tools/testing/selftests/seccomp/seccomp_bpf.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
   4  *
   5  * Test code for seccomp bpf.
   6  */
   7
   8 #define _GNU_SOURCE
   9 #include <sys/types.h>
  10
  11 /*
  12  * glibc 2.26 and later have SIGSYS in siginfo_t. Before that,
  13  * we need to use the kernel's siginfo.h file and trick glibc
  14  * into accepting it.
  15  */
  16 #if !__GLIBC_PREREQ(2, 26)
  17 # include <asm/siginfo.h>
  18 # define __have_siginfo_t 1
  19 # define __have_sigval_t 1
  20 # define __have_sigevent_t 1
  21 #endif
  22
  23 #include <errno.h>
  24 #include <linux/filter.h>
  25 #include <sys/prctl.h>
  26 #include <sys/ptrace.h>
  27 #include <sys/user.h>
  28 #include <linux/prctl.h>
  29 #include <linux/ptrace.h>
  30 #include <linux/seccomp.h>
  31 #include <pthread.h>
  32 #include <semaphore.h>
  33 #include <signal.h>
  34 #include <stddef.h>
  35 #include <stdbool.h>
  36 #include <string.h>
  37 #include <time.h>
  38 #include <limits.h>
  39 #include <linux/elf.h>
  40 #include <sys/uio.h>
  41 #include <sys/utsname.h>
  42 #include <sys/fcntl.h>
  43 #include <sys/mman.h>
  44 #include <sys/times.h>
  45 #include <sys/socket.h>
  46 #include <sys/ioctl.h>
  47 #include <linux/kcmp.h>
  48 #include <sys/resource.h>
  49 #include <sys/capability.h>
  50
  51 #include <unistd.h>
  52 #include <sys/syscall.h>
  53 #include <poll.h>
  54
  55 #include "../kselftest_harness.h"
  56 #include "../clone3/clone3_selftests.h"
  57
  58 /* Attempt to de-conflict with the selftests tree. */
  59 #ifndef SKIP
  60 #define SKIP(s, ...)    XFAIL(s, ##__VA_ARGS__)
  61 #endif
  62
  63 #define MIN(X, Y) ((X) < (Y) ? (X) : (Y))
  64
  65 #ifndef PR_SET_PTRACER
  66 # define PR_SET_PTRACER 0x59616d61
  67 #endif
  68
  69 #ifndef PR_SET_NO_NEW_PRIVS
  70 #define PR_SET_NO_NEW_PRIVS 38
  71 #define PR_GET_NO_NEW_PRIVS 39
  72 #endif
  73
  74 #ifndef PR_SECCOMP_EXT
  75 #define PR_SECCOMP_EXT 43
  76 #endif
  77
  78 #ifndef SECCOMP_EXT_ACT
  79 #define SECCOMP_EXT_ACT 1
  80 #endif
  81
  82 #ifndef SECCOMP_EXT_ACT_TSYNC
  83 #define SECCOMP_EXT_ACT_TSYNC 1
  84 #endif
  85
  86 #ifndef SECCOMP_MODE_STRICT
  87 #define SECCOMP_MODE_STRICT 1
  88 #endif
  89
  90 #ifndef SECCOMP_MODE_FILTER
  91 #define SECCOMP_MODE_FILTER 2
  92 #endif
  93
  94 #ifndef SECCOMP_RET_ALLOW
  95 struct seccomp_data {
  96         int nr;
  97         __u32 arch;
  98         __u64 instruction_pointer;
  99         __u64 args[6];
 100 };
 101 #endif
 102
 103 #ifndef SECCOMP_RET_KILL_PROCESS
 104 #define SECCOMP_RET_KILL_PROCESS 0x80000000U /* kill the process */
 105 #define SECCOMP_RET_KILL_THREAD  0x00000000U /* kill the thread */
 106 #endif
 107 #ifndef SECCOMP_RET_KILL
 108 #define SECCOMP_RET_KILL         SECCOMP_RET_KILL_THREAD
 109 #define SECCOMP_RET_TRAP         0x00030000U /* disallow and force a SIGSYS */
 110 #define SECCOMP_RET_ERRNO        0x00050000U /* returns an errno */
 111 #define SECCOMP_RET_TRACE        0x7ff00000U /* pass to a tracer or disallow */
 112 #define SECCOMP_RET_ALLOW        0x7fff0000U /* allow */
 113 #endif
 114 #ifndef SECCOMP_RET_LOG
 115 #define SECCOMP_RET_LOG          0x7ffc0000U /* allow after logging */
 116 #endif
 117
 118 #ifndef __NR_seccomp
 119 # if defined(__i386__)
 120 #  define __NR_seccomp 354
 121 # elif defined(__x86_64__)
 122 #  define __NR_seccomp 317
 123 # elif defined(__arm__)
 124 #  define __NR_seccomp 383
 125 # elif defined(__aarch64__)
 126 #  define __NR_seccomp 277
 127 # elif defined(__riscv)
 128 #  define __NR_seccomp 277
 129 # elif defined(__csky__)
 130 #  define __NR_seccomp 277
 131 # elif defined(__hppa__)
 132 #  define __NR_seccomp 338
 133 # elif defined(__powerpc__)
 134 #  define __NR_seccomp 358
 135 # elif defined(__s390__)
 136 #  define __NR_seccomp 348
 137 # elif defined(__xtensa__)
 138 #  define __NR_seccomp 337
 139 # elif defined(__sh__)
 140 #  define __NR_seccomp 372
 141 # else
 142 #  warning "seccomp syscall number unknown for this architecture"
 143 #  define __NR_seccomp 0xffff
 144 # endif
 145 #endif
 146
 147 #ifndef SECCOMP_SET_MODE_STRICT
 148 #define SECCOMP_SET_MODE_STRICT 0
 149 #endif
 150
 151 #ifndef SECCOMP_SET_MODE_FILTER
 152 #define SECCOMP_SET_MODE_FILTER 1
 153 #endif
 154
 155 #ifndef SECCOMP_GET_ACTION_AVAIL
 156 #define SECCOMP_GET_ACTION_AVAIL 2
 157 #endif
 158
 159 #ifndef SECCOMP_GET_NOTIF_SIZES
 160 #define SECCOMP_GET_NOTIF_SIZES 3
 161 #endif
 162
 163 #ifndef SECCOMP_FILTER_FLAG_TSYNC
 164 #define SECCOMP_FILTER_FLAG_TSYNC (1UL << 0)
 165 #endif
 166
 167 #ifndef SECCOMP_FILTER_FLAG_LOG
 168 #define SECCOMP_FILTER_FLAG_LOG (1UL << 1)
 169 #endif
 170
 171 #ifndef SECCOMP_FILTER_FLAG_SPEC_ALLOW
 172 #define SECCOMP_FILTER_FLAG_SPEC_ALLOW (1UL << 2)
 173 #endif
 174
 175 #ifndef PTRACE_SECCOMP_GET_METADATA
 176 #define PTRACE_SECCOMP_GET_METADATA     0x420d
 177
 178 struct seccomp_metadata {
 179         __u64 filter_off;       /* Input: which filter */
 180         __u64 flags;             /* Output: filter's flags */
 181 };
 182 #endif
 183
 184 #ifndef SECCOMP_FILTER_FLAG_NEW_LISTENER
 185 #define SECCOMP_FILTER_FLAG_NEW_LISTENER        (1UL << 3)
 186 #endif
 187
 188 #ifndef SECCOMP_RET_USER_NOTIF
 189 #define SECCOMP_RET_USER_NOTIF 0x7fc00000U
 190
 191 #define SECCOMP_IOC_MAGIC               '!'
 192 #define SECCOMP_IO(nr)                  _IO(SECCOMP_IOC_MAGIC, nr)
 193 #define SECCOMP_IOR(nr, type)           _IOR(SECCOMP_IOC_MAGIC, nr, type)
 194 #define SECCOMP_IOW(nr, type)           _IOW(SECCOMP_IOC_MAGIC, nr, type)
 195 #define SECCOMP_IOWR(nr, type)          _IOWR(SECCOMP_IOC_MAGIC, nr, type)
 196
 197 /* Flags for seccomp notification fd ioctl. */
 198 #define SECCOMP_IOCTL_NOTIF_RECV        SECCOMP_IOWR(0, struct seccomp_notif)
 199 #define SECCOMP_IOCTL_NOTIF_SEND        SECCOMP_IOWR(1, \
 200                                                 struct seccomp_notif_resp)
 201 #define SECCOMP_IOCTL_NOTIF_ID_VALID    SECCOMP_IOW(2, __u64)
 202
 203 struct seccomp_notif {
 204         __u64 id;
 205         __u32 pid;
 206         __u32 flags;
 207         struct seccomp_data data;
 208 };
 209
 210 struct seccomp_notif_resp {
 211         __u64 id;
 212         __s64 val;
 213         __s32 error;
 214         __u32 flags;
 215 };
 216
 217 struct seccomp_notif_sizes {
 218         __u16 seccomp_notif;
 219         __u16 seccomp_notif_resp;
 220         __u16 seccomp_data;
 221 };
 222 #endif
 223
 224 #ifndef SECCOMP_IOCTL_NOTIF_ADDFD
 225 /* On success, the return value is the remote process's added fd number */
 226 #define SECCOMP_IOCTL_NOTIF_ADDFD       SECCOMP_IOW(3,  \
 227                                                 struct seccomp_notif_addfd)
 228
 229 /* valid flags for seccomp_notif_addfd */
 230 #define SECCOMP_ADDFD_FLAG_SETFD        (1UL << 0) /* Specify remote fd */
 231
 232 struct seccomp_notif_addfd {
 233         __u64 id;
 234         __u32 flags;
 235         __u32 srcfd;
 236         __u32 newfd;
 237         __u32 newfd_flags;
 238 };
 239 #endif
 240
 241 #ifndef SECCOMP_ADDFD_FLAG_SEND
 242 #define SECCOMP_ADDFD_FLAG_SEND (1UL << 1) /* Addfd and return it, atomically */
 243 #endif
 244
 245 struct seccomp_notif_addfd_small {
 246         __u64 id;
 247         char weird[4];
 248 };
 249 #define SECCOMP_IOCTL_NOTIF_ADDFD_SMALL \
 250         SECCOMP_IOW(3, struct seccomp_notif_addfd_small)
 251
 252 struct seccomp_notif_addfd_big {
 253         union {
 254                 struct seccomp_notif_addfd addfd;
 255                 char buf[sizeof(struct seccomp_notif_addfd) + 8];
 256         };
 257 };
 258 #define SECCOMP_IOCTL_NOTIF_ADDFD_BIG   \
 259         SECCOMP_IOWR(3, struct seccomp_notif_addfd_big)
 260
 261 #ifndef PTRACE_EVENTMSG_SYSCALL_ENTRY
 262 #define PTRACE_EVENTMSG_SYSCALL_ENTRY   1
 263 #define PTRACE_EVENTMSG_SYSCALL_EXIT    2
 264 #endif
 265
 266 #ifndef SECCOMP_USER_NOTIF_FLAG_CONTINUE
 267 #define SECCOMP_USER_NOTIF_FLAG_CONTINUE 0x00000001
 268 #endif
 269
 270 #ifndef SECCOMP_FILTER_FLAG_TSYNC_ESRCH
 271 #define SECCOMP_FILTER_FLAG_TSYNC_ESRCH (1UL << 4)
 272 #endif
 273
 274 #ifndef SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV
 275 #define SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV (1UL << 5)
 276 #endif
 277
 278 #ifndef seccomp
 279 int seccomp(unsigned int op, unsigned int flags, void *args)
 280 {
 281         errno = 0;
 282         return syscall(__NR_seccomp, op, flags, args);
 283 }
 284 #endif
 285
 286 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
 287 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
 288 #elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
 289 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]) + sizeof(__u32))
 290 #else
 291 #error "wut? Unknown __BYTE_ORDER__?!"
 292 #endif
 293
 294 #define SIBLING_EXIT_UNKILLED   0xbadbeef
 295 #define SIBLING_EXIT_FAILURE    0xbadface
 296 #define SIBLING_EXIT_NEWPRIVS   0xbadfeed
 297
 298 static int __filecmp(pid_t pid1, pid_t pid2, int fd1, int fd2)
 299 {
 300 #ifdef __NR_kcmp
 301         errno = 0;
 302         return syscall(__NR_kcmp, pid1, pid2, KCMP_FILE, fd1, fd2);
 303 #else
 304         errno = ENOSYS;
 305         return -1;
 306 #endif
 307 }
 308
 309 /* Have TH_LOG report actual location filecmp() is used. */
 310 #define filecmp(pid1, pid2, fd1, fd2)   ({              \
 311         int _ret;                                       \
 312                                                         \
 313         _ret = __filecmp(pid1, pid2, fd1, fd2);         \
 314         if (_ret != 0) {                                \
 315                 if (_ret < 0 && errno == ENOSYS) {      \
 316                         TH_LOG("kcmp() syscall missing (test is less accurate)");\
 317                         _ret = 0;                       \
 318                 }                                       \
 319         }                                               \
 320         _ret; })
 321
 322 TEST(kcmp)
 323 {
 324         int ret;
 325
 326         ret = __filecmp(getpid(), getpid(), 1, 1);
 327         EXPECT_EQ(ret, 0);
 328         if (ret != 0 && errno == ENOSYS)
 329                 SKIP(return, "Kernel does not support kcmp() (missing CONFIG_KCMP?)");
 330 }
 331
 332 TEST(mode_strict_support)
 333 {
 334         long ret;
 335
 336         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL);
 337         ASSERT_EQ(0, ret) {
 338                 TH_LOG("Kernel does not support CONFIG_SECCOMP");
 339         }
 340         syscall(__NR_exit, 0);
 341 }
 342
 343 TEST_SIGNAL(mode_strict_cannot_call_prctl, SIGKILL)
 344 {
 345         long ret;
 346
 347         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL);
 348         ASSERT_EQ(0, ret) {
 349                 TH_LOG("Kernel does not support CONFIG_SECCOMP");
 350         }
 351         syscall(__NR_prctl, PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
 352                 NULL, NULL, NULL);
 353         EXPECT_FALSE(true) {
 354                 TH_LOG("Unreachable!");
 355         }
 356 }
 357
 358 /* Note! This doesn't test no new privs behavior */
 359 TEST(no_new_privs_support)
 360 {
 361         long ret;
 362
 363         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 364         EXPECT_EQ(0, ret) {
 365                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
 366         }
 367 }
 368
 369 /* Tests kernel support by checking for a copy_from_user() fault on NULL. */
 370 TEST(mode_filter_support)
 371 {
 372         long ret;
 373
 374         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
 375         ASSERT_EQ(0, ret) {
 376                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
 377         }
 378         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, NULL, NULL);
 379         EXPECT_EQ(-1, ret);
 380         EXPECT_EQ(EFAULT, errno) {
 381                 TH_LOG("Kernel does not support CONFIG_SECCOMP_FILTER!");
 382         }
 383 }
 384
 385 TEST(mode_filter_without_nnp)
 386 {
 387         struct sock_filter filter[] = {
 388                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 389         };
 390         struct sock_fprog prog = {
 391                 .len = (unsigned short)ARRAY_SIZE(filter),
 392                 .filter = filter,
 393         };
 394         long ret;
 395
 396         ret = prctl(PR_GET_NO_NEW_PRIVS, 0, NULL, 0, 0);
 397         ASSERT_LE(0, ret) {
 398                 TH_LOG("Expected 0 or unsupported for NO_NEW_PRIVS");
 399         }
 400         errno = 0;
 401         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 402         /* Succeeds with CAP_SYS_ADMIN, fails without */
 403         /* TODO(wad) check caps not euid */
 404         if (geteuid()) {
 405                 EXPECT_EQ(-1, ret);
 406                 EXPECT_EQ(EACCES, errno);
 407         } else {
 408                 EXPECT_EQ(0, ret);
 409         }
 410 }
 411
 412 #define MAX_INSNS_PER_PATH 32768
 413
 414 TEST(filter_size_limits)
 415 {
 416         int i;
 417         int count = BPF_MAXINSNS + 1;
 418         struct sock_filter allow[] = {
 419                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 420         };
 421         struct sock_filter *filter;
 422         struct sock_fprog prog = { };
 423         long ret;
 424
 425         filter = calloc(count, sizeof(*filter));
 426         ASSERT_NE(NULL, filter);
 427
 428         for (i = 0; i < count; i++)
 429                 filter[i] = allow[0];
 430
 431         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 432         ASSERT_EQ(0, ret);
 433
 434         prog.filter = filter;
 435         prog.len = count;
 436
 437         /* Too many filter instructions in a single filter. */
 438         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 439         ASSERT_NE(0, ret) {
 440                 TH_LOG("Installing %d insn filter was allowed", prog.len);
 441         }
 442
 443         /* One less is okay, though. */
 444         prog.len -= 1;
 445         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 446         ASSERT_EQ(0, ret) {
 447                 TH_LOG("Installing %d insn filter wasn't allowed", prog.len);
 448         }
 449 }
 450
 451 TEST(filter_chain_limits)
 452 {
 453         int i;
 454         int count = BPF_MAXINSNS;
 455         struct sock_filter allow[] = {
 456                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 457         };
 458         struct sock_filter *filter;
 459         struct sock_fprog prog = { };
 460         long ret;
 461
 462         filter = calloc(count, sizeof(*filter));
 463         ASSERT_NE(NULL, filter);
 464
 465         for (i = 0; i < count; i++)
 466                 filter[i] = allow[0];
 467
 468         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 469         ASSERT_EQ(0, ret);
 470
 471         prog.filter = filter;
 472         prog.len = 1;
 473
 474         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 475         ASSERT_EQ(0, ret);
 476
 477         prog.len = count;
 478
 479         /* Too many total filter instructions. */
 480         for (i = 0; i < MAX_INSNS_PER_PATH; i++) {
 481                 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 482                 if (ret != 0)
 483                         break;
 484         }
 485         ASSERT_NE(0, ret) {
 486                 TH_LOG("Allowed %d %d-insn filters (total with penalties:%d)",
 487                        i, count, i * (count + 4));
 488         }
 489 }
 490
 491 TEST(mode_filter_cannot_move_to_strict)
 492 {
 493         struct sock_filter filter[] = {
 494                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 495         };
 496         struct sock_fprog prog = {
 497                 .len = (unsigned short)ARRAY_SIZE(filter),
 498                 .filter = filter,
 499         };
 500         long ret;
 501
 502         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 503         ASSERT_EQ(0, ret);
 504
 505         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 506         ASSERT_EQ(0, ret);
 507
 508         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, 0, 0);
 509         EXPECT_EQ(-1, ret);
 510         EXPECT_EQ(EINVAL, errno);
 511 }
 512
 513
 514 TEST(mode_filter_get_seccomp)
 515 {
 516         struct sock_filter filter[] = {
 517                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 518         };
 519         struct sock_fprog prog = {
 520                 .len = (unsigned short)ARRAY_SIZE(filter),
 521                 .filter = filter,
 522         };
 523         long ret;
 524
 525         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 526         ASSERT_EQ(0, ret);
 527
 528         ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
 529         EXPECT_EQ(0, ret);
 530
 531         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 532         ASSERT_EQ(0, ret);
 533
 534         ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
 535         EXPECT_EQ(2, ret);
 536 }
 537
 538
 539 TEST(ALLOW_all)
 540 {
 541         struct sock_filter filter[] = {
 542                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 543         };
 544         struct sock_fprog prog = {
 545                 .len = (unsigned short)ARRAY_SIZE(filter),
 546                 .filter = filter,
 547         };
 548         long ret;
 549
 550         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 551         ASSERT_EQ(0, ret);
 552
 553         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 554         ASSERT_EQ(0, ret);
 555 }
 556
 557 TEST(empty_prog)
 558 {
 559         struct sock_filter filter[] = {
 560         };
 561         struct sock_fprog prog = {
 562                 .len = (unsigned short)ARRAY_SIZE(filter),
 563                 .filter = filter,
 564         };
 565         long ret;
 566
 567         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 568         ASSERT_EQ(0, ret);
 569
 570         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 571         EXPECT_EQ(-1, ret);
 572         EXPECT_EQ(EINVAL, errno);
 573 }
 574
 575 TEST(log_all)
 576 {
 577         struct sock_filter filter[] = {
 578                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG),
 579         };
 580         struct sock_fprog prog = {
 581                 .len = (unsigned short)ARRAY_SIZE(filter),
 582                 .filter = filter,
 583         };
 584         long ret;
 585         pid_t parent = getppid();
 586
 587         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 588         ASSERT_EQ(0, ret);
 589
 590         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 591         ASSERT_EQ(0, ret);
 592
 593         /* getppid() should succeed and be logged (no check for logging) */
 594         EXPECT_EQ(parent, syscall(__NR_getppid));
 595 }
 596
 597 TEST_SIGNAL(unknown_ret_is_kill_inside, SIGSYS)
 598 {
 599         struct sock_filter filter[] = {
 600                 BPF_STMT(BPF_RET|BPF_K, 0x10000000U),
 601         };
 602         struct sock_fprog prog = {
 603                 .len = (unsigned short)ARRAY_SIZE(filter),
 604                 .filter = filter,
 605         };
 606         long ret;
 607
 608         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 609         ASSERT_EQ(0, ret);
 610
 611         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 612         ASSERT_EQ(0, ret);
 613         EXPECT_EQ(0, syscall(__NR_getpid)) {
 614                 TH_LOG("getpid() shouldn't ever return");
 615         }
 616 }
 617
 618 /* return code >= 0x80000000 is unused. */
 619 TEST_SIGNAL(unknown_ret_is_kill_above_allow, SIGSYS)
 620 {
 621         struct sock_filter filter[] = {
 622                 BPF_STMT(BPF_RET|BPF_K, 0x90000000U),
 623         };
 624         struct sock_fprog prog = {
 625                 .len = (unsigned short)ARRAY_SIZE(filter),
 626                 .filter = filter,
 627         };
 628         long ret;
 629
 630         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 631         ASSERT_EQ(0, ret);
 632
 633         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 634         ASSERT_EQ(0, ret);
 635         EXPECT_EQ(0, syscall(__NR_getpid)) {
 636                 TH_LOG("getpid() shouldn't ever return");
 637         }
 638 }
 639
 640 TEST_SIGNAL(KILL_all, SIGSYS)
 641 {
 642         struct sock_filter filter[] = {
 643                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 644         };
 645         struct sock_fprog prog = {
 646                 .len = (unsigned short)ARRAY_SIZE(filter),
 647                 .filter = filter,
 648         };
 649         long ret;
 650
 651         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 652         ASSERT_EQ(0, ret);
 653
 654         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 655         ASSERT_EQ(0, ret);
 656 }
 657
 658 TEST_SIGNAL(KILL_one, SIGSYS)
 659 {
 660         struct sock_filter filter[] = {
 661                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 662                         offsetof(struct seccomp_data, nr)),
 663                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
 664                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 665                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 666         };
 667         struct sock_fprog prog = {
 668                 .len = (unsigned short)ARRAY_SIZE(filter),
 669                 .filter = filter,
 670         };
 671         long ret;
 672         pid_t parent = getppid();
 673
 674         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 675         ASSERT_EQ(0, ret);
 676
 677         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 678         ASSERT_EQ(0, ret);
 679
 680         EXPECT_EQ(parent, syscall(__NR_getppid));
 681         /* getpid() should never return. */
 682         EXPECT_EQ(0, syscall(__NR_getpid));
 683 }
 684
 685 TEST_SIGNAL(KILL_one_arg_one, SIGSYS)
 686 {
 687         void *fatal_address;
 688         struct sock_filter filter[] = {
 689                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 690                         offsetof(struct seccomp_data, nr)),
 691                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_times, 1, 0),
 692                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 693                 /* Only both with lower 32-bit for now. */
 694                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(0)),
 695                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K,
 696                         (unsigned long)&fatal_address, 0, 1),
 697                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 698                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 699         };
 700         struct sock_fprog prog = {
 701                 .len = (unsigned short)ARRAY_SIZE(filter),
 702                 .filter = filter,
 703         };
 704         long ret;
 705         pid_t parent = getppid();
 706         struct tms timebuf;
 707         clock_t clock = times(&timebuf);
 708
 709         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 710         ASSERT_EQ(0, ret);
 711
 712         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 713         ASSERT_EQ(0, ret);
 714
 715         EXPECT_EQ(parent, syscall(__NR_getppid));
 716         EXPECT_LE(clock, syscall(__NR_times, &timebuf));
 717         /* times() should never return. */
 718         EXPECT_EQ(0, syscall(__NR_times, &fatal_address));
 719 }
 720
 721 TEST_SIGNAL(KILL_one_arg_six, SIGSYS)
 722 {
 723 #ifndef __NR_mmap2
 724         int sysno = __NR_mmap;
 725 #else
 726         int sysno = __NR_mmap2;
 727 #endif
 728         struct sock_filter filter[] = {
 729                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 730                         offsetof(struct seccomp_data, nr)),
 731                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, sysno, 1, 0),
 732                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 733                 /* Only both with lower 32-bit for now. */
 734                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(5)),
 735                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 0x0C0FFEE, 0, 1),
 736                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 737                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 738         };
 739         struct sock_fprog prog = {
 740                 .len = (unsigned short)ARRAY_SIZE(filter),
 741                 .filter = filter,
 742         };
 743         long ret;
 744         pid_t parent = getppid();
 745         int fd;
 746         void *map1, *map2;
 747         int page_size = sysconf(_SC_PAGESIZE);
 748
 749         ASSERT_LT(0, page_size);
 750
 751         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 752         ASSERT_EQ(0, ret);
 753
 754         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 755         ASSERT_EQ(0, ret);
 756
 757         fd = open("/dev/zero", O_RDONLY);
 758         ASSERT_NE(-1, fd);
 759
 760         EXPECT_EQ(parent, syscall(__NR_getppid));
 761         map1 = (void *)syscall(sysno,
 762                 NULL, page_size, PROT_READ, MAP_PRIVATE, fd, page_size);
 763         EXPECT_NE(MAP_FAILED, map1);
 764         /* mmap2() should never return. */
 765         map2 = (void *)syscall(sysno,
 766                  NULL, page_size, PROT_READ, MAP_PRIVATE, fd, 0x0C0FFEE);
 767         EXPECT_EQ(MAP_FAILED, map2);
 768
 769         /* The test failed, so clean up the resources. */
 770         munmap(map1, page_size);
 771         munmap(map2, page_size);
 772         close(fd);
 773 }
 774
 775 /* This is a thread task to die via seccomp filter violation. */
 776 void *kill_thread(void *data)
 777 {
 778         bool die = (bool)data;
 779
 780         if (die) {
 781                 prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
 782                 return (void *)SIBLING_EXIT_FAILURE;
 783         }
 784
 785         return (void *)SIBLING_EXIT_UNKILLED;
 786 }
 787
 788 enum kill_t {
 789         KILL_THREAD,
 790         KILL_PROCESS,
 791         RET_UNKNOWN
 792 };
 793
 794 /* Prepare a thread that will kill itself or both of us. */
 795 void kill_thread_or_group(struct __test_metadata *_metadata,
 796                           enum kill_t kill_how)
 797 {
 798         pthread_t thread;
 799         void *status;
 800         /* Kill only when calling __NR_prctl. */
 801         struct sock_filter filter_thread[] = {
 802                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 803                         offsetof(struct seccomp_data, nr)),
 804                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
 805                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_THREAD),
 806                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 807         };
 808         struct sock_fprog prog_thread = {
 809                 .len = (unsigned short)ARRAY_SIZE(filter_thread),
 810                 .filter = filter_thread,
 811         };
 812         int kill = kill_how == KILL_PROCESS ? SECCOMP_RET_KILL_PROCESS : 0xAAAAAAAA;
 813         struct sock_filter filter_process[] = {
 814                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 815                         offsetof(struct seccomp_data, nr)),
 816                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
 817                 BPF_STMT(BPF_RET|BPF_K, kill),
 818                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 819         };
 820         struct sock_fprog prog_process = {
 821                 .len = (unsigned short)ARRAY_SIZE(filter_process),
 822                 .filter = filter_process,
 823         };
 824
 825         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
 826                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
 827         }
 828
 829         ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0,
 830                              kill_how == KILL_THREAD ? &prog_thread
 831                                                      : &prog_process));
 832
 833         /*
 834          * Add the KILL_THREAD rule again to make sure that the KILL_PROCESS
 835          * flag cannot be downgraded by a new filter.
 836          */
 837         if (kill_how == KILL_PROCESS)
 838                 ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread));
 839
 840         /* Start a thread that will exit immediately. */
 841         ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)false));
 842         ASSERT_EQ(0, pthread_join(thread, &status));
 843         ASSERT_EQ(SIBLING_EXIT_UNKILLED, (unsigned long)status);
 844
 845         /* Start a thread that will die immediately. */
 846         ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)true));
 847         ASSERT_EQ(0, pthread_join(thread, &status));
 848         ASSERT_NE(SIBLING_EXIT_FAILURE, (unsigned long)status);
 849
 850         /*
 851          * If we get here, only the spawned thread died. Let the parent know
 852          * the whole process didn't die (i.e. this thread, the spawner,
 853          * stayed running).
 854          */
 855         exit(42);
 856 }
 857
 858 TEST(KILL_thread)
 859 {
 860         int status;
 861         pid_t child_pid;
 862
 863         child_pid = fork();
 864         ASSERT_LE(0, child_pid);
 865         if (child_pid == 0) {
 866                 kill_thread_or_group(_metadata, KILL_THREAD);
 867                 _exit(38);
 868         }
 869
 870         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
 871
 872         /* If only the thread was killed, we'll see exit 42. */
 873         ASSERT_TRUE(WIFEXITED(status));
 874         ASSERT_EQ(42, WEXITSTATUS(status));
 875 }
 876
 877 TEST(KILL_process)
 878 {
 879         int status;
 880         pid_t child_pid;
 881
 882         child_pid = fork();
 883         ASSERT_LE(0, child_pid);
 884         if (child_pid == 0) {
 885                 kill_thread_or_group(_metadata, KILL_PROCESS);
 886                 _exit(38);
 887         }
 888
 889         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
 890
 891         /* If the entire process was killed, we'll see SIGSYS. */
 892         ASSERT_TRUE(WIFSIGNALED(status));
 893         ASSERT_EQ(SIGSYS, WTERMSIG(status));
 894 }
 895
 896 TEST(KILL_unknown)
 897 {
 898         int status;
 899         pid_t child_pid;
 900
 901         child_pid = fork();
 902         ASSERT_LE(0, child_pid);
 903         if (child_pid == 0) {
 904                 kill_thread_or_group(_metadata, RET_UNKNOWN);
 905                 _exit(38);
 906         }
 907
 908         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
 909
 910         /* If the entire process was killed, we'll see SIGSYS. */
 911         EXPECT_TRUE(WIFSIGNALED(status)) {
 912                 TH_LOG("Unknown SECCOMP_RET is only killing the thread?");
 913         }
 914         ASSERT_EQ(SIGSYS, WTERMSIG(status));
 915 }
 916
 917 /* TODO(wad) add 64-bit versus 32-bit arg tests. */
 918 TEST(arg_out_of_range)
 919 {
 920         struct sock_filter filter[] = {
 921                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(6)),
 922                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 923         };
 924         struct sock_fprog prog = {
 925                 .len = (unsigned short)ARRAY_SIZE(filter),
 926                 .filter = filter,
 927         };
 928         long ret;
 929
 930         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 931         ASSERT_EQ(0, ret);
 932
 933         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 934         EXPECT_EQ(-1, ret);
 935         EXPECT_EQ(EINVAL, errno);
 936 }
 937
 938 #define ERRNO_FILTER(name, errno)                                       \
 939         struct sock_filter _read_filter_##name[] = {                    \
 940                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,                          \
 941                         offsetof(struct seccomp_data, nr)),             \
 942                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),       \
 943                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | errno),     \
 944                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),             \
 945         };                                                              \
 946         struct sock_fprog prog_##name = {                               \
 947                 .len = (unsigned short)ARRAY_SIZE(_read_filter_##name), \
 948                 .filter = _read_filter_##name,                          \
 949         }
 950
 951 /* Make sure basic errno values are correctly passed through a filter. */
 952 TEST(ERRNO_valid)
 953 {
 954         ERRNO_FILTER(valid, E2BIG);
 955         long ret;
 956         pid_t parent = getppid();
 957
 958         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 959         ASSERT_EQ(0, ret);
 960
 961         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_valid);
 962         ASSERT_EQ(0, ret);
 963
 964         EXPECT_EQ(parent, syscall(__NR_getppid));
 965         EXPECT_EQ(-1, read(-1, NULL, 0));
 966         EXPECT_EQ(E2BIG, errno);
 967 }
 968
 969 /* Make sure an errno of zero is correctly handled by the arch code. */
 970 TEST(ERRNO_zero)
 971 {
 972         ERRNO_FILTER(zero, 0);
 973         long ret;
 974         pid_t parent = getppid();
 975
 976         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 977         ASSERT_EQ(0, ret);
 978
 979         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_zero);
 980         ASSERT_EQ(0, ret);
 981
 982         EXPECT_EQ(parent, syscall(__NR_getppid));
 983         /* "errno" of 0 is ok. */
 984         EXPECT_EQ(0, read(-1, NULL, 0));
 985 }
 986
 987 /*
 988  * The SECCOMP_RET_DATA mask is 16 bits wide, but errno is smaller.
 989  * This tests that the errno value gets capped correctly, fixed by
 990  * 580c57f10768 ("seccomp: cap SECCOMP_RET_ERRNO data to MAX_ERRNO").
 991  */
 992 TEST(ERRNO_capped)
 993 {
 994         ERRNO_FILTER(capped, 4096);
 995         long ret;
 996         pid_t parent = getppid();
 997
 998         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 999         ASSERT_EQ(0, ret);
1000
1001         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_capped);
1002         ASSERT_EQ(0, ret);
1003
1004         EXPECT_EQ(parent, syscall(__NR_getppid));
1005         EXPECT_EQ(-1, read(-1, NULL, 0));
1006         EXPECT_EQ(4095, errno);
1007 }
1008
1009 /*
1010  * Filters are processed in reverse order: last applied is executed first.
1011  * Since only the SECCOMP_RET_ACTION mask is tested for return values, the
1012  * SECCOMP_RET_DATA mask results will follow the most recently applied
1013  * matching filter return (and not the lowest or highest value).
1014  */
1015 TEST(ERRNO_order)
1016 {
1017         ERRNO_FILTER(first,  11);
1018         ERRNO_FILTER(second, 13);
1019         ERRNO_FILTER(third,  12);
1020         long ret;
1021         pid_t parent = getppid();
1022
1023         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1024         ASSERT_EQ(0, ret);
1025
1026         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_first);
1027         ASSERT_EQ(0, ret);
1028
1029         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_second);
1030         ASSERT_EQ(0, ret);
1031
1032         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_third);
1033         ASSERT_EQ(0, ret);
1034
1035         EXPECT_EQ(parent, syscall(__NR_getppid));
1036         EXPECT_EQ(-1, read(-1, NULL, 0));
1037         EXPECT_EQ(12, errno);
1038 }
1039
1040 FIXTURE(TRAP) {
1041         struct sock_fprog prog;
1042 };
1043
1044 FIXTURE_SETUP(TRAP)
1045 {
1046         struct sock_filter filter[] = {
1047                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1048                         offsetof(struct seccomp_data, nr)),
1049                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
1050                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
1051                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1052         };
1053
1054         memset(&self->prog, 0, sizeof(self->prog));
1055         self->prog.filter = malloc(sizeof(filter));
1056         ASSERT_NE(NULL, self->prog.filter);
1057         memcpy(self->prog.filter, filter, sizeof(filter));
1058         self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1059 }
1060
1061 FIXTURE_TEARDOWN(TRAP)
1062 {
1063         if (self->prog.filter)
1064                 free(self->prog.filter);
1065 }
1066
1067 TEST_F_SIGNAL(TRAP, dfl, SIGSYS)
1068 {
1069         long ret;
1070
1071         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1072         ASSERT_EQ(0, ret);
1073
1074         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1075         ASSERT_EQ(0, ret);
1076         syscall(__NR_getpid);
1077 }
1078
1079 /* Ensure that SIGSYS overrides SIG_IGN */
1080 TEST_F_SIGNAL(TRAP, ign, SIGSYS)
1081 {
1082         long ret;
1083
1084         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1085         ASSERT_EQ(0, ret);
1086
1087         signal(SIGSYS, SIG_IGN);
1088
1089         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1090         ASSERT_EQ(0, ret);
1091         syscall(__NR_getpid);
1092 }
1093
1094 static siginfo_t TRAP_info;
1095 static volatile int TRAP_nr;
1096 static void TRAP_action(int nr, siginfo_t *info, void *void_context)
1097 {
1098         memcpy(&TRAP_info, info, sizeof(TRAP_info));
1099         TRAP_nr = nr;
1100 }
1101
1102 TEST_F(TRAP, handler)
1103 {
1104         int ret, test;
1105         struct sigaction act;
1106         sigset_t mask;
1107
1108         memset(&act, 0, sizeof(act));
1109         sigemptyset(&mask);
1110         sigaddset(&mask, SIGSYS);
1111
1112         act.sa_sigaction = &TRAP_action;
1113         act.sa_flags = SA_SIGINFO;
1114         ret = sigaction(SIGSYS, &act, NULL);
1115         ASSERT_EQ(0, ret) {
1116                 TH_LOG("sigaction failed");
1117         }
1118         ret = sigprocmask(SIG_UNBLOCK, &mask, NULL);
1119         ASSERT_EQ(0, ret) {
1120                 TH_LOG("sigprocmask failed");
1121         }
1122
1123         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1124         ASSERT_EQ(0, ret);
1125         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1126         ASSERT_EQ(0, ret);
1127         TRAP_nr = 0;
1128         memset(&TRAP_info, 0, sizeof(TRAP_info));
1129         /* Expect the registers to be rolled back. (nr = error) may vary
1130          * based on arch. */
1131         ret = syscall(__NR_getpid);
1132         /* Silence gcc warning about volatile. */
1133         test = TRAP_nr;
1134         EXPECT_EQ(SIGSYS, test);
1135         struct local_sigsys {
1136                 void *_call_addr;       /* calling user insn */
1137                 int _syscall;           /* triggering system call number */
1138                 unsigned int _arch;     /* AUDIT_ARCH_* of syscall */
1139         } *sigsys = (struct local_sigsys *)
1140 #ifdef si_syscall
1141                 &(TRAP_info.si_call_addr);
1142 #else
1143                 &TRAP_info.si_pid;
1144 #endif
1145         EXPECT_EQ(__NR_getpid, sigsys->_syscall);
1146         /* Make sure arch is non-zero. */
1147         EXPECT_NE(0, sigsys->_arch);
1148         EXPECT_NE(0, (unsigned long)sigsys->_call_addr);
1149 }
1150
1151 FIXTURE(precedence) {
1152         struct sock_fprog allow;
1153         struct sock_fprog log;
1154         struct sock_fprog trace;
1155         struct sock_fprog error;
1156         struct sock_fprog trap;
1157         struct sock_fprog kill;
1158 };
1159
1160 FIXTURE_SETUP(precedence)
1161 {
1162         struct sock_filter allow_insns[] = {
1163                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1164         };
1165         struct sock_filter log_insns[] = {
1166                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1167                         offsetof(struct seccomp_data, nr)),
1168                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1169                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1170                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG),
1171         };
1172         struct sock_filter trace_insns[] = {
1173                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1174                         offsetof(struct seccomp_data, nr)),
1175                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1176                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1177                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE),
1178         };
1179         struct sock_filter error_insns[] = {
1180                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1181                         offsetof(struct seccomp_data, nr)),
1182                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1183                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1184                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO),
1185         };
1186         struct sock_filter trap_insns[] = {
1187                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1188                         offsetof(struct seccomp_data, nr)),
1189                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1190                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1191                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
1192         };
1193         struct sock_filter kill_insns[] = {
1194                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1195                         offsetof(struct seccomp_data, nr)),
1196                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1197                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1198                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
1199         };
1200
1201         memset(self, 0, sizeof(*self));
1202 #define FILTER_ALLOC(_x) \
1203         self->_x.filter = malloc(sizeof(_x##_insns)); \
1204         ASSERT_NE(NULL, self->_x.filter); \
1205         memcpy(self->_x.filter, &_x##_insns, sizeof(_x##_insns)); \
1206         self->_x.len = (unsigned short)ARRAY_SIZE(_x##_insns)
1207         FILTER_ALLOC(allow);
1208         FILTER_ALLOC(log);
1209         FILTER_ALLOC(trace);
1210         FILTER_ALLOC(error);
1211         FILTER_ALLOC(trap);
1212         FILTER_ALLOC(kill);
1213 }
1214
1215 FIXTURE_TEARDOWN(precedence)
1216 {
1217 #define FILTER_FREE(_x) if (self->_x.filter) free(self->_x.filter)
1218         FILTER_FREE(allow);
1219         FILTER_FREE(log);
1220         FILTER_FREE(trace);
1221         FILTER_FREE(error);
1222         FILTER_FREE(trap);
1223         FILTER_FREE(kill);
1224 }
1225
1226 TEST_F(precedence, allow_ok)
1227 {
1228         pid_t parent, res = 0;
1229         long ret;
1230
1231         parent = getppid();
1232         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1233         ASSERT_EQ(0, ret);
1234
1235         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1236         ASSERT_EQ(0, ret);
1237         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1238         ASSERT_EQ(0, ret);
1239         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1240         ASSERT_EQ(0, ret);
1241         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1242         ASSERT_EQ(0, ret);
1243         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1244         ASSERT_EQ(0, ret);
1245         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1246         ASSERT_EQ(0, ret);
1247         /* Should work just fine. */
1248         res = syscall(__NR_getppid);
1249         EXPECT_EQ(parent, res);
1250 }
1251
1252 TEST_F_SIGNAL(precedence, kill_is_highest, SIGSYS)
1253 {
1254         pid_t parent, res = 0;
1255         long ret;
1256
1257         parent = getppid();
1258         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1259         ASSERT_EQ(0, ret);
1260
1261         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1262         ASSERT_EQ(0, ret);
1263         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1264         ASSERT_EQ(0, ret);
1265         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1266         ASSERT_EQ(0, ret);
1267         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1268         ASSERT_EQ(0, ret);
1269         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1270         ASSERT_EQ(0, ret);
1271         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1272         ASSERT_EQ(0, ret);
1273         /* Should work just fine. */
1274         res = syscall(__NR_getppid);
1275         EXPECT_EQ(parent, res);
1276         /* getpid() should never return. */
1277         res = syscall(__NR_getpid);
1278         EXPECT_EQ(0, res);
1279 }
1280
1281 TEST_F_SIGNAL(precedence, kill_is_highest_in_any_order, SIGSYS)
1282 {
1283         pid_t parent;
1284         long ret;
1285
1286         parent = getppid();
1287         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1288         ASSERT_EQ(0, ret);
1289
1290         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1291         ASSERT_EQ(0, ret);
1292         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1293         ASSERT_EQ(0, ret);
1294         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1295         ASSERT_EQ(0, ret);
1296         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1297         ASSERT_EQ(0, ret);
1298         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1299         ASSERT_EQ(0, ret);
1300         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1301         ASSERT_EQ(0, ret);
1302         /* Should work just fine. */
1303         EXPECT_EQ(parent, syscall(__NR_getppid));
1304         /* getpid() should never return. */
1305         EXPECT_EQ(0, syscall(__NR_getpid));
1306 }
1307
1308 TEST_F_SIGNAL(precedence, trap_is_second, SIGSYS)
1309 {
1310         pid_t parent;
1311         long ret;
1312
1313         parent = getppid();
1314         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1315         ASSERT_EQ(0, ret);
1316
1317         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1318         ASSERT_EQ(0, ret);
1319         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1320         ASSERT_EQ(0, ret);
1321         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1322         ASSERT_EQ(0, ret);
1323         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1324         ASSERT_EQ(0, ret);
1325         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1326         ASSERT_EQ(0, ret);
1327         /* Should work just fine. */
1328         EXPECT_EQ(parent, syscall(__NR_getppid));
1329         /* getpid() should never return. */
1330         EXPECT_EQ(0, syscall(__NR_getpid));
1331 }
1332
1333 TEST_F_SIGNAL(precedence, trap_is_second_in_any_order, SIGSYS)
1334 {
1335         pid_t parent;
1336         long ret;
1337
1338         parent = getppid();
1339         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1340         ASSERT_EQ(0, ret);
1341
1342         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1343         ASSERT_EQ(0, ret);
1344         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1345         ASSERT_EQ(0, ret);
1346         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1347         ASSERT_EQ(0, ret);
1348         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1349         ASSERT_EQ(0, ret);
1350         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1351         ASSERT_EQ(0, ret);
1352         /* Should work just fine. */
1353         EXPECT_EQ(parent, syscall(__NR_getppid));
1354         /* getpid() should never return. */
1355         EXPECT_EQ(0, syscall(__NR_getpid));
1356 }
1357
1358 TEST_F(precedence, errno_is_third)
1359 {
1360         pid_t parent;
1361         long ret;
1362
1363         parent = getppid();
1364         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1365         ASSERT_EQ(0, ret);
1366
1367         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1368         ASSERT_EQ(0, ret);
1369         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1370         ASSERT_EQ(0, ret);
1371         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1372         ASSERT_EQ(0, ret);
1373         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1374         ASSERT_EQ(0, ret);
1375         /* Should work just fine. */
1376         EXPECT_EQ(parent, syscall(__NR_getppid));
1377         EXPECT_EQ(0, syscall(__NR_getpid));
1378 }
1379
1380 TEST_F(precedence, errno_is_third_in_any_order)
1381 {
1382         pid_t parent;
1383         long ret;
1384
1385         parent = getppid();
1386         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1387         ASSERT_EQ(0, ret);
1388
1389         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1390         ASSERT_EQ(0, ret);
1391         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1392         ASSERT_EQ(0, ret);
1393         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1394         ASSERT_EQ(0, ret);
1395         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1396         ASSERT_EQ(0, ret);
1397         /* Should work just fine. */
1398         EXPECT_EQ(parent, syscall(__NR_getppid));
1399         EXPECT_EQ(0, syscall(__NR_getpid));
1400 }
1401
1402 TEST_F(precedence, trace_is_fourth)
1403 {
1404         pid_t parent;
1405         long ret;
1406
1407         parent = getppid();
1408         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1409         ASSERT_EQ(0, ret);
1410
1411         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1412         ASSERT_EQ(0, ret);
1413         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1414         ASSERT_EQ(0, ret);
1415         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1416         ASSERT_EQ(0, ret);
1417         /* Should work just fine. */
1418         EXPECT_EQ(parent, syscall(__NR_getppid));
1419         /* No ptracer */
1420         EXPECT_EQ(-1, syscall(__NR_getpid));
1421 }
1422
1423 TEST_F(precedence, trace_is_fourth_in_any_order)
1424 {
1425         pid_t parent;
1426         long ret;
1427
1428         parent = getppid();
1429         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1430         ASSERT_EQ(0, ret);
1431
1432         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1433         ASSERT_EQ(0, ret);
1434         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1435         ASSERT_EQ(0, ret);
1436         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1437         ASSERT_EQ(0, ret);
1438         /* Should work just fine. */
1439         EXPECT_EQ(parent, syscall(__NR_getppid));
1440         /* No ptracer */
1441         EXPECT_EQ(-1, syscall(__NR_getpid));
1442 }
1443
1444 TEST_F(precedence, log_is_fifth)
1445 {
1446         pid_t mypid, parent;
1447         long ret;
1448
1449         mypid = getpid();
1450         parent = getppid();
1451         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1452         ASSERT_EQ(0, ret);
1453
1454         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1455         ASSERT_EQ(0, ret);
1456         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1457         ASSERT_EQ(0, ret);
1458         /* Should work just fine. */
1459         EXPECT_EQ(parent, syscall(__NR_getppid));
1460         /* Should also work just fine */
1461         EXPECT_EQ(mypid, syscall(__NR_getpid));
1462 }
1463
1464 TEST_F(precedence, log_is_fifth_in_any_order)
1465 {
1466         pid_t mypid, parent;
1467         long ret;
1468
1469         mypid = getpid();
1470         parent = getppid();
1471         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1472         ASSERT_EQ(0, ret);
1473
1474         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1475         ASSERT_EQ(0, ret);
1476         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1477         ASSERT_EQ(0, ret);
1478         /* Should work just fine. */
1479         EXPECT_EQ(parent, syscall(__NR_getppid));
1480         /* Should also work just fine */
1481         EXPECT_EQ(mypid, syscall(__NR_getpid));
1482 }
1483
1484 #ifndef PTRACE_O_TRACESECCOMP
1485 #define PTRACE_O_TRACESECCOMP   0x00000080
1486 #endif
1487
1488 /* Catch the Ubuntu 12.04 value error. */
1489 #if PTRACE_EVENT_SECCOMP != 7
1490 #undef PTRACE_EVENT_SECCOMP
1491 #endif
1492
1493 #ifndef PTRACE_EVENT_SECCOMP
1494 #define PTRACE_EVENT_SECCOMP 7
1495 #endif
1496
1497 #define PTRACE_EVENT_MASK(status) ((status) >> 16)
1498 bool tracer_running;
1499 void tracer_stop(int sig)
1500 {
1501         tracer_running = false;
1502 }
1503
1504 typedef void tracer_func_t(struct __test_metadata *_metadata,
1505                            pid_t tracee, int status, void *args);
1506
1507 void start_tracer(struct __test_metadata *_metadata, int fd, pid_t tracee,
1508             tracer_func_t tracer_func, void *args, bool ptrace_syscall)
1509 {
1510         int ret = -1;
1511         struct sigaction action = {
1512                 .sa_handler = tracer_stop,
1513         };
1514
1515         /* Allow external shutdown. */
1516         tracer_running = true;
1517         ASSERT_EQ(0, sigaction(SIGUSR1, &action, NULL));
1518
1519         errno = 0;
1520         while (ret == -1 && errno != EINVAL)
1521                 ret = ptrace(PTRACE_ATTACH, tracee, NULL, 0);
1522         ASSERT_EQ(0, ret) {
1523                 kill(tracee, SIGKILL);
1524         }
1525         /* Wait for attach stop */
1526         wait(NULL);
1527
1528         ret = ptrace(PTRACE_SETOPTIONS, tracee, NULL, ptrace_syscall ?
1529                                                       PTRACE_O_TRACESYSGOOD :
1530                                                       PTRACE_O_TRACESECCOMP);
1531         ASSERT_EQ(0, ret) {
1532                 TH_LOG("Failed to set PTRACE_O_TRACESECCOMP");
1533                 kill(tracee, SIGKILL);
1534         }
1535         ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT,
1536                      tracee, NULL, 0);
1537         ASSERT_EQ(0, ret);
1538
1539         /* Unblock the tracee */
1540         ASSERT_EQ(1, write(fd, "A", 1));
1541         ASSERT_EQ(0, close(fd));
1542
1543         /* Run until we're shut down. Must assert to stop execution. */
1544         while (tracer_running) {
1545                 int status;
1546
1547                 if (wait(&status) != tracee)
1548                         continue;
1549
1550                 if (WIFSIGNALED(status)) {
1551                         /* Child caught a fatal signal. */
1552                         return;
1553                 }
1554                 if (WIFEXITED(status)) {
1555                         /* Child exited with code. */
1556                         return;
1557                 }
1558
1559                 /* Check if we got an expected event. */
1560                 ASSERT_EQ(WIFCONTINUED(status), false);
1561                 ASSERT_EQ(WIFSTOPPED(status), true);
1562                 ASSERT_EQ(WSTOPSIG(status) & SIGTRAP, SIGTRAP) {
1563                         TH_LOG("Unexpected WSTOPSIG: %d", WSTOPSIG(status));
1564                 }
1565
1566                 tracer_func(_metadata, tracee, status, args);
1567
1568                 ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT,
1569                              tracee, NULL, 0);
1570                 ASSERT_EQ(0, ret);
1571         }
1572         /* Directly report the status of our test harness results. */
1573         syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);
1574 }
1575
1576 /* Common tracer setup/teardown functions. */
1577 void cont_handler(int num)
1578 { }
1579 pid_t setup_trace_fixture(struct __test_metadata *_metadata,
1580                           tracer_func_t func, void *args, bool ptrace_syscall)
1581 {
1582         char sync;
1583         int pipefd[2];
1584         pid_t tracer_pid;
1585         pid_t tracee = getpid();
1586
1587         /* Setup a pipe for clean synchronization. */
1588         ASSERT_EQ(0, pipe(pipefd));
1589
1590         /* Fork a child which we'll promote to tracer */
1591         tracer_pid = fork();
1592         ASSERT_LE(0, tracer_pid);
1593         signal(SIGALRM, cont_handler);
1594         if (tracer_pid == 0) {
1595                 close(pipefd[0]);
1596                 start_tracer(_metadata, pipefd[1], tracee, func, args,
1597                              ptrace_syscall);
1598                 syscall(__NR_exit, 0);
1599         }
1600         close(pipefd[1]);
1601         prctl(PR_SET_PTRACER, tracer_pid, 0, 0, 0);
1602         read(pipefd[0], &sync, 1);
1603         close(pipefd[0]);
1604
1605         return tracer_pid;
1606 }
1607
1608 void teardown_trace_fixture(struct __test_metadata *_metadata,
1609                             pid_t tracer)
1610 {
1611         if (tracer) {
1612                 int status;
1613                 /*
1614                  * Extract the exit code from the other process and
1615                  * adopt it for ourselves in case its asserts failed.
1616                  */
1617                 ASSERT_EQ(0, kill(tracer, SIGUSR1));
1618                 ASSERT_EQ(tracer, waitpid(tracer, &status, 0));
1619                 if (WEXITSTATUS(status))
1620                         _metadata->passed = 0;
1621         }
1622 }
1623
1624 /* "poke" tracer arguments and function. */
1625 struct tracer_args_poke_t {
1626         unsigned long poke_addr;
1627 };
1628
1629 void tracer_poke(struct __test_metadata *_metadata, pid_t tracee, int status,
1630                  void *args)
1631 {
1632         int ret;
1633         unsigned long msg;
1634         struct tracer_args_poke_t *info = (struct tracer_args_poke_t *)args;
1635
1636         ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
1637         EXPECT_EQ(0, ret);
1638         /* If this fails, don't try to recover. */
1639         ASSERT_EQ(0x1001, msg) {
1640                 kill(tracee, SIGKILL);
1641         }
1642         /*
1643          * Poke in the message.
1644          * Registers are not touched to try to keep this relatively arch
1645          * agnostic.
1646          */
1647         ret = ptrace(PTRACE_POKEDATA, tracee, info->poke_addr, 0x1001);
1648         EXPECT_EQ(0, ret);
1649 }
1650
1651 FIXTURE(TRACE_poke) {
1652         struct sock_fprog prog;
1653         pid_t tracer;
1654         long poked;
1655         struct tracer_args_poke_t tracer_args;
1656 };
1657
1658 FIXTURE_SETUP(TRACE_poke)
1659 {
1660         struct sock_filter filter[] = {
1661                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1662                         offsetof(struct seccomp_data, nr)),
1663                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
1664                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1001),
1665                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1666         };
1667
1668         self->poked = 0;
1669         memset(&self->prog, 0, sizeof(self->prog));
1670         self->prog.filter = malloc(sizeof(filter));
1671         ASSERT_NE(NULL, self->prog.filter);
1672         memcpy(self->prog.filter, filter, sizeof(filter));
1673         self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1674
1675         /* Set up tracer args. */
1676         self->tracer_args.poke_addr = (unsigned long)&self->poked;
1677
1678         /* Launch tracer. */
1679         self->tracer = setup_trace_fixture(_metadata, tracer_poke,
1680                                            &self->tracer_args, false);
1681 }
1682
1683 FIXTURE_TEARDOWN(TRACE_poke)
1684 {
1685         teardown_trace_fixture(_metadata, self->tracer);
1686         if (self->prog.filter)
1687                 free(self->prog.filter);
1688 }
1689
1690 TEST_F(TRACE_poke, read_has_side_effects)
1691 {
1692         ssize_t ret;
1693
1694         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1695         ASSERT_EQ(0, ret);
1696
1697         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1698         ASSERT_EQ(0, ret);
1699
1700         EXPECT_EQ(0, self->poked);
1701         ret = read(-1, NULL, 0);
1702         EXPECT_EQ(-1, ret);
1703         EXPECT_EQ(0x1001, self->poked);
1704 }
1705
1706 TEST_F(TRACE_poke, getpid_runs_normally)
1707 {
1708         long ret;
1709
1710         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1711         ASSERT_EQ(0, ret);
1712
1713         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1714         ASSERT_EQ(0, ret);
1715
1716         EXPECT_EQ(0, self->poked);
1717         EXPECT_NE(0, syscall(__NR_getpid));
1718         EXPECT_EQ(0, self->poked);
1719 }
1720
1721 #if defined(__x86_64__)
1722 # define ARCH_REGS              struct user_regs_struct
1723 # define SYSCALL_NUM(_regs)     (_regs).orig_rax
1724 # define SYSCALL_RET(_regs)     (_regs).rax
1725 #elif defined(__i386__)
1726 # define ARCH_REGS              struct user_regs_struct
1727 # define SYSCALL_NUM(_regs)     (_regs).orig_eax
1728 # define SYSCALL_RET(_regs)     (_regs).eax
1729 #elif defined(__arm__)
1730 # define ARCH_REGS              struct pt_regs
1731 # define SYSCALL_NUM(_regs)     (_regs).ARM_r7
1732 # ifndef PTRACE_SET_SYSCALL
1733 #  define PTRACE_SET_SYSCALL   23
1734 # endif
1735 # define SYSCALL_NUM_SET(_regs, _nr)    \
1736                 EXPECT_EQ(0, ptrace(PTRACE_SET_SYSCALL, tracee, NULL, _nr))
1737 # define SYSCALL_RET(_regs)     (_regs).ARM_r0
1738 #elif defined(__aarch64__)
1739 # define ARCH_REGS              struct user_pt_regs
1740 # define SYSCALL_NUM(_regs)     (_regs).regs[8]
1741 # ifndef NT_ARM_SYSTEM_CALL
1742 #  define NT_ARM_SYSTEM_CALL 0x404
1743 # endif
1744 # define SYSCALL_NUM_SET(_regs, _nr)                            \
1745         do {                                                    \
1746                 struct iovec __v;                               \
1747                 typeof(_nr) __nr = (_nr);                       \
1748                 __v.iov_base = &__nr;                           \
1749                 __v.iov_len = sizeof(__nr);                     \
1750                 EXPECT_EQ(0, ptrace(PTRACE_SETREGSET, tracee,   \
1751                                     NT_ARM_SYSTEM_CALL, &__v)); \
1752         } while (0)
1753 # define SYSCALL_RET(_regs)     (_regs).regs[0]
1754 #elif defined(__riscv) && __riscv_xlen == 64
1755 # define ARCH_REGS              struct user_regs_struct
1756 # define SYSCALL_NUM(_regs)     (_regs).a7
1757 # define SYSCALL_RET(_regs)     (_regs).a0
1758 #elif defined(__csky__)
1759 # define ARCH_REGS              struct pt_regs
1760 #  if defined(__CSKYABIV2__)
1761 #   define SYSCALL_NUM(_regs)   (_regs).regs[3]
1762 #  else
1763 #   define SYSCALL_NUM(_regs)   (_regs).regs[9]
1764 #  endif
1765 # define SYSCALL_RET(_regs)     (_regs).a0
1766 #elif defined(__hppa__)
1767 # define ARCH_REGS              struct user_regs_struct
1768 # define SYSCALL_NUM(_regs)     (_regs).gr[20]
1769 # define SYSCALL_RET(_regs)     (_regs).gr[28]
1770 #elif defined(__powerpc__)
1771 # define ARCH_REGS              struct pt_regs
1772 # define SYSCALL_NUM(_regs)     (_regs).gpr[0]
1773 # define SYSCALL_RET(_regs)     (_regs).gpr[3]
1774 # define SYSCALL_RET_SET(_regs, _val)                           \
1775         do {                                                    \
1776                 typeof(_val) _result = (_val);                  \
1777                 if ((_regs.trap & 0xfff0) == 0x3000) {          \
1778                         /*                                      \
1779                          * scv 0 system call uses -ve result    \
1780                          * for error, so no need to adjust.     \
1781                          */                                     \
1782                         SYSCALL_RET(_regs) = _result;           \
1783                 } else {                                        \
1784                         /*                                      \
1785                          * A syscall error is signaled by the   \
1786                          * CR0 SO bit and the code is stored as \
1787                          * a positive value.                    \
1788                          */                                     \
1789                         if (_result < 0) {                      \
1790                                 SYSCALL_RET(_regs) = -_result;  \
1791                                 (_regs).ccr |= 0x10000000;      \
1792                         } else {                                \
1793                                 SYSCALL_RET(_regs) = _result;   \
1794                                 (_regs).ccr &= ~0x10000000;     \
1795                         }                                       \
1796                 }                                               \
1797         } while (0)
1798 # define SYSCALL_RET_SET_ON_PTRACE_EXIT
1799 #elif defined(__s390__)
1800 # define ARCH_REGS              s390_regs
1801 # define SYSCALL_NUM(_regs)     (_regs).gprs[2]
1802 # define SYSCALL_RET_SET(_regs, _val)                   \
1803                 TH_LOG("Can't modify syscall return on this architecture")
1804 #elif defined(__mips__)
1805 # include <asm/unistd_nr_n32.h>
1806 # include <asm/unistd_nr_n64.h>
1807 # include <asm/unistd_nr_o32.h>
1808 # define ARCH_REGS              struct pt_regs
1809 # define SYSCALL_NUM(_regs)                             \
1810         ({                                              \
1811                 typeof((_regs).regs[2]) _nr;            \
1812                 if ((_regs).regs[2] == __NR_O32_Linux)  \
1813                         _nr = (_regs).regs[4];          \
1814                 else                                    \
1815                         _nr = (_regs).regs[2];          \
1816                 _nr;                                    \
1817         })
1818 # define SYSCALL_NUM_SET(_regs, _nr)                    \
1819         do {                                            \
1820                 if ((_regs).regs[2] == __NR_O32_Linux)  \
1821                         (_regs).regs[4] = _nr;          \
1822                 else                                    \
1823                         (_regs).regs[2] = _nr;          \
1824         } while (0)
1825 # define SYSCALL_RET_SET(_regs, _val)                   \
1826                 TH_LOG("Can't modify syscall return on this architecture")
1827 #elif defined(__xtensa__)
1828 # define ARCH_REGS              struct user_pt_regs
1829 # define SYSCALL_NUM(_regs)     (_regs).syscall
1830 /*
1831  * On xtensa syscall return value is in the register
1832  * a2 of the current window which is not fixed.
1833  */
1834 #define SYSCALL_RET(_regs)      (_regs).a[(_regs).windowbase * 4 + 2]
1835 #elif defined(__sh__)
1836 # define ARCH_REGS              struct pt_regs
1837 # define SYSCALL_NUM(_regs)     (_regs).regs[3]
1838 # define SYSCALL_RET(_regs)     (_regs).regs[0]
1839 #else
1840 # error "Do not know how to find your architecture's registers and syscalls"
1841 #endif
1842
1843 /*
1844  * Most architectures can change the syscall by just updating the
1845  * associated register. This is the default if not defined above.
1846  */
1847 #ifndef SYSCALL_NUM_SET
1848 # define SYSCALL_NUM_SET(_regs, _nr)            \
1849         do {                                    \
1850                 SYSCALL_NUM(_regs) = (_nr);     \
1851         } while (0)
1852 #endif
1853 /*
1854  * Most architectures can change the syscall return value by just
1855  * writing to the SYSCALL_RET register. This is the default if not
1856  * defined above. If an architecture cannot set the return value
1857  * (for example when the syscall and return value register is
1858  * shared), report it with TH_LOG() in an arch-specific definition
1859  * of SYSCALL_RET_SET() above, and leave SYSCALL_RET undefined.
1860  */
1861 #if !defined(SYSCALL_RET) && !defined(SYSCALL_RET_SET)
1862 # error "One of SYSCALL_RET or SYSCALL_RET_SET is needed for this arch"
1863 #endif
1864 #ifndef SYSCALL_RET_SET
1865 # define SYSCALL_RET_SET(_regs, _val)           \
1866         do {                                    \
1867                 SYSCALL_RET(_regs) = (_val);    \
1868         } while (0)
1869 #endif
1870
1871 /* When the syscall return can't be changed, stub out the tests for it. */
1872 #ifndef SYSCALL_RET
1873 # define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(-1, action)
1874 #else
1875 # define EXPECT_SYSCALL_RETURN(val, action)             \
1876         do {                                            \
1877                 errno = 0;                              \
1878                 if (val < 0) {                          \
1879                         EXPECT_EQ(-1, action);          \
1880                         EXPECT_EQ(-(val), errno);       \
1881                 } else {                                \
1882                         EXPECT_EQ(val, action);         \
1883                 }                                       \
1884         } while (0)
1885 #endif
1886
1887 /*
1888  * Some architectures (e.g. powerpc) can only set syscall
1889  * return values on syscall exit during ptrace.
1890  */
1891 const bool ptrace_entry_set_syscall_nr = true;
1892 const bool ptrace_entry_set_syscall_ret =
1893 #ifndef SYSCALL_RET_SET_ON_PTRACE_EXIT
1894         true;
1895 #else
1896         false;
1897 #endif
1898
1899 /*
1900  * Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
1901  * architectures without HAVE_ARCH_TRACEHOOK (e.g. User-mode Linux).
1902  */
1903 #if defined(__x86_64__) || defined(__i386__) || defined(__mips__)
1904 # define ARCH_GETREGS(_regs)    ptrace(PTRACE_GETREGS, tracee, 0, &(_regs))
1905 # define ARCH_SETREGS(_regs)    ptrace(PTRACE_SETREGS, tracee, 0, &(_regs))
1906 #else
1907 # define ARCH_GETREGS(_regs)    ({                                      \
1908                 struct iovec __v;                                       \
1909                 __v.iov_base = &(_regs);                                \
1910                 __v.iov_len = sizeof(_regs);                            \
1911                 ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &__v);    \
1912         })
1913 # define ARCH_SETREGS(_regs)    ({                                      \
1914                 struct iovec __v;                                       \
1915                 __v.iov_base = &(_regs);                                \
1916                 __v.iov_len = sizeof(_regs);                            \
1917                 ptrace(PTRACE_SETREGSET, tracee, NT_PRSTATUS, &__v);    \
1918         })
1919 #endif
1920
1921 /* Architecture-specific syscall fetching routine. */
1922 int get_syscall(struct __test_metadata *_metadata, pid_t tracee)
1923 {
1924         ARCH_REGS regs;
1925
1926         EXPECT_EQ(0, ARCH_GETREGS(regs)) {
1927                 return -1;
1928         }
1929
1930         return SYSCALL_NUM(regs);
1931 }
1932
1933 /* Architecture-specific syscall changing routine. */
1934 void __change_syscall(struct __test_metadata *_metadata,
1935                     pid_t tracee, long *syscall, long *ret)
1936 {
1937         ARCH_REGS orig, regs;
1938
1939         /* Do not get/set registers if we have nothing to do. */
1940         if (!syscall && !ret)
1941                 return;
1942
1943         EXPECT_EQ(0, ARCH_GETREGS(regs)) {
1944                 return;
1945         }
1946         orig = regs;
1947
1948         if (syscall)
1949                 SYSCALL_NUM_SET(regs, *syscall);
1950
1951         if (ret)
1952                 SYSCALL_RET_SET(regs, *ret);
1953
1954         /* Flush any register changes made. */
1955         if (memcmp(&orig, &regs, sizeof(orig)) != 0)
1956                 EXPECT_EQ(0, ARCH_SETREGS(regs));
1957 }
1958
1959 /* Change only syscall number. */
1960 void change_syscall_nr(struct __test_metadata *_metadata,
1961                        pid_t tracee, long syscall)
1962 {
1963         __change_syscall(_metadata, tracee, &syscall, NULL);
1964 }
1965
1966 /* Change syscall return value (and set syscall number to -1). */
1967 void change_syscall_ret(struct __test_metadata *_metadata,
1968                         pid_t tracee, long ret)
1969 {
1970         long syscall = -1;
1971
1972         __change_syscall(_metadata, tracee, &syscall, &ret);
1973 }
1974
1975 void tracer_seccomp(struct __test_metadata *_metadata, pid_t tracee,
1976                     int status, void *args)
1977 {
1978         int ret;
1979         unsigned long msg;
1980
1981         EXPECT_EQ(PTRACE_EVENT_MASK(status), PTRACE_EVENT_SECCOMP) {
1982                 TH_LOG("Unexpected ptrace event: %d", PTRACE_EVENT_MASK(status));
1983                 return;
1984         }
1985
1986         /* Make sure we got the right message. */
1987         ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
1988         EXPECT_EQ(0, ret);
1989
1990         /* Validate and take action on expected syscalls. */
1991         switch (msg) {
1992         case 0x1002:
1993                 /* change getpid to getppid. */
1994                 EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee));
1995                 change_syscall_nr(_metadata, tracee, __NR_getppid);
1996                 break;
1997         case 0x1003:
1998                 /* skip gettid with valid return code. */
1999                 EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee));
2000                 change_syscall_ret(_metadata, tracee, 45000);
2001                 break;
2002         case 0x1004:
2003                 /* skip openat with error. */
2004                 EXPECT_EQ(__NR_openat, get_syscall(_metadata, tracee));
2005                 change_syscall_ret(_metadata, tracee, -ESRCH);
2006                 break;
2007         case 0x1005:
2008                 /* do nothing (allow getppid) */
2009                 EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee));
2010                 break;
2011         default:
2012                 EXPECT_EQ(0, msg) {
2013                         TH_LOG("Unknown PTRACE_GETEVENTMSG: 0x%lx", msg);
2014                         kill(tracee, SIGKILL);
2015                 }
2016         }
2017
2018 }
2019
2020 FIXTURE(TRACE_syscall) {
2021         struct sock_fprog prog;
2022         pid_t tracer, mytid, mypid, parent;
2023         long syscall_nr;
2024 };
2025
2026 void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
2027                    int status, void *args)
2028 {
2029         int ret;
2030         unsigned long msg;
2031         static bool entry;
2032         long syscall_nr_val, syscall_ret_val;
2033         long *syscall_nr = NULL, *syscall_ret = NULL;
2034         FIXTURE_DATA(TRACE_syscall) *self = args;
2035
2036         EXPECT_EQ(WSTOPSIG(status) & 0x80, 0x80) {
2037                 TH_LOG("Unexpected WSTOPSIG: %d", WSTOPSIG(status));
2038                 return;
2039         }
2040
2041         /*
2042          * The traditional way to tell PTRACE_SYSCALL entry/exit
2043          * is by counting.
2044          */
2045         entry = !entry;
2046
2047         /* Make sure we got an appropriate message. */
2048         ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
2049         EXPECT_EQ(0, ret);
2050         EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY
2051                         : PTRACE_EVENTMSG_SYSCALL_EXIT, msg);
2052
2053         /*
2054          * Some architectures only support setting return values during
2055          * syscall exit under ptrace, and on exit the syscall number may
2056          * no longer be available. Therefore, save the initial sycall
2057          * number here, so it can be examined during both entry and exit
2058          * phases.
2059          */
2060         if (entry)
2061                 self->syscall_nr = get_syscall(_metadata, tracee);
2062
2063         /*
2064          * Depending on the architecture's syscall setting abilities, we
2065          * pick which things to set during this phase (entry or exit).
2066          */
2067         if (entry == ptrace_entry_set_syscall_nr)
2068                 syscall_nr = &syscall_nr_val;
2069         if (entry == ptrace_entry_set_syscall_ret)
2070                 syscall_ret = &syscall_ret_val;
2071
2072         /* Now handle the actual rewriting cases. */
2073         switch (self->syscall_nr) {
2074         case __NR_getpid:
2075                 syscall_nr_val = __NR_getppid;
2076                 /* Never change syscall return for this case. */
2077                 syscall_ret = NULL;
2078                 break;
2079         case __NR_gettid:
2080                 syscall_nr_val = -1;
2081                 syscall_ret_val = 45000;
2082                 break;
2083         case __NR_openat:
2084                 syscall_nr_val = -1;
2085                 syscall_ret_val = -ESRCH;
2086                 break;
2087         default:
2088                 /* Unhandled, do nothing. */
2089                 return;
2090         }
2091
2092         __change_syscall(_metadata, tracee, syscall_nr, syscall_ret);
2093 }
2094
2095 FIXTURE_VARIANT(TRACE_syscall) {
2096         /*
2097          * All of the SECCOMP_RET_TRACE behaviors can be tested with either
2098          * SECCOMP_RET_TRACE+PTRACE_CONT or plain ptrace()+PTRACE_SYSCALL.
2099          * This indicates if we should use SECCOMP_RET_TRACE (false), or
2100          * ptrace (true).
2101          */
2102         bool use_ptrace;
2103 };
2104
2105 FIXTURE_VARIANT_ADD(TRACE_syscall, ptrace) {
2106         .use_ptrace = true,
2107 };
2108
2109 FIXTURE_VARIANT_ADD(TRACE_syscall, seccomp) {
2110         .use_ptrace = false,
2111 };
2112
2113 FIXTURE_SETUP(TRACE_syscall)
2114 {
2115         struct sock_filter filter[] = {
2116                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2117                         offsetof(struct seccomp_data, nr)),
2118                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
2119                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002),
2120                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1),
2121                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003),
2122                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_openat, 0, 1),
2123                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004),
2124                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
2125                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1005),
2126                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2127         };
2128         struct sock_fprog prog = {
2129                 .len = (unsigned short)ARRAY_SIZE(filter),
2130                 .filter = filter,
2131         };
2132         long ret;
2133
2134         /* Prepare some testable syscall results. */
2135         self->mytid = syscall(__NR_gettid);
2136         ASSERT_GT(self->mytid, 0);
2137         ASSERT_NE(self->mytid, 1) {
2138                 TH_LOG("Running this test as init is not supported. :)");
2139         }
2140
2141         self->mypid = getpid();
2142         ASSERT_GT(self->mypid, 0);
2143         ASSERT_EQ(self->mytid, self->mypid);
2144
2145         self->parent = getppid();
2146         ASSERT_GT(self->parent, 0);
2147         ASSERT_NE(self->parent, self->mypid);
2148
2149         /* Launch tracer. */
2150         self->tracer = setup_trace_fixture(_metadata,
2151                                            variant->use_ptrace ? tracer_ptrace
2152                                                                : tracer_seccomp,
2153                                            self, variant->use_ptrace);
2154
2155         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
2156         ASSERT_EQ(0, ret);
2157
2158         /* Do not install seccomp rewrite filters, as we'll use ptrace instead. */
2159         if (variant->use_ptrace)
2160                 return;
2161
2162         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2163         ASSERT_EQ(0, ret);
2164 }
2165
2166 FIXTURE_TEARDOWN(TRACE_syscall)
2167 {
2168         teardown_trace_fixture(_metadata, self->tracer);
2169 }
2170
2171 TEST(negative_ENOSYS)
2172 {
2173         /*
2174          * There should be no difference between an "internal" skip
2175          * and userspace asking for syscall "-1".
2176          */
2177         errno = 0;
2178         EXPECT_EQ(-1, syscall(-1));
2179         EXPECT_EQ(errno, ENOSYS);
2180         /* And no difference for "still not valid but not -1". */
2181         errno = 0;
2182         EXPECT_EQ(-1, syscall(-101));
2183         EXPECT_EQ(errno, ENOSYS);
2184 }
2185
2186 TEST_F(TRACE_syscall, negative_ENOSYS)
2187 {
2188         negative_ENOSYS(_metadata);
2189 }
2190
2191 TEST_F(TRACE_syscall, syscall_allowed)
2192 {
2193         /* getppid works as expected (no changes). */
2194         EXPECT_EQ(self->parent, syscall(__NR_getppid));
2195         EXPECT_NE(self->mypid, syscall(__NR_getppid));
2196 }
2197
2198 TEST_F(TRACE_syscall, syscall_redirected)
2199 {
2200         /* getpid has been redirected to getppid as expected. */
2201         EXPECT_EQ(self->parent, syscall(__NR_getpid));
2202         EXPECT_NE(self->mypid, syscall(__NR_getpid));
2203 }
2204
2205 TEST_F(TRACE_syscall, syscall_errno)
2206 {
2207         /* Tracer should skip the open syscall, resulting in ESRCH. */
2208         EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
2209 }
2210
2211 TEST_F(TRACE_syscall, syscall_faked)
2212 {
2213         /* Tracer skips the gettid syscall and store altered return value. */
2214         EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
2215 }
2216
2217 TEST_F_SIGNAL(TRACE_syscall, kill_immediate, SIGSYS)
2218 {
2219         struct sock_filter filter[] = {
2220                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2221                         offsetof(struct seccomp_data, nr)),
2222                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_mknodat, 0, 1),
2223                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_THREAD),
2224                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2225         };
2226         struct sock_fprog prog = {
2227                 .len = (unsigned short)ARRAY_SIZE(filter),
2228                 .filter = filter,
2229         };
2230         long ret;
2231
2232         /* Install "kill on mknodat" filter. */
2233         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2234         ASSERT_EQ(0, ret);
2235
2236         /* This should immediately die with SIGSYS, regardless of tracer. */
2237         EXPECT_EQ(-1, syscall(__NR_mknodat, -1, NULL, 0, 0));
2238 }
2239
2240 TEST_F(TRACE_syscall, skip_after)
2241 {
2242         struct sock_filter filter[] = {
2243                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2244                         offsetof(struct seccomp_data, nr)),
2245                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
2246                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EPERM),
2247                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2248         };
2249         struct sock_fprog prog = {
2250                 .len = (unsigned short)ARRAY_SIZE(filter),
2251                 .filter = filter,
2252         };
2253         long ret;
2254
2255         /* Install additional "errno on getppid" filter. */
2256         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2257         ASSERT_EQ(0, ret);
2258
2259         /* Tracer will redirect getpid to getppid, and we should see EPERM. */
2260         errno = 0;
2261         EXPECT_EQ(-1, syscall(__NR_getpid));
2262         EXPECT_EQ(EPERM, errno);
2263 }
2264
2265 TEST_F_SIGNAL(TRACE_syscall, kill_after, SIGSYS)
2266 {
2267         struct sock_filter filter[] = {
2268                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2269                         offsetof(struct seccomp_data, nr)),
2270                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
2271                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
2272                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2273         };
2274         struct sock_fprog prog = {
2275                 .len = (unsigned short)ARRAY_SIZE(filter),
2276                 .filter = filter,
2277         };
2278         long ret;
2279
2280         /* Install additional "death on getppid" filter. */
2281         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2282         ASSERT_EQ(0, ret);
2283
2284         /* Tracer will redirect getpid to getppid, and we should die. */
2285         EXPECT_NE(self->mypid, syscall(__NR_getpid));
2286 }
2287
2288 TEST(seccomp_syscall)
2289 {
2290         struct sock_filter filter[] = {
2291                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2292         };
2293         struct sock_fprog prog = {
2294                 .len = (unsigned short)ARRAY_SIZE(filter),
2295                 .filter = filter,
2296         };
2297         long ret;
2298
2299         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
2300         ASSERT_EQ(0, ret) {
2301                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2302         }
2303
2304         /* Reject insane operation. */
2305         ret = seccomp(-1, 0, &prog);
2306         ASSERT_NE(ENOSYS, errno) {
2307                 TH_LOG("Kernel does not support seccomp syscall!");
2308         }
2309         EXPECT_EQ(EINVAL, errno) {
2310                 TH_LOG("Did not reject crazy op value!");
2311         }
2312
2313         /* Reject strict with flags or pointer. */
2314         ret = seccomp(SECCOMP_SET_MODE_STRICT, -1, NULL);
2315         EXPECT_EQ(EINVAL, errno) {
2316                 TH_LOG("Did not reject mode strict with flags!");
2317         }
2318         ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, &prog);
2319         EXPECT_EQ(EINVAL, errno) {
2320                 TH_LOG("Did not reject mode strict with uargs!");
2321         }
2322
2323         /* Reject insane args for filter. */
2324         ret = seccomp(SECCOMP_SET_MODE_FILTER, -1, &prog);
2325         EXPECT_EQ(EINVAL, errno) {
2326                 TH_LOG("Did not reject crazy filter flags!");
2327         }
2328         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, NULL);
2329         EXPECT_EQ(EFAULT, errno) {
2330                 TH_LOG("Did not reject NULL filter!");
2331         }
2332
2333         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
2334         EXPECT_EQ(0, errno) {
2335                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER: %s",
2336                         strerror(errno));
2337         }
2338 }
2339
2340 TEST(seccomp_syscall_mode_lock)
2341 {
2342         struct sock_filter filter[] = {
2343                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2344         };
2345         struct sock_fprog prog = {
2346                 .len = (unsigned short)ARRAY_SIZE(filter),
2347                 .filter = filter,
2348         };
2349         long ret;
2350
2351         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
2352         ASSERT_EQ(0, ret) {
2353                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2354         }
2355
2356         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
2357         ASSERT_NE(ENOSYS, errno) {
2358                 TH_LOG("Kernel does not support seccomp syscall!");
2359         }
2360         EXPECT_EQ(0, ret) {
2361                 TH_LOG("Could not install filter!");
2362         }
2363
2364         /* Make sure neither entry point will switch to strict. */
2365         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, 0, 0, 0);
2366         EXPECT_EQ(EINVAL, errno) {
2367                 TH_LOG("Switched to mode strict!");
2368         }
2369
2370         ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, NULL);
2371         EXPECT_EQ(EINVAL, errno) {
2372                 TH_LOG("Switched to mode strict!");
2373         }
2374 }
2375
2376 /*
2377  * Test detection of known and unknown filter flags. Userspace needs to be able
2378  * to check if a filter flag is supported by the current kernel and a good way
2379  * of doing that is by attempting to enter filter mode, with the flag bit in
2380  * question set, and a NULL pointer for the _args_ parameter. EFAULT indicates
2381  * that the flag is valid and EINVAL indicates that the flag is invalid.
2382  */
2383 TEST(detect_seccomp_filter_flags)
2384 {
2385         unsigned int flags[] = { SECCOMP_FILTER_FLAG_TSYNC,
2386                                  SECCOMP_FILTER_FLAG_LOG,
2387                                  SECCOMP_FILTER_FLAG_SPEC_ALLOW,
2388                                  SECCOMP_FILTER_FLAG_NEW_LISTENER,
2389                                  SECCOMP_FILTER_FLAG_TSYNC_ESRCH };
2390         unsigned int exclusive[] = {
2391                                 SECCOMP_FILTER_FLAG_TSYNC,
2392                                 SECCOMP_FILTER_FLAG_NEW_LISTENER };
2393         unsigned int flag, all_flags, exclusive_mask;
2394         int i;
2395         long ret;
2396
2397         /* Test detection of individual known-good filter flags */
2398         for (i = 0, all_flags = 0; i < ARRAY_SIZE(flags); i++) {
2399                 int bits = 0;
2400
2401                 flag = flags[i];
2402                 /* Make sure the flag is a single bit! */
2403                 while (flag) {
2404                         if (flag & 0x1)
2405                                 bits ++;
2406                         flag >>= 1;
2407                 }
2408                 ASSERT_EQ(1, bits);
2409                 flag = flags[i];
2410
2411                 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2412                 ASSERT_NE(ENOSYS, errno) {
2413                         TH_LOG("Kernel does not support seccomp syscall!");
2414                 }
2415                 EXPECT_EQ(-1, ret);
2416                 EXPECT_EQ(EFAULT, errno) {
2417                         TH_LOG("Failed to detect that a known-good filter flag (0x%X) is supported!",
2418                                flag);
2419                 }
2420
2421                 all_flags |= flag;
2422         }
2423
2424         /*
2425          * Test detection of all known-good filter flags combined. But
2426          * for the exclusive flags we need to mask them out and try them
2427          * individually for the "all flags" testing.
2428          */
2429         exclusive_mask = 0;
2430         for (i = 0; i < ARRAY_SIZE(exclusive); i++)
2431                 exclusive_mask |= exclusive[i];
2432         for (i = 0; i < ARRAY_SIZE(exclusive); i++) {
2433                 flag = all_flags & ~exclusive_mask;
2434                 flag |= exclusive[i];
2435
2436                 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2437                 EXPECT_EQ(-1, ret);
2438                 EXPECT_EQ(EFAULT, errno) {
2439                         TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!",
2440                                flag);
2441                 }
2442         }
2443
2444         /* Test detection of an unknown filter flags, without exclusives. */
2445         flag = -1;
2446         flag &= ~exclusive_mask;
2447         ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2448         EXPECT_EQ(-1, ret);
2449         EXPECT_EQ(EINVAL, errno) {
2450                 TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported!",
2451                        flag);
2452         }
2453
2454         /*
2455          * Test detection of an unknown filter flag that may simply need to be
2456          * added to this test
2457          */
2458         flag = flags[ARRAY_SIZE(flags) - 1] << 1;
2459         ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2460         EXPECT_EQ(-1, ret);
2461         EXPECT_EQ(EINVAL, errno) {
2462                 TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported! Does a new flag need to be added to this test?",
2463                        flag);
2464         }
2465 }
2466
2467 TEST(TSYNC_first)
2468 {
2469         struct sock_filter filter[] = {
2470                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2471         };
2472         struct sock_fprog prog = {
2473                 .len = (unsigned short)ARRAY_SIZE(filter),
2474                 .filter = filter,
2475         };
2476         long ret;
2477
2478         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
2479         ASSERT_EQ(0, ret) {
2480                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2481         }
2482
2483         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2484                       &prog);
2485         ASSERT_NE(ENOSYS, errno) {
2486                 TH_LOG("Kernel does not support seccomp syscall!");
2487         }
2488         EXPECT_EQ(0, ret) {
2489                 TH_LOG("Could not install initial filter with TSYNC!");
2490         }
2491 }
2492
2493 #define TSYNC_SIBLINGS 2
2494 struct tsync_sibling {
2495         pthread_t tid;
2496         pid_t system_tid;
2497         sem_t *started;
2498         pthread_cond_t *cond;
2499         pthread_mutex_t *mutex;
2500         int diverge;
2501         int num_waits;
2502         struct sock_fprog *prog;
2503         struct __test_metadata *metadata;
2504 };
2505
2506 /*
2507  * To avoid joining joined threads (which is not allowed by Bionic),
2508  * make sure we both successfully join and clear the tid to skip a
2509  * later join attempt during fixture teardown. Any remaining threads
2510  * will be directly killed during teardown.
2511  */
2512 #define PTHREAD_JOIN(tid, status)                                       \
2513         do {                                                            \
2514                 int _rc = pthread_join(tid, status);                    \
2515                 if (_rc) {                                              \
2516                         TH_LOG("pthread_join of tid %u failed: %d\n",   \
2517                                 (unsigned int)tid, _rc);                \
2518                 } else {                                                \
2519                         tid = 0;                                        \
2520                 }                                                       \
2521         } while (0)
2522
2523 FIXTURE(TSYNC) {
2524         struct sock_fprog root_prog, apply_prog;
2525         struct tsync_sibling sibling[TSYNC_SIBLINGS];
2526         sem_t started;
2527         pthread_cond_t cond;
2528         pthread_mutex_t mutex;
2529         int sibling_count;
2530 };
2531
2532 FIXTURE_SETUP(TSYNC)
2533 {
2534         struct sock_filter root_filter[] = {
2535                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2536         };
2537         struct sock_filter apply_filter[] = {
2538                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2539                         offsetof(struct seccomp_data, nr)),
2540                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
2541                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
2542                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2543         };
2544
2545         memset(&self->root_prog, 0, sizeof(self->root_prog));
2546         memset(&self->apply_prog, 0, sizeof(self->apply_prog));
2547         memset(&self->sibling, 0, sizeof(self->sibling));
2548         self->root_prog.filter = malloc(sizeof(root_filter));
2549         ASSERT_NE(NULL, self->root_prog.filter);
2550         memcpy(self->root_prog.filter, &root_filter, sizeof(root_filter));
2551         self->root_prog.len = (unsigned short)ARRAY_SIZE(root_filter);
2552
2553         self->apply_prog.filter = malloc(sizeof(apply_filter));
2554         ASSERT_NE(NULL, self->apply_prog.filter);
2555         memcpy(self->apply_prog.filter, &apply_filter, sizeof(apply_filter));
2556         self->apply_prog.len = (unsigned short)ARRAY_SIZE(apply_filter);
2557
2558         self->sibling_count = 0;
2559         pthread_mutex_init(&self->mutex, NULL);
2560         pthread_cond_init(&self->cond, NULL);
2561         sem_init(&self->started, 0, 0);
2562         self->sibling[0].tid = 0;
2563         self->sibling[0].cond = &self->cond;
2564         self->sibling[0].started = &self->started;
2565         self->sibling[0].mutex = &self->mutex;
2566         self->sibling[0].diverge = 0;
2567         self->sibling[0].num_waits = 1;
2568         self->sibling[0].prog = &self->root_prog;
2569         self->sibling[0].metadata = _metadata;
2570         self->sibling[1].tid = 0;
2571         self->sibling[1].cond = &self->cond;
2572         self->sibling[1].started = &self->started;
2573         self->sibling[1].mutex = &self->mutex;
2574         self->sibling[1].diverge = 0;
2575         self->sibling[1].prog = &self->root_prog;
2576         self->sibling[1].num_waits = 1;
2577         self->sibling[1].metadata = _metadata;
2578 }
2579
2580 FIXTURE_TEARDOWN(TSYNC)
2581 {
2582         int sib = 0;
2583
2584         if (self->root_prog.filter)
2585                 free(self->root_prog.filter);
2586         if (self->apply_prog.filter)
2587                 free(self->apply_prog.filter);
2588
2589         for ( ; sib < self->sibling_count; ++sib) {
2590                 struct tsync_sibling *s = &self->sibling[sib];
2591
2592                 if (!s->tid)
2593                         continue;
2594                 /*
2595                  * If a thread is still running, it may be stuck, so hit
2596                  * it over the head really hard.
2597                  */
2598                 pthread_kill(s->tid, 9);
2599         }
2600         pthread_mutex_destroy(&self->mutex);
2601         pthread_cond_destroy(&self->cond);
2602         sem_destroy(&self->started);
2603 }
2604
2605 void *tsync_sibling(void *data)
2606 {
2607         long ret = 0;
2608         struct tsync_sibling *me = data;
2609
2610         me->system_tid = syscall(__NR_gettid);
2611
2612         pthread_mutex_lock(me->mutex);
2613         if (me->diverge) {
2614                 /* Just re-apply the root prog to fork the tree */
2615                 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
2616                                 me->prog, 0, 0);
2617         }
2618         sem_post(me->started);
2619         /* Return outside of started so parent notices failures. */
2620         if (ret) {
2621                 pthread_mutex_unlock(me->mutex);
2622                 return (void *)SIBLING_EXIT_FAILURE;
2623         }
2624         do {
2625                 pthread_cond_wait(me->cond, me->mutex);
2626                 me->num_waits = me->num_waits - 1;
2627         } while (me->num_waits);
2628         pthread_mutex_unlock(me->mutex);
2629
2630         ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
2631         if (!ret)
2632                 return (void *)SIBLING_EXIT_NEWPRIVS;
2633         read(-1, NULL, 0);
2634         return (void *)SIBLING_EXIT_UNKILLED;
2635 }
2636
2637 void tsync_start_sibling(struct tsync_sibling *sibling)
2638 {
2639         pthread_create(&sibling->tid, NULL, tsync_sibling, (void *)sibling);
2640 }
2641
2642 TEST_F(TSYNC, siblings_fail_prctl)
2643 {
2644         long ret;
2645         void *status;
2646         struct sock_filter filter[] = {
2647                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2648                         offsetof(struct seccomp_data, nr)),
2649                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
2650                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EINVAL),
2651                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2652         };
2653         struct sock_fprog prog = {
2654                 .len = (unsigned short)ARRAY_SIZE(filter),
2655                 .filter = filter,
2656         };
2657
2658         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2659                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2660         }
2661
2662         /* Check prctl failure detection by requesting sib 0 diverge. */
2663         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
2664         ASSERT_NE(ENOSYS, errno) {
2665                 TH_LOG("Kernel does not support seccomp syscall!");
2666         }
2667         ASSERT_EQ(0, ret) {
2668                 TH_LOG("setting filter failed");
2669         }
2670
2671         self->sibling[0].diverge = 1;
2672         tsync_start_sibling(&self->sibling[0]);
2673         tsync_start_sibling(&self->sibling[1]);
2674
2675         while (self->sibling_count < TSYNC_SIBLINGS) {
2676                 sem_wait(&self->started);
2677                 self->sibling_count++;
2678         }
2679
2680         /* Signal the threads to clean up*/
2681         pthread_mutex_lock(&self->mutex);
2682         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2683                 TH_LOG("cond broadcast non-zero");
2684         }
2685         pthread_mutex_unlock(&self->mutex);
2686
2687         /* Ensure diverging sibling failed to call prctl. */
2688         PTHREAD_JOIN(self->sibling[0].tid, &status);
2689         EXPECT_EQ(SIBLING_EXIT_FAILURE, (long)status);
2690         PTHREAD_JOIN(self->sibling[1].tid, &status);
2691         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2692 }
2693
2694 TEST_F(TSYNC, two_siblings_with_ancestor)
2695 {
2696         long ret;
2697         void *status;
2698
2699         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2700                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2701         }
2702
2703         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2704         ASSERT_NE(ENOSYS, errno) {
2705                 TH_LOG("Kernel does not support seccomp syscall!");
2706         }
2707         ASSERT_EQ(0, ret) {
2708                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2709         }
2710         tsync_start_sibling(&self->sibling[0]);
2711         tsync_start_sibling(&self->sibling[1]);
2712
2713         while (self->sibling_count < TSYNC_SIBLINGS) {
2714                 sem_wait(&self->started);
2715                 self->sibling_count++;
2716         }
2717
2718         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2719                       &self->apply_prog);
2720         ASSERT_EQ(0, ret) {
2721                 TH_LOG("Could install filter on all threads!");
2722         }
2723         /* Tell the siblings to test the policy */
2724         pthread_mutex_lock(&self->mutex);
2725         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2726                 TH_LOG("cond broadcast non-zero");
2727         }
2728         pthread_mutex_unlock(&self->mutex);
2729         /* Ensure they are both killed and don't exit cleanly. */
2730         PTHREAD_JOIN(self->sibling[0].tid, &status);
2731         EXPECT_EQ(0x0, (long)status);
2732         PTHREAD_JOIN(self->sibling[1].tid, &status);
2733         EXPECT_EQ(0x0, (long)status);
2734 }
2735
2736 TEST_F(TSYNC, two_sibling_want_nnp)
2737 {
2738         void *status;
2739
2740         /* start siblings before any prctl() operations */
2741         tsync_start_sibling(&self->sibling[0]);
2742         tsync_start_sibling(&self->sibling[1]);
2743         while (self->sibling_count < TSYNC_SIBLINGS) {
2744                 sem_wait(&self->started);
2745                 self->sibling_count++;
2746         }
2747
2748         /* Tell the siblings to test no policy */
2749         pthread_mutex_lock(&self->mutex);
2750         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2751                 TH_LOG("cond broadcast non-zero");
2752         }
2753         pthread_mutex_unlock(&self->mutex);
2754
2755         /* Ensure they are both upset about lacking nnp. */
2756         PTHREAD_JOIN(self->sibling[0].tid, &status);
2757         EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status);
2758         PTHREAD_JOIN(self->sibling[1].tid, &status);
2759         EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status);
2760 }
2761
2762 TEST_F(TSYNC, two_siblings_with_no_filter)
2763 {
2764         long ret;
2765         void *status;
2766
2767         /* start siblings before any prctl() operations */
2768         tsync_start_sibling(&self->sibling[0]);
2769         tsync_start_sibling(&self->sibling[1]);
2770         while (self->sibling_count < TSYNC_SIBLINGS) {
2771                 sem_wait(&self->started);
2772                 self->sibling_count++;
2773         }
2774
2775         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2776                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2777         }
2778
2779         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2780                       &self->apply_prog);
2781         ASSERT_NE(ENOSYS, errno) {
2782                 TH_LOG("Kernel does not support seccomp syscall!");
2783         }
2784         ASSERT_EQ(0, ret) {
2785                 TH_LOG("Could install filter on all threads!");
2786         }
2787
2788         /* Tell the siblings to test the policy */
2789         pthread_mutex_lock(&self->mutex);
2790         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2791                 TH_LOG("cond broadcast non-zero");
2792         }
2793         pthread_mutex_unlock(&self->mutex);
2794
2795         /* Ensure they are both killed and don't exit cleanly. */
2796         PTHREAD_JOIN(self->sibling[0].tid, &status);
2797         EXPECT_EQ(0x0, (long)status);
2798         PTHREAD_JOIN(self->sibling[1].tid, &status);
2799         EXPECT_EQ(0x0, (long)status);
2800 }
2801
2802 TEST_F(TSYNC, two_siblings_with_one_divergence)
2803 {
2804         long ret;
2805         void *status;
2806
2807         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2808                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2809         }
2810
2811         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2812         ASSERT_NE(ENOSYS, errno) {
2813                 TH_LOG("Kernel does not support seccomp syscall!");
2814         }
2815         ASSERT_EQ(0, ret) {
2816                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2817         }
2818         self->sibling[0].diverge = 1;
2819         tsync_start_sibling(&self->sibling[0]);
2820         tsync_start_sibling(&self->sibling[1]);
2821
2822         while (self->sibling_count < TSYNC_SIBLINGS) {
2823                 sem_wait(&self->started);
2824                 self->sibling_count++;
2825         }
2826
2827         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2828                       &self->apply_prog);
2829         ASSERT_EQ(self->sibling[0].system_tid, ret) {
2830                 TH_LOG("Did not fail on diverged sibling.");
2831         }
2832
2833         /* Wake the threads */
2834         pthread_mutex_lock(&self->mutex);
2835         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2836                 TH_LOG("cond broadcast non-zero");
2837         }
2838         pthread_mutex_unlock(&self->mutex);
2839
2840         /* Ensure they are both unkilled. */
2841         PTHREAD_JOIN(self->sibling[0].tid, &status);
2842         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2843         PTHREAD_JOIN(self->sibling[1].tid, &status);
2844         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2845 }
2846
2847 TEST_F(TSYNC, two_siblings_with_one_divergence_no_tid_in_err)
2848 {
2849         long ret, flags;
2850         void *status;
2851
2852         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2853                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2854         }
2855
2856         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2857         ASSERT_NE(ENOSYS, errno) {
2858                 TH_LOG("Kernel does not support seccomp syscall!");
2859         }
2860         ASSERT_EQ(0, ret) {
2861                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2862         }
2863         self->sibling[0].diverge = 1;
2864         tsync_start_sibling(&self->sibling[0]);
2865         tsync_start_sibling(&self->sibling[1]);
2866
2867         while (self->sibling_count < TSYNC_SIBLINGS) {
2868                 sem_wait(&self->started);
2869                 self->sibling_count++;
2870         }
2871
2872         flags = SECCOMP_FILTER_FLAG_TSYNC | \
2873                 SECCOMP_FILTER_FLAG_TSYNC_ESRCH;
2874         ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &self->apply_prog);
2875         ASSERT_EQ(ESRCH, errno) {
2876                 TH_LOG("Did not return ESRCH for diverged sibling.");
2877         }
2878         ASSERT_EQ(-1, ret) {
2879                 TH_LOG("Did not fail on diverged sibling.");
2880         }
2881
2882         /* Wake the threads */
2883         pthread_mutex_lock(&self->mutex);
2884         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2885                 TH_LOG("cond broadcast non-zero");
2886         }
2887         pthread_mutex_unlock(&self->mutex);
2888
2889         /* Ensure they are both unkilled. */
2890         PTHREAD_JOIN(self->sibling[0].tid, &status);
2891         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2892         PTHREAD_JOIN(self->sibling[1].tid, &status);
2893         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2894 }
2895
2896 TEST_F(TSYNC, two_siblings_not_under_filter)
2897 {
2898         long ret, sib;
2899         void *status;
2900         struct timespec delay = { .tv_nsec = 100000000 };
2901
2902         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2903                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2904         }
2905
2906         /*
2907          * Sibling 0 will have its own seccomp policy
2908          * and Sibling 1 will not be under seccomp at
2909          * all. Sibling 1 will enter seccomp and 0
2910          * will cause failure.
2911          */
2912         self->sibling[0].diverge = 1;
2913         tsync_start_sibling(&self->sibling[0]);
2914         tsync_start_sibling(&self->sibling[1]);
2915
2916         while (self->sibling_count < TSYNC_SIBLINGS) {
2917                 sem_wait(&self->started);
2918                 self->sibling_count++;
2919         }
2920
2921         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2922         ASSERT_NE(ENOSYS, errno) {
2923                 TH_LOG("Kernel does not support seccomp syscall!");
2924         }
2925         ASSERT_EQ(0, ret) {
2926                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2927         }
2928
2929         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2930                       &self->apply_prog);
2931         ASSERT_EQ(ret, self->sibling[0].system_tid) {
2932                 TH_LOG("Did not fail on diverged sibling.");
2933         }
2934         sib = 1;
2935         if (ret == self->sibling[0].system_tid)
2936                 sib = 0;
2937
2938         pthread_mutex_lock(&self->mutex);
2939
2940         /* Increment the other siblings num_waits so we can clean up
2941          * the one we just saw.
2942          */
2943         self->sibling[!sib].num_waits += 1;
2944
2945         /* Signal the thread to clean up*/
2946         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2947                 TH_LOG("cond broadcast non-zero");
2948         }
2949         pthread_mutex_unlock(&self->mutex);
2950         PTHREAD_JOIN(self->sibling[sib].tid, &status);
2951         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2952         /* Poll for actual task death. pthread_join doesn't guarantee it. */
2953         while (!kill(self->sibling[sib].system_tid, 0))
2954                 nanosleep(&delay, NULL);
2955         /* Switch to the remaining sibling */
2956         sib = !sib;
2957
2958         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2959                       &self->apply_prog);
2960         ASSERT_EQ(0, ret) {
2961                 TH_LOG("Expected the remaining sibling to sync");
2962         };
2963
2964         pthread_mutex_lock(&self->mutex);
2965
2966         /* If remaining sibling didn't have a chance to wake up during
2967          * the first broadcast, manually reduce the num_waits now.
2968          */
2969         if (self->sibling[sib].num_waits > 1)
2970                 self->sibling[sib].num_waits = 1;
2971         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2972                 TH_LOG("cond broadcast non-zero");
2973         }
2974         pthread_mutex_unlock(&self->mutex);
2975         PTHREAD_JOIN(self->sibling[sib].tid, &status);
2976         EXPECT_EQ(0, (long)status);
2977         /* Poll for actual task death. pthread_join doesn't guarantee it. */
2978         while (!kill(self->sibling[sib].system_tid, 0))
2979                 nanosleep(&delay, NULL);
2980
2981         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2982                       &self->apply_prog);
2983         ASSERT_EQ(0, ret);  /* just us chickens */
2984 }
2985
2986 /* Make sure restarted syscalls are seen directly as "restart_syscall". */
2987 TEST(syscall_restart)
2988 {
2989         long ret;
2990         unsigned long msg;
2991         pid_t child_pid;
2992         int pipefd[2];
2993         int status;
2994         siginfo_t info = { };
2995         struct sock_filter filter[] = {
2996                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2997                          offsetof(struct seccomp_data, nr)),
2998
2999 #ifdef __NR_sigreturn
3000                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_sigreturn, 7, 0),
3001 #endif
3002                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 6, 0),
3003                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_exit, 5, 0),
3004                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_rt_sigreturn, 4, 0),
3005                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_nanosleep, 5, 0),
3006                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_clock_nanosleep, 4, 0),
3007                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_restart_syscall, 4, 0),
3008
3009                 /* Allow __NR_write for easy logging. */
3010                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_write, 0, 1),
3011                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3012                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
3013                 /* The nanosleep jump target. */
3014                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x100),
3015                 /* The restart_syscall jump target. */
3016                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x200),
3017         };
3018         struct sock_fprog prog = {
3019                 .len = (unsigned short)ARRAY_SIZE(filter),
3020                 .filter = filter,
3021         };
3022 #if defined(__arm__)
3023         struct utsname utsbuf;
3024 #endif
3025
3026         ASSERT_EQ(0, pipe(pipefd));
3027
3028         child_pid = fork();
3029         ASSERT_LE(0, child_pid);
3030         if (child_pid == 0) {
3031                 /* Child uses EXPECT not ASSERT to deliver status correctly. */
3032                 char buf = ' ';
3033                 struct timespec timeout = { };
3034
3035                 /* Attach parent as tracer and stop. */
3036                 EXPECT_EQ(0, ptrace(PTRACE_TRACEME));
3037                 EXPECT_EQ(0, raise(SIGSTOP));
3038
3039                 EXPECT_EQ(0, close(pipefd[1]));
3040
3041                 EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
3042                         TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3043                 }
3044
3045                 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
3046                 EXPECT_EQ(0, ret) {
3047                         TH_LOG("Failed to install filter!");
3048                 }
3049
3050                 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) {
3051                         TH_LOG("Failed to read() sync from parent");
3052                 }
3053                 EXPECT_EQ('.', buf) {
3054                         TH_LOG("Failed to get sync data from read()");
3055                 }
3056
3057                 /* Start nanosleep to be interrupted. */
3058                 timeout.tv_sec = 1;
3059                 errno = 0;
3060                 EXPECT_EQ(0, nanosleep(&timeout, NULL)) {
3061                         TH_LOG("Call to nanosleep() failed (errno %d)", errno);
3062                 }
3063
3064                 /* Read final sync from parent. */
3065                 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) {
3066                         TH_LOG("Failed final read() from parent");
3067                 }
3068                 EXPECT_EQ('!', buf) {
3069                         TH_LOG("Failed to get final data from read()");
3070                 }
3071
3072                 /* Directly report the status of our test harness results. */
3073                 syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS
3074                                                      : EXIT_FAILURE);
3075         }
3076         EXPECT_EQ(0, close(pipefd[0]));
3077
3078         /* Attach to child, setup options, and release. */
3079         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3080         ASSERT_EQ(true, WIFSTOPPED(status));
3081         ASSERT_EQ(0, ptrace(PTRACE_SETOPTIONS, child_pid, NULL,
3082                             PTRACE_O_TRACESECCOMP));
3083         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3084         ASSERT_EQ(1, write(pipefd[1], ".", 1));
3085
3086         /* Wait for nanosleep() to start. */
3087         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3088         ASSERT_EQ(true, WIFSTOPPED(status));
3089         ASSERT_EQ(SIGTRAP, WSTOPSIG(status));
3090         ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16));
3091         ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg));
3092         ASSERT_EQ(0x100, msg);
3093         ret = get_syscall(_metadata, child_pid);
3094         EXPECT_TRUE(ret == __NR_nanosleep || ret == __NR_clock_nanosleep);
3095
3096         /* Might as well check siginfo for sanity while we're here. */
3097         ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info));
3098         ASSERT_EQ(SIGTRAP, info.si_signo);
3099         ASSERT_EQ(SIGTRAP | (PTRACE_EVENT_SECCOMP << 8), info.si_code);
3100         EXPECT_EQ(0, info.si_errno);
3101         EXPECT_EQ(getuid(), info.si_uid);
3102         /* Verify signal delivery came from child (seccomp-triggered). */
3103         EXPECT_EQ(child_pid, info.si_pid);
3104
3105         /* Interrupt nanosleep with SIGSTOP (which we'll need to handle). */
3106         ASSERT_EQ(0, kill(child_pid, SIGSTOP));
3107         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3108         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3109         ASSERT_EQ(true, WIFSTOPPED(status));
3110         ASSERT_EQ(SIGSTOP, WSTOPSIG(status));
3111         ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info));
3112         /*
3113          * There is no siginfo on SIGSTOP any more, so we can't verify
3114          * signal delivery came from parent now (getpid() == info.si_pid).
3115          * https://lkml.kernel.org/r/CAGXu5jJaZAOzP1qFz66tYrtbuywqb+UN2SOA1VLHpCCOiYvYeg@mail.gmail.com
3116          * At least verify the SIGSTOP via PTRACE_GETSIGINFO.
3117          */
3118         EXPECT_EQ(SIGSTOP, info.si_signo);
3119
3120         /* Restart nanosleep with SIGCONT, which triggers restart_syscall. */
3121         ASSERT_EQ(0, kill(child_pid, SIGCONT));
3122         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3123         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3124         ASSERT_EQ(true, WIFSTOPPED(status));
3125         ASSERT_EQ(SIGCONT, WSTOPSIG(status));
3126         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3127
3128         /* Wait for restart_syscall() to start. */
3129         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3130         ASSERT_EQ(true, WIFSTOPPED(status));
3131         ASSERT_EQ(SIGTRAP, WSTOPSIG(status));
3132         ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16));
3133         ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg));
3134
3135         ASSERT_EQ(0x200, msg);
3136         ret = get_syscall(_metadata, child_pid);
3137 #if defined(__arm__)
3138         /*
3139          * FIXME:
3140          * - native ARM registers do NOT expose true syscall.
3141          * - compat ARM registers on ARM64 DO expose true syscall.
3142          */
3143         ASSERT_EQ(0, uname(&utsbuf));
3144         if (strncmp(utsbuf.machine, "arm", 3) == 0) {
3145                 EXPECT_EQ(__NR_nanosleep, ret);
3146         } else
3147 #endif
3148         {
3149                 EXPECT_EQ(__NR_restart_syscall, ret);
3150         }
3151
3152         /* Write again to end test. */
3153         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3154         ASSERT_EQ(1, write(pipefd[1], "!", 1));
3155         EXPECT_EQ(0, close(pipefd[1]));
3156
3157         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3158         if (WIFSIGNALED(status) || WEXITSTATUS(status))
3159                 _metadata->passed = 0;
3160 }
3161
3162 TEST_SIGNAL(filter_flag_log, SIGSYS)
3163 {
3164         struct sock_filter allow_filter[] = {
3165                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3166         };
3167         struct sock_filter kill_filter[] = {
3168                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
3169                         offsetof(struct seccomp_data, nr)),
3170                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
3171                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
3172                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3173         };
3174         struct sock_fprog allow_prog = {
3175                 .len = (unsigned short)ARRAY_SIZE(allow_filter),
3176                 .filter = allow_filter,
3177         };
3178         struct sock_fprog kill_prog = {
3179                 .len = (unsigned short)ARRAY_SIZE(kill_filter),
3180                 .filter = kill_filter,
3181         };
3182         long ret;
3183         pid_t parent = getppid();
3184
3185         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3186         ASSERT_EQ(0, ret);
3187
3188         /* Verify that the FILTER_FLAG_LOG flag isn't accepted in strict mode */
3189         ret = seccomp(SECCOMP_SET_MODE_STRICT, SECCOMP_FILTER_FLAG_LOG,
3190                       &allow_prog);
3191         ASSERT_NE(ENOSYS, errno) {
3192                 TH_LOG("Kernel does not support seccomp syscall!");
3193         }
3194         EXPECT_NE(0, ret) {
3195                 TH_LOG("Kernel accepted FILTER_FLAG_LOG flag in strict mode!");
3196         }
3197         EXPECT_EQ(EINVAL, errno) {
3198                 TH_LOG("Kernel returned unexpected errno for FILTER_FLAG_LOG flag in strict mode!");
3199         }
3200
3201         /* Verify that a simple, permissive filter can be added with no flags */
3202         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &allow_prog);
3203         EXPECT_EQ(0, ret);
3204
3205         /* See if the same filter can be added with the FILTER_FLAG_LOG flag */
3206         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
3207                       &allow_prog);
3208         ASSERT_NE(EINVAL, errno) {
3209                 TH_LOG("Kernel does not support the FILTER_FLAG_LOG flag!");
3210         }
3211         EXPECT_EQ(0, ret);
3212
3213         /* Ensure that the kill filter works with the FILTER_FLAG_LOG flag */
3214         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
3215                       &kill_prog);
3216         EXPECT_EQ(0, ret);
3217
3218         EXPECT_EQ(parent, syscall(__NR_getppid));
3219         /* getpid() should never return. */
3220         EXPECT_EQ(0, syscall(__NR_getpid));
3221 }
3222
3223 TEST(get_action_avail)
3224 {
3225         __u32 actions[] = { SECCOMP_RET_KILL_THREAD, SECCOMP_RET_TRAP,
3226                             SECCOMP_RET_ERRNO, SECCOMP_RET_TRACE,
3227                             SECCOMP_RET_LOG,   SECCOMP_RET_ALLOW };
3228         __u32 unknown_action = 0x10000000U;
3229         int i;
3230         long ret;
3231
3232         ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[0]);
3233         ASSERT_NE(ENOSYS, errno) {
3234                 TH_LOG("Kernel does not support seccomp syscall!");
3235         }
3236         ASSERT_NE(EINVAL, errno) {
3237                 TH_LOG("Kernel does not support SECCOMP_GET_ACTION_AVAIL operation!");
3238         }
3239         EXPECT_EQ(ret, 0);
3240
3241         for (i = 0; i < ARRAY_SIZE(actions); i++) {
3242                 ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[i]);
3243                 EXPECT_EQ(ret, 0) {
3244                         TH_LOG("Expected action (0x%X) not available!",
3245                                actions[i]);
3246                 }
3247         }
3248
3249         /* Check that an unknown action is handled properly (EOPNOTSUPP) */
3250         ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &unknown_action);
3251         EXPECT_EQ(ret, -1);
3252         EXPECT_EQ(errno, EOPNOTSUPP);
3253 }
3254
3255 TEST(get_metadata)
3256 {
3257         pid_t pid;
3258         int pipefd[2];
3259         char buf;
3260         struct seccomp_metadata md;
3261         long ret;
3262
3263         /* Only real root can get metadata. */
3264         if (geteuid()) {
3265                 SKIP(return, "get_metadata requires real root");
3266                 return;
3267         }
3268
3269         ASSERT_EQ(0, pipe(pipefd));
3270
3271         pid = fork();
3272         ASSERT_GE(pid, 0);
3273         if (pid == 0) {
3274                 struct sock_filter filter[] = {
3275                         BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3276                 };
3277                 struct sock_fprog prog = {
3278                         .len = (unsigned short)ARRAY_SIZE(filter),
3279                         .filter = filter,
3280                 };
3281
3282                 /* one with log, one without */
3283                 EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER,
3284                                      SECCOMP_FILTER_FLAG_LOG, &prog));
3285                 EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog));
3286
3287                 EXPECT_EQ(0, close(pipefd[0]));
3288                 ASSERT_EQ(1, write(pipefd[1], "1", 1));
3289                 ASSERT_EQ(0, close(pipefd[1]));
3290
3291                 while (1)
3292                         sleep(100);
3293         }
3294
3295         ASSERT_EQ(0, close(pipefd[1]));
3296         ASSERT_EQ(1, read(pipefd[0], &buf, 1));
3297
3298         ASSERT_EQ(0, ptrace(PTRACE_ATTACH, pid));
3299         ASSERT_EQ(pid, waitpid(pid, NULL, 0));
3300
3301         /* Past here must not use ASSERT or child process is never killed. */
3302
3303         md.filter_off = 0;
3304         errno = 0;
3305         ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md);
3306         EXPECT_EQ(sizeof(md), ret) {
3307                 if (errno == EINVAL)
3308                         SKIP(goto skip, "Kernel does not support PTRACE_SECCOMP_GET_METADATA (missing CONFIG_CHECKPOINT_RESTORE?)");
3309         }
3310
3311         EXPECT_EQ(md.flags, SECCOMP_FILTER_FLAG_LOG);
3312         EXPECT_EQ(md.filter_off, 0);
3313
3314         md.filter_off = 1;
3315         ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md);
3316         EXPECT_EQ(sizeof(md), ret);
3317         EXPECT_EQ(md.flags, 0);
3318         EXPECT_EQ(md.filter_off, 1);
3319
3320 skip:
3321         ASSERT_EQ(0, kill(pid, SIGKILL));
3322 }
3323
3324 static int user_notif_syscall(int nr, unsigned int flags)
3325 {
3326         struct sock_filter filter[] = {
3327                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
3328                         offsetof(struct seccomp_data, nr)),
3329                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, nr, 0, 1),
3330                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_USER_NOTIF),
3331                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3332         };
3333
3334         struct sock_fprog prog = {
3335                 .len = (unsigned short)ARRAY_SIZE(filter),
3336                 .filter = filter,
3337         };
3338
3339         return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog);
3340 }
3341
3342 #define USER_NOTIF_MAGIC INT_MAX
3343 TEST(user_notification_basic)
3344 {
3345         pid_t pid;
3346         long ret;
3347         int status, listener;
3348         struct seccomp_notif req = {};
3349         struct seccomp_notif_resp resp = {};
3350         struct pollfd pollfd;
3351
3352         struct sock_filter filter[] = {
3353                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3354         };
3355         struct sock_fprog prog = {
3356                 .len = (unsigned short)ARRAY_SIZE(filter),
3357                 .filter = filter,
3358         };
3359
3360         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3361         ASSERT_EQ(0, ret) {
3362                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3363         }
3364
3365         pid = fork();
3366         ASSERT_GE(pid, 0);
3367
3368         /* Check that we get -ENOSYS with no listener attached */
3369         if (pid == 0) {
3370                 if (user_notif_syscall(__NR_getppid, 0) < 0)
3371                         exit(1);
3372                 ret = syscall(__NR_getppid);
3373                 exit(ret >= 0 || errno != ENOSYS);
3374         }
3375
3376         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3377         EXPECT_EQ(true, WIFEXITED(status));
3378         EXPECT_EQ(0, WEXITSTATUS(status));
3379
3380         /* Add some no-op filters for grins. */
3381         EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3382         EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3383         EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3384         EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3385
3386         /* Check that the basic notification machinery works */
3387         listener = user_notif_syscall(__NR_getppid,
3388                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3389         ASSERT_GE(listener, 0);
3390
3391         /* Installing a second listener in the chain should EBUSY */
3392         EXPECT_EQ(user_notif_syscall(__NR_getppid,
3393                                      SECCOMP_FILTER_FLAG_NEW_LISTENER),
3394                   -1);
3395         EXPECT_EQ(errno, EBUSY);
3396
3397         pid = fork();
3398         ASSERT_GE(pid, 0);
3399
3400         if (pid == 0) {
3401                 ret = syscall(__NR_getppid);
3402                 exit(ret != USER_NOTIF_MAGIC);
3403         }
3404
3405         pollfd.fd = listener;
3406         pollfd.events = POLLIN | POLLOUT;
3407
3408         EXPECT_GT(poll(&pollfd, 1, -1), 0);
3409         EXPECT_EQ(pollfd.revents, POLLIN);
3410
3411         /* Test that we can't pass garbage to the kernel. */
3412         memset(&req, 0, sizeof(req));
3413         req.pid = -1;
3414         errno = 0;
3415         ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req);
3416         EXPECT_EQ(-1, ret);
3417         EXPECT_EQ(EINVAL, errno);
3418
3419         if (ret) {
3420                 req.pid = 0;
3421                 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3422         }
3423
3424         pollfd.fd = listener;
3425         pollfd.events = POLLIN | POLLOUT;
3426
3427         EXPECT_GT(poll(&pollfd, 1, -1), 0);
3428         EXPECT_EQ(pollfd.revents, POLLOUT);
3429
3430         EXPECT_EQ(req.data.nr,  __NR_getppid);
3431
3432         resp.id = req.id;
3433         resp.error = 0;
3434         resp.val = USER_NOTIF_MAGIC;
3435
3436         /* check that we make sure flags == 0 */
3437         resp.flags = 1;
3438         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3439         EXPECT_EQ(errno, EINVAL);
3440
3441         resp.flags = 0;
3442         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3443
3444         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3445         EXPECT_EQ(true, WIFEXITED(status));
3446         EXPECT_EQ(0, WEXITSTATUS(status));
3447 }
3448
3449 TEST(user_notification_with_tsync)
3450 {
3451         int ret;
3452         unsigned int flags;
3453
3454         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3455         ASSERT_EQ(0, ret) {
3456                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3457         }
3458
3459         /* these were exclusive */
3460         flags = SECCOMP_FILTER_FLAG_NEW_LISTENER |
3461                 SECCOMP_FILTER_FLAG_TSYNC;
3462         ASSERT_EQ(-1, user_notif_syscall(__NR_getppid, flags));
3463         ASSERT_EQ(EINVAL, errno);
3464
3465         /* but now they're not */
3466         flags |= SECCOMP_FILTER_FLAG_TSYNC_ESRCH;
3467         ret = user_notif_syscall(__NR_getppid, flags);
3468         close(ret);
3469         ASSERT_LE(0, ret);
3470 }
3471
3472 TEST(user_notification_kill_in_middle)
3473 {
3474         pid_t pid;
3475         long ret;
3476         int listener;
3477         struct seccomp_notif req = {};
3478         struct seccomp_notif_resp resp = {};
3479
3480         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3481         ASSERT_EQ(0, ret) {
3482                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3483         }
3484
3485         listener = user_notif_syscall(__NR_getppid,
3486                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3487         ASSERT_GE(listener, 0);
3488
3489         /*
3490          * Check that nothing bad happens when we kill the task in the middle
3491          * of a syscall.
3492          */
3493         pid = fork();
3494         ASSERT_GE(pid, 0);
3495
3496         if (pid == 0) {
3497                 ret = syscall(__NR_getppid);
3498                 exit(ret != USER_NOTIF_MAGIC);
3499         }
3500
3501         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3502         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id), 0);
3503
3504         EXPECT_EQ(kill(pid, SIGKILL), 0);
3505         EXPECT_EQ(waitpid(pid, NULL, 0), pid);
3506
3507         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id), -1);
3508
3509         resp.id = req.id;
3510         ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp);
3511         EXPECT_EQ(ret, -1);
3512         EXPECT_EQ(errno, ENOENT);
3513 }
3514
3515 static int handled = -1;
3516
3517 static void signal_handler(int signal)
3518 {
3519         if (write(handled, "c", 1) != 1)
3520                 perror("write from signal");
3521 }
3522
3523 TEST(user_notification_signal)
3524 {
3525         pid_t pid;
3526         long ret;
3527         int status, listener, sk_pair[2];
3528         struct seccomp_notif req = {};
3529         struct seccomp_notif_resp resp = {};
3530         char c;
3531
3532         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3533         ASSERT_EQ(0, ret) {
3534                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3535         }
3536
3537         ASSERT_EQ(socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair), 0);
3538
3539         listener = user_notif_syscall(__NR_gettid,
3540                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3541         ASSERT_GE(listener, 0);
3542
3543         pid = fork();
3544         ASSERT_GE(pid, 0);
3545
3546         if (pid == 0) {
3547                 close(sk_pair[0]);
3548                 handled = sk_pair[1];
3549                 if (signal(SIGUSR1, signal_handler) == SIG_ERR) {
3550                         perror("signal");
3551                         exit(1);
3552                 }
3553                 /*
3554                  * ERESTARTSYS behavior is a bit hard to test, because we need
3555                  * to rely on a signal that has not yet been handled. Let's at
3556                  * least check that the error code gets propagated through, and
3557                  * hope that it doesn't break when there is actually a signal :)
3558                  */
3559                 ret = syscall(__NR_gettid);
3560                 exit(!(ret == -1 && errno == 512));
3561         }
3562
3563         close(sk_pair[1]);
3564
3565         memset(&req, 0, sizeof(req));
3566         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3567
3568         EXPECT_EQ(kill(pid, SIGUSR1), 0);
3569
3570         /*
3571          * Make sure the signal really is delivered, which means we're not
3572          * stuck in the user notification code any more and the notification
3573          * should be dead.
3574          */
3575         EXPECT_EQ(read(sk_pair[0], &c, 1), 1);
3576
3577         resp.id = req.id;
3578         resp.error = -EPERM;
3579         resp.val = 0;
3580
3581         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3582         EXPECT_EQ(errno, ENOENT);
3583
3584         memset(&req, 0, sizeof(req));
3585         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3586
3587         resp.id = req.id;
3588         resp.error = -512; /* -ERESTARTSYS */
3589         resp.val = 0;
3590
3591         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3592
3593         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3594         EXPECT_EQ(true, WIFEXITED(status));
3595         EXPECT_EQ(0, WEXITSTATUS(status));
3596 }
3597
3598 TEST(user_notification_closed_listener)
3599 {
3600         pid_t pid;
3601         long ret;
3602         int status, listener;
3603
3604         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3605         ASSERT_EQ(0, ret) {
3606                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3607         }
3608
3609         listener = user_notif_syscall(__NR_getppid,
3610                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3611         ASSERT_GE(listener, 0);
3612
3613         /*
3614          * Check that we get an ENOSYS when the listener is closed.
3615          */
3616         pid = fork();
3617         ASSERT_GE(pid, 0);
3618         if (pid == 0) {
3619                 close(listener);
3620                 ret = syscall(__NR_getppid);
3621                 exit(ret != -1 && errno != ENOSYS);
3622         }
3623
3624         close(listener);
3625
3626         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3627         EXPECT_EQ(true, WIFEXITED(status));
3628         EXPECT_EQ(0, WEXITSTATUS(status));
3629 }
3630
3631 /*
3632  * Check that a pid in a child namespace still shows up as valid in ours.
3633  */
3634 TEST(user_notification_child_pid_ns)
3635 {
3636         pid_t pid;
3637         int status, listener;
3638         struct seccomp_notif req = {};
3639         struct seccomp_notif_resp resp = {};
3640
3641         ASSERT_EQ(unshare(CLONE_NEWUSER | CLONE_NEWPID), 0) {
3642                 if (errno == EINVAL)
3643                         SKIP(return, "kernel missing CLONE_NEWUSER support");
3644         };
3645
3646         listener = user_notif_syscall(__NR_getppid,
3647                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3648         ASSERT_GE(listener, 0);
3649
3650         pid = fork();
3651         ASSERT_GE(pid, 0);
3652
3653         if (pid == 0)
3654                 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
3655
3656         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3657         EXPECT_EQ(req.pid, pid);
3658
3659         resp.id = req.id;
3660         resp.error = 0;
3661         resp.val = USER_NOTIF_MAGIC;
3662
3663         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3664
3665         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3666         EXPECT_EQ(true, WIFEXITED(status));
3667         EXPECT_EQ(0, WEXITSTATUS(status));
3668         close(listener);
3669 }
3670
3671 /*
3672  * Check that a pid in a sibling (i.e. unrelated) namespace shows up as 0, i.e.
3673  * invalid.
3674  */
3675 TEST(user_notification_sibling_pid_ns)
3676 {
3677         pid_t pid, pid2;
3678         int status, listener;
3679         struct seccomp_notif req = {};
3680         struct seccomp_notif_resp resp = {};
3681
3682         ASSERT_EQ(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0) {
3683                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3684         }
3685
3686         listener = user_notif_syscall(__NR_getppid,
3687                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3688         ASSERT_GE(listener, 0);
3689
3690         pid = fork();
3691         ASSERT_GE(pid, 0);
3692
3693         if (pid == 0) {
3694                 ASSERT_EQ(unshare(CLONE_NEWPID), 0);
3695
3696                 pid2 = fork();
3697                 ASSERT_GE(pid2, 0);
3698
3699                 if (pid2 == 0)
3700                         exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
3701
3702                 EXPECT_EQ(waitpid(pid2, &status, 0), pid2);
3703                 EXPECT_EQ(true, WIFEXITED(status));
3704                 EXPECT_EQ(0, WEXITSTATUS(status));
3705                 exit(WEXITSTATUS(status));
3706         }
3707
3708         /* Create the sibling ns, and sibling in it. */
3709         ASSERT_EQ(unshare(CLONE_NEWPID), 0) {
3710                 if (errno == EPERM)
3711                         SKIP(return, "CLONE_NEWPID requires CAP_SYS_ADMIN");
3712         }
3713         ASSERT_EQ(errno, 0);
3714
3715         pid2 = fork();
3716         ASSERT_GE(pid2, 0);
3717
3718         if (pid2 == 0) {
3719                 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3720                 /*
3721                  * The pid should be 0, i.e. the task is in some namespace that
3722                  * we can't "see".
3723                  */
3724                 EXPECT_EQ(req.pid, 0);
3725
3726                 resp.id = req.id;
3727                 resp.error = 0;
3728                 resp.val = USER_NOTIF_MAGIC;
3729
3730                 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3731                 exit(0);
3732         }
3733
3734         close(listener);
3735
3736         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3737         EXPECT_EQ(true, WIFEXITED(status));
3738         EXPECT_EQ(0, WEXITSTATUS(status));
3739
3740         EXPECT_EQ(waitpid(pid2, &status, 0), pid2);
3741         EXPECT_EQ(true, WIFEXITED(status));
3742         EXPECT_EQ(0, WEXITSTATUS(status));
3743 }
3744
3745 TEST(user_notification_fault_recv)
3746 {
3747         pid_t pid;
3748         int status, listener;
3749         struct seccomp_notif req = {};
3750         struct seccomp_notif_resp resp = {};
3751
3752         ASSERT_EQ(unshare(CLONE_NEWUSER), 0) {
3753                 if (errno == EINVAL)
3754                         SKIP(return, "kernel missing CLONE_NEWUSER support");
3755         }
3756
3757         listener = user_notif_syscall(__NR_getppid,
3758                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3759         ASSERT_GE(listener, 0);
3760
3761         pid = fork();
3762         ASSERT_GE(pid, 0);
3763
3764         if (pid == 0)
3765                 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
3766
3767         /* Do a bad recv() */
3768         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, NULL), -1);
3769         EXPECT_EQ(errno, EFAULT);
3770
3771         /* We should still be able to receive this notification, though. */
3772         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3773         EXPECT_EQ(req.pid, pid);
3774
3775         resp.id = req.id;
3776         resp.error = 0;
3777         resp.val = USER_NOTIF_MAGIC;
3778
3779         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3780
3781         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3782         EXPECT_EQ(true, WIFEXITED(status));
3783         EXPECT_EQ(0, WEXITSTATUS(status));
3784 }
3785
3786 TEST(seccomp_get_notif_sizes)
3787 {
3788         struct seccomp_notif_sizes sizes;
3789
3790         ASSERT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0);
3791         EXPECT_EQ(sizes.seccomp_notif, sizeof(struct seccomp_notif));
3792         EXPECT_EQ(sizes.seccomp_notif_resp, sizeof(struct seccomp_notif_resp));
3793 }
3794
3795 TEST(user_notification_continue)
3796 {
3797         pid_t pid;
3798         long ret;
3799         int status, listener;
3800         struct seccomp_notif req = {};
3801         struct seccomp_notif_resp resp = {};
3802         struct pollfd pollfd;
3803
3804         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3805         ASSERT_EQ(0, ret) {
3806                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3807         }
3808
3809         listener = user_notif_syscall(__NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER);
3810         ASSERT_GE(listener, 0);
3811
3812         pid = fork();
3813         ASSERT_GE(pid, 0);
3814
3815         if (pid == 0) {
3816                 int dup_fd, pipe_fds[2];
3817                 pid_t self;
3818
3819                 ASSERT_GE(pipe(pipe_fds), 0);
3820
3821                 dup_fd = dup(pipe_fds[0]);
3822                 ASSERT_GE(dup_fd, 0);
3823                 EXPECT_NE(pipe_fds[0], dup_fd);
3824
3825                 self = getpid();
3826                 ASSERT_EQ(filecmp(self, self, pipe_fds[0], dup_fd), 0);
3827                 exit(0);
3828         }
3829
3830         pollfd.fd = listener;
3831         pollfd.events = POLLIN | POLLOUT;
3832
3833         EXPECT_GT(poll(&pollfd, 1, -1), 0);
3834         EXPECT_EQ(pollfd.revents, POLLIN);
3835
3836         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3837
3838         pollfd.fd = listener;
3839         pollfd.events = POLLIN | POLLOUT;
3840
3841         EXPECT_GT(poll(&pollfd, 1, -1), 0);
3842         EXPECT_EQ(pollfd.revents, POLLOUT);
3843
3844         EXPECT_EQ(req.data.nr, __NR_dup);
3845
3846         resp.id = req.id;
3847         resp.flags = SECCOMP_USER_NOTIF_FLAG_CONTINUE;
3848
3849         /*
3850          * Verify that setting SECCOMP_USER_NOTIF_FLAG_CONTINUE enforces other
3851          * args be set to 0.
3852          */
3853         resp.error = 0;
3854         resp.val = USER_NOTIF_MAGIC;
3855         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3856         EXPECT_EQ(errno, EINVAL);
3857
3858         resp.error = USER_NOTIF_MAGIC;
3859         resp.val = 0;
3860         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3861         EXPECT_EQ(errno, EINVAL);
3862
3863         resp.error = 0;
3864         resp.val = 0;
3865         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0) {
3866                 if (errno == EINVAL)
3867                         SKIP(goto skip, "Kernel does not support SECCOMP_USER_NOTIF_FLAG_CONTINUE");
3868         }
3869
3870 skip:
3871         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3872         EXPECT_EQ(true, WIFEXITED(status));
3873         EXPECT_EQ(0, WEXITSTATUS(status)) {
3874                 if (WEXITSTATUS(status) == 2) {
3875                         SKIP(return, "Kernel does not support kcmp() syscall");
3876                         return;
3877                 }
3878         }
3879 }
3880
3881 TEST(user_notification_filter_empty)
3882 {
3883         pid_t pid;
3884         long ret;
3885         int status;
3886         struct pollfd pollfd;
3887         struct __clone_args args = {
3888                 .flags = CLONE_FILES,
3889                 .exit_signal = SIGCHLD,
3890         };
3891
3892         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3893         ASSERT_EQ(0, ret) {
3894                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3895         }
3896
3897         pid = sys_clone3(&args, sizeof(args));
3898         ASSERT_GE(pid, 0);
3899
3900         if (pid == 0) {
3901                 int listener;
3902
3903                 listener = user_notif_syscall(__NR_mknodat, SECCOMP_FILTER_FLAG_NEW_LISTENER);
3904                 if (listener < 0)
3905                         _exit(EXIT_FAILURE);
3906
3907                 if (dup2(listener, 200) != 200)
3908                         _exit(EXIT_FAILURE);
3909
3910                 close(listener);
3911
3912                 _exit(EXIT_SUCCESS);
3913         }
3914
3915         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3916         EXPECT_EQ(true, WIFEXITED(status));
3917         EXPECT_EQ(0, WEXITSTATUS(status));
3918
3919         /*
3920          * The seccomp filter has become unused so we should be notified once
3921          * the kernel gets around to cleaning up task struct.
3922          */
3923         pollfd.fd = 200;
3924         pollfd.events = POLLHUP;
3925
3926         EXPECT_GT(poll(&pollfd, 1, 2000), 0);
3927         EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0);
3928 }
3929
3930 static void *do_thread(void *data)
3931 {
3932         return NULL;
3933 }
3934
3935 TEST(user_notification_filter_empty_threaded)
3936 {
3937         pid_t pid;
3938         long ret;
3939         int status;
3940         struct pollfd pollfd;
3941         struct __clone_args args = {
3942                 .flags = CLONE_FILES,
3943                 .exit_signal = SIGCHLD,
3944         };
3945
3946         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3947         ASSERT_EQ(0, ret) {
3948                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3949         }
3950
3951         pid = sys_clone3(&args, sizeof(args));
3952         ASSERT_GE(pid, 0);
3953
3954         if (pid == 0) {
3955                 pid_t pid1, pid2;
3956                 int listener, status;
3957                 pthread_t thread;
3958
3959                 listener = user_notif_syscall(__NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER);
3960                 if (listener < 0)
3961                         _exit(EXIT_FAILURE);
3962
3963                 if (dup2(listener, 200) != 200)
3964                         _exit(EXIT_FAILURE);
3965
3966                 close(listener);
3967
3968                 pid1 = fork();
3969                 if (pid1 < 0)
3970                         _exit(EXIT_FAILURE);
3971
3972                 if (pid1 == 0)
3973                         _exit(EXIT_SUCCESS);
3974
3975                 pid2 = fork();
3976                 if (pid2 < 0)
3977                         _exit(EXIT_FAILURE);
3978
3979                 if (pid2 == 0)
3980                         _exit(EXIT_SUCCESS);
3981
3982                 if (pthread_create(&thread, NULL, do_thread, NULL) ||
3983                     pthread_join(thread, NULL))
3984                         _exit(EXIT_FAILURE);
3985
3986                 if (pthread_create(&thread, NULL, do_thread, NULL) ||
3987                     pthread_join(thread, NULL))
3988                         _exit(EXIT_FAILURE);
3989
3990                 if (waitpid(pid1, &status, 0) != pid1 || !WIFEXITED(status) ||
3991                     WEXITSTATUS(status))
3992                         _exit(EXIT_FAILURE);
3993
3994                 if (waitpid(pid2, &status, 0) != pid2 || !WIFEXITED(status) ||
3995                     WEXITSTATUS(status))
3996                         _exit(EXIT_FAILURE);
3997
3998                 exit(EXIT_SUCCESS);
3999         }
4000
4001         EXPECT_EQ(waitpid(pid, &status, 0), pid);
4002         EXPECT_EQ(true, WIFEXITED(status));
4003         EXPECT_EQ(0, WEXITSTATUS(status));
4004
4005         /*
4006          * The seccomp filter has become unused so we should be notified once
4007          * the kernel gets around to cleaning up task struct.
4008          */
4009         pollfd.fd = 200;
4010         pollfd.events = POLLHUP;
4011
4012         EXPECT_GT(poll(&pollfd, 1, 2000), 0);
4013         EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0);
4014 }
4015
4016 TEST(user_notification_addfd)
4017 {
4018         pid_t pid;
4019         long ret;
4020         int status, listener, memfd, fd, nextfd;
4021         struct seccomp_notif_addfd addfd = {};
4022         struct seccomp_notif_addfd_small small = {};
4023         struct seccomp_notif_addfd_big big = {};
4024         struct seccomp_notif req = {};
4025         struct seccomp_notif_resp resp = {};
4026         /* 100 ms */
4027         struct timespec delay = { .tv_nsec = 100000000 };
4028
4029         /* There may be arbitrary already-open fds at test start. */
4030         memfd = memfd_create("test", 0);
4031         ASSERT_GE(memfd, 0);
4032         nextfd = memfd + 1;
4033
4034         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4035         ASSERT_EQ(0, ret) {
4036                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4037         }
4038
4039         /* fd: 4 */
4040         /* Check that the basic notification machinery works */
4041         listener = user_notif_syscall(__NR_getppid,
4042                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
4043         ASSERT_EQ(listener, nextfd++);
4044
4045         pid = fork();
4046         ASSERT_GE(pid, 0);
4047
4048         if (pid == 0) {
4049                 /* fds will be added and this value is expected */
4050                 if (syscall(__NR_getppid) != USER_NOTIF_MAGIC)
4051                         exit(1);
4052
4053                 /* Atomic addfd+send is received here. Check it is a valid fd */
4054                 if (fcntl(syscall(__NR_getppid), F_GETFD) == -1)
4055                         exit(1);
4056
4057                 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
4058         }
4059
4060         ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4061
4062         addfd.srcfd = memfd;
4063         addfd.newfd = 0;
4064         addfd.id = req.id;
4065         addfd.flags = 0x0;
4066
4067         /* Verify bad newfd_flags cannot be set */
4068         addfd.newfd_flags = ~O_CLOEXEC;
4069         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4070         EXPECT_EQ(errno, EINVAL);
4071         addfd.newfd_flags = O_CLOEXEC;
4072
4073         /* Verify bad flags cannot be set */
4074         addfd.flags = 0xff;
4075         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4076         EXPECT_EQ(errno, EINVAL);
4077         addfd.flags = 0;
4078
4079         /* Verify that remote_fd cannot be set without setting flags */
4080         addfd.newfd = 1;
4081         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4082         EXPECT_EQ(errno, EINVAL);
4083         addfd.newfd = 0;
4084
4085         /* Verify small size cannot be set */
4086         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_SMALL, &small), -1);
4087         EXPECT_EQ(errno, EINVAL);
4088
4089         /* Verify we can't send bits filled in unknown buffer area */
4090         memset(&big, 0xAA, sizeof(big));
4091         big.addfd = addfd;
4092         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_BIG, &big), -1);
4093         EXPECT_EQ(errno, E2BIG);
4094
4095
4096         /* Verify we can set an arbitrary remote fd */
4097         fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
4098         EXPECT_EQ(fd, nextfd++);
4099         EXPECT_EQ(filecmp(getpid(), pid, memfd, fd), 0);
4100
4101         /* Verify we can set an arbitrary remote fd with large size */
4102         memset(&big, 0x0, sizeof(big));
4103         big.addfd = addfd;
4104         fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_BIG, &big);
4105         EXPECT_EQ(fd, nextfd++);
4106
4107         /* Verify we can set a specific remote fd */
4108         addfd.newfd = 42;
4109         addfd.flags = SECCOMP_ADDFD_FLAG_SETFD;
4110         fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
4111         EXPECT_EQ(fd, 42);
4112         EXPECT_EQ(filecmp(getpid(), pid, memfd, fd), 0);
4113
4114         /* Resume syscall */
4115         resp.id = req.id;
4116         resp.error = 0;
4117         resp.val = USER_NOTIF_MAGIC;
4118         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4119
4120         /*
4121          * This sets the ID of the ADD FD to the last request plus 1. The
4122          * notification ID increments 1 per notification.
4123          */
4124         addfd.id = req.id + 1;
4125
4126         /* This spins until the underlying notification is generated */
4127         while (ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd) != -1 &&
4128                errno != -EINPROGRESS)
4129                 nanosleep(&delay, NULL);
4130
4131         memset(&req, 0, sizeof(req));
4132         ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4133         ASSERT_EQ(addfd.id, req.id);
4134
4135         /* Verify we can do an atomic addfd and send */
4136         addfd.newfd = 0;
4137         addfd.flags = SECCOMP_ADDFD_FLAG_SEND;
4138         fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
4139         /*
4140          * Child has earlier "low" fds and now 42, so we expect the next
4141          * lowest available fd to be assigned here.
4142          */
4143         EXPECT_EQ(fd, nextfd++);
4144         ASSERT_EQ(filecmp(getpid(), pid, memfd, fd), 0);
4145
4146         /*
4147          * This sets the ID of the ADD FD to the last request plus 1. The
4148          * notification ID increments 1 per notification.
4149          */
4150         addfd.id = req.id + 1;
4151
4152         /* This spins until the underlying notification is generated */
4153         while (ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd) != -1 &&
4154                errno != -EINPROGRESS)
4155                 nanosleep(&delay, NULL);
4156
4157         memset(&req, 0, sizeof(req));
4158         ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4159         ASSERT_EQ(addfd.id, req.id);
4160
4161         resp.id = req.id;
4162         resp.error = 0;
4163         resp.val = USER_NOTIF_MAGIC;
4164         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4165
4166         /* Wait for child to finish. */
4167         EXPECT_EQ(waitpid(pid, &status, 0), pid);
4168         EXPECT_EQ(true, WIFEXITED(status));
4169         EXPECT_EQ(0, WEXITSTATUS(status));
4170
4171         close(memfd);
4172 }
4173
4174 TEST(user_notification_addfd_rlimit)
4175 {
4176         pid_t pid;
4177         long ret;
4178         int status, listener, memfd;
4179         struct seccomp_notif_addfd addfd = {};
4180         struct seccomp_notif req = {};
4181         struct seccomp_notif_resp resp = {};
4182         const struct rlimit lim = {
4183                 .rlim_cur       = 0,
4184                 .rlim_max       = 0,
4185         };
4186
4187         memfd = memfd_create("test", 0);
4188         ASSERT_GE(memfd, 0);
4189
4190         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4191         ASSERT_EQ(0, ret) {
4192                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4193         }
4194
4195         /* Check that the basic notification machinery works */
4196         listener = user_notif_syscall(__NR_getppid,
4197                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
4198         ASSERT_GE(listener, 0);
4199
4200         pid = fork();
4201         ASSERT_GE(pid, 0);
4202
4203         if (pid == 0)
4204                 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
4205
4206
4207         ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4208
4209         ASSERT_EQ(prlimit(pid, RLIMIT_NOFILE, &lim, NULL), 0);
4210
4211         addfd.srcfd = memfd;
4212         addfd.newfd_flags = O_CLOEXEC;
4213         addfd.newfd = 0;
4214         addfd.id = req.id;
4215         addfd.flags = 0;
4216
4217         /* Should probably spot check /proc/sys/fs/file-nr */
4218         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4219         EXPECT_EQ(errno, EMFILE);
4220
4221         addfd.flags = SECCOMP_ADDFD_FLAG_SEND;
4222         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4223         EXPECT_EQ(errno, EMFILE);
4224
4225         addfd.newfd = 100;
4226         addfd.flags = SECCOMP_ADDFD_FLAG_SETFD;
4227         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4228         EXPECT_EQ(errno, EBADF);
4229
4230         resp.id = req.id;
4231         resp.error = 0;
4232         resp.val = USER_NOTIF_MAGIC;
4233
4234         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4235
4236         /* Wait for child to finish. */
4237         EXPECT_EQ(waitpid(pid, &status, 0), pid);
4238         EXPECT_EQ(true, WIFEXITED(status));
4239         EXPECT_EQ(0, WEXITSTATUS(status));
4240
4241         close(memfd);
4242 }
4243
4244 /* Make sure PTRACE_O_SUSPEND_SECCOMP requires CAP_SYS_ADMIN. */
4245 FIXTURE(O_SUSPEND_SECCOMP) {
4246         pid_t pid;
4247 };
4248
4249 FIXTURE_SETUP(O_SUSPEND_SECCOMP)
4250 {
4251         ERRNO_FILTER(block_read, E2BIG);
4252         cap_value_t cap_list[] = { CAP_SYS_ADMIN };
4253         cap_t caps;
4254
4255         self->pid = 0;
4256
4257         /* make sure we don't have CAP_SYS_ADMIN */
4258         caps = cap_get_proc();
4259         ASSERT_NE(NULL, caps);
4260         ASSERT_EQ(0, cap_set_flag(caps, CAP_EFFECTIVE, 1, cap_list, CAP_CLEAR));
4261         ASSERT_EQ(0, cap_set_proc(caps));
4262         cap_free(caps);
4263
4264         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
4265         ASSERT_EQ(0, prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_block_read));
4266
4267         self->pid = fork();
4268         ASSERT_GE(self->pid, 0);
4269
4270         if (self->pid == 0) {
4271                 while (1)
4272                         pause();
4273                 _exit(127);
4274         }
4275 }
4276
4277 FIXTURE_TEARDOWN(O_SUSPEND_SECCOMP)
4278 {
4279         if (self->pid)
4280                 kill(self->pid, SIGKILL);
4281 }
4282
4283 TEST_F(O_SUSPEND_SECCOMP, setoptions)
4284 {
4285         int wstatus;
4286
4287         ASSERT_EQ(0, ptrace(PTRACE_ATTACH, self->pid, NULL, 0));
4288         ASSERT_EQ(self->pid, wait(&wstatus));
4289         ASSERT_EQ(-1, ptrace(PTRACE_SETOPTIONS, self->pid, NULL, PTRACE_O_SUSPEND_SECCOMP));
4290         if (errno == EINVAL)
4291                 SKIP(return, "Kernel does not support PTRACE_O_SUSPEND_SECCOMP (missing CONFIG_CHECKPOINT_RESTORE?)");
4292         ASSERT_EQ(EPERM, errno);
4293 }
4294
4295 TEST_F(O_SUSPEND_SECCOMP, seize)
4296 {
4297         int ret;
4298
4299         ret = ptrace(PTRACE_SEIZE, self->pid, NULL, PTRACE_O_SUSPEND_SECCOMP);
4300         ASSERT_EQ(-1, ret);
4301         if (errno == EINVAL)
4302                 SKIP(return, "Kernel does not support PTRACE_O_SUSPEND_SECCOMP (missing CONFIG_CHECKPOINT_RESTORE?)");
4303         ASSERT_EQ(EPERM, errno);
4304 }
4305
4306 /*
4307  * get_nth - Get the nth, space separated entry in a file.
4308  *
4309  * Returns the length of the read field.
4310  * Throws error if field is zero-lengthed.
4311  */
4312 static ssize_t get_nth(struct __test_metadata *_metadata, const char *path,
4313                      const unsigned int position, char **entry)
4314 {
4315         char *line = NULL;
4316         unsigned int i;
4317         ssize_t nread;
4318         size_t len = 0;
4319         FILE *f;
4320
4321         f = fopen(path, "r");
4322         ASSERT_NE(f, NULL) {
4323                 TH_LOG("Could not open %s: %s", path, strerror(errno));
4324         }
4325
4326         for (i = 0; i < position; i++) {
4327                 nread = getdelim(&line, &len, ' ', f);
4328                 ASSERT_GE(nread, 0) {
4329                         TH_LOG("Failed to read %d entry in file %s", i, path);
4330                 }
4331         }
4332         fclose(f);
4333
4334         ASSERT_GT(nread, 0) {
4335                 TH_LOG("Entry in file %s had zero length", path);
4336         }
4337
4338         *entry = line;
4339         return nread - 1;
4340 }
4341
4342 /* For a given PID, get the task state (D, R, etc...) */
4343 static char get_proc_stat(struct __test_metadata *_metadata, pid_t pid)
4344 {
4345         char proc_path[100] = {0};
4346         char status;
4347         char *line;
4348
4349         snprintf(proc_path, sizeof(proc_path), "/proc/%d/stat", pid);
4350         ASSERT_EQ(get_nth(_metadata, proc_path, 3, &line), 1);
4351
4352         status = *line;
4353         free(line);
4354
4355         return status;
4356 }
4357
4358 TEST(user_notification_fifo)
4359 {
4360         struct seccomp_notif_resp resp = {};
4361         struct seccomp_notif req = {};
4362         int i, status, listener;
4363         pid_t pid, pids[3];
4364         __u64 baseid;
4365         long ret;
4366         /* 100 ms */
4367         struct timespec delay = { .tv_nsec = 100000000 };
4368
4369         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4370         ASSERT_EQ(0, ret) {
4371                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4372         }
4373
4374         /* Setup a listener */
4375         listener = user_notif_syscall(__NR_getppid,
4376                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
4377         ASSERT_GE(listener, 0);
4378
4379         pid = fork();
4380         ASSERT_GE(pid, 0);
4381
4382         if (pid == 0) {
4383                 ret = syscall(__NR_getppid);
4384                 exit(ret != USER_NOTIF_MAGIC);
4385         }
4386
4387         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4388         baseid = req.id + 1;
4389
4390         resp.id = req.id;
4391         resp.error = 0;
4392         resp.val = USER_NOTIF_MAGIC;
4393
4394         /* check that we make sure flags == 0 */
4395         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4396
4397         EXPECT_EQ(waitpid(pid, &status, 0), pid);
4398         EXPECT_EQ(true, WIFEXITED(status));
4399         EXPECT_EQ(0, WEXITSTATUS(status));
4400
4401         /* Start children, and generate notifications */
4402         for (i = 0; i < ARRAY_SIZE(pids); i++) {
4403                 pid = fork();
4404                 if (pid == 0) {
4405                         ret = syscall(__NR_getppid);
4406                         exit(ret != USER_NOTIF_MAGIC);
4407                 }
4408                 pids[i] = pid;
4409         }
4410
4411         /* This spins until all of the children are sleeping */
4412 restart_wait:
4413         for (i = 0; i < ARRAY_SIZE(pids); i++) {
4414                 if (get_proc_stat(_metadata, pids[i]) != 'S') {
4415                         nanosleep(&delay, NULL);
4416                         goto restart_wait;
4417                 }
4418         }
4419
4420         /* Read the notifications in order (and respond) */
4421         for (i = 0; i < ARRAY_SIZE(pids); i++) {
4422                 memset(&req, 0, sizeof(req));
4423                 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4424                 EXPECT_EQ(req.id, baseid + i);
4425                 resp.id = req.id;
4426                 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4427         }
4428
4429         /* Make sure notifications were received */
4430         for (i = 0; i < ARRAY_SIZE(pids); i++) {
4431                 EXPECT_EQ(waitpid(pids[i], &status, 0), pids[i]);
4432                 EXPECT_EQ(true, WIFEXITED(status));
4433                 EXPECT_EQ(0, WEXITSTATUS(status));
4434         }
4435 }
4436
4437 /* get_proc_syscall - Get the syscall in progress for a given pid
4438  *
4439  * Returns the current syscall number for a given process
4440  * Returns -1 if not in syscall (running or blocked)
4441  */
4442 static long get_proc_syscall(struct __test_metadata *_metadata, int pid)
4443 {
4444         char proc_path[100] = {0};
4445         long ret = -1;
4446         ssize_t nread;
4447         char *line;
4448
4449         snprintf(proc_path, sizeof(proc_path), "/proc/%d/syscall", pid);
4450         nread = get_nth(_metadata, proc_path, 1, &line);
4451         ASSERT_GT(nread, 0);
4452
4453         if (!strncmp("running", line, MIN(7, nread)))
4454                 ret = strtol(line, NULL, 16);
4455
4456         free(line);
4457         return ret;
4458 }
4459
4460 /* Ensure non-fatal signals prior to receive are unmodified */
4461 TEST(user_notification_wait_killable_pre_notification)
4462 {
4463         struct sigaction new_action = {
4464                 .sa_handler = signal_handler,
4465         };
4466         int listener, status, sk_pair[2];
4467         pid_t pid;
4468         long ret;
4469         char c;
4470         /* 100 ms */
4471         struct timespec delay = { .tv_nsec = 100000000 };
4472
4473         ASSERT_EQ(sigemptyset(&new_action.sa_mask), 0);
4474
4475         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4476         ASSERT_EQ(0, ret)
4477         {
4478                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4479         }
4480
4481         ASSERT_EQ(socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair), 0);
4482
4483         listener = user_notif_syscall(
4484                 __NR_getppid, SECCOMP_FILTER_FLAG_NEW_LISTENER |
4485                                       SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV);
4486         ASSERT_GE(listener, 0);
4487
4488         /*
4489          * Check that we can kill the process with SIGUSR1 prior to receiving
4490          * the notification. SIGUSR1 is wired up to a custom signal handler,
4491          * and make sure it gets called.
4492          */
4493         pid = fork();
4494         ASSERT_GE(pid, 0);
4495
4496         if (pid == 0) {
4497                 close(sk_pair[0]);
4498                 handled = sk_pair[1];
4499
4500                 /* Setup the non-fatal sigaction without SA_RESTART */
4501                 if (sigaction(SIGUSR1, &new_action, NULL)) {
4502                         perror("sigaction");
4503                         exit(1);
4504                 }
4505
4506                 ret = syscall(__NR_getppid);
4507                 /* Make sure we got a return from a signal interruption */
4508                 exit(ret != -1 || errno != EINTR);
4509         }
4510
4511         /*
4512          * Make sure we've gotten to the seccomp user notification wait
4513          * from getppid prior to sending any signals
4514          */
4515         while (get_proc_syscall(_metadata, pid) != __NR_getppid &&
4516                get_proc_stat(_metadata, pid) != 'S')
4517                 nanosleep(&delay, NULL);
4518
4519         /* Send non-fatal kill signal */
4520         EXPECT_EQ(kill(pid, SIGUSR1), 0);
4521
4522         /* wait for process to exit (exit checks for EINTR) */
4523         EXPECT_EQ(waitpid(pid, &status, 0), pid);
4524         EXPECT_EQ(true, WIFEXITED(status));
4525         EXPECT_EQ(0, WEXITSTATUS(status));
4526
4527         EXPECT_EQ(read(sk_pair[0], &c, 1), 1);
4528 }
4529
4530 /* Ensure non-fatal signals after receive are blocked */
4531 TEST(user_notification_wait_killable)
4532 {
4533         struct sigaction new_action = {
4534                 .sa_handler = signal_handler,
4535         };
4536         struct seccomp_notif_resp resp = {};
4537         struct seccomp_notif req = {};
4538         int listener, status, sk_pair[2];
4539         pid_t pid;
4540         long ret;
4541         char c;
4542         /* 100 ms */
4543         struct timespec delay = { .tv_nsec = 100000000 };
4544
4545         ASSERT_EQ(sigemptyset(&new_action.sa_mask), 0);
4546
4547         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4548         ASSERT_EQ(0, ret)
4549         {
4550                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4551         }
4552
4553         ASSERT_EQ(socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair), 0);
4554
4555         listener = user_notif_syscall(
4556                 __NR_getppid, SECCOMP_FILTER_FLAG_NEW_LISTENER |
4557                                       SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV);
4558         ASSERT_GE(listener, 0);
4559
4560         pid = fork();
4561         ASSERT_GE(pid, 0);
4562
4563         if (pid == 0) {
4564                 close(sk_pair[0]);
4565                 handled = sk_pair[1];
4566
4567                 /* Setup the sigaction without SA_RESTART */
4568                 if (sigaction(SIGUSR1, &new_action, NULL)) {
4569                         perror("sigaction");
4570                         exit(1);
4571                 }
4572
4573                 /* Make sure that the syscall is completed (no EINTR) */
4574                 ret = syscall(__NR_getppid);
4575                 exit(ret != USER_NOTIF_MAGIC);
4576         }
4577
4578         /*
4579          * Get the notification, to make move the notifying process into a
4580          * non-preemptible (TASK_KILLABLE) state.
4581          */
4582         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4583         /* Send non-fatal kill signal */
4584         EXPECT_EQ(kill(pid, SIGUSR1), 0);
4585
4586         /*
4587          * Make sure the task enters moves to TASK_KILLABLE by waiting for
4588          * D (Disk Sleep) state after receiving non-fatal signal.
4589          */
4590         while (get_proc_stat(_metadata, pid) != 'D')
4591                 nanosleep(&delay, NULL);
4592
4593         resp.id = req.id;
4594         resp.val = USER_NOTIF_MAGIC;
4595         /* Make sure the notification is found and able to be replied to */
4596         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4597
4598         /*
4599          * Make sure that the signal handler does get called once we're back in
4600          * userspace.
4601          */
4602         EXPECT_EQ(read(sk_pair[0], &c, 1), 1);
4603         /* wait for process to exit (exit checks for USER_NOTIF_MAGIC) */
4604         EXPECT_EQ(waitpid(pid, &status, 0), pid);
4605         EXPECT_EQ(true, WIFEXITED(status));
4606         EXPECT_EQ(0, WEXITSTATUS(status));
4607 }
4608
4609 /* Ensure fatal signals after receive are not blocked */
4610 TEST(user_notification_wait_killable_fatal)
4611 {
4612         struct seccomp_notif req = {};
4613         int listener, status;
4614         pid_t pid;
4615         long ret;
4616         /* 100 ms */
4617         struct timespec delay = { .tv_nsec = 100000000 };
4618
4619         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4620         ASSERT_EQ(0, ret)
4621         {
4622                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4623         }
4624
4625         listener = user_notif_syscall(
4626                 __NR_getppid, SECCOMP_FILTER_FLAG_NEW_LISTENER |
4627                                       SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV);
4628         ASSERT_GE(listener, 0);
4629
4630         pid = fork();
4631         ASSERT_GE(pid, 0);
4632
4633         if (pid == 0) {
4634                 /* This should never complete as it should get a SIGTERM */
4635                 syscall(__NR_getppid);
4636                 exit(1);
4637         }
4638
4639         while (get_proc_stat(_metadata, pid) != 'S')
4640                 nanosleep(&delay, NULL);
4641
4642         /*
4643          * Get the notification, to make move the notifying process into a
4644          * non-preemptible (TASK_KILLABLE) state.
4645          */
4646         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4647         /* Kill the process with a fatal signal */
4648         EXPECT_EQ(kill(pid, SIGTERM), 0);
4649
4650         /*
4651          * Wait for the process to exit, and make sure the process terminated
4652          * due to the SIGTERM signal.
4653          */
4654         EXPECT_EQ(waitpid(pid, &status, 0), pid);
4655         EXPECT_EQ(true, WIFSIGNALED(status));
4656         EXPECT_EQ(SIGTERM, WTERMSIG(status));
4657 }
4658
4659 /*
4660  * TODO:
4661  * - expand NNP testing
4662  * - better arch-specific TRACE and TRAP handlers.
4663  * - endianness checking when appropriate
4664  * - 64-bit arg prodding
4665  * - arch value testing (x86 modes especially)
4666  * - verify that FILTER_FLAG_LOG filters generate log messages
4667  * - verify that RET_LOG generates log messages
4668  */
4669
4670 TEST_HARNESS_MAIN