exit, 5, 0),
3027 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_rt_sigreturn, 4, 0),
3028 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_nanosleep, 5, 0),
3029 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_clock_nanosleep, 4, 0),
3030 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_restart_syscall, 4, 0),
3031
3032 /* Allow __NR_write for easy logging. */
3033 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_write, 0, 1),
3034 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3035 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
3036 /* The nanosleep jump target. */
3037 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x100),
3038 /* The restart_syscall jump target. */
3039 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x200),
3040 };
3041 struct sock_fprog prog = {
3042 .len = (unsigned short)ARRAY_SIZE(filter),
3043 .filter = filter,
3044 };
3045 #if defined(__arm__)
3046 struct utsname utsbuf;
3047 int arm_version;
3048 #endif
3049
3050 ASSERT_EQ(0, pipe(pipefd));
3051
3052 child_pid = fork();
3053 ASSERT_LE(0, child_pid);
3054 if (child_pid == 0) {
3055 /* Child uses EXPECT not ASSERT to deliver status correctly. */
3056 char buf = ' ';
3057 struct timespec timeout = { };
3058
3059 /* Attach parent as tracer and stop. */
3060 EXPECT_EQ(0, ptrace(PTRACE_TRACEME));
3061 EXPECT_EQ(0, raise(SIGSTOP));
3062
3063 EXPECT_EQ(0, close(pipefd[1]));
3064
3065 EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
3066 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3067 }
3068
3069 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
3070 EXPECT_EQ(0, ret) {
3071 TH_LOG("Failed to install filter!");
3072 }
3073
3074 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) {
3075 TH_LOG("Failed to read() sync from parent");
3076 }
3077 EXPECT_EQ('.', buf) {
3078 TH_LOG("Failed to get sync data from read()");
3079 }
3080
3081 /* Start nanosleep to be interrupted. */
3082 timeout.tv_sec = 1;
3083 errno = 0;
3084 EXPECT_EQ(0, nanosleep(&timeout, NULL)) {
3085 TH_LOG("Call to nanosleep() failed (errno %d)", errno);
3086 }
3087
3088 /* Read final sync from parent. */
3089 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) {
3090 TH_LOG("Failed final read() from parent");
3091 }
3092 EXPECT_EQ('!', buf) {
3093 TH_LOG("Failed to get final data from read()");
3094 }
3095
3096 /* Directly report the status of our test harness results. */
3097 syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS
3098 : EXIT_FAILURE);
3099 }
3100 EXPECT_EQ(0, close(pipefd[0]));
3101
3102 /* Attach to child, setup options, and release. */
3103 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3104 ASSERT_EQ(true, WIFSTOPPED(status));
3105 ASSERT_EQ(0, ptrace(PTRACE_SETOPTIONS, child_pid, NULL,
3106 PTRACE_O_TRACESECCOMP));
3107 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3108 ASSERT_EQ(1, write(pipefd[1], ".", 1));
3109
3110 /* Wait for nanosleep() to start. */
3111 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3112 ASSERT_EQ(true, WIFSTOPPED(status));
3113 ASSERT_EQ(SIGTRAP, WSTOPSIG(status));
3114 ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16));
3115 ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg));
3116 ASSERT_EQ(0x100, msg);
3117 ret = get_syscall(_metadata, child_pid);
3118 EXPECT_TRUE(ret == __NR_nanosleep || ret == __NR_clock_nanosleep);
3119
3120 /* Might as well check siginfo for sanity while we're here. */
3121 ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info));
3122 ASSERT_EQ(SIGTRAP, info.si_signo);
3123 ASSERT_EQ(SIGTRAP | (PTRACE_EVENT_SECCOMP << 8), info.si_code);
3124 EXPECT_EQ(0, info.si_errno);
3125 EXPECT_EQ(getuid(), info.si_uid);
3126 /* Verify signal delivery came from child (seccomp-triggered). */
3127 EXPECT_EQ(child_pid, info.si_pid);
3128
3129 /* Interrupt nanosleep with SIGSTOP (which we'll need to handle). */
3130 ASSERT_EQ(0, kill(child_pid, SIGSTOP));
3131 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3132 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3133 ASSERT_EQ(true, WIFSTOPPED(status));
3134 ASSERT_EQ(SIGSTOP, WSTOPSIG(status));
3135 ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info));
3136 /*
3137 * There is no siginfo on SIGSTOP any more, so we can't verify
3138 * signal delivery came from parent now (getpid() == info.si_pid).
3139 * https://lkml.kernel.org/r/CAGXu5jJaZAOzP1qFz66tYrtbuywqb+UN2SOA1VLHpCCOiYvYeg@mail.gmail.com
3140 * At least verify the SIGSTOP via PTRACE_GETSIGINFO.
3141 */
3142 EXPECT_EQ(SIGSTOP, info.si_signo);
3143
3144 /* Restart nanosleep with SIGCONT, which triggers restart_syscall. */
3145 ASSERT_EQ(0, kill(child_pid, SIGCONT));
3146 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3147 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3148 ASSERT_EQ(true, WIFSTOPPED(status));
3149 ASSERT_EQ(SIGCONT, WSTOPSIG(status));
3150 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3151
3152 /* Wait for restart_syscall() to start. */
3153 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3154 ASSERT_EQ(true, WIFSTOPPED(status));
3155 ASSERT_EQ(SIGTRAP, WSTOPSIG(status));
3156 ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16));
3157 ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg));
3158
3159 ASSERT_EQ(0x200, msg);
3160 ret = get_syscall(_metadata, child_pid);
3161 #if defined(__arm__)
3162 /*
3163 * - native ARM registers do NOT expose true syscall.
3164 * - compat ARM registers on ARM64 DO expose true syscall.
3165 */
3166 ASSERT_EQ(0, uname(&utsbuf));
3167 if (sscanf(utsbuf.machine, "armv%d", &arm_version) == 1 &&
3168 arm_version < 8) {
3169 EXPECT_EQ(__NR_nanosleep, ret);
3170 } else
3171 #endif
3172 {
3173 EXPECT_EQ(__NR_restart_syscall, ret);
3174 }
3175
3176 /* Write again to end test. */
3177 ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3178 ASSERT_EQ(1, write(pipefd[1], "!", 1));
3179 EXPECT_EQ(0, close(pipefd[1]));
3180
3181 ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3182 if (WIFSIGNALED(status) || WEXITSTATUS(status))
3183 _metadata->passed = 0;
3184 }
3185
TEST_SIGNAL(filter_flag_log,SIGSYS)3186 TEST_SIGNAL(filter_flag_log, SIGSYS)
3187 {
3188 struct sock_filter allow_filter[] = {
3189 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3190 };
3191 struct sock_filter kill_filter[] = {
3192 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
3193 offsetof(struct seccomp_data, nr)),
3194 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
3195 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
3196 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3197 };
3198 struct sock_fprog allow_prog = {
3199 .len = (unsigned short)ARRAY_SIZE(allow_filter),
3200 .filter = allow_filter,
3201 };
3202 struct sock_fprog kill_prog = {
3203 .len = (unsigned short)ARRAY_SIZE(kill_filter),
3204 .filter = kill_filter,
3205 };
3206 long ret;
3207 pid_t parent = getppid();
3208
3209 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3210 ASSERT_EQ(0, ret);
3211
3212 /* Verify that the FILTER_FLAG_LOG flag isn't accepted in strict mode */
3213 ret = seccomp(SECCOMP_SET_MODE_STRICT, SECCOMP_FILTER_FLAG_LOG,
3214 &allow_prog);
3215 ASSERT_NE(ENOSYS, errno) {
3216 TH_LOG("Kernel does not support seccomp syscall!");
3217 }
3218 EXPECT_NE(0, ret) {
3219 TH_LOG("Kernel accepted FILTER_FLAG_LOG flag in strict mode!");
3220 }
3221 EXPECT_EQ(EINVAL, errno) {
3222 TH_LOG("Kernel returned unexpected errno for FILTER_FLAG_LOG flag in strict mode!");
3223 }
3224
3225 /* Verify that a simple, permissive filter can be added with no flags */
3226 ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &allow_prog);
3227 EXPECT_EQ(0, ret);
3228
3229 /* See if the same filter can be added with the FILTER_FLAG_LOG flag */
3230 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
3231 &allow_prog);
3232 ASSERT_NE(EINVAL, errno) {
3233 TH_LOG("Kernel does not support the FILTER_FLAG_LOG flag!");
3234 }
3235 EXPECT_EQ(0, ret);
3236
3237 /* Ensure that the kill filter works with the FILTER_FLAG_LOG flag */
3238 ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
3239 &kill_prog);
3240 EXPECT_EQ(0, ret);
3241
3242 EXPECT_EQ(parent, syscall(__NR_getppid));
3243 /* getpid() should never return. */
3244 EXPECT_EQ(0, syscall(__NR_getpid));
3245 }
3246
TEST(get_action_avail)3247 TEST(get_action_avail)
3248 {
3249 __u32 actions[] = { SECCOMP_RET_KILL_THREAD, SECCOMP_RET_TRAP,
3250 SECCOMP_RET_ERRNO, SECCOMP_RET_TRACE,
3251 SECCOMP_RET_LOG, SECCOMP_RET_ALLOW };
3252 __u32 unknown_action = 0x10000000U;
3253 int i;
3254 long ret;
3255
3256 ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[0]);
3257 ASSERT_NE(ENOSYS, errno) {
3258 TH_LOG("Kernel does not support seccomp syscall!");
3259 }
3260 ASSERT_NE(EINVAL, errno) {
3261 TH_LOG("Kernel does not support SECCOMP_GET_ACTION_AVAIL operation!");
3262 }
3263 EXPECT_EQ(ret, 0);
3264
3265 for (i = 0; i < ARRAY_SIZE(actions); i++) {
3266 ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[i]);
3267 EXPECT_EQ(ret, 0) {
3268 TH_LOG("Expected action (0x%X) not available!",
3269 actions[i]);
3270 }
3271 }
3272
3273 /* Check that an unknown action is handled properly (EOPNOTSUPP) */
3274 ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &unknown_action);
3275 EXPECT_EQ(ret, -1);
3276 EXPECT_EQ(errno, EOPNOTSUPP);
3277 }
3278
3279 /*
3280 * b/147676645
3281 * PTRACE_SECCOMP_GET_METADATA not compatible < 4.16
3282 */
3283 #ifndef __ANDROID__
TEST(get_metadata)3284 TEST(get_metadata)
3285 {
3286 pid_t pid;
3287 int pipefd[2];
3288 char buf;
3289 struct seccomp_metadata md;
3290 long ret;
3291
3292 /* Only real root can get metadata. */
3293 if (geteuid()) {
3294 SKIP(return, "get_metadata requires real root");
3295 return;
3296 }
3297
3298 ASSERT_EQ(0, pipe(pipefd));
3299
3300 pid = fork();
3301 ASSERT_GE(pid, 0);
3302 if (pid == 0) {
3303 struct sock_filter filter[] = {
3304 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3305 };
3306 struct sock_fprog prog = {
3307 .len = (unsigned short)ARRAY_SIZE(filter),
3308 .filter = filter,
3309 };
3310
3311 /* one with log, one without */
3312 EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER,
3313 SECCOMP_FILTER_FLAG_LOG, &prog));
3314 EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog));
3315
3316 EXPECT_EQ(0, close(pipefd[0]));
3317 ASSERT_EQ(1, write(pipefd[1], "1", 1));
3318 ASSERT_EQ(0, close(pipefd[1]));
3319
3320 while (1)
3321 sleep(100);
3322 }
3323
3324 ASSERT_EQ(0, close(pipefd[1]));
3325 ASSERT_EQ(1, read(pipefd[0], &buf, 1));
3326
3327 ASSERT_EQ(0, ptrace(PTRACE_ATTACH, pid));
3328 ASSERT_EQ(pid, waitpid(pid, NULL, 0));
3329
3330 /* Past here must not use ASSERT or child process is never killed. */
3331
3332 md.filter_off = 0;
3333 errno = 0;
3334 ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md);
3335 EXPECT_EQ(sizeof(md), ret) {
3336 if (errno == EINVAL)
3337 SKIP(goto skip, "Kernel does not support PTRACE_SECCOMP_GET_METADATA (missing CONFIG_CHECKPOINT_RESTORE?)");
3338 }
3339
3340 EXPECT_EQ(md.flags, SECCOMP_FILTER_FLAG_LOG);
3341 EXPECT_EQ(md.filter_off, 0);
3342
3343 md.filter_off = 1;
3344 ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md);
3345 EXPECT_EQ(sizeof(md), ret);
3346 EXPECT_EQ(md.flags, 0);
3347 EXPECT_EQ(md.filter_off, 1);
3348
3349 skip:
3350 ASSERT_EQ(0, kill(pid, SIGKILL));
3351 }
3352 #endif
3353
3354 /*
3355 * b/147676645
3356 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
3357 */
3358 #ifndef __ANDROID__
user_notif_syscall(int nr,unsigned int flags)3359 static int user_notif_syscall(int nr, unsigned int flags)
3360 {
3361 struct sock_filter filter[] = {
3362 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
3363 offsetof(struct seccomp_data, nr)),
3364 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, nr, 0, 1),
3365 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_USER_NOTIF),
3366 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3367 };
3368
3369 struct sock_fprog prog = {
3370 .len = (unsigned short)ARRAY_SIZE(filter),
3371 .filter = filter,
3372 };
3373
3374 return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog);
3375 }
3376
3377 #define USER_NOTIF_MAGIC INT_MAX
TEST(user_notification_basic)3378 TEST(user_notification_basic)
3379 {
3380 pid_t pid;
3381 long ret;
3382 int status, listener;
3383 struct seccomp_notif req = {};
3384 struct seccomp_notif_resp resp = {};
3385 struct pollfd pollfd;
3386
3387 struct sock_filter filter[] = {
3388 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3389 };
3390 struct sock_fprog prog = {
3391 .len = (unsigned short)ARRAY_SIZE(filter),
3392 .filter = filter,
3393 };
3394
3395 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3396 ASSERT_EQ(0, ret) {
3397 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3398 }
3399
3400 pid = fork();
3401 ASSERT_GE(pid, 0);
3402
3403 /* Check that we get -ENOSYS with no listener attached */
3404 if (pid == 0) {
3405 if (user_notif_syscall(__NR_getppid, 0) < 0)
3406 exit(1);
3407 ret = syscall(__NR_getppid);
3408 exit(ret >= 0 || errno != ENOSYS);
3409 }
3410
3411 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3412 EXPECT_EQ(true, WIFEXITED(status));
3413 EXPECT_EQ(0, WEXITSTATUS(status));
3414
3415 /* Add some no-op filters for grins. */
3416 EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3417 EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3418 EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3419 EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3420
3421 /* Check that the basic notification machinery works */
3422 listener = user_notif_syscall(__NR_getppid,
3423 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3424 ASSERT_GE(listener, 0);
3425
3426 /* Installing a second listener in the chain should EBUSY */
3427 EXPECT_EQ(user_notif_syscall(__NR_getppid,
3428 SECCOMP_FILTER_FLAG_NEW_LISTENER),
3429 -1);
3430 EXPECT_EQ(errno, EBUSY);
3431
3432 pid = fork();
3433 ASSERT_GE(pid, 0);
3434
3435 if (pid == 0) {
3436 ret = syscall(__NR_getppid);
3437 exit(ret != USER_NOTIF_MAGIC);
3438 }
3439
3440 pollfd.fd = listener;
3441 pollfd.events = POLLIN | POLLOUT;
3442
3443 EXPECT_GT(poll(&pollfd, 1, -1), 0);
3444 EXPECT_EQ(pollfd.revents, POLLIN);
3445
3446 /* Test that we can't pass garbage to the kernel. */
3447 memset(&req, 0, sizeof(req));
3448 req.pid = -1;
3449 errno = 0;
3450 ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req);
3451 EXPECT_EQ(-1, ret);
3452 EXPECT_EQ(EINVAL, errno);
3453
3454 if (ret) {
3455 req.pid = 0;
3456 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3457 }
3458
3459 pollfd.fd = listener;
3460 pollfd.events = POLLIN | POLLOUT;
3461
3462 EXPECT_GT(poll(&pollfd, 1, -1), 0);
3463 EXPECT_EQ(pollfd.revents, POLLOUT);
3464
3465 EXPECT_EQ(req.data.nr, __NR_getppid);
3466
3467 resp.id = req.id;
3468 resp.error = 0;
3469 resp.val = USER_NOTIF_MAGIC;
3470
3471 /* check that we make sure flags == 0 */
3472 resp.flags = 1;
3473 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3474 EXPECT_EQ(errno, EINVAL);
3475
3476 resp.flags = 0;
3477 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3478
3479 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3480 EXPECT_EQ(true, WIFEXITED(status));
3481 EXPECT_EQ(0, WEXITSTATUS(status));
3482 }
3483 #endif
3484
3485 /*
3486 * b/147676645
3487 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
3488 */
3489 #ifndef __ANDROID__
TEST(user_notification_with_tsync)3490 TEST(user_notification_with_tsync)
3491 {
3492 int ret;
3493 unsigned int flags;
3494
3495 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3496 ASSERT_EQ(0, ret) {
3497 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3498 }
3499
3500 /* these were exclusive */
3501 flags = SECCOMP_FILTER_FLAG_NEW_LISTENER |
3502 SECCOMP_FILTER_FLAG_TSYNC;
3503 ASSERT_EQ(-1, user_notif_syscall(__NR_getppid, flags));
3504 ASSERT_EQ(EINVAL, errno);
3505
3506 /* but now they're not */
3507 flags |= SECCOMP_FILTER_FLAG_TSYNC_ESRCH;
3508 ret = user_notif_syscall(__NR_getppid, flags);
3509 close(ret);
3510 ASSERT_LE(0, ret);
3511 }
3512 #endif
3513
3514 /*
3515 * b/147676645
3516 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
3517 */
3518 #ifndef __ANDROID__
TEST(user_notification_kill_in_middle)3519 TEST(user_notification_kill_in_middle)
3520 {
3521 pid_t pid;
3522 long ret;
3523 int listener;
3524 struct seccomp_notif req = {};
3525 struct seccomp_notif_resp resp = {};
3526
3527 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3528 ASSERT_EQ(0, ret) {
3529 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3530 }
3531
3532 listener = user_notif_syscall(__NR_getppid,
3533 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3534 ASSERT_GE(listener, 0);
3535
3536 /*
3537 * Check that nothing bad happens when we kill the task in the middle
3538 * of a syscall.
3539 */
3540 pid = fork();
3541 ASSERT_GE(pid, 0);
3542
3543 if (pid == 0) {
3544 ret = syscall(__NR_getppid);
3545 exit(ret != USER_NOTIF_MAGIC);
3546 }
3547
3548 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3549 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id), 0);
3550
3551 EXPECT_EQ(kill(pid, SIGKILL), 0);
3552 EXPECT_EQ(waitpid(pid, NULL, 0), pid);
3553
3554 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id), -1);
3555
3556 resp.id = req.id;
3557 ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp);
3558 EXPECT_EQ(ret, -1);
3559 EXPECT_EQ(errno, ENOENT);
3560 }
3561
3562 static int handled = -1;
3563
signal_handler(int signal)3564 static void signal_handler(int signal)
3565 {
3566 if (write(handled, "c", 1) != 1)
3567 perror("write from signal");
3568 }
3569 #endif
3570
3571 /*
3572 * b/147676645
3573 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
3574 */
3575 #ifndef __ANDROID__
TEST(user_notification_signal)3576 TEST(user_notification_signal)
3577 {
3578 pid_t pid;
3579 long ret;
3580 int status, listener, sk_pair[2];
3581 struct seccomp_notif req = {};
3582 struct seccomp_notif_resp resp = {};
3583 char c;
3584
3585 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3586 ASSERT_EQ(0, ret) {
3587 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3588 }
3589
3590 ASSERT_EQ(socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair), 0);
3591
3592 listener = user_notif_syscall(__NR_gettid,
3593 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3594 ASSERT_GE(listener, 0);
3595
3596 pid = fork();
3597 ASSERT_GE(pid, 0);
3598
3599 if (pid == 0) {
3600 close(sk_pair[0]);
3601 handled = sk_pair[1];
3602 if (signal(SIGUSR1, signal_handler) == SIG_ERR) {
3603 perror("signal");
3604 exit(1);
3605 }
3606 /*
3607 * ERESTARTSYS behavior is a bit hard to test, because we need
3608 * to rely on a signal that has not yet been handled. Let's at
3609 * least check that the error code gets propagated through, and
3610 * hope that it doesn't break when there is actually a signal :)
3611 */
3612 ret = syscall(__NR_gettid);
3613 exit(!(ret == -1 && errno == 512));
3614 }
3615
3616 close(sk_pair[1]);
3617
3618 memset(&req, 0, sizeof(req));
3619 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3620
3621 EXPECT_EQ(kill(pid, SIGUSR1), 0);
3622
3623 /*
3624 * Make sure the signal really is delivered, which means we're not
3625 * stuck in the user notification code any more and the notification
3626 * should be dead.
3627 */
3628 EXPECT_EQ(read(sk_pair[0], &c, 1), 1);
3629
3630 resp.id = req.id;
3631 resp.error = -EPERM;
3632 resp.val = 0;
3633
3634 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3635 EXPECT_EQ(errno, ENOENT);
3636
3637 memset(&req, 0, sizeof(req));
3638 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3639
3640 resp.id = req.id;
3641 resp.error = -512; /* -ERESTARTSYS */
3642 resp.val = 0;
3643
3644 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3645
3646 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3647 EXPECT_EQ(true, WIFEXITED(status));
3648 EXPECT_EQ(0, WEXITSTATUS(status));
3649 }
3650 #endif
3651
3652 /*
3653 * b/147676645
3654 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
3655 */
3656 #ifndef __ANDROID__
TEST(user_notification_closed_listener)3657 TEST(user_notification_closed_listener)
3658 {
3659 pid_t pid;
3660 long ret;
3661 int status, listener;
3662
3663 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3664 ASSERT_EQ(0, ret) {
3665 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3666 }
3667
3668 listener = user_notif_syscall(__NR_getppid,
3669 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3670 ASSERT_GE(listener, 0);
3671
3672 /*
3673 * Check that we get an ENOSYS when the listener is closed.
3674 */
3675 pid = fork();
3676 ASSERT_GE(pid, 0);
3677 if (pid == 0) {
3678 close(listener);
3679 ret = syscall(__NR_getppid);
3680 exit(ret != -1 && errno != ENOSYS);
3681 }
3682
3683 close(listener);
3684
3685 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3686 EXPECT_EQ(true, WIFEXITED(status));
3687 EXPECT_EQ(0, WEXITSTATUS(status));
3688 }
3689 #endif
3690
3691 /*
3692 * b/147676645
3693 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
3694 * unshare(CLONE_NEWUSER) returns EINVAL with Android
3695 * unshare(CLONE_NEWPID) returns EINVAL with Android
3696 */
3697 #ifndef __ANDROID__
3698 /*
3699 * Check that a pid in a child namespace still shows up as valid in ours.
3700 */
TEST(user_notification_child_pid_ns)3701 TEST(user_notification_child_pid_ns)
3702 {
3703 pid_t pid;
3704 int status, listener;
3705 struct seccomp_notif req = {};
3706 struct seccomp_notif_resp resp = {};
3707
3708 ASSERT_EQ(unshare(CLONE_NEWUSER | CLONE_NEWPID), 0) {
3709 if (errno == EINVAL)
3710 SKIP(return, "kernel missing CLONE_NEWUSER support");
3711 };
3712
3713 listener = user_notif_syscall(__NR_getppid,
3714 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3715 ASSERT_GE(listener, 0);
3716
3717 pid = fork();
3718 ASSERT_GE(pid, 0);
3719
3720 if (pid == 0)
3721 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
3722
3723 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3724 EXPECT_EQ(req.pid, pid);
3725
3726 resp.id = req.id;
3727 resp.error = 0;
3728 resp.val = USER_NOTIF_MAGIC;
3729
3730 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3731
3732 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3733 EXPECT_EQ(true, WIFEXITED(status));
3734 EXPECT_EQ(0, WEXITSTATUS(status));
3735 close(listener);
3736 }
3737 #endif
3738
3739 /*
3740 * b/147676645
3741 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
3742 * unshare(CLONE_NEWPID) returns EINVAL with Android
3743 */
3744 #ifndef __ANDROID__
3745 /*
3746 * Check that a pid in a sibling (i.e. unrelated) namespace shows up as 0, i.e.
3747 * invalid.
3748 */
TEST(user_notification_sibling_pid_ns)3749 TEST(user_notification_sibling_pid_ns)
3750 {
3751 pid_t pid, pid2;
3752 int status, listener;
3753 struct seccomp_notif req = {};
3754 struct seccomp_notif_resp resp = {};
3755
3756 ASSERT_EQ(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0) {
3757 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3758 }
3759
3760 listener = user_notif_syscall(__NR_getppid,
3761 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3762 ASSERT_GE(listener, 0);
3763
3764 pid = fork();
3765 ASSERT_GE(pid, 0);
3766
3767 if (pid == 0) {
3768 ASSERT_EQ(unshare(CLONE_NEWPID), 0);
3769
3770 pid2 = fork();
3771 ASSERT_GE(pid2, 0);
3772
3773 if (pid2 == 0)
3774 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
3775
3776 EXPECT_EQ(waitpid(pid2, &status, 0), pid2);
3777 EXPECT_EQ(true, WIFEXITED(status));
3778 EXPECT_EQ(0, WEXITSTATUS(status));
3779 exit(WEXITSTATUS(status));
3780 }
3781
3782 /* Create the sibling ns, and sibling in it. */
3783 ASSERT_EQ(unshare(CLONE_NEWPID), 0) {
3784 if (errno == EPERM)
3785 SKIP(return, "CLONE_NEWPID requires CAP_SYS_ADMIN");
3786 }
3787 ASSERT_EQ(errno, 0);
3788
3789 pid2 = fork();
3790 ASSERT_GE(pid2, 0);
3791
3792 if (pid2 == 0) {
3793 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3794 /*
3795 * The pid should be 0, i.e. the task is in some namespace that
3796 * we can't "see".
3797 */
3798 EXPECT_EQ(req.pid, 0);
3799
3800 resp.id = req.id;
3801 resp.error = 0;
3802 resp.val = USER_NOTIF_MAGIC;
3803
3804 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3805 exit(0);
3806 }
3807
3808 close(listener);
3809
3810 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3811 EXPECT_EQ(true, WIFEXITED(status));
3812 EXPECT_EQ(0, WEXITSTATUS(status));
3813
3814 EXPECT_EQ(waitpid(pid2, &status, 0), pid2);
3815 EXPECT_EQ(true, WIFEXITED(status));
3816 EXPECT_EQ(0, WEXITSTATUS(status));
3817 }
3818 #endif
3819
3820 /*
3821 * b/147676645
3822 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
3823 * unshare(CLONE_NEWUSER) returns EINVAL with Android
3824 */
3825 #ifndef __ANDROID__
TEST(user_notification_fault_recv)3826 TEST(user_notification_fault_recv)
3827 {
3828 pid_t pid;
3829 int status, listener;
3830 struct seccomp_notif req = {};
3831 struct seccomp_notif_resp resp = {};
3832
3833 ASSERT_EQ(unshare(CLONE_NEWUSER), 0);
3834
3835 listener = user_notif_syscall(__NR_getppid,
3836 SECCOMP_FILTER_FLAG_NEW_LISTENER);
3837 ASSERT_GE(listener, 0);
3838
3839 pid = fork();
3840 ASSERT_GE(pid, 0);
3841
3842 if (pid == 0)
3843 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
3844
3845 /* Do a bad recv() */
3846 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, NULL), -1);
3847 EXPECT_EQ(errno, EFAULT);
3848
3849 /* We should still be able to receive this notification, though. */
3850 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3851 EXPECT_EQ(req.pid, pid);
3852
3853 resp.id = req.id;
3854 resp.error = 0;
3855 resp.val = USER_NOTIF_MAGIC;
3856
3857 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3858
3859 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3860 EXPECT_EQ(true, WIFEXITED(status));
3861 EXPECT_EQ(0, WEXITSTATUS(status));
3862 }
3863 #endif
3864
3865 /*
3866 * b/147676645
3867 * SECCOMP_GET_NOTIF_SIZES not compatible < 5.0
3868 */
3869 #ifndef __ANDROID__
TEST(seccomp_get_notif_sizes)3870 TEST(seccomp_get_notif_sizes)
3871 {
3872 struct seccomp_notif_sizes sizes;
3873
3874 ASSERT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0);
3875 EXPECT_EQ(sizes.seccomp_notif, sizeof(struct seccomp_notif));
3876 EXPECT_EQ(sizes.seccomp_notif_resp, sizeof(struct seccomp_notif_resp));
3877 }
3878 #endif
3879
3880 /*
3881 * b/147676645
3882 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
3883 */
3884 #ifndef __ANDROID__
TEST(user_notification_continue)3885 TEST(user_notification_continue)
3886 {
3887 pid_t pid;
3888 long ret;
3889 int status, listener;
3890 struct seccomp_notif req = {};
3891 struct seccomp_notif_resp resp = {};
3892 struct pollfd pollfd;
3893
3894 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3895 ASSERT_EQ(0, ret) {
3896 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3897 }
3898
3899 listener = user_notif_syscall(__NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER);
3900 ASSERT_GE(listener, 0);
3901
3902 pid = fork();
3903 ASSERT_GE(pid, 0);
3904
3905 if (pid == 0) {
3906 int dup_fd, pipe_fds[2];
3907 pid_t self;
3908
3909 ASSERT_GE(pipe(pipe_fds), 0);
3910
3911 dup_fd = dup(pipe_fds[0]);
3912 ASSERT_GE(dup_fd, 0);
3913 EXPECT_NE(pipe_fds[0], dup_fd);
3914
3915 self = getpid();
3916 ASSERT_EQ(filecmp(self, self, pipe_fds[0], dup_fd), 0);
3917 exit(0);
3918 }
3919
3920 pollfd.fd = listener;
3921 pollfd.events = POLLIN | POLLOUT;
3922
3923 EXPECT_GT(poll(&pollfd, 1, -1), 0);
3924 EXPECT_EQ(pollfd.revents, POLLIN);
3925
3926 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3927
3928 pollfd.fd = listener;
3929 pollfd.events = POLLIN | POLLOUT;
3930
3931 EXPECT_GT(poll(&pollfd, 1, -1), 0);
3932 EXPECT_EQ(pollfd.revents, POLLOUT);
3933
3934 EXPECT_EQ(req.data.nr, __NR_dup);
3935
3936 resp.id = req.id;
3937 resp.flags = SECCOMP_USER_NOTIF_FLAG_CONTINUE;
3938
3939 /*
3940 * Verify that setting SECCOMP_USER_NOTIF_FLAG_CONTINUE enforces other
3941 * args be set to 0.
3942 */
3943 resp.error = 0;
3944 resp.val = USER_NOTIF_MAGIC;
3945 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3946 EXPECT_EQ(errno, EINVAL);
3947
3948 resp.error = USER_NOTIF_MAGIC;
3949 resp.val = 0;
3950 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3951 EXPECT_EQ(errno, EINVAL);
3952
3953 resp.error = 0;
3954 resp.val = 0;
3955 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0) {
3956 if (errno == EINVAL)
3957 SKIP(goto skip, "Kernel does not support SECCOMP_USER_NOTIF_FLAG_CONTINUE");
3958 }
3959
3960 skip:
3961 EXPECT_EQ(waitpid(pid, &status, 0), pid);
3962 EXPECT_EQ(true, WIFEXITED(status));
3963 EXPECT_EQ(0, WEXITSTATUS(status)) {
3964 if (WEXITSTATUS(status) == 2) {
3965 SKIP(return, "Kernel does not support kcmp() syscall");
3966 return;
3967 }
3968 }
3969 }
3970 #endif
3971
3972 /*
3973 * b/147676645
3974 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
3975 */
3976 #ifndef __ANDROID__
TEST(user_notification_filter_empty)3977 TEST(user_notification_filter_empty)
3978 {
3979 pid_t pid;
3980 long ret;
3981 int status;
3982 struct pollfd pollfd;
3983 struct __clone_args args = {
3984 .flags = CLONE_FILES,
3985 .exit_signal = SIGCHLD,
3986 };
3987
3988 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3989 ASSERT_EQ(0, ret) {
3990 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3991 }
3992
3993 pid = sys_clone3(&args, sizeof(args));
3994 ASSERT_GE(pid, 0);
3995
3996 if (pid == 0) {
3997 int listener;
3998
3999 listener = user_notif_syscall(__NR_mknodat, SECCOMP_FILTER_FLAG_NEW_LISTENER);
4000 if (listener < 0)
4001 _exit(EXIT_FAILURE);
4002
4003 if (dup2(listener, 200) != 200)
4004 _exit(EXIT_FAILURE);
4005
4006 close(listener);
4007
4008 _exit(EXIT_SUCCESS);
4009 }
4010
4011 EXPECT_EQ(waitpid(pid, &status, 0), pid);
4012 EXPECT_EQ(true, WIFEXITED(status));
4013 EXPECT_EQ(0, WEXITSTATUS(status));
4014
4015 /*
4016 * The seccomp filter has become unused so we should be notified once
4017 * the kernel gets around to cleaning up task struct.
4018 */
4019 pollfd.fd = 200;
4020 pollfd.events = POLLHUP;
4021
4022 EXPECT_GT(poll(&pollfd, 1, 2000), 0);
4023 EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0);
4024 }
4025 #endif
4026
4027 /*
4028 * b/147676645
4029 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
4030 */
4031 #ifndef __ANDROID__
do_thread(void * data)4032 static void *do_thread(void *data)
4033 {
4034 return NULL;
4035 }
4036
TEST(user_notification_filter_empty_threaded)4037 TEST(user_notification_filter_empty_threaded)
4038 {
4039 pid_t pid;
4040 long ret;
4041 int status;
4042 struct pollfd pollfd;
4043 struct __clone_args args = {
4044 .flags = CLONE_FILES,
4045 .exit_signal = SIGCHLD,
4046 };
4047
4048 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4049 ASSERT_EQ(0, ret) {
4050 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4051 }
4052
4053 pid = sys_clone3(&args, sizeof(args));
4054 ASSERT_GE(pid, 0);
4055
4056 if (pid == 0) {
4057 pid_t pid1, pid2;
4058 int listener, status;
4059 pthread_t thread;
4060
4061 listener = user_notif_syscall(__NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER);
4062 if (listener < 0)
4063 _exit(EXIT_FAILURE);
4064
4065 if (dup2(listener, 200) != 200)
4066 _exit(EXIT_FAILURE);
4067
4068 close(listener);
4069
4070 pid1 = fork();
4071 if (pid1 < 0)
4072 _exit(EXIT_FAILURE);
4073
4074 if (pid1 == 0)
4075 _exit(EXIT_SUCCESS);
4076
4077 pid2 = fork();
4078 if (pid2 < 0)
4079 _exit(EXIT_FAILURE);
4080
4081 if (pid2 == 0)
4082 _exit(EXIT_SUCCESS);
4083
4084 if (pthread_create(&thread, NULL, do_thread, NULL) ||
4085 pthread_join(thread, NULL))
4086 _exit(EXIT_FAILURE);
4087
4088 if (pthread_create(&thread, NULL, do_thread, NULL) ||
4089 pthread_join(thread, NULL))
4090 _exit(EXIT_FAILURE);
4091
4092 if (waitpid(pid1, &status, 0) != pid1 || !WIFEXITED(status) ||
4093 WEXITSTATUS(status))
4094 _exit(EXIT_FAILURE);
4095
4096 if (waitpid(pid2, &status, 0) != pid2 || !WIFEXITED(status) ||
4097 WEXITSTATUS(status))
4098 _exit(EXIT_FAILURE);
4099
4100 exit(EXIT_SUCCESS);
4101 }
4102
4103 EXPECT_EQ(waitpid(pid, &status, 0), pid);
4104 EXPECT_EQ(true, WIFEXITED(status));
4105 EXPECT_EQ(0, WEXITSTATUS(status));
4106
4107 /*
4108 * The seccomp filter has become unused so we should be notified once
4109 * the kernel gets around to cleaning up task struct.
4110 */
4111 pollfd.fd = 200;
4112 pollfd.events = POLLHUP;
4113
4114 EXPECT_GT(poll(&pollfd, 1, 2000), 0);
4115 EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0);
4116 }
4117 #endif
4118
4119 /*
4120 * b/147676645
4121 * SECCOMP_ADDED_FLAG_SEND not compatible < 5.14
4122 * SECCOMP_IOCTL_NOTIF_ADDFD not comptible < 5.9
4123 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
4124 */
4125 #ifndef __ANDROID__
TEST(user_notification_addfd)4126 TEST(user_notification_addfd)
4127 {
4128 pid_t pid;
4129 long ret;
4130 int status, listener, memfd, fd, nextfd;
4131 struct seccomp_notif_addfd addfd = {};
4132 struct seccomp_notif_addfd_small small = {};
4133 struct seccomp_notif_addfd_big big = {};
4134 struct seccomp_notif req = {};
4135 struct seccomp_notif_resp resp = {};
4136 /* 100 ms */
4137 struct timespec delay = { .tv_nsec = 100000000 };
4138
4139 /* There may be arbitrary already-open fds at test start. */
4140 memfd = memfd_create("test", 0);
4141 ASSERT_GE(memfd, 0);
4142 nextfd = memfd + 1;
4143
4144 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4145 ASSERT_EQ(0, ret) {
4146 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4147 }
4148
4149 /* fd: 4 */
4150 /* Check that the basic notification machinery works */
4151 listener = user_notif_syscall(__NR_getppid,
4152 SECCOMP_FILTER_FLAG_NEW_LISTENER);
4153 ASSERT_EQ(listener, nextfd++);
4154
4155 pid = fork();
4156 ASSERT_GE(pid, 0);
4157
4158 if (pid == 0) {
4159 /* fds will be added and this value is expected */
4160 if (syscall(__NR_getppid) != USER_NOTIF_MAGIC)
4161 exit(1);
4162
4163 /* Atomic addfd+send is received here. Check it is a valid fd */
4164 if (fcntl(syscall(__NR_getppid), F_GETFD) == -1)
4165 exit(1);
4166
4167 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
4168 }
4169
4170 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4171
4172 addfd.srcfd = memfd;
4173 addfd.newfd = 0;
4174 addfd.id = req.id;
4175 addfd.flags = 0x0;
4176
4177 /* Verify bad newfd_flags cannot be set */
4178 addfd.newfd_flags = ~O_CLOEXEC;
4179 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4180 EXPECT_EQ(errno, EINVAL);
4181 addfd.newfd_flags = O_CLOEXEC;
4182
4183 /* Verify bad flags cannot be set */
4184 addfd.flags = 0xff;
4185 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4186 EXPECT_EQ(errno, EINVAL);
4187 addfd.flags = 0;
4188
4189 /* Verify that remote_fd cannot be set without setting flags */
4190 addfd.newfd = 1;
4191 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4192 EXPECT_EQ(errno, EINVAL);
4193 addfd.newfd = 0;
4194
4195 /* Verify small size cannot be set */
4196 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_SMALL, &small), -1);
4197 EXPECT_EQ(errno, EINVAL);
4198
4199 /* Verify we can't send bits filled in unknown buffer area */
4200 memset(&big, 0xAA, sizeof(big));
4201 big.addfd = addfd;
4202 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_BIG, &big), -1);
4203 EXPECT_EQ(errno, E2BIG);
4204
4205
4206 /* Verify we can set an arbitrary remote fd */
4207 fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
4208 EXPECT_EQ(fd, nextfd++);
4209 EXPECT_EQ(filecmp(getpid(), pid, memfd, fd), 0);
4210
4211 /* Verify we can set an arbitrary remote fd with large size */
4212 memset(&big, 0x0, sizeof(big));
4213 big.addfd = addfd;
4214 fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_BIG, &big);
4215 EXPECT_EQ(fd, nextfd++);
4216
4217 /* Verify we can set a specific remote fd */
4218 addfd.newfd = 42;
4219 addfd.flags = SECCOMP_ADDFD_FLAG_SETFD;
4220 fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
4221 EXPECT_EQ(fd, 42);
4222 EXPECT_EQ(filecmp(getpid(), pid, memfd, fd), 0);
4223
4224 /* Resume syscall */
4225 resp.id = req.id;
4226 resp.error = 0;
4227 resp.val = USER_NOTIF_MAGIC;
4228 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4229
4230 /*
4231 * This sets the ID of the ADD FD to the last request plus 1. The
4232 * notification ID increments 1 per notification.
4233 */
4234 addfd.id = req.id + 1;
4235
4236 /* This spins until the underlying notification is generated */
4237 while (ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd) != -1 &&
4238 errno != -EINPROGRESS)
4239 nanosleep(&delay, NULL);
4240
4241 memset(&req, 0, sizeof(req));
4242 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4243 ASSERT_EQ(addfd.id, req.id);
4244
4245 /* Verify we can do an atomic addfd and send */
4246 addfd.newfd = 0;
4247 addfd.flags = SECCOMP_ADDFD_FLAG_SEND;
4248 fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
4249 /*
4250 * Child has earlier "low" fds and now 42, so we expect the next
4251 * lowest available fd to be assigned here.
4252 */
4253 EXPECT_EQ(fd, nextfd++);
4254 ASSERT_EQ(filecmp(getpid(), pid, memfd, fd), 0);
4255
4256 /*
4257 * This sets the ID of the ADD FD to the last request plus 1. The
4258 * notification ID increments 1 per notification.
4259 */
4260 addfd.id = req.id + 1;
4261
4262 /* This spins until the underlying notification is generated */
4263 while (ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd) != -1 &&
4264 errno != -EINPROGRESS)
4265 nanosleep(&delay, NULL);
4266
4267 memset(&req, 0, sizeof(req));
4268 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4269 ASSERT_EQ(addfd.id, req.id);
4270
4271 resp.id = req.id;
4272 resp.error = 0;
4273 resp.val = USER_NOTIF_MAGIC;
4274 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4275
4276 /* Wait for child to finish. */
4277 EXPECT_EQ(waitpid(pid, &status, 0), pid);
4278 EXPECT_EQ(true, WIFEXITED(status));
4279 EXPECT_EQ(0, WEXITSTATUS(status));
4280
4281 close(memfd);
4282 }
4283 #endif
4284
4285 /*
4286 * b/147676645
4287 * SECCOMP_ADDED_FLAG_SEND not compatible < 5.14
4288 * SECCOMP_IOCTL_NOTIF_ADDFD not comptible < 5.9
4289 * SECCOMP_FILTER_FLAG_NEW_LISTENER not compatible < 5.0
4290 */
4291 #ifndef __ANDROID__
TEST(user_notification_addfd_rlimit)4292 TEST(user_notification_addfd_rlimit)
4293 {
4294 pid_t pid;
4295 long ret;
4296 int status, listener, memfd;
4297 struct seccomp_notif_addfd addfd = {};
4298 struct seccomp_notif req = {};
4299 struct seccomp_notif_resp resp = {};
4300 const struct rlimit lim = {
4301 .rlim_cur = 0,
4302 .rlim_max = 0,
4303 };
4304
4305 memfd = memfd_create("test", 0);
4306 ASSERT_GE(memfd, 0);
4307
4308 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4309 ASSERT_EQ(0, ret) {
4310 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4311 }
4312
4313 /* Check that the basic notification machinery works */
4314 listener = user_notif_syscall(__NR_getppid,
4315 SECCOMP_FILTER_FLAG_NEW_LISTENER);
4316 ASSERT_GE(listener, 0);
4317
4318 pid = fork();
4319 ASSERT_GE(pid, 0);
4320
4321 if (pid == 0)
4322 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
4323
4324
4325 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4326
4327 ASSERT_EQ(prlimit(pid, RLIMIT_NOFILE, &lim, NULL), 0);
4328
4329 addfd.srcfd = memfd;
4330 addfd.newfd_flags = O_CLOEXEC;
4331 addfd.newfd = 0;
4332 addfd.id = req.id;
4333 addfd.flags = 0;
4334
4335 /* Should probably spot check /proc/sys/fs/file-nr */
4336 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4337 EXPECT_EQ(errno, EMFILE);
4338
4339 addfd.flags = SECCOMP_ADDFD_FLAG_SEND;
4340 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4341 EXPECT_EQ(errno, EMFILE);
4342
4343 addfd.newfd = 100;
4344 addfd.flags = SECCOMP_ADDFD_FLAG_SETFD;
4345 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4346 EXPECT_EQ(errno, EBADF);
4347
4348 resp.id = req.id;
4349 resp.error = 0;
4350 resp.val = USER_NOTIF_MAGIC;
4351
4352 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4353
4354 /* Wait for child to finish. */
4355 EXPECT_EQ(waitpid(pid, &status, 0), pid);
4356 EXPECT_EQ(true, WIFEXITED(status));
4357 EXPECT_EQ(0, WEXITSTATUS(status));
4358
4359 close(memfd);
4360 }
4361 #endif
4362
4363 /*
4364 * TODO:
4365 * - expand NNP testing
4366 * - better arch-specific TRACE and TRAP handlers.
4367 * - endianness checking when appropriate
4368 * - 64-bit arg prodding
4369 * - arch value testing (x86 modes especially)
4370 * - verify that FILTER_FLAG_LOG filters generate log messages
4371 * - verify that RET_LOG generates log messages
4372 */
4373
4374 TEST_HARNESS_MAIN
4375