Commit c7140706 authored by Tycho Andersen's avatar Tycho Andersen Committed by Shuah Khan
Browse files

selftests: set NO_NEW_PRIVS bit in seccomp user tests 



seccomp() doesn't allow users who aren't root in their userns to attach
filters unless they have the nnp bit set, so let's set it so that these
tests can pass when run as an unprivileged user.

This idea stolen from the other seccomp tests, which use this trick :)

Signed-off-by: default avatarTycho Andersen <tycho@tycho.ws>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarShuah Khan <shuah@kernel.org>
parent 3aa415dd

tools/testing/selftests/seccomp/seccomp_bpf.c

+24 −0
Original line number Diff line number Diff line
@@ -3068,6 +3068,11 @@ TEST(user_notification_basic) 
		.filter = filter,

	};



	ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);

	ASSERT_EQ(0, ret) {

		TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");

	}



	pid = fork();

	ASSERT_GE(pid, 0);
@@ -3149,6 +3154,11 @@ TEST(user_notification_kill_in_middle) 
	struct seccomp_notif req = {};

	struct seccomp_notif_resp resp = {};



	ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);

	ASSERT_EQ(0, ret) {

		TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");

	}



	listener = user_trap_syscall(__NR_getpid,

				     SECCOMP_FILTER_FLAG_NEW_LISTENER);

	ASSERT_GE(listener, 0);
@@ -3196,6 +3206,11 @@ TEST(user_notification_signal) 
	struct seccomp_notif_resp resp = {};

	char c;



	ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);

	ASSERT_EQ(0, ret) {

		TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");

	}



	ASSERT_EQ(socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair), 0);



	listener = user_trap_syscall(__NR_gettid,
@@ -3261,6 +3276,11 @@ TEST(user_notification_closed_listener) 
	long ret;

	int status, listener;



	ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);

	ASSERT_EQ(0, ret) {

		TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");

	}



	listener = user_trap_syscall(__NR_getpid,

				     SECCOMP_FILTER_FLAG_NEW_LISTENER);

	ASSERT_GE(listener, 0);
@@ -3330,6 +3350,10 @@ TEST(user_notification_sibling_pid_ns) 
	struct seccomp_notif req = {};

	struct seccomp_notif_resp resp = {};



	ASSERT_EQ(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0) {

		TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");

	}



	listener = user_trap_syscall(__NR_getpid, SECCOMP_FILTER_FLAG_NEW_LISTENER);

	ASSERT_GE(listener, 0);

CRA Git | Maintained and supported by SUSTech CRA and CCSE