selftests/seccomp: Add test for unknown SECCOMP_RET kill behavior (3932fcec) · Commits · 戴 / test

tools/testing/selftests/seccomp/seccomp_bpf.c

+37 −6

Original line number	Diff line number	Diff line
		@@ -774,8 +774,15 @@ void kill_thread(void data)
		return (void *)SIBLING_EXIT_UNKILLED;
		}

		enum kill_t {
		KILL_THREAD,
		KILL_PROCESS,
		RET_UNKNOWN
		};

		/* Prepare a thread that will kill itself or both of us. */
		void kill_thread_or_group(struct __test_metadata *_metadata, bool kill_process)
		void kill_thread_or_group(struct __test_metadata *_metadata,
		enum kill_t kill_how)
		{
		pthread_t thread;
		void *status;
		@@ -791,11 +798,12 @@ void kill_thread_or_group(struct __test_metadata *_metadata, bool kill_process)
		.len = (unsigned short)ARRAY_SIZE(filter_thread),
		.filter = filter_thread,
		};
		int kill = kill_how == KILL_PROCESS ? SECCOMP_RET_KILL_PROCESS : 0xAAAAAAAAA;
		struct sock_filter filter_process[] = {
		BPF_STMT(BPF_LD\|BPF_W\|BPF_ABS,
		offsetof(struct seccomp_data, nr)),
		BPF_JUMP(BPF_JMP\|BPF_JEQ\|BPF_K, __NR_prctl, 0, 1),
		BPF_STMT(BPF_RET\|BPF_K, SECCOMP_RET_KILL_PROCESS),
		BPF_STMT(BPF_RET\|BPF_K, kill),
		BPF_STMT(BPF_RET\|BPF_K, SECCOMP_RET_ALLOW),
		};
		struct sock_fprog prog_process = {
		@@ -808,12 +816,14 @@ void kill_thread_or_group(struct __test_metadata *_metadata, bool kill_process)
		}

		ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0,
		kill_process ? &prog_process : &prog_thread));
		kill_how == KILL_THREAD ? &prog_thread
		: &prog_process));

		/*
		* Add the KILL_THREAD rule again to make sure that the KILL_PROCESS
		* flag cannot be downgraded by a new filter.
		*/
		if (kill_how == KILL_PROCESS)
		ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread));

		/* Start a thread that will exit immediately. */
		@@ -842,7 +852,7 @@ TEST(KILL_thread)
		child_pid = fork();
		ASSERT_LE(0, child_pid);
		if (child_pid == 0) {
		kill_thread_or_group(_metadata, false);
		kill_thread_or_group(_metadata, KILL_THREAD);
		_exit(38);
		}

		@@ -861,7 +871,7 @@ TEST(KILL_process)
		child_pid = fork();
		ASSERT_LE(0, child_pid);
		if (child_pid == 0) {
		kill_thread_or_group(_metadata, true);
		kill_thread_or_group(_metadata, KILL_PROCESS);
		_exit(38);
		}

		@@ -872,6 +882,27 @@ TEST(KILL_process)
		ASSERT_EQ(SIGSYS, WTERMSIG(status));
		}

		TEST(KILL_unknown)
		{
		int status;
		pid_t child_pid;

		child_pid = fork();
		ASSERT_LE(0, child_pid);
		if (child_pid == 0) {
		kill_thread_or_group(_metadata, RET_UNKNOWN);
		_exit(38);
		}

		ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));

		/* If the entire process was killed, we'll see SIGSYS. */
		EXPECT_TRUE(WIFSIGNALED(status)) {
		TH_LOG("Unknown SECCOMP_RET is only killing the thread?");
		}
		ASSERT_EQ(SIGSYS, WTERMSIG(status));
		}

		/* TODO(wad) add 64-bit versus 32-bit arg tests. */
		TEST(arg_out_of_range)
		{

Admin message