tools/testing/selftests/seccomp/seccomp_bpf.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
   4  *
   5  * Test code for seccomp bpf.
   6  */
   7
   8 #define _GNU_SOURCE
   9 #include <sys/types.h>
  10
  11 /*
  12  * glibc 2.26 and later have SIGSYS in siginfo_t. Before that,
  13  * we need to use the kernel's siginfo.h file and trick glibc
  14  * into accepting it.
  15  */
  16 #if !__GLIBC_PREREQ(2, 26)
  17 # include <asm/siginfo.h>
  18 # define __have_siginfo_t 1
  19 # define __have_sigval_t 1
  20 # define __have_sigevent_t 1
  21 #endif
  22
  23 #include <errno.h>
  24 #include <linux/filter.h>
  25 #include <sys/prctl.h>
  26 #include <sys/ptrace.h>
  27 #include <sys/user.h>
  28 #include <linux/prctl.h>
  29 #include <linux/ptrace.h>
  30 #include <linux/seccomp.h>
  31 #include <pthread.h>
  32 #include <semaphore.h>
  33 #include <signal.h>
  34 #include <stddef.h>
  35 #include <stdbool.h>
  36 #include <string.h>
  37 #include <time.h>
  38 #include <limits.h>
  39 #include <linux/elf.h>
  40 #include <sys/uio.h>
  41 #include <sys/utsname.h>
  42 #include <sys/fcntl.h>
  43 #include <sys/mman.h>
  44 #include <sys/times.h>
  45 #include <sys/socket.h>
  46 #include <sys/ioctl.h>
  47 #include <linux/kcmp.h>
  48 #include <sys/resource.h>
  49
  50 #include <unistd.h>
  51 #include <sys/syscall.h>
  52 #include <poll.h>
  53
  54 #include "../kselftest_harness.h"
  55 #include "../clone3/clone3_selftests.h"
  56
  57 /* Attempt to de-conflict with the selftests tree. */
  58 #ifndef SKIP
  59 #define SKIP(s, ...)    XFAIL(s, ##__VA_ARGS__)
  60 #endif
  61
  62 #ifndef PR_SET_PTRACER
  63 # define PR_SET_PTRACER 0x59616d61
  64 #endif
  65
  66 #ifndef PR_SET_NO_NEW_PRIVS
  67 #define PR_SET_NO_NEW_PRIVS 38
  68 #define PR_GET_NO_NEW_PRIVS 39
  69 #endif
  70
  71 #ifndef PR_SECCOMP_EXT
  72 #define PR_SECCOMP_EXT 43
  73 #endif
  74
  75 #ifndef SECCOMP_EXT_ACT
  76 #define SECCOMP_EXT_ACT 1
  77 #endif
  78
  79 #ifndef SECCOMP_EXT_ACT_TSYNC
  80 #define SECCOMP_EXT_ACT_TSYNC 1
  81 #endif
  82
  83 #ifndef SECCOMP_MODE_STRICT
  84 #define SECCOMP_MODE_STRICT 1
  85 #endif
  86
  87 #ifndef SECCOMP_MODE_FILTER
  88 #define SECCOMP_MODE_FILTER 2
  89 #endif
  90
  91 #ifndef SECCOMP_RET_ALLOW
  92 struct seccomp_data {
  93         int nr;
  94         __u32 arch;
  95         __u64 instruction_pointer;
  96         __u64 args[6];
  97 };
  98 #endif
  99
 100 #ifndef SECCOMP_RET_KILL_PROCESS
 101 #define SECCOMP_RET_KILL_PROCESS 0x80000000U /* kill the process */
 102 #define SECCOMP_RET_KILL_THREAD  0x00000000U /* kill the thread */
 103 #endif
 104 #ifndef SECCOMP_RET_KILL
 105 #define SECCOMP_RET_KILL         SECCOMP_RET_KILL_THREAD
 106 #define SECCOMP_RET_TRAP         0x00030000U /* disallow and force a SIGSYS */
 107 #define SECCOMP_RET_ERRNO        0x00050000U /* returns an errno */
 108 #define SECCOMP_RET_TRACE        0x7ff00000U /* pass to a tracer or disallow */
 109 #define SECCOMP_RET_ALLOW        0x7fff0000U /* allow */
 110 #endif
 111 #ifndef SECCOMP_RET_LOG
 112 #define SECCOMP_RET_LOG          0x7ffc0000U /* allow after logging */
 113 #endif
 114
 115 #ifndef __NR_seccomp
 116 # if defined(__i386__)
 117 #  define __NR_seccomp 354
 118 # elif defined(__x86_64__)
 119 #  define __NR_seccomp 317
 120 # elif defined(__arm__)
 121 #  define __NR_seccomp 383
 122 # elif defined(__aarch64__)
 123 #  define __NR_seccomp 277
 124 # elif defined(__riscv)
 125 #  define __NR_seccomp 277
 126 # elif defined(__csky__)
 127 #  define __NR_seccomp 277
 128 # elif defined(__hppa__)
 129 #  define __NR_seccomp 338
 130 # elif defined(__powerpc__)
 131 #  define __NR_seccomp 358
 132 # elif defined(__s390__)
 133 #  define __NR_seccomp 348
 134 # elif defined(__xtensa__)
 135 #  define __NR_seccomp 337
 136 # elif defined(__sh__)
 137 #  define __NR_seccomp 372
 138 # else
 139 #  warning "seccomp syscall number unknown for this architecture"
 140 #  define __NR_seccomp 0xffff
 141 # endif
 142 #endif
 143
 144 #ifndef SECCOMP_SET_MODE_STRICT
 145 #define SECCOMP_SET_MODE_STRICT 0
 146 #endif
 147
 148 #ifndef SECCOMP_SET_MODE_FILTER
 149 #define SECCOMP_SET_MODE_FILTER 1
 150 #endif
 151
 152 #ifndef SECCOMP_GET_ACTION_AVAIL
 153 #define SECCOMP_GET_ACTION_AVAIL 2
 154 #endif
 155
 156 #ifndef SECCOMP_GET_NOTIF_SIZES
 157 #define SECCOMP_GET_NOTIF_SIZES 3
 158 #endif
 159
 160 #ifndef SECCOMP_FILTER_FLAG_TSYNC
 161 #define SECCOMP_FILTER_FLAG_TSYNC (1UL << 0)
 162 #endif
 163
 164 #ifndef SECCOMP_FILTER_FLAG_LOG
 165 #define SECCOMP_FILTER_FLAG_LOG (1UL << 1)
 166 #endif
 167
 168 #ifndef SECCOMP_FILTER_FLAG_SPEC_ALLOW
 169 #define SECCOMP_FILTER_FLAG_SPEC_ALLOW (1UL << 2)
 170 #endif
 171
 172 #ifndef PTRACE_SECCOMP_GET_METADATA
 173 #define PTRACE_SECCOMP_GET_METADATA     0x420d
 174
 175 struct seccomp_metadata {
 176         __u64 filter_off;       /* Input: which filter */
 177         __u64 flags;             /* Output: filter's flags */
 178 };
 179 #endif
 180
 181 #ifndef SECCOMP_FILTER_FLAG_NEW_LISTENER
 182 #define SECCOMP_FILTER_FLAG_NEW_LISTENER        (1UL << 3)
 183 #endif
 184
 185 #ifndef SECCOMP_RET_USER_NOTIF
 186 #define SECCOMP_RET_USER_NOTIF 0x7fc00000U
 187
 188 #define SECCOMP_IOC_MAGIC               '!'
 189 #define SECCOMP_IO(nr)                  _IO(SECCOMP_IOC_MAGIC, nr)
 190 #define SECCOMP_IOR(nr, type)           _IOR(SECCOMP_IOC_MAGIC, nr, type)
 191 #define SECCOMP_IOW(nr, type)           _IOW(SECCOMP_IOC_MAGIC, nr, type)
 192 #define SECCOMP_IOWR(nr, type)          _IOWR(SECCOMP_IOC_MAGIC, nr, type)
 193
 194 /* Flags for seccomp notification fd ioctl. */
 195 #define SECCOMP_IOCTL_NOTIF_RECV        SECCOMP_IOWR(0, struct seccomp_notif)
 196 #define SECCOMP_IOCTL_NOTIF_SEND        SECCOMP_IOWR(1, \
 197                                                 struct seccomp_notif_resp)
 198 #define SECCOMP_IOCTL_NOTIF_ID_VALID    SECCOMP_IOW(2, __u64)
 199
 200 struct seccomp_notif {
 201         __u64 id;
 202         __u32 pid;
 203         __u32 flags;
 204         struct seccomp_data data;
 205 };
 206
 207 struct seccomp_notif_resp {
 208         __u64 id;
 209         __s64 val;
 210         __s32 error;
 211         __u32 flags;
 212 };
 213
 214 struct seccomp_notif_sizes {
 215         __u16 seccomp_notif;
 216         __u16 seccomp_notif_resp;
 217         __u16 seccomp_data;
 218 };
 219 #endif
 220
 221 #ifndef SECCOMP_IOCTL_NOTIF_ADDFD
 222 /* On success, the return value is the remote process's added fd number */
 223 #define SECCOMP_IOCTL_NOTIF_ADDFD       SECCOMP_IOW(3,  \
 224                                                 struct seccomp_notif_addfd)
 225
 226 /* valid flags for seccomp_notif_addfd */
 227 #define SECCOMP_ADDFD_FLAG_SETFD        (1UL << 0) /* Specify remote fd */
 228
 229 struct seccomp_notif_addfd {
 230         __u64 id;
 231         __u32 flags;
 232         __u32 srcfd;
 233         __u32 newfd;
 234         __u32 newfd_flags;
 235 };
 236 #endif
 237
 238 struct seccomp_notif_addfd_small {
 239         __u64 id;
 240         char weird[4];
 241 };
 242 #define SECCOMP_IOCTL_NOTIF_ADDFD_SMALL \
 243         SECCOMP_IOW(3, struct seccomp_notif_addfd_small)
 244
 245 struct seccomp_notif_addfd_big {
 246         union {
 247                 struct seccomp_notif_addfd addfd;
 248                 char buf[sizeof(struct seccomp_notif_addfd) + 8];
 249         };
 250 };
 251 #define SECCOMP_IOCTL_NOTIF_ADDFD_BIG   \
 252         SECCOMP_IOWR(3, struct seccomp_notif_addfd_big)
 253
 254 #ifndef PTRACE_EVENTMSG_SYSCALL_ENTRY
 255 #define PTRACE_EVENTMSG_SYSCALL_ENTRY   1
 256 #define PTRACE_EVENTMSG_SYSCALL_EXIT    2
 257 #endif
 258
 259 #ifndef SECCOMP_USER_NOTIF_FLAG_CONTINUE
 260 #define SECCOMP_USER_NOTIF_FLAG_CONTINUE 0x00000001
 261 #endif
 262
 263 #ifndef SECCOMP_FILTER_FLAG_TSYNC_ESRCH
 264 #define SECCOMP_FILTER_FLAG_TSYNC_ESRCH (1UL << 4)
 265 #endif
 266
 267 #ifndef seccomp
 268 int seccomp(unsigned int op, unsigned int flags, void *args)
 269 {
 270         errno = 0;
 271         return syscall(__NR_seccomp, op, flags, args);
 272 }
 273 #endif
 274
 275 #if __BYTE_ORDER == __LITTLE_ENDIAN
 276 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
 277 #elif __BYTE_ORDER == __BIG_ENDIAN
 278 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]) + sizeof(__u32))
 279 #else
 280 #error "wut? Unknown __BYTE_ORDER?!"
 281 #endif
 282
 283 #define SIBLING_EXIT_UNKILLED   0xbadbeef
 284 #define SIBLING_EXIT_FAILURE    0xbadface
 285 #define SIBLING_EXIT_NEWPRIVS   0xbadfeed
 286
 287 static int __filecmp(pid_t pid1, pid_t pid2, int fd1, int fd2)
 288 {
 289 #ifdef __NR_kcmp
 290         errno = 0;
 291         return syscall(__NR_kcmp, pid1, pid2, KCMP_FILE, fd1, fd2);
 292 #else
 293         errno = ENOSYS;
 294         return -1;
 295 #endif
 296 }
 297
 298 /* Have TH_LOG report actual location filecmp() is used. */
 299 #define filecmp(pid1, pid2, fd1, fd2)   ({              \
 300         int _ret;                                       \
 301                                                         \
 302         _ret = __filecmp(pid1, pid2, fd1, fd2);         \
 303         if (_ret != 0) {                                \
 304                 if (_ret < 0 && errno == ENOSYS) {      \
 305                         TH_LOG("kcmp() syscall missing (test is less accurate)");\
 306                         _ret = 0;                       \
 307                 }                                       \
 308         }                                               \
 309         _ret; })
 310
 311 TEST(kcmp)
 312 {
 313         int ret;
 314
 315         ret = __filecmp(getpid(), getpid(), 1, 1);
 316         EXPECT_EQ(ret, 0);
 317         if (ret != 0 && errno == ENOSYS)
 318                 SKIP(return, "Kernel does not support kcmp() (missing CONFIG_KCMP?)");
 319 }
 320
 321 TEST(mode_strict_support)
 322 {
 323         long ret;
 324
 325         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL);
 326         ASSERT_EQ(0, ret) {
 327                 TH_LOG("Kernel does not support CONFIG_SECCOMP");
 328         }
 329         syscall(__NR_exit, 0);
 330 }
 331
 332 TEST_SIGNAL(mode_strict_cannot_call_prctl, SIGKILL)
 333 {
 334         long ret;
 335
 336         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL);
 337         ASSERT_EQ(0, ret) {
 338                 TH_LOG("Kernel does not support CONFIG_SECCOMP");
 339         }
 340         syscall(__NR_prctl, PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
 341                 NULL, NULL, NULL);
 342         EXPECT_FALSE(true) {
 343                 TH_LOG("Unreachable!");
 344         }
 345 }
 346
 347 /* Note! This doesn't test no new privs behavior */
 348 TEST(no_new_privs_support)
 349 {
 350         long ret;
 351
 352         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 353         EXPECT_EQ(0, ret) {
 354                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
 355         }
 356 }
 357
 358 /* Tests kernel support by checking for a copy_from_user() fault on NULL. */
 359 TEST(mode_filter_support)
 360 {
 361         long ret;
 362
 363         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
 364         ASSERT_EQ(0, ret) {
 365                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
 366         }
 367         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, NULL, NULL);
 368         EXPECT_EQ(-1, ret);
 369         EXPECT_EQ(EFAULT, errno) {
 370                 TH_LOG("Kernel does not support CONFIG_SECCOMP_FILTER!");
 371         }
 372 }
 373
 374 TEST(mode_filter_without_nnp)
 375 {
 376         struct sock_filter filter[] = {
 377                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 378         };
 379         struct sock_fprog prog = {
 380                 .len = (unsigned short)ARRAY_SIZE(filter),
 381                 .filter = filter,
 382         };
 383         long ret;
 384
 385         ret = prctl(PR_GET_NO_NEW_PRIVS, 0, NULL, 0, 0);
 386         ASSERT_LE(0, ret) {
 387                 TH_LOG("Expected 0 or unsupported for NO_NEW_PRIVS");
 388         }
 389         errno = 0;
 390         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 391         /* Succeeds with CAP_SYS_ADMIN, fails without */
 392         /* TODO(wad) check caps not euid */
 393         if (geteuid()) {
 394                 EXPECT_EQ(-1, ret);
 395                 EXPECT_EQ(EACCES, errno);
 396         } else {
 397                 EXPECT_EQ(0, ret);
 398         }
 399 }
 400
 401 #define MAX_INSNS_PER_PATH 32768
 402
 403 TEST(filter_size_limits)
 404 {
 405         int i;
 406         int count = BPF_MAXINSNS + 1;
 407         struct sock_filter allow[] = {
 408                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 409         };
 410         struct sock_filter *filter;
 411         struct sock_fprog prog = { };
 412         long ret;
 413
 414         filter = calloc(count, sizeof(*filter));
 415         ASSERT_NE(NULL, filter);
 416
 417         for (i = 0; i < count; i++)
 418                 filter[i] = allow[0];
 419
 420         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 421         ASSERT_EQ(0, ret);
 422
 423         prog.filter = filter;
 424         prog.len = count;
 425
 426         /* Too many filter instructions in a single filter. */
 427         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 428         ASSERT_NE(0, ret) {
 429                 TH_LOG("Installing %d insn filter was allowed", prog.len);
 430         }
 431
 432         /* One less is okay, though. */
 433         prog.len -= 1;
 434         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 435         ASSERT_EQ(0, ret) {
 436                 TH_LOG("Installing %d insn filter wasn't allowed", prog.len);
 437         }
 438 }
 439
 440 TEST(filter_chain_limits)
 441 {
 442         int i;
 443         int count = BPF_MAXINSNS;
 444         struct sock_filter allow[] = {
 445                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 446         };
 447         struct sock_filter *filter;
 448         struct sock_fprog prog = { };
 449         long ret;
 450
 451         filter = calloc(count, sizeof(*filter));
 452         ASSERT_NE(NULL, filter);
 453
 454         for (i = 0; i < count; i++)
 455                 filter[i] = allow[0];
 456
 457         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 458         ASSERT_EQ(0, ret);
 459
 460         prog.filter = filter;
 461         prog.len = 1;
 462
 463         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 464         ASSERT_EQ(0, ret);
 465
 466         prog.len = count;
 467
 468         /* Too many total filter instructions. */
 469         for (i = 0; i < MAX_INSNS_PER_PATH; i++) {
 470                 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 471                 if (ret != 0)
 472                         break;
 473         }
 474         ASSERT_NE(0, ret) {
 475                 TH_LOG("Allowed %d %d-insn filters (total with penalties:%d)",
 476                        i, count, i * (count + 4));
 477         }
 478 }
 479
 480 TEST(mode_filter_cannot_move_to_strict)
 481 {
 482         struct sock_filter filter[] = {
 483                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 484         };
 485         struct sock_fprog prog = {
 486                 .len = (unsigned short)ARRAY_SIZE(filter),
 487                 .filter = filter,
 488         };
 489         long ret;
 490
 491         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 492         ASSERT_EQ(0, ret);
 493
 494         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 495         ASSERT_EQ(0, ret);
 496
 497         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, 0, 0);
 498         EXPECT_EQ(-1, ret);
 499         EXPECT_EQ(EINVAL, errno);
 500 }
 501
 502
 503 TEST(mode_filter_get_seccomp)
 504 {
 505         struct sock_filter filter[] = {
 506                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 507         };
 508         struct sock_fprog prog = {
 509                 .len = (unsigned short)ARRAY_SIZE(filter),
 510                 .filter = filter,
 511         };
 512         long ret;
 513
 514         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 515         ASSERT_EQ(0, ret);
 516
 517         ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
 518         EXPECT_EQ(0, ret);
 519
 520         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 521         ASSERT_EQ(0, ret);
 522
 523         ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
 524         EXPECT_EQ(2, ret);
 525 }
 526
 527
 528 TEST(ALLOW_all)
 529 {
 530         struct sock_filter filter[] = {
 531                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 532         };
 533         struct sock_fprog prog = {
 534                 .len = (unsigned short)ARRAY_SIZE(filter),
 535                 .filter = filter,
 536         };
 537         long ret;
 538
 539         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 540         ASSERT_EQ(0, ret);
 541
 542         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 543         ASSERT_EQ(0, ret);
 544 }
 545
 546 TEST(empty_prog)
 547 {
 548         struct sock_filter filter[] = {
 549         };
 550         struct sock_fprog prog = {
 551                 .len = (unsigned short)ARRAY_SIZE(filter),
 552                 .filter = filter,
 553         };
 554         long ret;
 555
 556         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 557         ASSERT_EQ(0, ret);
 558
 559         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 560         EXPECT_EQ(-1, ret);
 561         EXPECT_EQ(EINVAL, errno);
 562 }
 563
 564 TEST(log_all)
 565 {
 566         struct sock_filter filter[] = {
 567                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG),
 568         };
 569         struct sock_fprog prog = {
 570                 .len = (unsigned short)ARRAY_SIZE(filter),
 571                 .filter = filter,
 572         };
 573         long ret;
 574         pid_t parent = getppid();
 575
 576         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 577         ASSERT_EQ(0, ret);
 578
 579         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 580         ASSERT_EQ(0, ret);
 581
 582         /* getppid() should succeed and be logged (no check for logging) */
 583         EXPECT_EQ(parent, syscall(__NR_getppid));
 584 }
 585
 586 TEST_SIGNAL(unknown_ret_is_kill_inside, SIGSYS)
 587 {
 588         struct sock_filter filter[] = {
 589                 BPF_STMT(BPF_RET|BPF_K, 0x10000000U),
 590         };
 591         struct sock_fprog prog = {
 592                 .len = (unsigned short)ARRAY_SIZE(filter),
 593                 .filter = filter,
 594         };
 595         long ret;
 596
 597         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 598         ASSERT_EQ(0, ret);
 599
 600         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 601         ASSERT_EQ(0, ret);
 602         EXPECT_EQ(0, syscall(__NR_getpid)) {
 603                 TH_LOG("getpid() shouldn't ever return");
 604         }
 605 }
 606
 607 /* return code >= 0x80000000 is unused. */
 608 TEST_SIGNAL(unknown_ret_is_kill_above_allow, SIGSYS)
 609 {
 610         struct sock_filter filter[] = {
 611                 BPF_STMT(BPF_RET|BPF_K, 0x90000000U),
 612         };
 613         struct sock_fprog prog = {
 614                 .len = (unsigned short)ARRAY_SIZE(filter),
 615                 .filter = filter,
 616         };
 617         long ret;
 618
 619         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 620         ASSERT_EQ(0, ret);
 621
 622         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 623         ASSERT_EQ(0, ret);
 624         EXPECT_EQ(0, syscall(__NR_getpid)) {
 625                 TH_LOG("getpid() shouldn't ever return");
 626         }
 627 }
 628
 629 TEST_SIGNAL(KILL_all, SIGSYS)
 630 {
 631         struct sock_filter filter[] = {
 632                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 633         };
 634         struct sock_fprog prog = {
 635                 .len = (unsigned short)ARRAY_SIZE(filter),
 636                 .filter = filter,
 637         };
 638         long ret;
 639
 640         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 641         ASSERT_EQ(0, ret);
 642
 643         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 644         ASSERT_EQ(0, ret);
 645 }
 646
 647 TEST_SIGNAL(KILL_one, SIGSYS)
 648 {
 649         struct sock_filter filter[] = {
 650                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 651                         offsetof(struct seccomp_data, nr)),
 652                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
 653                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 654                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 655         };
 656         struct sock_fprog prog = {
 657                 .len = (unsigned short)ARRAY_SIZE(filter),
 658                 .filter = filter,
 659         };
 660         long ret;
 661         pid_t parent = getppid();
 662
 663         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 664         ASSERT_EQ(0, ret);
 665
 666         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 667         ASSERT_EQ(0, ret);
 668
 669         EXPECT_EQ(parent, syscall(__NR_getppid));
 670         /* getpid() should never return. */
 671         EXPECT_EQ(0, syscall(__NR_getpid));
 672 }
 673
 674 TEST_SIGNAL(KILL_one_arg_one, SIGSYS)
 675 {
 676         void *fatal_address;
 677         struct sock_filter filter[] = {
 678                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 679                         offsetof(struct seccomp_data, nr)),
 680                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_times, 1, 0),
 681                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 682                 /* Only both with lower 32-bit for now. */
 683                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(0)),
 684                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K,
 685                         (unsigned long)&fatal_address, 0, 1),
 686                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 687                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 688         };
 689         struct sock_fprog prog = {
 690                 .len = (unsigned short)ARRAY_SIZE(filter),
 691                 .filter = filter,
 692         };
 693         long ret;
 694         pid_t parent = getppid();
 695         struct tms timebuf;
 696         clock_t clock = times(&timebuf);
 697
 698         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 699         ASSERT_EQ(0, ret);
 700
 701         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 702         ASSERT_EQ(0, ret);
 703
 704         EXPECT_EQ(parent, syscall(__NR_getppid));
 705         EXPECT_LE(clock, syscall(__NR_times, &timebuf));
 706         /* times() should never return. */
 707         EXPECT_EQ(0, syscall(__NR_times, &fatal_address));
 708 }
 709
 710 TEST_SIGNAL(KILL_one_arg_six, SIGSYS)
 711 {
 712 #ifndef __NR_mmap2
 713         int sysno = __NR_mmap;
 714 #else
 715         int sysno = __NR_mmap2;
 716 #endif
 717         struct sock_filter filter[] = {
 718                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 719                         offsetof(struct seccomp_data, nr)),
 720                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, sysno, 1, 0),
 721                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 722                 /* Only both with lower 32-bit for now. */
 723                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(5)),
 724                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 0x0C0FFEE, 0, 1),
 725                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 726                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 727         };
 728         struct sock_fprog prog = {
 729                 .len = (unsigned short)ARRAY_SIZE(filter),
 730                 .filter = filter,
 731         };
 732         long ret;
 733         pid_t parent = getppid();
 734         int fd;
 735         void *map1, *map2;
 736         int page_size = sysconf(_SC_PAGESIZE);
 737
 738         ASSERT_LT(0, page_size);
 739
 740         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 741         ASSERT_EQ(0, ret);
 742
 743         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 744         ASSERT_EQ(0, ret);
 745
 746         fd = open("/dev/zero", O_RDONLY);
 747         ASSERT_NE(-1, fd);
 748
 749         EXPECT_EQ(parent, syscall(__NR_getppid));
 750         map1 = (void *)syscall(sysno,
 751                 NULL, page_size, PROT_READ, MAP_PRIVATE, fd, page_size);
 752         EXPECT_NE(MAP_FAILED, map1);
 753         /* mmap2() should never return. */
 754         map2 = (void *)syscall(sysno,
 755                  NULL, page_size, PROT_READ, MAP_PRIVATE, fd, 0x0C0FFEE);
 756         EXPECT_EQ(MAP_FAILED, map2);
 757
 758         /* The test failed, so clean up the resources. */
 759         munmap(map1, page_size);
 760         munmap(map2, page_size);
 761         close(fd);
 762 }
 763
 764 /* This is a thread task to die via seccomp filter violation. */
 765 void *kill_thread(void *data)
 766 {
 767         bool die = (bool)data;
 768
 769         if (die) {
 770                 prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
 771                 return (void *)SIBLING_EXIT_FAILURE;
 772         }
 773
 774         return (void *)SIBLING_EXIT_UNKILLED;
 775 }
 776
 777 enum kill_t {
 778         KILL_THREAD,
 779         KILL_PROCESS,
 780         RET_UNKNOWN
 781 };
 782
 783 /* Prepare a thread that will kill itself or both of us. */
 784 void kill_thread_or_group(struct __test_metadata *_metadata,
 785                           enum kill_t kill_how)
 786 {
 787         pthread_t thread;
 788         void *status;
 789         /* Kill only when calling __NR_prctl. */
 790         struct sock_filter filter_thread[] = {
 791                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 792                         offsetof(struct seccomp_data, nr)),
 793                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
 794                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_THREAD),
 795                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 796         };
 797         struct sock_fprog prog_thread = {
 798                 .len = (unsigned short)ARRAY_SIZE(filter_thread),
 799                 .filter = filter_thread,
 800         };
 801         int kill = kill_how == KILL_PROCESS ? SECCOMP_RET_KILL_PROCESS : 0xAAAAAAAAA;
 802         struct sock_filter filter_process[] = {
 803                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 804                         offsetof(struct seccomp_data, nr)),
 805                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
 806                 BPF_STMT(BPF_RET|BPF_K, kill),
 807                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 808         };
 809         struct sock_fprog prog_process = {
 810                 .len = (unsigned short)ARRAY_SIZE(filter_process),
 811                 .filter = filter_process,
 812         };
 813
 814         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
 815                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
 816         }
 817
 818         ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0,
 819                              kill_how == KILL_THREAD ? &prog_thread
 820                                                      : &prog_process));
 821
 822         /*
 823          * Add the KILL_THREAD rule again to make sure that the KILL_PROCESS
 824          * flag cannot be downgraded by a new filter.
 825          */
 826         if (kill_how == KILL_PROCESS)
 827                 ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread));
 828
 829         /* Start a thread that will exit immediately. */
 830         ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)false));
 831         ASSERT_EQ(0, pthread_join(thread, &status));
 832         ASSERT_EQ(SIBLING_EXIT_UNKILLED, (unsigned long)status);
 833
 834         /* Start a thread that will die immediately. */
 835         ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)true));
 836         ASSERT_EQ(0, pthread_join(thread, &status));
 837         ASSERT_NE(SIBLING_EXIT_FAILURE, (unsigned long)status);
 838
 839         /*
 840          * If we get here, only the spawned thread died. Let the parent know
 841          * the whole process didn't die (i.e. this thread, the spawner,
 842          * stayed running).
 843          */
 844         exit(42);
 845 }
 846
 847 TEST(KILL_thread)
 848 {
 849         int status;
 850         pid_t child_pid;
 851
 852         child_pid = fork();
 853         ASSERT_LE(0, child_pid);
 854         if (child_pid == 0) {
 855                 kill_thread_or_group(_metadata, KILL_THREAD);
 856                 _exit(38);
 857         }
 858
 859         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
 860
 861         /* If only the thread was killed, we'll see exit 42. */
 862         ASSERT_TRUE(WIFEXITED(status));
 863         ASSERT_EQ(42, WEXITSTATUS(status));
 864 }
 865
 866 TEST(KILL_process)
 867 {
 868         int status;
 869         pid_t child_pid;
 870
 871         child_pid = fork();
 872         ASSERT_LE(0, child_pid);
 873         if (child_pid == 0) {
 874                 kill_thread_or_group(_metadata, KILL_PROCESS);
 875                 _exit(38);
 876         }
 877
 878         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
 879
 880         /* If the entire process was killed, we'll see SIGSYS. */
 881         ASSERT_TRUE(WIFSIGNALED(status));
 882         ASSERT_EQ(SIGSYS, WTERMSIG(status));
 883 }
 884
 885 TEST(KILL_unknown)
 886 {
 887         int status;
 888         pid_t child_pid;
 889
 890         child_pid = fork();
 891         ASSERT_LE(0, child_pid);
 892         if (child_pid == 0) {
 893                 kill_thread_or_group(_metadata, RET_UNKNOWN);
 894                 _exit(38);
 895         }
 896
 897         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
 898
 899         /* If the entire process was killed, we'll see SIGSYS. */
 900         EXPECT_TRUE(WIFSIGNALED(status)) {
 901                 TH_LOG("Unknown SECCOMP_RET is only killing the thread?");
 902         }
 903         ASSERT_EQ(SIGSYS, WTERMSIG(status));
 904 }
 905
 906 /* TODO(wad) add 64-bit versus 32-bit arg tests. */
 907 TEST(arg_out_of_range)
 908 {
 909         struct sock_filter filter[] = {
 910                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(6)),
 911                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 912         };
 913         struct sock_fprog prog = {
 914                 .len = (unsigned short)ARRAY_SIZE(filter),
 915                 .filter = filter,
 916         };
 917         long ret;
 918
 919         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 920         ASSERT_EQ(0, ret);
 921
 922         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 923         EXPECT_EQ(-1, ret);
 924         EXPECT_EQ(EINVAL, errno);
 925 }
 926
 927 #define ERRNO_FILTER(name, errno)                                       \
 928         struct sock_filter _read_filter_##name[] = {                    \
 929                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,                          \
 930                         offsetof(struct seccomp_data, nr)),             \
 931                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),       \
 932                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | errno),     \
 933                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),             \
 934         };                                                              \
 935         struct sock_fprog prog_##name = {                               \
 936                 .len = (unsigned short)ARRAY_SIZE(_read_filter_##name), \
 937                 .filter = _read_filter_##name,                          \
 938         }
 939
 940 /* Make sure basic errno values are correctly passed through a filter. */
 941 TEST(ERRNO_valid)
 942 {
 943         ERRNO_FILTER(valid, E2BIG);
 944         long ret;
 945         pid_t parent = getppid();
 946
 947         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 948         ASSERT_EQ(0, ret);
 949
 950         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_valid);
 951         ASSERT_EQ(0, ret);
 952
 953         EXPECT_EQ(parent, syscall(__NR_getppid));
 954         EXPECT_EQ(-1, read(0, NULL, 0));
 955         EXPECT_EQ(E2BIG, errno);
 956 }
 957
 958 /* Make sure an errno of zero is correctly handled by the arch code. */
 959 TEST(ERRNO_zero)
 960 {
 961         ERRNO_FILTER(zero, 0);
 962         long ret;
 963         pid_t parent = getppid();
 964
 965         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 966         ASSERT_EQ(0, ret);
 967
 968         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_zero);
 969         ASSERT_EQ(0, ret);
 970
 971         EXPECT_EQ(parent, syscall(__NR_getppid));
 972         /* "errno" of 0 is ok. */
 973         EXPECT_EQ(0, read(0, NULL, 0));
 974 }
 975
 976 /*
 977  * The SECCOMP_RET_DATA mask is 16 bits wide, but errno is smaller.
 978  * This tests that the errno value gets capped correctly, fixed by
 979  * 580c57f10768 ("seccomp: cap SECCOMP_RET_ERRNO data to MAX_ERRNO").
 980  */
 981 TEST(ERRNO_capped)
 982 {
 983         ERRNO_FILTER(capped, 4096);
 984         long ret;
 985         pid_t parent = getppid();
 986
 987         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 988         ASSERT_EQ(0, ret);
 989
 990         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_capped);
 991         ASSERT_EQ(0, ret);
 992
 993         EXPECT_EQ(parent, syscall(__NR_getppid));
 994         EXPECT_EQ(-1, read(0, NULL, 0));
 995         EXPECT_EQ(4095, errno);
 996 }
 997
 998 /*
 999  * Filters are processed in reverse order: last applied is executed first.
1000  * Since only the SECCOMP_RET_ACTION mask is tested for return values, the
1001  * SECCOMP_RET_DATA mask results will follow the most recently applied
1002  * matching filter return (and not the lowest or highest value).
1003  */
1004 TEST(ERRNO_order)
1005 {
1006         ERRNO_FILTER(first,  11);
1007         ERRNO_FILTER(second, 13);
1008         ERRNO_FILTER(third,  12);
1009         long ret;
1010         pid_t parent = getppid();
1011
1012         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1013         ASSERT_EQ(0, ret);
1014
1015         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_first);
1016         ASSERT_EQ(0, ret);
1017
1018         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_second);
1019         ASSERT_EQ(0, ret);
1020
1021         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_third);
1022         ASSERT_EQ(0, ret);
1023
1024         EXPECT_EQ(parent, syscall(__NR_getppid));
1025         EXPECT_EQ(-1, read(0, NULL, 0));
1026         EXPECT_EQ(12, errno);
1027 }
1028
1029 FIXTURE(TRAP) {
1030         struct sock_fprog prog;
1031 };
1032
1033 FIXTURE_SETUP(TRAP)
1034 {
1035         struct sock_filter filter[] = {
1036                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1037                         offsetof(struct seccomp_data, nr)),
1038                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
1039                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
1040                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1041         };
1042
1043         memset(&self->prog, 0, sizeof(self->prog));
1044         self->prog.filter = malloc(sizeof(filter));
1045         ASSERT_NE(NULL, self->prog.filter);
1046         memcpy(self->prog.filter, filter, sizeof(filter));
1047         self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1048 }
1049
1050 FIXTURE_TEARDOWN(TRAP)
1051 {
1052         if (self->prog.filter)
1053                 free(self->prog.filter);
1054 }
1055
1056 TEST_F_SIGNAL(TRAP, dfl, SIGSYS)
1057 {
1058         long ret;
1059
1060         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1061         ASSERT_EQ(0, ret);
1062
1063         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1064         ASSERT_EQ(0, ret);
1065         syscall(__NR_getpid);
1066 }
1067
1068 /* Ensure that SIGSYS overrides SIG_IGN */
1069 TEST_F_SIGNAL(TRAP, ign, SIGSYS)
1070 {
1071         long ret;
1072
1073         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1074         ASSERT_EQ(0, ret);
1075
1076         signal(SIGSYS, SIG_IGN);
1077
1078         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1079         ASSERT_EQ(0, ret);
1080         syscall(__NR_getpid);
1081 }
1082
1083 static siginfo_t TRAP_info;
1084 static volatile int TRAP_nr;
1085 static void TRAP_action(int nr, siginfo_t *info, void *void_context)
1086 {
1087         memcpy(&TRAP_info, info, sizeof(TRAP_info));
1088         TRAP_nr = nr;
1089 }
1090
1091 TEST_F(TRAP, handler)
1092 {
1093         int ret, test;
1094         struct sigaction act;
1095         sigset_t mask;
1096
1097         memset(&act, 0, sizeof(act));
1098         sigemptyset(&mask);
1099         sigaddset(&mask, SIGSYS);
1100
1101         act.sa_sigaction = &TRAP_action;
1102         act.sa_flags = SA_SIGINFO;
1103         ret = sigaction(SIGSYS, &act, NULL);
1104         ASSERT_EQ(0, ret) {
1105                 TH_LOG("sigaction failed");
1106         }
1107         ret = sigprocmask(SIG_UNBLOCK, &mask, NULL);
1108         ASSERT_EQ(0, ret) {
1109                 TH_LOG("sigprocmask failed");
1110         }
1111
1112         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1113         ASSERT_EQ(0, ret);
1114         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
1115         ASSERT_EQ(0, ret);
1116         TRAP_nr = 0;
1117         memset(&TRAP_info, 0, sizeof(TRAP_info));
1118         /* Expect the registers to be rolled back. (nr = error) may vary
1119          * based on arch. */
1120         ret = syscall(__NR_getpid);
1121         /* Silence gcc warning about volatile. */
1122         test = TRAP_nr;
1123         EXPECT_EQ(SIGSYS, test);
1124         struct local_sigsys {
1125                 void *_call_addr;       /* calling user insn */
1126                 int _syscall;           /* triggering system call number */
1127                 unsigned int _arch;     /* AUDIT_ARCH_* of syscall */
1128         } *sigsys = (struct local_sigsys *)
1129 #ifdef si_syscall
1130                 &(TRAP_info.si_call_addr);
1131 #else
1132                 &TRAP_info.si_pid;
1133 #endif
1134         EXPECT_EQ(__NR_getpid, sigsys->_syscall);
1135         /* Make sure arch is non-zero. */
1136         EXPECT_NE(0, sigsys->_arch);
1137         EXPECT_NE(0, (unsigned long)sigsys->_call_addr);
1138 }
1139
1140 FIXTURE(precedence) {
1141         struct sock_fprog allow;
1142         struct sock_fprog log;
1143         struct sock_fprog trace;
1144         struct sock_fprog error;
1145         struct sock_fprog trap;
1146         struct sock_fprog kill;
1147 };
1148
1149 FIXTURE_SETUP(precedence)
1150 {
1151         struct sock_filter allow_insns[] = {
1152                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1153         };
1154         struct sock_filter log_insns[] = {
1155                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1156                         offsetof(struct seccomp_data, nr)),
1157                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1158                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1159                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG),
1160         };
1161         struct sock_filter trace_insns[] = {
1162                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1163                         offsetof(struct seccomp_data, nr)),
1164                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1165                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1166                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE),
1167         };
1168         struct sock_filter error_insns[] = {
1169                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1170                         offsetof(struct seccomp_data, nr)),
1171                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1172                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1173                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO),
1174         };
1175         struct sock_filter trap_insns[] = {
1176                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1177                         offsetof(struct seccomp_data, nr)),
1178                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1179                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1180                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
1181         };
1182         struct sock_filter kill_insns[] = {
1183                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1184                         offsetof(struct seccomp_data, nr)),
1185                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
1186                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1187                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
1188         };
1189
1190         memset(self, 0, sizeof(*self));
1191 #define FILTER_ALLOC(_x) \
1192         self->_x.filter = malloc(sizeof(_x##_insns)); \
1193         ASSERT_NE(NULL, self->_x.filter); \
1194         memcpy(self->_x.filter, &_x##_insns, sizeof(_x##_insns)); \
1195         self->_x.len = (unsigned short)ARRAY_SIZE(_x##_insns)
1196         FILTER_ALLOC(allow);
1197         FILTER_ALLOC(log);
1198         FILTER_ALLOC(trace);
1199         FILTER_ALLOC(error);
1200         FILTER_ALLOC(trap);
1201         FILTER_ALLOC(kill);
1202 }
1203
1204 FIXTURE_TEARDOWN(precedence)
1205 {
1206 #define FILTER_FREE(_x) if (self->_x.filter) free(self->_x.filter)
1207         FILTER_FREE(allow);
1208         FILTER_FREE(log);
1209         FILTER_FREE(trace);
1210         FILTER_FREE(error);
1211         FILTER_FREE(trap);
1212         FILTER_FREE(kill);
1213 }
1214
1215 TEST_F(precedence, allow_ok)
1216 {
1217         pid_t parent, res = 0;
1218         long ret;
1219
1220         parent = getppid();
1221         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1222         ASSERT_EQ(0, ret);
1223
1224         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1225         ASSERT_EQ(0, ret);
1226         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1227         ASSERT_EQ(0, ret);
1228         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1229         ASSERT_EQ(0, ret);
1230         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1231         ASSERT_EQ(0, ret);
1232         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1233         ASSERT_EQ(0, ret);
1234         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1235         ASSERT_EQ(0, ret);
1236         /* Should work just fine. */
1237         res = syscall(__NR_getppid);
1238         EXPECT_EQ(parent, res);
1239 }
1240
1241 TEST_F_SIGNAL(precedence, kill_is_highest, SIGSYS)
1242 {
1243         pid_t parent, res = 0;
1244         long ret;
1245
1246         parent = getppid();
1247         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1248         ASSERT_EQ(0, ret);
1249
1250         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1251         ASSERT_EQ(0, ret);
1252         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1253         ASSERT_EQ(0, ret);
1254         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1255         ASSERT_EQ(0, ret);
1256         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1257         ASSERT_EQ(0, ret);
1258         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1259         ASSERT_EQ(0, ret);
1260         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1261         ASSERT_EQ(0, ret);
1262         /* Should work just fine. */
1263         res = syscall(__NR_getppid);
1264         EXPECT_EQ(parent, res);
1265         /* getpid() should never return. */
1266         res = syscall(__NR_getpid);
1267         EXPECT_EQ(0, res);
1268 }
1269
1270 TEST_F_SIGNAL(precedence, kill_is_highest_in_any_order, SIGSYS)
1271 {
1272         pid_t parent;
1273         long ret;
1274
1275         parent = getppid();
1276         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1277         ASSERT_EQ(0, ret);
1278
1279         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1280         ASSERT_EQ(0, ret);
1281         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
1282         ASSERT_EQ(0, ret);
1283         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1284         ASSERT_EQ(0, ret);
1285         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1286         ASSERT_EQ(0, ret);
1287         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1288         ASSERT_EQ(0, ret);
1289         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1290         ASSERT_EQ(0, ret);
1291         /* Should work just fine. */
1292         EXPECT_EQ(parent, syscall(__NR_getppid));
1293         /* getpid() should never return. */
1294         EXPECT_EQ(0, syscall(__NR_getpid));
1295 }
1296
1297 TEST_F_SIGNAL(precedence, trap_is_second, SIGSYS)
1298 {
1299         pid_t parent;
1300         long ret;
1301
1302         parent = getppid();
1303         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1304         ASSERT_EQ(0, ret);
1305
1306         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1307         ASSERT_EQ(0, ret);
1308         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1309         ASSERT_EQ(0, ret);
1310         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1311         ASSERT_EQ(0, ret);
1312         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1313         ASSERT_EQ(0, ret);
1314         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1315         ASSERT_EQ(0, ret);
1316         /* Should work just fine. */
1317         EXPECT_EQ(parent, syscall(__NR_getppid));
1318         /* getpid() should never return. */
1319         EXPECT_EQ(0, syscall(__NR_getpid));
1320 }
1321
1322 TEST_F_SIGNAL(precedence, trap_is_second_in_any_order, SIGSYS)
1323 {
1324         pid_t parent;
1325         long ret;
1326
1327         parent = getppid();
1328         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1329         ASSERT_EQ(0, ret);
1330
1331         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1332         ASSERT_EQ(0, ret);
1333         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
1334         ASSERT_EQ(0, ret);
1335         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1336         ASSERT_EQ(0, ret);
1337         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1338         ASSERT_EQ(0, ret);
1339         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1340         ASSERT_EQ(0, ret);
1341         /* Should work just fine. */
1342         EXPECT_EQ(parent, syscall(__NR_getppid));
1343         /* getpid() should never return. */
1344         EXPECT_EQ(0, syscall(__NR_getpid));
1345 }
1346
1347 TEST_F(precedence, errno_is_third)
1348 {
1349         pid_t parent;
1350         long ret;
1351
1352         parent = getppid();
1353         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1354         ASSERT_EQ(0, ret);
1355
1356         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1357         ASSERT_EQ(0, ret);
1358         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1359         ASSERT_EQ(0, ret);
1360         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1361         ASSERT_EQ(0, ret);
1362         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1363         ASSERT_EQ(0, ret);
1364         /* Should work just fine. */
1365         EXPECT_EQ(parent, syscall(__NR_getppid));
1366         EXPECT_EQ(0, syscall(__NR_getpid));
1367 }
1368
1369 TEST_F(precedence, errno_is_third_in_any_order)
1370 {
1371         pid_t parent;
1372         long ret;
1373
1374         parent = getppid();
1375         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1376         ASSERT_EQ(0, ret);
1377
1378         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1379         ASSERT_EQ(0, ret);
1380         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
1381         ASSERT_EQ(0, ret);
1382         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1383         ASSERT_EQ(0, ret);
1384         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1385         ASSERT_EQ(0, ret);
1386         /* Should work just fine. */
1387         EXPECT_EQ(parent, syscall(__NR_getppid));
1388         EXPECT_EQ(0, syscall(__NR_getpid));
1389 }
1390
1391 TEST_F(precedence, trace_is_fourth)
1392 {
1393         pid_t parent;
1394         long ret;
1395
1396         parent = getppid();
1397         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1398         ASSERT_EQ(0, ret);
1399
1400         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1401         ASSERT_EQ(0, ret);
1402         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1403         ASSERT_EQ(0, ret);
1404         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1405         ASSERT_EQ(0, ret);
1406         /* Should work just fine. */
1407         EXPECT_EQ(parent, syscall(__NR_getppid));
1408         /* No ptracer */
1409         EXPECT_EQ(-1, syscall(__NR_getpid));
1410 }
1411
1412 TEST_F(precedence, trace_is_fourth_in_any_order)
1413 {
1414         pid_t parent;
1415         long ret;
1416
1417         parent = getppid();
1418         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1419         ASSERT_EQ(0, ret);
1420
1421         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
1422         ASSERT_EQ(0, ret);
1423         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1424         ASSERT_EQ(0, ret);
1425         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1426         ASSERT_EQ(0, ret);
1427         /* Should work just fine. */
1428         EXPECT_EQ(parent, syscall(__NR_getppid));
1429         /* No ptracer */
1430         EXPECT_EQ(-1, syscall(__NR_getpid));
1431 }
1432
1433 TEST_F(precedence, log_is_fifth)
1434 {
1435         pid_t mypid, parent;
1436         long ret;
1437
1438         mypid = getpid();
1439         parent = getppid();
1440         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1441         ASSERT_EQ(0, ret);
1442
1443         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1444         ASSERT_EQ(0, ret);
1445         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1446         ASSERT_EQ(0, ret);
1447         /* Should work just fine. */
1448         EXPECT_EQ(parent, syscall(__NR_getppid));
1449         /* Should also work just fine */
1450         EXPECT_EQ(mypid, syscall(__NR_getpid));
1451 }
1452
1453 TEST_F(precedence, log_is_fifth_in_any_order)
1454 {
1455         pid_t mypid, parent;
1456         long ret;
1457
1458         mypid = getpid();
1459         parent = getppid();
1460         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1461         ASSERT_EQ(0, ret);
1462
1463         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
1464         ASSERT_EQ(0, ret);
1465         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
1466         ASSERT_EQ(0, ret);
1467         /* Should work just fine. */
1468         EXPECT_EQ(parent, syscall(__NR_getppid));
1469         /* Should also work just fine */
1470         EXPECT_EQ(mypid, syscall(__NR_getpid));
1471 }
1472
1473 #ifndef PTRACE_O_TRACESECCOMP
1474 #define PTRACE_O_TRACESECCOMP   0x00000080
1475 #endif
1476
1477 /* Catch the Ubuntu 12.04 value error. */
1478 #if PTRACE_EVENT_SECCOMP != 7
1479 #undef PTRACE_EVENT_SECCOMP
1480 #endif
1481
1482 #ifndef PTRACE_EVENT_SECCOMP
1483 #define PTRACE_EVENT_SECCOMP 7
1484 #endif
1485
1486 #define IS_SECCOMP_EVENT(status) ((status >> 16) == PTRACE_EVENT_SECCOMP)
1487 bool tracer_running;
1488 void tracer_stop(int sig)
1489 {
1490         tracer_running = false;
1491 }
1492
1493 typedef void tracer_func_t(struct __test_metadata *_metadata,
1494                            pid_t tracee, int status, void *args);
1495
1496 void start_tracer(struct __test_metadata *_metadata, int fd, pid_t tracee,
1497             tracer_func_t tracer_func, void *args, bool ptrace_syscall)
1498 {
1499         int ret = -1;
1500         struct sigaction action = {
1501                 .sa_handler = tracer_stop,
1502         };
1503
1504         /* Allow external shutdown. */
1505         tracer_running = true;
1506         ASSERT_EQ(0, sigaction(SIGUSR1, &action, NULL));
1507
1508         errno = 0;
1509         while (ret == -1 && errno != EINVAL)
1510                 ret = ptrace(PTRACE_ATTACH, tracee, NULL, 0);
1511         ASSERT_EQ(0, ret) {
1512                 kill(tracee, SIGKILL);
1513         }
1514         /* Wait for attach stop */
1515         wait(NULL);
1516
1517         ret = ptrace(PTRACE_SETOPTIONS, tracee, NULL, ptrace_syscall ?
1518                                                       PTRACE_O_TRACESYSGOOD :
1519                                                       PTRACE_O_TRACESECCOMP);
1520         ASSERT_EQ(0, ret) {
1521                 TH_LOG("Failed to set PTRACE_O_TRACESECCOMP");
1522                 kill(tracee, SIGKILL);
1523         }
1524         ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT,
1525                      tracee, NULL, 0);
1526         ASSERT_EQ(0, ret);
1527
1528         /* Unblock the tracee */
1529         ASSERT_EQ(1, write(fd, "A", 1));
1530         ASSERT_EQ(0, close(fd));
1531
1532         /* Run until we're shut down. Must assert to stop execution. */
1533         while (tracer_running) {
1534                 int status;
1535
1536                 if (wait(&status) != tracee)
1537                         continue;
1538                 if (WIFSIGNALED(status) || WIFEXITED(status))
1539                         /* Child is dead. Time to go. */
1540                         return;
1541
1542                 /* Check if this is a seccomp event. */
1543                 ASSERT_EQ(!ptrace_syscall, IS_SECCOMP_EVENT(status));
1544
1545                 tracer_func(_metadata, tracee, status, args);
1546
1547                 ret = ptrace(ptrace_syscall ? PTRACE_SYSCALL : PTRACE_CONT,
1548                              tracee, NULL, 0);
1549                 ASSERT_EQ(0, ret);
1550         }
1551         /* Directly report the status of our test harness results. */
1552         syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);
1553 }
1554
1555 /* Common tracer setup/teardown functions. */
1556 void cont_handler(int num)
1557 { }
1558 pid_t setup_trace_fixture(struct __test_metadata *_metadata,
1559                           tracer_func_t func, void *args, bool ptrace_syscall)
1560 {
1561         char sync;
1562         int pipefd[2];
1563         pid_t tracer_pid;
1564         pid_t tracee = getpid();
1565
1566         /* Setup a pipe for clean synchronization. */
1567         ASSERT_EQ(0, pipe(pipefd));
1568
1569         /* Fork a child which we'll promote to tracer */
1570         tracer_pid = fork();
1571         ASSERT_LE(0, tracer_pid);
1572         signal(SIGALRM, cont_handler);
1573         if (tracer_pid == 0) {
1574                 close(pipefd[0]);
1575                 start_tracer(_metadata, pipefd[1], tracee, func, args,
1576                              ptrace_syscall);
1577                 syscall(__NR_exit, 0);
1578         }
1579         close(pipefd[1]);
1580         prctl(PR_SET_PTRACER, tracer_pid, 0, 0, 0);
1581         read(pipefd[0], &sync, 1);
1582         close(pipefd[0]);
1583
1584         return tracer_pid;
1585 }
1586
1587 void teardown_trace_fixture(struct __test_metadata *_metadata,
1588                             pid_t tracer)
1589 {
1590         if (tracer) {
1591                 int status;
1592                 /*
1593                  * Extract the exit code from the other process and
1594                  * adopt it for ourselves in case its asserts failed.
1595                  */
1596                 ASSERT_EQ(0, kill(tracer, SIGUSR1));
1597                 ASSERT_EQ(tracer, waitpid(tracer, &status, 0));
1598                 if (WEXITSTATUS(status))
1599                         _metadata->passed = 0;
1600         }
1601 }
1602
1603 /* "poke" tracer arguments and function. */
1604 struct tracer_args_poke_t {
1605         unsigned long poke_addr;
1606 };
1607
1608 void tracer_poke(struct __test_metadata *_metadata, pid_t tracee, int status,
1609                  void *args)
1610 {
1611         int ret;
1612         unsigned long msg;
1613         struct tracer_args_poke_t *info = (struct tracer_args_poke_t *)args;
1614
1615         ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
1616         EXPECT_EQ(0, ret);
1617         /* If this fails, don't try to recover. */
1618         ASSERT_EQ(0x1001, msg) {
1619                 kill(tracee, SIGKILL);
1620         }
1621         /*
1622          * Poke in the message.
1623          * Registers are not touched to try to keep this relatively arch
1624          * agnostic.
1625          */
1626         ret = ptrace(PTRACE_POKEDATA, tracee, info->poke_addr, 0x1001);
1627         EXPECT_EQ(0, ret);
1628 }
1629
1630 FIXTURE(TRACE_poke) {
1631         struct sock_fprog prog;
1632         pid_t tracer;
1633         long poked;
1634         struct tracer_args_poke_t tracer_args;
1635 };
1636
1637 FIXTURE_SETUP(TRACE_poke)
1638 {
1639         struct sock_filter filter[] = {
1640                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1641                         offsetof(struct seccomp_data, nr)),
1642                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
1643                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1001),
1644                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1645         };
1646
1647         self->poked = 0;
1648         memset(&self->prog, 0, sizeof(self->prog));
1649         self->prog.filter = malloc(sizeof(filter));
1650         ASSERT_NE(NULL, self->prog.filter);
1651         memcpy(self->prog.filter, filter, sizeof(filter));
1652         self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1653
1654         /* Set up tracer args. */
1655         self->tracer_args.poke_addr = (unsigned long)&self->poked;
1656
1657         /* Launch tracer. */
1658         self->tracer = setup_trace_fixture(_metadata, tracer_poke,
1659                                            &self->tracer_args, false);
1660 }
1661
1662 FIXTURE_TEARDOWN(TRACE_poke)
1663 {
1664         teardown_trace_fixture(_metadata, self->tracer);
1665         if (self->prog.filter)
1666                 free(self->prog.filter);
1667 }
1668
1669 TEST_F(TRACE_poke, read_has_side_effects)
1670 {
1671         ssize_t ret;
1672
1673         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1674         ASSERT_EQ(0, ret);
1675
1676         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1677         ASSERT_EQ(0, ret);
1678
1679         EXPECT_EQ(0, self->poked);
1680         ret = read(-1, NULL, 0);
1681         EXPECT_EQ(-1, ret);
1682         EXPECT_EQ(0x1001, self->poked);
1683 }
1684
1685 TEST_F(TRACE_poke, getpid_runs_normally)
1686 {
1687         long ret;
1688
1689         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1690         ASSERT_EQ(0, ret);
1691
1692         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1693         ASSERT_EQ(0, ret);
1694
1695         EXPECT_EQ(0, self->poked);
1696         EXPECT_NE(0, syscall(__NR_getpid));
1697         EXPECT_EQ(0, self->poked);
1698 }
1699
1700 #if defined(__x86_64__)
1701 # define ARCH_REGS              struct user_regs_struct
1702 # define SYSCALL_NUM(_regs)     (_regs).orig_rax
1703 # define SYSCALL_RET(_regs)     (_regs).rax
1704 #elif defined(__i386__)
1705 # define ARCH_REGS              struct user_regs_struct
1706 # define SYSCALL_NUM(_regs)     (_regs).orig_eax
1707 # define SYSCALL_RET(_regs)     (_regs).eax
1708 #elif defined(__arm__)
1709 # define ARCH_REGS              struct pt_regs
1710 # define SYSCALL_NUM(_regs)     (_regs).ARM_r7
1711 # ifndef PTRACE_SET_SYSCALL
1712 #  define PTRACE_SET_SYSCALL   23
1713 # endif
1714 # define SYSCALL_NUM_SET(_regs, _nr)    \
1715                 EXPECT_EQ(0, ptrace(PTRACE_SET_SYSCALL, tracee, NULL, _nr))
1716 # define SYSCALL_RET(_regs)     (_regs).ARM_r0
1717 #elif defined(__aarch64__)
1718 # define ARCH_REGS              struct user_pt_regs
1719 # define SYSCALL_NUM(_regs)     (_regs).regs[8]
1720 # ifndef NT_ARM_SYSTEM_CALL
1721 #  define NT_ARM_SYSTEM_CALL 0x404
1722 # endif
1723 # define SYSCALL_NUM_SET(_regs, _nr)                            \
1724         do {                                                    \
1725                 struct iovec __v;                               \
1726                 typeof(_nr) __nr = (_nr);                       \
1727                 __v.iov_base = &__nr;                           \
1728                 __v.iov_len = sizeof(__nr);                     \
1729                 EXPECT_EQ(0, ptrace(PTRACE_SETREGSET, tracee,   \
1730                                     NT_ARM_SYSTEM_CALL, &__v)); \
1731         } while (0)
1732 # define SYSCALL_RET(_regs)     (_regs).regs[0]
1733 #elif defined(__riscv) && __riscv_xlen == 64
1734 # define ARCH_REGS              struct user_regs_struct
1735 # define SYSCALL_NUM(_regs)     (_regs).a7
1736 # define SYSCALL_RET(_regs)     (_regs).a0
1737 #elif defined(__csky__)
1738 # define ARCH_REGS              struct pt_regs
1739 #  if defined(__CSKYABIV2__)
1740 #   define SYSCALL_NUM(_regs)   (_regs).regs[3]
1741 #  else
1742 #   define SYSCALL_NUM(_regs)   (_regs).regs[9]
1743 #  endif
1744 # define SYSCALL_RET(_regs)     (_regs).a0
1745 #elif defined(__hppa__)
1746 # define ARCH_REGS              struct user_regs_struct
1747 # define SYSCALL_NUM(_regs)     (_regs).gr[20]
1748 # define SYSCALL_RET(_regs)     (_regs).gr[28]
1749 #elif defined(__powerpc__)
1750 # define ARCH_REGS              struct pt_regs
1751 # define SYSCALL_NUM(_regs)     (_regs).gpr[0]
1752 # define SYSCALL_RET(_regs)     (_regs).gpr[3]
1753 # define SYSCALL_RET_SET(_regs, _val)                           \
1754         do {                                                    \
1755                 typeof(_val) _result = (_val);                  \
1756                 /*                                              \
1757                  * A syscall error is signaled by CR0 SO bit    \
1758                  * and the code is stored as a positive value.  \
1759                  */                                             \
1760                 if (_result < 0) {                              \
1761                         SYSCALL_RET(_regs) = -_result;          \
1762                         (_regs).ccr |= 0x10000000;              \
1763                 } else {                                        \
1764                         SYSCALL_RET(_regs) = _result;           \
1765                         (_regs).ccr &= ~0x10000000;             \
1766                 }                                               \
1767         } while (0)
1768 # define SYSCALL_RET_SET_ON_PTRACE_EXIT
1769 #elif defined(__s390__)
1770 # define ARCH_REGS              s390_regs
1771 # define SYSCALL_NUM(_regs)     (_regs).gprs[2]
1772 # define SYSCALL_RET_SET(_regs, _val)                   \
1773                 TH_LOG("Can't modify syscall return on this architecture")
1774 #elif defined(__mips__)
1775 # include <asm/unistd_nr_n32.h>
1776 # include <asm/unistd_nr_n64.h>
1777 # include <asm/unistd_nr_o32.h>
1778 # define ARCH_REGS              struct pt_regs
1779 # define SYSCALL_NUM(_regs)                             \
1780         ({                                              \
1781                 typeof((_regs).regs[2]) _nr;            \
1782                 if ((_regs).regs[2] == __NR_O32_Linux)  \
1783                         _nr = (_regs).regs[4];          \
1784                 else                                    \
1785                         _nr = (_regs).regs[2];          \
1786                 _nr;                                    \
1787         })
1788 # define SYSCALL_NUM_SET(_regs, _nr)                    \
1789         do {                                            \
1790                 if ((_regs).regs[2] == __NR_O32_Linux)  \
1791                         (_regs).regs[4] = _nr;          \
1792                 else                                    \
1793                         (_regs).regs[2] = _nr;          \
1794         } while (0)
1795 # define SYSCALL_RET_SET(_regs, _val)                   \
1796                 TH_LOG("Can't modify syscall return on this architecture")
1797 #elif defined(__xtensa__)
1798 # define ARCH_REGS              struct user_pt_regs
1799 # define SYSCALL_NUM(_regs)     (_regs).syscall
1800 /*
1801  * On xtensa syscall return value is in the register
1802  * a2 of the current window which is not fixed.
1803  */
1804 #define SYSCALL_RET(_regs)      (_regs).a[(_regs).windowbase * 4 + 2]
1805 #elif defined(__sh__)
1806 # define ARCH_REGS              struct pt_regs
1807 # define SYSCALL_NUM(_regs)     (_regs).regs[3]
1808 # define SYSCALL_RET(_regs)     (_regs).regs[0]
1809 #else
1810 # error "Do not know how to find your architecture's registers and syscalls"
1811 #endif
1812
1813 /*
1814  * Most architectures can change the syscall by just updating the
1815  * associated register. This is the default if not defined above.
1816  */
1817 #ifndef SYSCALL_NUM_SET
1818 # define SYSCALL_NUM_SET(_regs, _nr)            \
1819         do {                                    \
1820                 SYSCALL_NUM(_regs) = (_nr);     \
1821         } while (0)
1822 #endif
1823 /*
1824  * Most architectures can change the syscall return value by just
1825  * writing to the SYSCALL_RET register. This is the default if not
1826  * defined above. If an architecture cannot set the return value
1827  * (for example when the syscall and return value register is
1828  * shared), report it with TH_LOG() in an arch-specific definition
1829  * of SYSCALL_RET_SET() above, and leave SYSCALL_RET undefined.
1830  */
1831 #if !defined(SYSCALL_RET) && !defined(SYSCALL_RET_SET)
1832 # error "One of SYSCALL_RET or SYSCALL_RET_SET is needed for this arch"
1833 #endif
1834 #ifndef SYSCALL_RET_SET
1835 # define SYSCALL_RET_SET(_regs, _val)           \
1836         do {                                    \
1837                 SYSCALL_RET(_regs) = (_val);    \
1838         } while (0)
1839 #endif
1840
1841 /* When the syscall return can't be changed, stub out the tests for it. */
1842 #ifndef SYSCALL_RET
1843 # define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(-1, action)
1844 #else
1845 # define EXPECT_SYSCALL_RETURN(val, action)             \
1846         do {                                            \
1847                 errno = 0;                              \
1848                 if (val < 0) {                          \
1849                         EXPECT_EQ(-1, action);          \
1850                         EXPECT_EQ(-(val), errno);       \
1851                 } else {                                \
1852                         EXPECT_EQ(val, action);         \
1853                 }                                       \
1854         } while (0)
1855 #endif
1856
1857 /*
1858  * Some architectures (e.g. powerpc) can only set syscall
1859  * return values on syscall exit during ptrace.
1860  */
1861 const bool ptrace_entry_set_syscall_nr = true;
1862 const bool ptrace_entry_set_syscall_ret =
1863 #ifndef SYSCALL_RET_SET_ON_PTRACE_EXIT
1864         true;
1865 #else
1866         false;
1867 #endif
1868
1869 /*
1870  * Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
1871  * architectures without HAVE_ARCH_TRACEHOOK (e.g. User-mode Linux).
1872  */
1873 #if defined(__x86_64__) || defined(__i386__) || defined(__mips__)
1874 # define ARCH_GETREGS(_regs)    ptrace(PTRACE_GETREGS, tracee, 0, &(_regs))
1875 # define ARCH_SETREGS(_regs)    ptrace(PTRACE_SETREGS, tracee, 0, &(_regs))
1876 #else
1877 # define ARCH_GETREGS(_regs)    ({                                      \
1878                 struct iovec __v;                                       \
1879                 __v.iov_base = &(_regs);                                \
1880                 __v.iov_len = sizeof(_regs);                            \
1881                 ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &__v);    \
1882         })
1883 # define ARCH_SETREGS(_regs)    ({                                      \
1884                 struct iovec __v;                                       \
1885                 __v.iov_base = &(_regs);                                \
1886                 __v.iov_len = sizeof(_regs);                            \
1887                 ptrace(PTRACE_SETREGSET, tracee, NT_PRSTATUS, &__v);    \
1888         })
1889 #endif
1890
1891 /* Architecture-specific syscall fetching routine. */
1892 int get_syscall(struct __test_metadata *_metadata, pid_t tracee)
1893 {
1894         ARCH_REGS regs;
1895
1896         EXPECT_EQ(0, ARCH_GETREGS(regs)) {
1897                 return -1;
1898         }
1899
1900         return SYSCALL_NUM(regs);
1901 }
1902
1903 /* Architecture-specific syscall changing routine. */
1904 void __change_syscall(struct __test_metadata *_metadata,
1905                     pid_t tracee, long *syscall, long *ret)
1906 {
1907         ARCH_REGS orig, regs;
1908
1909         /* Do not get/set registers if we have nothing to do. */
1910         if (!syscall && !ret)
1911                 return;
1912
1913         EXPECT_EQ(0, ARCH_GETREGS(regs)) {
1914                 return;
1915         }
1916         orig = regs;
1917
1918         if (syscall)
1919                 SYSCALL_NUM_SET(regs, *syscall);
1920
1921         if (ret)
1922                 SYSCALL_RET_SET(regs, *ret);
1923
1924         /* Flush any register changes made. */
1925         if (memcmp(&orig, &regs, sizeof(orig)) != 0)
1926                 EXPECT_EQ(0, ARCH_SETREGS(regs));
1927 }
1928
1929 /* Change only syscall number. */
1930 void change_syscall_nr(struct __test_metadata *_metadata,
1931                        pid_t tracee, long syscall)
1932 {
1933         __change_syscall(_metadata, tracee, &syscall, NULL);
1934 }
1935
1936 /* Change syscall return value (and set syscall number to -1). */
1937 void change_syscall_ret(struct __test_metadata *_metadata,
1938                         pid_t tracee, long ret)
1939 {
1940         long syscall = -1;
1941
1942         __change_syscall(_metadata, tracee, &syscall, &ret);
1943 }
1944
1945 void tracer_seccomp(struct __test_metadata *_metadata, pid_t tracee,
1946                     int status, void *args)
1947 {
1948         int ret;
1949         unsigned long msg;
1950
1951         /* Make sure we got the right message. */
1952         ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
1953         EXPECT_EQ(0, ret);
1954
1955         /* Validate and take action on expected syscalls. */
1956         switch (msg) {
1957         case 0x1002:
1958                 /* change getpid to getppid. */
1959                 EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee));
1960                 change_syscall_nr(_metadata, tracee, __NR_getppid);
1961                 break;
1962         case 0x1003:
1963                 /* skip gettid with valid return code. */
1964                 EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee));
1965                 change_syscall_ret(_metadata, tracee, 45000);
1966                 break;
1967         case 0x1004:
1968                 /* skip openat with error. */
1969                 EXPECT_EQ(__NR_openat, get_syscall(_metadata, tracee));
1970                 change_syscall_ret(_metadata, tracee, -ESRCH);
1971                 break;
1972         case 0x1005:
1973                 /* do nothing (allow getppid) */
1974                 EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee));
1975                 break;
1976         default:
1977                 EXPECT_EQ(0, msg) {
1978                         TH_LOG("Unknown PTRACE_GETEVENTMSG: 0x%lx", msg);
1979                         kill(tracee, SIGKILL);
1980                 }
1981         }
1982
1983 }
1984
1985 FIXTURE(TRACE_syscall) {
1986         struct sock_fprog prog;
1987         pid_t tracer, mytid, mypid, parent;
1988         long syscall_nr;
1989 };
1990
1991 void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
1992                    int status, void *args)
1993 {
1994         int ret;
1995         unsigned long msg;
1996         static bool entry;
1997         long syscall_nr_val, syscall_ret_val;
1998         long *syscall_nr = NULL, *syscall_ret = NULL;
1999         FIXTURE_DATA(TRACE_syscall) *self = args;
2000
2001         /*
2002          * The traditional way to tell PTRACE_SYSCALL entry/exit
2003          * is by counting.
2004          */
2005         entry = !entry;
2006
2007         /* Make sure we got an appropriate message. */
2008         ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
2009         EXPECT_EQ(0, ret);
2010         EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY
2011                         : PTRACE_EVENTMSG_SYSCALL_EXIT, msg);
2012
2013         /*
2014          * Some architectures only support setting return values during
2015          * syscall exit under ptrace, and on exit the syscall number may
2016          * no longer be available. Therefore, save the initial sycall
2017          * number here, so it can be examined during both entry and exit
2018          * phases.
2019          */
2020         if (entry)
2021                 self->syscall_nr = get_syscall(_metadata, tracee);
2022
2023         /*
2024          * Depending on the architecture's syscall setting abilities, we
2025          * pick which things to set during this phase (entry or exit).
2026          */
2027         if (entry == ptrace_entry_set_syscall_nr)
2028                 syscall_nr = &syscall_nr_val;
2029         if (entry == ptrace_entry_set_syscall_ret)
2030                 syscall_ret = &syscall_ret_val;
2031
2032         /* Now handle the actual rewriting cases. */
2033         switch (self->syscall_nr) {
2034         case __NR_getpid:
2035                 syscall_nr_val = __NR_getppid;
2036                 /* Never change syscall return for this case. */
2037                 syscall_ret = NULL;
2038                 break;
2039         case __NR_gettid:
2040                 syscall_nr_val = -1;
2041                 syscall_ret_val = 45000;
2042                 break;
2043         case __NR_openat:
2044                 syscall_nr_val = -1;
2045                 syscall_ret_val = -ESRCH;
2046                 break;
2047         default:
2048                 /* Unhandled, do nothing. */
2049                 return;
2050         }
2051
2052         __change_syscall(_metadata, tracee, syscall_nr, syscall_ret);
2053 }
2054
2055 FIXTURE_VARIANT(TRACE_syscall) {
2056         /*
2057          * All of the SECCOMP_RET_TRACE behaviors can be tested with either
2058          * SECCOMP_RET_TRACE+PTRACE_CONT or plain ptrace()+PTRACE_SYSCALL.
2059          * This indicates if we should use SECCOMP_RET_TRACE (false), or
2060          * ptrace (true).
2061          */
2062         bool use_ptrace;
2063 };
2064
2065 FIXTURE_VARIANT_ADD(TRACE_syscall, ptrace) {
2066         .use_ptrace = true,
2067 };
2068
2069 FIXTURE_VARIANT_ADD(TRACE_syscall, seccomp) {
2070         .use_ptrace = false,
2071 };
2072
2073 FIXTURE_SETUP(TRACE_syscall)
2074 {
2075         struct sock_filter filter[] = {
2076                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2077                         offsetof(struct seccomp_data, nr)),
2078                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
2079                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002),
2080                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1),
2081                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003),
2082                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_openat, 0, 1),
2083                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004),
2084                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
2085                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1005),
2086                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2087         };
2088         struct sock_fprog prog = {
2089                 .len = (unsigned short)ARRAY_SIZE(filter),
2090                 .filter = filter,
2091         };
2092         long ret;
2093
2094         /* Prepare some testable syscall results. */
2095         self->mytid = syscall(__NR_gettid);
2096         ASSERT_GT(self->mytid, 0);
2097         ASSERT_NE(self->mytid, 1) {
2098                 TH_LOG("Running this test as init is not supported. :)");
2099         }
2100
2101         self->mypid = getpid();
2102         ASSERT_GT(self->mypid, 0);
2103         ASSERT_EQ(self->mytid, self->mypid);
2104
2105         self->parent = getppid();
2106         ASSERT_GT(self->parent, 0);
2107         ASSERT_NE(self->parent, self->mypid);
2108
2109         /* Launch tracer. */
2110         self->tracer = setup_trace_fixture(_metadata,
2111                                            variant->use_ptrace ? tracer_ptrace
2112                                                                : tracer_seccomp,
2113                                            self, variant->use_ptrace);
2114
2115         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
2116         ASSERT_EQ(0, ret);
2117
2118         if (variant->use_ptrace)
2119                 return;
2120
2121         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2122         ASSERT_EQ(0, ret);
2123 }
2124
2125 FIXTURE_TEARDOWN(TRACE_syscall)
2126 {
2127         teardown_trace_fixture(_metadata, self->tracer);
2128 }
2129
2130 TEST(negative_ENOSYS)
2131 {
2132         /*
2133          * There should be no difference between an "internal" skip
2134          * and userspace asking for syscall "-1".
2135          */
2136         errno = 0;
2137         EXPECT_EQ(-1, syscall(-1));
2138         EXPECT_EQ(errno, ENOSYS);
2139         /* And no difference for "still not valid but not -1". */
2140         errno = 0;
2141         EXPECT_EQ(-1, syscall(-101));
2142         EXPECT_EQ(errno, ENOSYS);
2143 }
2144
2145 TEST_F(TRACE_syscall, negative_ENOSYS)
2146 {
2147         negative_ENOSYS(_metadata);
2148 }
2149
2150 TEST_F(TRACE_syscall, syscall_allowed)
2151 {
2152         /* getppid works as expected (no changes). */
2153         EXPECT_EQ(self->parent, syscall(__NR_getppid));
2154         EXPECT_NE(self->mypid, syscall(__NR_getppid));
2155 }
2156
2157 TEST_F(TRACE_syscall, syscall_redirected)
2158 {
2159         /* getpid has been redirected to getppid as expected. */
2160         EXPECT_EQ(self->parent, syscall(__NR_getpid));
2161         EXPECT_NE(self->mypid, syscall(__NR_getpid));
2162 }
2163
2164 TEST_F(TRACE_syscall, syscall_errno)
2165 {
2166         /* Tracer should skip the open syscall, resulting in ESRCH. */
2167         EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
2168 }
2169
2170 TEST_F(TRACE_syscall, syscall_faked)
2171 {
2172         /* Tracer skips the gettid syscall and store altered return value. */
2173         EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
2174 }
2175
2176 TEST_F(TRACE_syscall, skip_after)
2177 {
2178         struct sock_filter filter[] = {
2179                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2180                         offsetof(struct seccomp_data, nr)),
2181                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
2182                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EPERM),
2183                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2184         };
2185         struct sock_fprog prog = {
2186                 .len = (unsigned short)ARRAY_SIZE(filter),
2187                 .filter = filter,
2188         };
2189         long ret;
2190
2191         /* Install additional "errno on getppid" filter. */
2192         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2193         ASSERT_EQ(0, ret);
2194
2195         /* Tracer will redirect getpid to getppid, and we should see EPERM. */
2196         errno = 0;
2197         EXPECT_EQ(-1, syscall(__NR_getpid));
2198         EXPECT_EQ(EPERM, errno);
2199 }
2200
2201 TEST_F_SIGNAL(TRACE_syscall, kill_after, SIGSYS)
2202 {
2203         struct sock_filter filter[] = {
2204                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2205                         offsetof(struct seccomp_data, nr)),
2206                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
2207                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
2208                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2209         };
2210         struct sock_fprog prog = {
2211                 .len = (unsigned short)ARRAY_SIZE(filter),
2212                 .filter = filter,
2213         };
2214         long ret;
2215
2216         /* Install additional "death on getppid" filter. */
2217         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2218         ASSERT_EQ(0, ret);
2219
2220         /* Tracer will redirect getpid to getppid, and we should die. */
2221         EXPECT_NE(self->mypid, syscall(__NR_getpid));
2222 }
2223
2224 TEST(seccomp_syscall)
2225 {
2226         struct sock_filter filter[] = {
2227                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2228         };
2229         struct sock_fprog prog = {
2230                 .len = (unsigned short)ARRAY_SIZE(filter),
2231                 .filter = filter,
2232         };
2233         long ret;
2234
2235         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
2236         ASSERT_EQ(0, ret) {
2237                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2238         }
2239
2240         /* Reject insane operation. */
2241         ret = seccomp(-1, 0, &prog);
2242         ASSERT_NE(ENOSYS, errno) {
2243                 TH_LOG("Kernel does not support seccomp syscall!");
2244         }
2245         EXPECT_EQ(EINVAL, errno) {
2246                 TH_LOG("Did not reject crazy op value!");
2247         }
2248
2249         /* Reject strict with flags or pointer. */
2250         ret = seccomp(SECCOMP_SET_MODE_STRICT, -1, NULL);
2251         EXPECT_EQ(EINVAL, errno) {
2252                 TH_LOG("Did not reject mode strict with flags!");
2253         }
2254         ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, &prog);
2255         EXPECT_EQ(EINVAL, errno) {
2256                 TH_LOG("Did not reject mode strict with uargs!");
2257         }
2258
2259         /* Reject insane args for filter. */
2260         ret = seccomp(SECCOMP_SET_MODE_FILTER, -1, &prog);
2261         EXPECT_EQ(EINVAL, errno) {
2262                 TH_LOG("Did not reject crazy filter flags!");
2263         }
2264         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, NULL);
2265         EXPECT_EQ(EFAULT, errno) {
2266                 TH_LOG("Did not reject NULL filter!");
2267         }
2268
2269         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
2270         EXPECT_EQ(0, errno) {
2271                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER: %s",
2272                         strerror(errno));
2273         }
2274 }
2275
2276 TEST(seccomp_syscall_mode_lock)
2277 {
2278         struct sock_filter filter[] = {
2279                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2280         };
2281         struct sock_fprog prog = {
2282                 .len = (unsigned short)ARRAY_SIZE(filter),
2283                 .filter = filter,
2284         };
2285         long ret;
2286
2287         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
2288         ASSERT_EQ(0, ret) {
2289                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2290         }
2291
2292         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
2293         ASSERT_NE(ENOSYS, errno) {
2294                 TH_LOG("Kernel does not support seccomp syscall!");
2295         }
2296         EXPECT_EQ(0, ret) {
2297                 TH_LOG("Could not install filter!");
2298         }
2299
2300         /* Make sure neither entry point will switch to strict. */
2301         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, 0, 0, 0);
2302         EXPECT_EQ(EINVAL, errno) {
2303                 TH_LOG("Switched to mode strict!");
2304         }
2305
2306         ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, NULL);
2307         EXPECT_EQ(EINVAL, errno) {
2308                 TH_LOG("Switched to mode strict!");
2309         }
2310 }
2311
2312 /*
2313  * Test detection of known and unknown filter flags. Userspace needs to be able
2314  * to check if a filter flag is supported by the current kernel and a good way
2315  * of doing that is by attempting to enter filter mode, with the flag bit in
2316  * question set, and a NULL pointer for the _args_ parameter. EFAULT indicates
2317  * that the flag is valid and EINVAL indicates that the flag is invalid.
2318  */
2319 TEST(detect_seccomp_filter_flags)
2320 {
2321         unsigned int flags[] = { SECCOMP_FILTER_FLAG_TSYNC,
2322                                  SECCOMP_FILTER_FLAG_LOG,
2323                                  SECCOMP_FILTER_FLAG_SPEC_ALLOW,
2324                                  SECCOMP_FILTER_FLAG_NEW_LISTENER,
2325                                  SECCOMP_FILTER_FLAG_TSYNC_ESRCH };
2326         unsigned int exclusive[] = {
2327                                 SECCOMP_FILTER_FLAG_TSYNC,
2328                                 SECCOMP_FILTER_FLAG_NEW_LISTENER };
2329         unsigned int flag, all_flags, exclusive_mask;
2330         int i;
2331         long ret;
2332
2333         /* Test detection of individual known-good filter flags */
2334         for (i = 0, all_flags = 0; i < ARRAY_SIZE(flags); i++) {
2335                 int bits = 0;
2336
2337                 flag = flags[i];
2338                 /* Make sure the flag is a single bit! */
2339                 while (flag) {
2340                         if (flag & 0x1)
2341                                 bits ++;
2342                         flag >>= 1;
2343                 }
2344                 ASSERT_EQ(1, bits);
2345                 flag = flags[i];
2346
2347                 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2348                 ASSERT_NE(ENOSYS, errno) {
2349                         TH_LOG("Kernel does not support seccomp syscall!");
2350                 }
2351                 EXPECT_EQ(-1, ret);
2352                 EXPECT_EQ(EFAULT, errno) {
2353                         TH_LOG("Failed to detect that a known-good filter flag (0x%X) is supported!",
2354                                flag);
2355                 }
2356
2357                 all_flags |= flag;
2358         }
2359
2360         /*
2361          * Test detection of all known-good filter flags combined. But
2362          * for the exclusive flags we need to mask them out and try them
2363          * individually for the "all flags" testing.
2364          */
2365         exclusive_mask = 0;
2366         for (i = 0; i < ARRAY_SIZE(exclusive); i++)
2367                 exclusive_mask |= exclusive[i];
2368         for (i = 0; i < ARRAY_SIZE(exclusive); i++) {
2369                 flag = all_flags & ~exclusive_mask;
2370                 flag |= exclusive[i];
2371
2372                 ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2373                 EXPECT_EQ(-1, ret);
2374                 EXPECT_EQ(EFAULT, errno) {
2375                         TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!",
2376                                flag);
2377                 }
2378         }
2379
2380         /* Test detection of an unknown filter flags, without exclusives. */
2381         flag = -1;
2382         flag &= ~exclusive_mask;
2383         ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2384         EXPECT_EQ(-1, ret);
2385         EXPECT_EQ(EINVAL, errno) {
2386                 TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported!",
2387                        flag);
2388         }
2389
2390         /*
2391          * Test detection of an unknown filter flag that may simply need to be
2392          * added to this test
2393          */
2394         flag = flags[ARRAY_SIZE(flags) - 1] << 1;
2395         ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
2396         EXPECT_EQ(-1, ret);
2397         EXPECT_EQ(EINVAL, errno) {
2398                 TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported! Does a new flag need to be added to this test?",
2399                        flag);
2400         }
2401 }
2402
2403 TEST(TSYNC_first)
2404 {
2405         struct sock_filter filter[] = {
2406                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2407         };
2408         struct sock_fprog prog = {
2409                 .len = (unsigned short)ARRAY_SIZE(filter),
2410                 .filter = filter,
2411         };
2412         long ret;
2413
2414         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
2415         ASSERT_EQ(0, ret) {
2416                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2417         }
2418
2419         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2420                       &prog);
2421         ASSERT_NE(ENOSYS, errno) {
2422                 TH_LOG("Kernel does not support seccomp syscall!");
2423         }
2424         EXPECT_EQ(0, ret) {
2425                 TH_LOG("Could not install initial filter with TSYNC!");
2426         }
2427 }
2428
2429 #define TSYNC_SIBLINGS 2
2430 struct tsync_sibling {
2431         pthread_t tid;
2432         pid_t system_tid;
2433         sem_t *started;
2434         pthread_cond_t *cond;
2435         pthread_mutex_t *mutex;
2436         int diverge;
2437         int num_waits;
2438         struct sock_fprog *prog;
2439         struct __test_metadata *metadata;
2440 };
2441
2442 /*
2443  * To avoid joining joined threads (which is not allowed by Bionic),
2444  * make sure we both successfully join and clear the tid to skip a
2445  * later join attempt during fixture teardown. Any remaining threads
2446  * will be directly killed during teardown.
2447  */
2448 #define PTHREAD_JOIN(tid, status)                                       \
2449         do {                                                            \
2450                 int _rc = pthread_join(tid, status);                    \
2451                 if (_rc) {                                              \
2452                         TH_LOG("pthread_join of tid %u failed: %d\n",   \
2453                                 (unsigned int)tid, _rc);                \
2454                 } else {                                                \
2455                         tid = 0;                                        \
2456                 }                                                       \
2457         } while (0)
2458
2459 FIXTURE(TSYNC) {
2460         struct sock_fprog root_prog, apply_prog;
2461         struct tsync_sibling sibling[TSYNC_SIBLINGS];
2462         sem_t started;
2463         pthread_cond_t cond;
2464         pthread_mutex_t mutex;
2465         int sibling_count;
2466 };
2467
2468 FIXTURE_SETUP(TSYNC)
2469 {
2470         struct sock_filter root_filter[] = {
2471                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2472         };
2473         struct sock_filter apply_filter[] = {
2474                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2475                         offsetof(struct seccomp_data, nr)),
2476                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
2477                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
2478                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2479         };
2480
2481         memset(&self->root_prog, 0, sizeof(self->root_prog));
2482         memset(&self->apply_prog, 0, sizeof(self->apply_prog));
2483         memset(&self->sibling, 0, sizeof(self->sibling));
2484         self->root_prog.filter = malloc(sizeof(root_filter));
2485         ASSERT_NE(NULL, self->root_prog.filter);
2486         memcpy(self->root_prog.filter, &root_filter, sizeof(root_filter));
2487         self->root_prog.len = (unsigned short)ARRAY_SIZE(root_filter);
2488
2489         self->apply_prog.filter = malloc(sizeof(apply_filter));
2490         ASSERT_NE(NULL, self->apply_prog.filter);
2491         memcpy(self->apply_prog.filter, &apply_filter, sizeof(apply_filter));
2492         self->apply_prog.len = (unsigned short)ARRAY_SIZE(apply_filter);
2493
2494         self->sibling_count = 0;
2495         pthread_mutex_init(&self->mutex, NULL);
2496         pthread_cond_init(&self->cond, NULL);
2497         sem_init(&self->started, 0, 0);
2498         self->sibling[0].tid = 0;
2499         self->sibling[0].cond = &self->cond;
2500         self->sibling[0].started = &self->started;
2501         self->sibling[0].mutex = &self->mutex;
2502         self->sibling[0].diverge = 0;
2503         self->sibling[0].num_waits = 1;
2504         self->sibling[0].prog = &self->root_prog;
2505         self->sibling[0].metadata = _metadata;
2506         self->sibling[1].tid = 0;
2507         self->sibling[1].cond = &self->cond;
2508         self->sibling[1].started = &self->started;
2509         self->sibling[1].mutex = &self->mutex;
2510         self->sibling[1].diverge = 0;
2511         self->sibling[1].prog = &self->root_prog;
2512         self->sibling[1].num_waits = 1;
2513         self->sibling[1].metadata = _metadata;
2514 }
2515
2516 FIXTURE_TEARDOWN(TSYNC)
2517 {
2518         int sib = 0;
2519
2520         if (self->root_prog.filter)
2521                 free(self->root_prog.filter);
2522         if (self->apply_prog.filter)
2523                 free(self->apply_prog.filter);
2524
2525         for ( ; sib < self->sibling_count; ++sib) {
2526                 struct tsync_sibling *s = &self->sibling[sib];
2527
2528                 if (!s->tid)
2529                         continue;
2530                 /*
2531                  * If a thread is still running, it may be stuck, so hit
2532                  * it over the head really hard.
2533                  */
2534                 pthread_kill(s->tid, 9);
2535         }
2536         pthread_mutex_destroy(&self->mutex);
2537         pthread_cond_destroy(&self->cond);
2538         sem_destroy(&self->started);
2539 }
2540
2541 void *tsync_sibling(void *data)
2542 {
2543         long ret = 0;
2544         struct tsync_sibling *me = data;
2545
2546         me->system_tid = syscall(__NR_gettid);
2547
2548         pthread_mutex_lock(me->mutex);
2549         if (me->diverge) {
2550                 /* Just re-apply the root prog to fork the tree */
2551                 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
2552                                 me->prog, 0, 0);
2553         }
2554         sem_post(me->started);
2555         /* Return outside of started so parent notices failures. */
2556         if (ret) {
2557                 pthread_mutex_unlock(me->mutex);
2558                 return (void *)SIBLING_EXIT_FAILURE;
2559         }
2560         do {
2561                 pthread_cond_wait(me->cond, me->mutex);
2562                 me->num_waits = me->num_waits - 1;
2563         } while (me->num_waits);
2564         pthread_mutex_unlock(me->mutex);
2565
2566         ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
2567         if (!ret)
2568                 return (void *)SIBLING_EXIT_NEWPRIVS;
2569         read(0, NULL, 0);
2570         return (void *)SIBLING_EXIT_UNKILLED;
2571 }
2572
2573 void tsync_start_sibling(struct tsync_sibling *sibling)
2574 {
2575         pthread_create(&sibling->tid, NULL, tsync_sibling, (void *)sibling);
2576 }
2577
2578 TEST_F(TSYNC, siblings_fail_prctl)
2579 {
2580         long ret;
2581         void *status;
2582         struct sock_filter filter[] = {
2583                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2584                         offsetof(struct seccomp_data, nr)),
2585                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
2586                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EINVAL),
2587                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2588         };
2589         struct sock_fprog prog = {
2590                 .len = (unsigned short)ARRAY_SIZE(filter),
2591                 .filter = filter,
2592         };
2593
2594         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2595                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2596         }
2597
2598         /* Check prctl failure detection by requesting sib 0 diverge. */
2599         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
2600         ASSERT_NE(ENOSYS, errno) {
2601                 TH_LOG("Kernel does not support seccomp syscall!");
2602         }
2603         ASSERT_EQ(0, ret) {
2604                 TH_LOG("setting filter failed");
2605         }
2606
2607         self->sibling[0].diverge = 1;
2608         tsync_start_sibling(&self->sibling[0]);
2609         tsync_start_sibling(&self->sibling[1]);
2610
2611         while (self->sibling_count < TSYNC_SIBLINGS) {
2612                 sem_wait(&self->started);
2613                 self->sibling_count++;
2614         }
2615
2616         /* Signal the threads to clean up*/
2617         pthread_mutex_lock(&self->mutex);
2618         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2619                 TH_LOG("cond broadcast non-zero");
2620         }
2621         pthread_mutex_unlock(&self->mutex);
2622
2623         /* Ensure diverging sibling failed to call prctl. */
2624         PTHREAD_JOIN(self->sibling[0].tid, &status);
2625         EXPECT_EQ(SIBLING_EXIT_FAILURE, (long)status);
2626         PTHREAD_JOIN(self->sibling[1].tid, &status);
2627         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2628 }
2629
2630 TEST_F(TSYNC, two_siblings_with_ancestor)
2631 {
2632         long ret;
2633         void *status;
2634
2635         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2636                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2637         }
2638
2639         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2640         ASSERT_NE(ENOSYS, errno) {
2641                 TH_LOG("Kernel does not support seccomp syscall!");
2642         }
2643         ASSERT_EQ(0, ret) {
2644                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2645         }
2646         tsync_start_sibling(&self->sibling[0]);
2647         tsync_start_sibling(&self->sibling[1]);
2648
2649         while (self->sibling_count < TSYNC_SIBLINGS) {
2650                 sem_wait(&self->started);
2651                 self->sibling_count++;
2652         }
2653
2654         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2655                       &self->apply_prog);
2656         ASSERT_EQ(0, ret) {
2657                 TH_LOG("Could install filter on all threads!");
2658         }
2659         /* Tell the siblings to test the policy */
2660         pthread_mutex_lock(&self->mutex);
2661         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2662                 TH_LOG("cond broadcast non-zero");
2663         }
2664         pthread_mutex_unlock(&self->mutex);
2665         /* Ensure they are both killed and don't exit cleanly. */
2666         PTHREAD_JOIN(self->sibling[0].tid, &status);
2667         EXPECT_EQ(0x0, (long)status);
2668         PTHREAD_JOIN(self->sibling[1].tid, &status);
2669         EXPECT_EQ(0x0, (long)status);
2670 }
2671
2672 TEST_F(TSYNC, two_sibling_want_nnp)
2673 {
2674         void *status;
2675
2676         /* start siblings before any prctl() operations */
2677         tsync_start_sibling(&self->sibling[0]);
2678         tsync_start_sibling(&self->sibling[1]);
2679         while (self->sibling_count < TSYNC_SIBLINGS) {
2680                 sem_wait(&self->started);
2681                 self->sibling_count++;
2682         }
2683
2684         /* Tell the siblings to test no policy */
2685         pthread_mutex_lock(&self->mutex);
2686         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2687                 TH_LOG("cond broadcast non-zero");
2688         }
2689         pthread_mutex_unlock(&self->mutex);
2690
2691         /* Ensure they are both upset about lacking nnp. */
2692         PTHREAD_JOIN(self->sibling[0].tid, &status);
2693         EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status);
2694         PTHREAD_JOIN(self->sibling[1].tid, &status);
2695         EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status);
2696 }
2697
2698 TEST_F(TSYNC, two_siblings_with_no_filter)
2699 {
2700         long ret;
2701         void *status;
2702
2703         /* start siblings before any prctl() operations */
2704         tsync_start_sibling(&self->sibling[0]);
2705         tsync_start_sibling(&self->sibling[1]);
2706         while (self->sibling_count < TSYNC_SIBLINGS) {
2707                 sem_wait(&self->started);
2708                 self->sibling_count++;
2709         }
2710
2711         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2712                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2713         }
2714
2715         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2716                       &self->apply_prog);
2717         ASSERT_NE(ENOSYS, errno) {
2718                 TH_LOG("Kernel does not support seccomp syscall!");
2719         }
2720         ASSERT_EQ(0, ret) {
2721                 TH_LOG("Could install filter on all threads!");
2722         }
2723
2724         /* Tell the siblings to test the policy */
2725         pthread_mutex_lock(&self->mutex);
2726         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2727                 TH_LOG("cond broadcast non-zero");
2728         }
2729         pthread_mutex_unlock(&self->mutex);
2730
2731         /* Ensure they are both killed and don't exit cleanly. */
2732         PTHREAD_JOIN(self->sibling[0].tid, &status);
2733         EXPECT_EQ(0x0, (long)status);
2734         PTHREAD_JOIN(self->sibling[1].tid, &status);
2735         EXPECT_EQ(0x0, (long)status);
2736 }
2737
2738 TEST_F(TSYNC, two_siblings_with_one_divergence)
2739 {
2740         long ret;
2741         void *status;
2742
2743         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2744                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2745         }
2746
2747         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2748         ASSERT_NE(ENOSYS, errno) {
2749                 TH_LOG("Kernel does not support seccomp syscall!");
2750         }
2751         ASSERT_EQ(0, ret) {
2752                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2753         }
2754         self->sibling[0].diverge = 1;
2755         tsync_start_sibling(&self->sibling[0]);
2756         tsync_start_sibling(&self->sibling[1]);
2757
2758         while (self->sibling_count < TSYNC_SIBLINGS) {
2759                 sem_wait(&self->started);
2760                 self->sibling_count++;
2761         }
2762
2763         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2764                       &self->apply_prog);
2765         ASSERT_EQ(self->sibling[0].system_tid, ret) {
2766                 TH_LOG("Did not fail on diverged sibling.");
2767         }
2768
2769         /* Wake the threads */
2770         pthread_mutex_lock(&self->mutex);
2771         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2772                 TH_LOG("cond broadcast non-zero");
2773         }
2774         pthread_mutex_unlock(&self->mutex);
2775
2776         /* Ensure they are both unkilled. */
2777         PTHREAD_JOIN(self->sibling[0].tid, &status);
2778         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2779         PTHREAD_JOIN(self->sibling[1].tid, &status);
2780         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2781 }
2782
2783 TEST_F(TSYNC, two_siblings_with_one_divergence_no_tid_in_err)
2784 {
2785         long ret, flags;
2786         void *status;
2787
2788         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2789                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2790         }
2791
2792         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2793         ASSERT_NE(ENOSYS, errno) {
2794                 TH_LOG("Kernel does not support seccomp syscall!");
2795         }
2796         ASSERT_EQ(0, ret) {
2797                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2798         }
2799         self->sibling[0].diverge = 1;
2800         tsync_start_sibling(&self->sibling[0]);
2801         tsync_start_sibling(&self->sibling[1]);
2802
2803         while (self->sibling_count < TSYNC_SIBLINGS) {
2804                 sem_wait(&self->started);
2805                 self->sibling_count++;
2806         }
2807
2808         flags = SECCOMP_FILTER_FLAG_TSYNC | \
2809                 SECCOMP_FILTER_FLAG_TSYNC_ESRCH;
2810         ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &self->apply_prog);
2811         ASSERT_EQ(ESRCH, errno) {
2812                 TH_LOG("Did not return ESRCH for diverged sibling.");
2813         }
2814         ASSERT_EQ(-1, ret) {
2815                 TH_LOG("Did not fail on diverged sibling.");
2816         }
2817
2818         /* Wake the threads */
2819         pthread_mutex_lock(&self->mutex);
2820         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2821                 TH_LOG("cond broadcast non-zero");
2822         }
2823         pthread_mutex_unlock(&self->mutex);
2824
2825         /* Ensure they are both unkilled. */
2826         PTHREAD_JOIN(self->sibling[0].tid, &status);
2827         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2828         PTHREAD_JOIN(self->sibling[1].tid, &status);
2829         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2830 }
2831
2832 TEST_F(TSYNC, two_siblings_not_under_filter)
2833 {
2834         long ret, sib;
2835         void *status;
2836         struct timespec delay = { .tv_nsec = 100000000 };
2837
2838         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2839                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2840         }
2841
2842         /*
2843          * Sibling 0 will have its own seccomp policy
2844          * and Sibling 1 will not be under seccomp at
2845          * all. Sibling 1 will enter seccomp and 0
2846          * will cause failure.
2847          */
2848         self->sibling[0].diverge = 1;
2849         tsync_start_sibling(&self->sibling[0]);
2850         tsync_start_sibling(&self->sibling[1]);
2851
2852         while (self->sibling_count < TSYNC_SIBLINGS) {
2853                 sem_wait(&self->started);
2854                 self->sibling_count++;
2855         }
2856
2857         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
2858         ASSERT_NE(ENOSYS, errno) {
2859                 TH_LOG("Kernel does not support seccomp syscall!");
2860         }
2861         ASSERT_EQ(0, ret) {
2862                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
2863         }
2864
2865         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2866                       &self->apply_prog);
2867         ASSERT_EQ(ret, self->sibling[0].system_tid) {
2868                 TH_LOG("Did not fail on diverged sibling.");
2869         }
2870         sib = 1;
2871         if (ret == self->sibling[0].system_tid)
2872                 sib = 0;
2873
2874         pthread_mutex_lock(&self->mutex);
2875
2876         /* Increment the other siblings num_waits so we can clean up
2877          * the one we just saw.
2878          */
2879         self->sibling[!sib].num_waits += 1;
2880
2881         /* Signal the thread to clean up*/
2882         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2883                 TH_LOG("cond broadcast non-zero");
2884         }
2885         pthread_mutex_unlock(&self->mutex);
2886         PTHREAD_JOIN(self->sibling[sib].tid, &status);
2887         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
2888         /* Poll for actual task death. pthread_join doesn't guarantee it. */
2889         while (!kill(self->sibling[sib].system_tid, 0))
2890                 nanosleep(&delay, NULL);
2891         /* Switch to the remaining sibling */
2892         sib = !sib;
2893
2894         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2895                       &self->apply_prog);
2896         ASSERT_EQ(0, ret) {
2897                 TH_LOG("Expected the remaining sibling to sync");
2898         };
2899
2900         pthread_mutex_lock(&self->mutex);
2901
2902         /* If remaining sibling didn't have a chance to wake up during
2903          * the first broadcast, manually reduce the num_waits now.
2904          */
2905         if (self->sibling[sib].num_waits > 1)
2906                 self->sibling[sib].num_waits = 1;
2907         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2908                 TH_LOG("cond broadcast non-zero");
2909         }
2910         pthread_mutex_unlock(&self->mutex);
2911         PTHREAD_JOIN(self->sibling[sib].tid, &status);
2912         EXPECT_EQ(0, (long)status);
2913         /* Poll for actual task death. pthread_join doesn't guarantee it. */
2914         while (!kill(self->sibling[sib].system_tid, 0))
2915                 nanosleep(&delay, NULL);
2916
2917         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
2918                       &self->apply_prog);
2919         ASSERT_EQ(0, ret);  /* just us chickens */
2920 }
2921
2922 /* Make sure restarted syscalls are seen directly as "restart_syscall". */
2923 TEST(syscall_restart)
2924 {
2925         long ret;
2926         unsigned long msg;
2927         pid_t child_pid;
2928         int pipefd[2];
2929         int status;
2930         siginfo_t info = { };
2931         struct sock_filter filter[] = {
2932                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2933                          offsetof(struct seccomp_data, nr)),
2934
2935 #ifdef __NR_sigreturn
2936                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_sigreturn, 7, 0),
2937 #endif
2938                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 6, 0),
2939                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_exit, 5, 0),
2940                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_rt_sigreturn, 4, 0),
2941                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_nanosleep, 5, 0),
2942                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_clock_nanosleep, 4, 0),
2943                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_restart_syscall, 4, 0),
2944
2945                 /* Allow __NR_write for easy logging. */
2946                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_write, 0, 1),
2947                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2948                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
2949                 /* The nanosleep jump target. */
2950                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x100),
2951                 /* The restart_syscall jump target. */
2952                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x200),
2953         };
2954         struct sock_fprog prog = {
2955                 .len = (unsigned short)ARRAY_SIZE(filter),
2956                 .filter = filter,
2957         };
2958 #if defined(__arm__)
2959         struct utsname utsbuf;
2960 #endif
2961
2962         ASSERT_EQ(0, pipe(pipefd));
2963
2964         child_pid = fork();
2965         ASSERT_LE(0, child_pid);
2966         if (child_pid == 0) {
2967                 /* Child uses EXPECT not ASSERT to deliver status correctly. */
2968                 char buf = ' ';
2969                 struct timespec timeout = { };
2970
2971                 /* Attach parent as tracer and stop. */
2972                 EXPECT_EQ(0, ptrace(PTRACE_TRACEME));
2973                 EXPECT_EQ(0, raise(SIGSTOP));
2974
2975                 EXPECT_EQ(0, close(pipefd[1]));
2976
2977                 EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2978                         TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2979                 }
2980
2981                 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2982                 EXPECT_EQ(0, ret) {
2983                         TH_LOG("Failed to install filter!");
2984                 }
2985
2986                 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) {
2987                         TH_LOG("Failed to read() sync from parent");
2988                 }
2989                 EXPECT_EQ('.', buf) {
2990                         TH_LOG("Failed to get sync data from read()");
2991                 }
2992
2993                 /* Start nanosleep to be interrupted. */
2994                 timeout.tv_sec = 1;
2995                 errno = 0;
2996                 EXPECT_EQ(0, nanosleep(&timeout, NULL)) {
2997                         TH_LOG("Call to nanosleep() failed (errno %d)", errno);
2998                 }
2999
3000                 /* Read final sync from parent. */
3001                 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) {
3002                         TH_LOG("Failed final read() from parent");
3003                 }
3004                 EXPECT_EQ('!', buf) {
3005                         TH_LOG("Failed to get final data from read()");
3006                 }
3007
3008                 /* Directly report the status of our test harness results. */
3009                 syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS
3010                                                      : EXIT_FAILURE);
3011         }
3012         EXPECT_EQ(0, close(pipefd[0]));
3013
3014         /* Attach to child, setup options, and release. */
3015         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3016         ASSERT_EQ(true, WIFSTOPPED(status));
3017         ASSERT_EQ(0, ptrace(PTRACE_SETOPTIONS, child_pid, NULL,
3018                             PTRACE_O_TRACESECCOMP));
3019         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3020         ASSERT_EQ(1, write(pipefd[1], ".", 1));
3021
3022         /* Wait for nanosleep() to start. */
3023         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3024         ASSERT_EQ(true, WIFSTOPPED(status));
3025         ASSERT_EQ(SIGTRAP, WSTOPSIG(status));
3026         ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16));
3027         ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg));
3028         ASSERT_EQ(0x100, msg);
3029         ret = get_syscall(_metadata, child_pid);
3030         EXPECT_TRUE(ret == __NR_nanosleep || ret == __NR_clock_nanosleep);
3031
3032         /* Might as well check siginfo for sanity while we're here. */
3033         ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info));
3034         ASSERT_EQ(SIGTRAP, info.si_signo);
3035         ASSERT_EQ(SIGTRAP | (PTRACE_EVENT_SECCOMP << 8), info.si_code);
3036         EXPECT_EQ(0, info.si_errno);
3037         EXPECT_EQ(getuid(), info.si_uid);
3038         /* Verify signal delivery came from child (seccomp-triggered). */
3039         EXPECT_EQ(child_pid, info.si_pid);
3040
3041         /* Interrupt nanosleep with SIGSTOP (which we'll need to handle). */
3042         ASSERT_EQ(0, kill(child_pid, SIGSTOP));
3043         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3044         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3045         ASSERT_EQ(true, WIFSTOPPED(status));
3046         ASSERT_EQ(SIGSTOP, WSTOPSIG(status));
3047         ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info));
3048         /*
3049          * There is no siginfo on SIGSTOP any more, so we can't verify
3050          * signal delivery came from parent now (getpid() == info.si_pid).
3051          * https://lkml.kernel.org/r/CAGXu5jJaZAOzP1qFz66tYrtbuywqb+UN2SOA1VLHpCCOiYvYeg@mail.gmail.com
3052          * At least verify the SIGSTOP via PTRACE_GETSIGINFO.
3053          */
3054         EXPECT_EQ(SIGSTOP, info.si_signo);
3055
3056         /* Restart nanosleep with SIGCONT, which triggers restart_syscall. */
3057         ASSERT_EQ(0, kill(child_pid, SIGCONT));
3058         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3059         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3060         ASSERT_EQ(true, WIFSTOPPED(status));
3061         ASSERT_EQ(SIGCONT, WSTOPSIG(status));
3062         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3063
3064         /* Wait for restart_syscall() to start. */
3065         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3066         ASSERT_EQ(true, WIFSTOPPED(status));
3067         ASSERT_EQ(SIGTRAP, WSTOPSIG(status));
3068         ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16));
3069         ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg));
3070
3071         ASSERT_EQ(0x200, msg);
3072         ret = get_syscall(_metadata, child_pid);
3073 #if defined(__arm__)
3074         /*
3075          * FIXME:
3076          * - native ARM registers do NOT expose true syscall.
3077          * - compat ARM registers on ARM64 DO expose true syscall.
3078          */
3079         ASSERT_EQ(0, uname(&utsbuf));
3080         if (strncmp(utsbuf.machine, "arm", 3) == 0) {
3081                 EXPECT_EQ(__NR_nanosleep, ret);
3082         } else
3083 #endif
3084         {
3085                 EXPECT_EQ(__NR_restart_syscall, ret);
3086         }
3087
3088         /* Write again to end test. */
3089         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
3090         ASSERT_EQ(1, write(pipefd[1], "!", 1));
3091         EXPECT_EQ(0, close(pipefd[1]));
3092
3093         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
3094         if (WIFSIGNALED(status) || WEXITSTATUS(status))
3095                 _metadata->passed = 0;
3096 }
3097
3098 TEST_SIGNAL(filter_flag_log, SIGSYS)
3099 {
3100         struct sock_filter allow_filter[] = {
3101                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3102         };
3103         struct sock_filter kill_filter[] = {
3104                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
3105                         offsetof(struct seccomp_data, nr)),
3106                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
3107                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
3108                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3109         };
3110         struct sock_fprog allow_prog = {
3111                 .len = (unsigned short)ARRAY_SIZE(allow_filter),
3112                 .filter = allow_filter,
3113         };
3114         struct sock_fprog kill_prog = {
3115                 .len = (unsigned short)ARRAY_SIZE(kill_filter),
3116                 .filter = kill_filter,
3117         };
3118         long ret;
3119         pid_t parent = getppid();
3120
3121         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3122         ASSERT_EQ(0, ret);
3123
3124         /* Verify that the FILTER_FLAG_LOG flag isn't accepted in strict mode */
3125         ret = seccomp(SECCOMP_SET_MODE_STRICT, SECCOMP_FILTER_FLAG_LOG,
3126                       &allow_prog);
3127         ASSERT_NE(ENOSYS, errno) {
3128                 TH_LOG("Kernel does not support seccomp syscall!");
3129         }
3130         EXPECT_NE(0, ret) {
3131                 TH_LOG("Kernel accepted FILTER_FLAG_LOG flag in strict mode!");
3132         }
3133         EXPECT_EQ(EINVAL, errno) {
3134                 TH_LOG("Kernel returned unexpected errno for FILTER_FLAG_LOG flag in strict mode!");
3135         }
3136
3137         /* Verify that a simple, permissive filter can be added with no flags */
3138         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &allow_prog);
3139         EXPECT_EQ(0, ret);
3140
3141         /* See if the same filter can be added with the FILTER_FLAG_LOG flag */
3142         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
3143                       &allow_prog);
3144         ASSERT_NE(EINVAL, errno) {
3145                 TH_LOG("Kernel does not support the FILTER_FLAG_LOG flag!");
3146         }
3147         EXPECT_EQ(0, ret);
3148
3149         /* Ensure that the kill filter works with the FILTER_FLAG_LOG flag */
3150         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
3151                       &kill_prog);
3152         EXPECT_EQ(0, ret);
3153
3154         EXPECT_EQ(parent, syscall(__NR_getppid));
3155         /* getpid() should never return. */
3156         EXPECT_EQ(0, syscall(__NR_getpid));
3157 }
3158
3159 TEST(get_action_avail)
3160 {
3161         __u32 actions[] = { SECCOMP_RET_KILL_THREAD, SECCOMP_RET_TRAP,
3162                             SECCOMP_RET_ERRNO, SECCOMP_RET_TRACE,
3163                             SECCOMP_RET_LOG,   SECCOMP_RET_ALLOW };
3164         __u32 unknown_action = 0x10000000U;
3165         int i;
3166         long ret;
3167
3168         ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[0]);
3169         ASSERT_NE(ENOSYS, errno) {
3170                 TH_LOG("Kernel does not support seccomp syscall!");
3171         }
3172         ASSERT_NE(EINVAL, errno) {
3173                 TH_LOG("Kernel does not support SECCOMP_GET_ACTION_AVAIL operation!");
3174         }
3175         EXPECT_EQ(ret, 0);
3176
3177         for (i = 0; i < ARRAY_SIZE(actions); i++) {
3178                 ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[i]);
3179                 EXPECT_EQ(ret, 0) {
3180                         TH_LOG("Expected action (0x%X) not available!",
3181                                actions[i]);
3182                 }
3183         }
3184
3185         /* Check that an unknown action is handled properly (EOPNOTSUPP) */
3186         ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &unknown_action);
3187         EXPECT_EQ(ret, -1);
3188         EXPECT_EQ(errno, EOPNOTSUPP);
3189 }
3190
3191 TEST(get_metadata)
3192 {
3193         pid_t pid;
3194         int pipefd[2];
3195         char buf;
3196         struct seccomp_metadata md;
3197         long ret;
3198
3199         /* Only real root can get metadata. */
3200         if (geteuid()) {
3201                 SKIP(return, "get_metadata requires real root");
3202                 return;
3203         }
3204
3205         ASSERT_EQ(0, pipe(pipefd));
3206
3207         pid = fork();
3208         ASSERT_GE(pid, 0);
3209         if (pid == 0) {
3210                 struct sock_filter filter[] = {
3211                         BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3212                 };
3213                 struct sock_fprog prog = {
3214                         .len = (unsigned short)ARRAY_SIZE(filter),
3215                         .filter = filter,
3216                 };
3217
3218                 /* one with log, one without */
3219                 EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER,
3220                                      SECCOMP_FILTER_FLAG_LOG, &prog));
3221                 EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog));
3222
3223                 EXPECT_EQ(0, close(pipefd[0]));
3224                 ASSERT_EQ(1, write(pipefd[1], "1", 1));
3225                 ASSERT_EQ(0, close(pipefd[1]));
3226
3227                 while (1)
3228                         sleep(100);
3229         }
3230
3231         ASSERT_EQ(0, close(pipefd[1]));
3232         ASSERT_EQ(1, read(pipefd[0], &buf, 1));
3233
3234         ASSERT_EQ(0, ptrace(PTRACE_ATTACH, pid));
3235         ASSERT_EQ(pid, waitpid(pid, NULL, 0));
3236
3237         /* Past here must not use ASSERT or child process is never killed. */
3238
3239         md.filter_off = 0;
3240         errno = 0;
3241         ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md);
3242         EXPECT_EQ(sizeof(md), ret) {
3243                 if (errno == EINVAL)
3244                         SKIP(goto skip, "Kernel does not support PTRACE_SECCOMP_GET_METADATA (missing CONFIG_CHECKPOINT_RESTORE?)");
3245         }
3246
3247         EXPECT_EQ(md.flags, SECCOMP_FILTER_FLAG_LOG);
3248         EXPECT_EQ(md.filter_off, 0);
3249
3250         md.filter_off = 1;
3251         ret = ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md);
3252         EXPECT_EQ(sizeof(md), ret);
3253         EXPECT_EQ(md.flags, 0);
3254         EXPECT_EQ(md.filter_off, 1);
3255
3256 skip:
3257         ASSERT_EQ(0, kill(pid, SIGKILL));
3258 }
3259
3260 static int user_notif_syscall(int nr, unsigned int flags)
3261 {
3262         struct sock_filter filter[] = {
3263                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
3264                         offsetof(struct seccomp_data, nr)),
3265                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, nr, 0, 1),
3266                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_USER_NOTIF),
3267                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3268         };
3269
3270         struct sock_fprog prog = {
3271                 .len = (unsigned short)ARRAY_SIZE(filter),
3272                 .filter = filter,
3273         };
3274
3275         return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog);
3276 }
3277
3278 #define USER_NOTIF_MAGIC INT_MAX
3279 TEST(user_notification_basic)
3280 {
3281         pid_t pid;
3282         long ret;
3283         int status, listener;
3284         struct seccomp_notif req = {};
3285         struct seccomp_notif_resp resp = {};
3286         struct pollfd pollfd;
3287
3288         struct sock_filter filter[] = {
3289                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
3290         };
3291         struct sock_fprog prog = {
3292                 .len = (unsigned short)ARRAY_SIZE(filter),
3293                 .filter = filter,
3294         };
3295
3296         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3297         ASSERT_EQ(0, ret) {
3298                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3299         }
3300
3301         pid = fork();
3302         ASSERT_GE(pid, 0);
3303
3304         /* Check that we get -ENOSYS with no listener attached */
3305         if (pid == 0) {
3306                 if (user_notif_syscall(__NR_getppid, 0) < 0)
3307                         exit(1);
3308                 ret = syscall(__NR_getppid);
3309                 exit(ret >= 0 || errno != ENOSYS);
3310         }
3311
3312         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3313         EXPECT_EQ(true, WIFEXITED(status));
3314         EXPECT_EQ(0, WEXITSTATUS(status));
3315
3316         /* Add some no-op filters for grins. */
3317         EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3318         EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3319         EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3320         EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
3321
3322         /* Check that the basic notification machinery works */
3323         listener = user_notif_syscall(__NR_getppid,
3324                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3325         ASSERT_GE(listener, 0);
3326
3327         /* Installing a second listener in the chain should EBUSY */
3328         EXPECT_EQ(user_notif_syscall(__NR_getppid,
3329                                      SECCOMP_FILTER_FLAG_NEW_LISTENER),
3330                   -1);
3331         EXPECT_EQ(errno, EBUSY);
3332
3333         pid = fork();
3334         ASSERT_GE(pid, 0);
3335
3336         if (pid == 0) {
3337                 ret = syscall(__NR_getppid);
3338                 exit(ret != USER_NOTIF_MAGIC);
3339         }
3340
3341         pollfd.fd = listener;
3342         pollfd.events = POLLIN | POLLOUT;
3343
3344         EXPECT_GT(poll(&pollfd, 1, -1), 0);
3345         EXPECT_EQ(pollfd.revents, POLLIN);
3346
3347         /* Test that we can't pass garbage to the kernel. */
3348         memset(&req, 0, sizeof(req));
3349         req.pid = -1;
3350         errno = 0;
3351         ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req);
3352         EXPECT_EQ(-1, ret);
3353         EXPECT_EQ(EINVAL, errno);
3354
3355         if (ret) {
3356                 req.pid = 0;
3357                 EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3358         }
3359
3360         pollfd.fd = listener;
3361         pollfd.events = POLLIN | POLLOUT;
3362
3363         EXPECT_GT(poll(&pollfd, 1, -1), 0);
3364         EXPECT_EQ(pollfd.revents, POLLOUT);
3365
3366         EXPECT_EQ(req.data.nr,  __NR_getppid);
3367
3368         resp.id = req.id;
3369         resp.error = 0;
3370         resp.val = USER_NOTIF_MAGIC;
3371
3372         /* check that we make sure flags == 0 */
3373         resp.flags = 1;
3374         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3375         EXPECT_EQ(errno, EINVAL);
3376
3377         resp.flags = 0;
3378         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3379
3380         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3381         EXPECT_EQ(true, WIFEXITED(status));
3382         EXPECT_EQ(0, WEXITSTATUS(status));
3383 }
3384
3385 TEST(user_notification_with_tsync)
3386 {
3387         int ret;
3388         unsigned int flags;
3389
3390         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3391         ASSERT_EQ(0, ret) {
3392                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3393         }
3394
3395         /* these were exclusive */
3396         flags = SECCOMP_FILTER_FLAG_NEW_LISTENER |
3397                 SECCOMP_FILTER_FLAG_TSYNC;
3398         ASSERT_EQ(-1, user_notif_syscall(__NR_getppid, flags));
3399         ASSERT_EQ(EINVAL, errno);
3400
3401         /* but now they're not */
3402         flags |= SECCOMP_FILTER_FLAG_TSYNC_ESRCH;
3403         ret = user_notif_syscall(__NR_getppid, flags);
3404         close(ret);
3405         ASSERT_LE(0, ret);
3406 }
3407
3408 TEST(user_notification_kill_in_middle)
3409 {
3410         pid_t pid;
3411         long ret;
3412         int listener;
3413         struct seccomp_notif req = {};
3414         struct seccomp_notif_resp resp = {};
3415
3416         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3417         ASSERT_EQ(0, ret) {
3418                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3419         }
3420
3421         listener = user_notif_syscall(__NR_getppid,
3422                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3423         ASSERT_GE(listener, 0);
3424
3425         /*
3426          * Check that nothing bad happens when we kill the task in the middle
3427          * of a syscall.
3428          */
3429         pid = fork();
3430         ASSERT_GE(pid, 0);
3431
3432         if (pid == 0) {
3433                 ret = syscall(__NR_getppid);
3434                 exit(ret != USER_NOTIF_MAGIC);
3435         }
3436
3437         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3438         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id), 0);
3439
3440         EXPECT_EQ(kill(pid, SIGKILL), 0);
3441         EXPECT_EQ(waitpid(pid, NULL, 0), pid);
3442
3443         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id), -1);
3444
3445         resp.id = req.id;
3446         ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp);
3447         EXPECT_EQ(ret, -1);
3448         EXPECT_EQ(errno, ENOENT);
3449 }
3450
3451 static int handled = -1;
3452
3453 static void signal_handler(int signal)
3454 {
3455         if (write(handled, "c", 1) != 1)
3456                 perror("write from signal");
3457 }
3458
3459 TEST(user_notification_signal)
3460 {
3461         pid_t pid;
3462         long ret;
3463         int status, listener, sk_pair[2];
3464         struct seccomp_notif req = {};
3465         struct seccomp_notif_resp resp = {};
3466         char c;
3467
3468         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3469         ASSERT_EQ(0, ret) {
3470                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3471         }
3472
3473         ASSERT_EQ(socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair), 0);
3474
3475         listener = user_notif_syscall(__NR_gettid,
3476                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3477         ASSERT_GE(listener, 0);
3478
3479         pid = fork();
3480         ASSERT_GE(pid, 0);
3481
3482         if (pid == 0) {
3483                 close(sk_pair[0]);
3484                 handled = sk_pair[1];
3485                 if (signal(SIGUSR1, signal_handler) == SIG_ERR) {
3486                         perror("signal");
3487                         exit(1);
3488                 }
3489                 /*
3490                  * ERESTARTSYS behavior is a bit hard to test, because we need
3491                  * to rely on a signal that has not yet been handled. Let's at
3492                  * least check that the error code gets propagated through, and
3493                  * hope that it doesn't break when there is actually a signal :)
3494                  */
3495                 ret = syscall(__NR_gettid);
3496                 exit(!(ret == -1 && errno == 512));
3497         }
3498
3499         close(sk_pair[1]);
3500
3501         memset(&req, 0, sizeof(req));
3502         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3503
3504         EXPECT_EQ(kill(pid, SIGUSR1), 0);
3505
3506         /*
3507          * Make sure the signal really is delivered, which means we're not
3508          * stuck in the user notification code any more and the notification
3509          * should be dead.
3510          */
3511         EXPECT_EQ(read(sk_pair[0], &c, 1), 1);
3512
3513         resp.id = req.id;
3514         resp.error = -EPERM;
3515         resp.val = 0;
3516
3517         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3518         EXPECT_EQ(errno, ENOENT);
3519
3520         memset(&req, 0, sizeof(req));
3521         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3522
3523         resp.id = req.id;
3524         resp.error = -512; /* -ERESTARTSYS */
3525         resp.val = 0;
3526
3527         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3528
3529         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3530         EXPECT_EQ(true, WIFEXITED(status));
3531         EXPECT_EQ(0, WEXITSTATUS(status));
3532 }
3533
3534 TEST(user_notification_closed_listener)
3535 {
3536         pid_t pid;
3537         long ret;
3538         int status, listener;
3539
3540         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3541         ASSERT_EQ(0, ret) {
3542                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3543         }
3544
3545         listener = user_notif_syscall(__NR_getppid,
3546                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3547         ASSERT_GE(listener, 0);
3548
3549         /*
3550          * Check that we get an ENOSYS when the listener is closed.
3551          */
3552         pid = fork();
3553         ASSERT_GE(pid, 0);
3554         if (pid == 0) {
3555                 close(listener);
3556                 ret = syscall(__NR_getppid);
3557                 exit(ret != -1 && errno != ENOSYS);
3558         }
3559
3560         close(listener);
3561
3562         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3563         EXPECT_EQ(true, WIFEXITED(status));
3564         EXPECT_EQ(0, WEXITSTATUS(status));
3565 }
3566
3567 /*
3568  * Check that a pid in a child namespace still shows up as valid in ours.
3569  */
3570 TEST(user_notification_child_pid_ns)
3571 {
3572         pid_t pid;
3573         int status, listener;
3574         struct seccomp_notif req = {};
3575         struct seccomp_notif_resp resp = {};
3576
3577         ASSERT_EQ(unshare(CLONE_NEWUSER | CLONE_NEWPID), 0) {
3578                 if (errno == EINVAL)
3579                         SKIP(return, "kernel missing CLONE_NEWUSER support");
3580         };
3581
3582         listener = user_notif_syscall(__NR_getppid,
3583                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3584         ASSERT_GE(listener, 0);
3585
3586         pid = fork();
3587         ASSERT_GE(pid, 0);
3588
3589         if (pid == 0)
3590                 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
3591
3592         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3593         EXPECT_EQ(req.pid, pid);
3594
3595         resp.id = req.id;
3596         resp.error = 0;
3597         resp.val = USER_NOTIF_MAGIC;
3598
3599         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3600
3601         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3602         EXPECT_EQ(true, WIFEXITED(status));
3603         EXPECT_EQ(0, WEXITSTATUS(status));
3604         close(listener);
3605 }
3606
3607 /*
3608  * Check that a pid in a sibling (i.e. unrelated) namespace shows up as 0, i.e.
3609  * invalid.
3610  */
3611 TEST(user_notification_sibling_pid_ns)
3612 {
3613         pid_t pid, pid2;
3614         int status, listener;
3615         struct seccomp_notif req = {};
3616         struct seccomp_notif_resp resp = {};
3617
3618         ASSERT_EQ(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0), 0) {
3619                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3620         }
3621
3622         listener = user_notif_syscall(__NR_getppid,
3623                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3624         ASSERT_GE(listener, 0);
3625
3626         pid = fork();
3627         ASSERT_GE(pid, 0);
3628
3629         if (pid == 0) {
3630                 ASSERT_EQ(unshare(CLONE_NEWPID), 0);
3631
3632                 pid2 = fork();
3633                 ASSERT_GE(pid2, 0);
3634
3635                 if (pid2 == 0)
3636                         exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
3637
3638                 EXPECT_EQ(waitpid(pid2, &status, 0), pid2);
3639                 EXPECT_EQ(true, WIFEXITED(status));
3640                 EXPECT_EQ(0, WEXITSTATUS(status));
3641                 exit(WEXITSTATUS(status));
3642         }
3643
3644         /* Create the sibling ns, and sibling in it. */
3645         ASSERT_EQ(unshare(CLONE_NEWPID), 0) {
3646                 if (errno == EPERM)
3647                         SKIP(return, "CLONE_NEWPID requires CAP_SYS_ADMIN");
3648         }
3649         ASSERT_EQ(errno, 0);
3650
3651         pid2 = fork();
3652         ASSERT_GE(pid2, 0);
3653
3654         if (pid2 == 0) {
3655                 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3656                 /*
3657                  * The pid should be 0, i.e. the task is in some namespace that
3658                  * we can't "see".
3659                  */
3660                 EXPECT_EQ(req.pid, 0);
3661
3662                 resp.id = req.id;
3663                 resp.error = 0;
3664                 resp.val = USER_NOTIF_MAGIC;
3665
3666                 ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3667                 exit(0);
3668         }
3669
3670         close(listener);
3671
3672         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3673         EXPECT_EQ(true, WIFEXITED(status));
3674         EXPECT_EQ(0, WEXITSTATUS(status));
3675
3676         EXPECT_EQ(waitpid(pid2, &status, 0), pid2);
3677         EXPECT_EQ(true, WIFEXITED(status));
3678         EXPECT_EQ(0, WEXITSTATUS(status));
3679 }
3680
3681 TEST(user_notification_fault_recv)
3682 {
3683         pid_t pid;
3684         int status, listener;
3685         struct seccomp_notif req = {};
3686         struct seccomp_notif_resp resp = {};
3687
3688         ASSERT_EQ(unshare(CLONE_NEWUSER), 0);
3689
3690         listener = user_notif_syscall(__NR_getppid,
3691                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3692         ASSERT_GE(listener, 0);
3693
3694         pid = fork();
3695         ASSERT_GE(pid, 0);
3696
3697         if (pid == 0)
3698                 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
3699
3700         /* Do a bad recv() */
3701         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, NULL), -1);
3702         EXPECT_EQ(errno, EFAULT);
3703
3704         /* We should still be able to receive this notification, though. */
3705         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3706         EXPECT_EQ(req.pid, pid);
3707
3708         resp.id = req.id;
3709         resp.error = 0;
3710         resp.val = USER_NOTIF_MAGIC;
3711
3712         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
3713
3714         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3715         EXPECT_EQ(true, WIFEXITED(status));
3716         EXPECT_EQ(0, WEXITSTATUS(status));
3717 }
3718
3719 TEST(seccomp_get_notif_sizes)
3720 {
3721         struct seccomp_notif_sizes sizes;
3722
3723         ASSERT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0);
3724         EXPECT_EQ(sizes.seccomp_notif, sizeof(struct seccomp_notif));
3725         EXPECT_EQ(sizes.seccomp_notif_resp, sizeof(struct seccomp_notif_resp));
3726 }
3727
3728 TEST(user_notification_continue)
3729 {
3730         pid_t pid;
3731         long ret;
3732         int status, listener;
3733         struct seccomp_notif req = {};
3734         struct seccomp_notif_resp resp = {};
3735         struct pollfd pollfd;
3736
3737         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3738         ASSERT_EQ(0, ret) {
3739                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3740         }
3741
3742         listener = user_notif_syscall(__NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER);
3743         ASSERT_GE(listener, 0);
3744
3745         pid = fork();
3746         ASSERT_GE(pid, 0);
3747
3748         if (pid == 0) {
3749                 int dup_fd, pipe_fds[2];
3750                 pid_t self;
3751
3752                 ASSERT_GE(pipe(pipe_fds), 0);
3753
3754                 dup_fd = dup(pipe_fds[0]);
3755                 ASSERT_GE(dup_fd, 0);
3756                 EXPECT_NE(pipe_fds[0], dup_fd);
3757
3758                 self = getpid();
3759                 ASSERT_EQ(filecmp(self, self, pipe_fds[0], dup_fd), 0);
3760                 exit(0);
3761         }
3762
3763         pollfd.fd = listener;
3764         pollfd.events = POLLIN | POLLOUT;
3765
3766         EXPECT_GT(poll(&pollfd, 1, -1), 0);
3767         EXPECT_EQ(pollfd.revents, POLLIN);
3768
3769         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3770
3771         pollfd.fd = listener;
3772         pollfd.events = POLLIN | POLLOUT;
3773
3774         EXPECT_GT(poll(&pollfd, 1, -1), 0);
3775         EXPECT_EQ(pollfd.revents, POLLOUT);
3776
3777         EXPECT_EQ(req.data.nr, __NR_dup);
3778
3779         resp.id = req.id;
3780         resp.flags = SECCOMP_USER_NOTIF_FLAG_CONTINUE;
3781
3782         /*
3783          * Verify that setting SECCOMP_USER_NOTIF_FLAG_CONTINUE enforces other
3784          * args be set to 0.
3785          */
3786         resp.error = 0;
3787         resp.val = USER_NOTIF_MAGIC;
3788         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3789         EXPECT_EQ(errno, EINVAL);
3790
3791         resp.error = USER_NOTIF_MAGIC;
3792         resp.val = 0;
3793         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1);
3794         EXPECT_EQ(errno, EINVAL);
3795
3796         resp.error = 0;
3797         resp.val = 0;
3798         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0) {
3799                 if (errno == EINVAL)
3800                         SKIP(goto skip, "Kernel does not support SECCOMP_USER_NOTIF_FLAG_CONTINUE");
3801         }
3802
3803 skip:
3804         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3805         EXPECT_EQ(true, WIFEXITED(status));
3806         EXPECT_EQ(0, WEXITSTATUS(status)) {
3807                 if (WEXITSTATUS(status) == 2) {
3808                         SKIP(return, "Kernel does not support kcmp() syscall");
3809                         return;
3810                 }
3811         }
3812 }
3813
3814 TEST(user_notification_filter_empty)
3815 {
3816         pid_t pid;
3817         long ret;
3818         int status;
3819         struct pollfd pollfd;
3820         struct __clone_args args = {
3821                 .flags = CLONE_FILES,
3822                 .exit_signal = SIGCHLD,
3823         };
3824
3825         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3826         ASSERT_EQ(0, ret) {
3827                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3828         }
3829
3830         pid = sys_clone3(&args, sizeof(args));
3831         ASSERT_GE(pid, 0);
3832
3833         if (pid == 0) {
3834                 int listener;
3835
3836                 listener = user_notif_syscall(__NR_mknodat, SECCOMP_FILTER_FLAG_NEW_LISTENER);
3837                 if (listener < 0)
3838                         _exit(EXIT_FAILURE);
3839
3840                 if (dup2(listener, 200) != 200)
3841                         _exit(EXIT_FAILURE);
3842
3843                 close(listener);
3844
3845                 _exit(EXIT_SUCCESS);
3846         }
3847
3848         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3849         EXPECT_EQ(true, WIFEXITED(status));
3850         EXPECT_EQ(0, WEXITSTATUS(status));
3851
3852         /*
3853          * The seccomp filter has become unused so we should be notified once
3854          * the kernel gets around to cleaning up task struct.
3855          */
3856         pollfd.fd = 200;
3857         pollfd.events = POLLHUP;
3858
3859         EXPECT_GT(poll(&pollfd, 1, 2000), 0);
3860         EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0);
3861 }
3862
3863 static void *do_thread(void *data)
3864 {
3865         return NULL;
3866 }
3867
3868 TEST(user_notification_filter_empty_threaded)
3869 {
3870         pid_t pid;
3871         long ret;
3872         int status;
3873         struct pollfd pollfd;
3874         struct __clone_args args = {
3875                 .flags = CLONE_FILES,
3876                 .exit_signal = SIGCHLD,
3877         };
3878
3879         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3880         ASSERT_EQ(0, ret) {
3881                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3882         }
3883
3884         pid = sys_clone3(&args, sizeof(args));
3885         ASSERT_GE(pid, 0);
3886
3887         if (pid == 0) {
3888                 pid_t pid1, pid2;
3889                 int listener, status;
3890                 pthread_t thread;
3891
3892                 listener = user_notif_syscall(__NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER);
3893                 if (listener < 0)
3894                         _exit(EXIT_FAILURE);
3895
3896                 if (dup2(listener, 200) != 200)
3897                         _exit(EXIT_FAILURE);
3898
3899                 close(listener);
3900
3901                 pid1 = fork();
3902                 if (pid1 < 0)
3903                         _exit(EXIT_FAILURE);
3904
3905                 if (pid1 == 0)
3906                         _exit(EXIT_SUCCESS);
3907
3908                 pid2 = fork();
3909                 if (pid2 < 0)
3910                         _exit(EXIT_FAILURE);
3911
3912                 if (pid2 == 0)
3913                         _exit(EXIT_SUCCESS);
3914
3915                 if (pthread_create(&thread, NULL, do_thread, NULL) ||
3916                     pthread_join(thread, NULL))
3917                         _exit(EXIT_FAILURE);
3918
3919                 if (pthread_create(&thread, NULL, do_thread, NULL) ||
3920                     pthread_join(thread, NULL))
3921                         _exit(EXIT_FAILURE);
3922
3923                 if (waitpid(pid1, &status, 0) != pid1 || !WIFEXITED(status) ||
3924                     WEXITSTATUS(status))
3925                         _exit(EXIT_FAILURE);
3926
3927                 if (waitpid(pid2, &status, 0) != pid2 || !WIFEXITED(status) ||
3928                     WEXITSTATUS(status))
3929                         _exit(EXIT_FAILURE);
3930
3931                 exit(EXIT_SUCCESS);
3932         }
3933
3934         EXPECT_EQ(waitpid(pid, &status, 0), pid);
3935         EXPECT_EQ(true, WIFEXITED(status));
3936         EXPECT_EQ(0, WEXITSTATUS(status));
3937
3938         /*
3939          * The seccomp filter has become unused so we should be notified once
3940          * the kernel gets around to cleaning up task struct.
3941          */
3942         pollfd.fd = 200;
3943         pollfd.events = POLLHUP;
3944
3945         EXPECT_GT(poll(&pollfd, 1, 2000), 0);
3946         EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0);
3947 }
3948
3949 TEST(user_notification_addfd)
3950 {
3951         pid_t pid;
3952         long ret;
3953         int status, listener, memfd, fd;
3954         struct seccomp_notif_addfd addfd = {};
3955         struct seccomp_notif_addfd_small small = {};
3956         struct seccomp_notif_addfd_big big = {};
3957         struct seccomp_notif req = {};
3958         struct seccomp_notif_resp resp = {};
3959         /* 100 ms */
3960         struct timespec delay = { .tv_nsec = 100000000 };
3961
3962         memfd = memfd_create("test", 0);
3963         ASSERT_GE(memfd, 0);
3964
3965         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3966         ASSERT_EQ(0, ret) {
3967                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3968         }
3969
3970         /* Check that the basic notification machinery works */
3971         listener = user_notif_syscall(__NR_getppid,
3972                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
3973         ASSERT_GE(listener, 0);
3974
3975         pid = fork();
3976         ASSERT_GE(pid, 0);
3977
3978         if (pid == 0) {
3979                 if (syscall(__NR_getppid) != USER_NOTIF_MAGIC)
3980                         exit(1);
3981                 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
3982         }
3983
3984         ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
3985
3986         addfd.srcfd = memfd;
3987         addfd.newfd = 0;
3988         addfd.id = req.id;
3989         addfd.flags = 0x0;
3990
3991         /* Verify bad newfd_flags cannot be set */
3992         addfd.newfd_flags = ~O_CLOEXEC;
3993         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
3994         EXPECT_EQ(errno, EINVAL);
3995         addfd.newfd_flags = O_CLOEXEC;
3996
3997         /* Verify bad flags cannot be set */
3998         addfd.flags = 0xff;
3999         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4000         EXPECT_EQ(errno, EINVAL);
4001         addfd.flags = 0;
4002
4003         /* Verify that remote_fd cannot be set without setting flags */
4004         addfd.newfd = 1;
4005         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4006         EXPECT_EQ(errno, EINVAL);
4007         addfd.newfd = 0;
4008
4009         /* Verify small size cannot be set */
4010         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_SMALL, &small), -1);
4011         EXPECT_EQ(errno, EINVAL);
4012
4013         /* Verify we can't send bits filled in unknown buffer area */
4014         memset(&big, 0xAA, sizeof(big));
4015         big.addfd = addfd;
4016         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_BIG, &big), -1);
4017         EXPECT_EQ(errno, E2BIG);
4018
4019
4020         /* Verify we can set an arbitrary remote fd */
4021         fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
4022         EXPECT_GE(fd, 0);
4023         EXPECT_EQ(filecmp(getpid(), pid, memfd, fd), 0);
4024
4025         /* Verify we can set an arbitrary remote fd with large size */
4026         memset(&big, 0x0, sizeof(big));
4027         big.addfd = addfd;
4028         fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD_BIG, &big);
4029         EXPECT_GE(fd, 0);
4030
4031         /* Verify we can set a specific remote fd */
4032         addfd.newfd = 42;
4033         addfd.flags = SECCOMP_ADDFD_FLAG_SETFD;
4034         fd = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
4035         EXPECT_EQ(fd, 42);
4036         EXPECT_EQ(filecmp(getpid(), pid, memfd, fd), 0);
4037
4038         /* Resume syscall */
4039         resp.id = req.id;
4040         resp.error = 0;
4041         resp.val = USER_NOTIF_MAGIC;
4042         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4043
4044         /*
4045          * This sets the ID of the ADD FD to the last request plus 1. The
4046          * notification ID increments 1 per notification.
4047          */
4048         addfd.id = req.id + 1;
4049
4050         /* This spins until the underlying notification is generated */
4051         while (ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd) != -1 &&
4052                errno != -EINPROGRESS)
4053                 nanosleep(&delay, NULL);
4054
4055         memset(&req, 0, sizeof(req));
4056         ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4057         ASSERT_EQ(addfd.id, req.id);
4058
4059         resp.id = req.id;
4060         resp.error = 0;
4061         resp.val = USER_NOTIF_MAGIC;
4062         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4063
4064         /* Wait for child to finish. */
4065         EXPECT_EQ(waitpid(pid, &status, 0), pid);
4066         EXPECT_EQ(true, WIFEXITED(status));
4067         EXPECT_EQ(0, WEXITSTATUS(status));
4068
4069         close(memfd);
4070 }
4071
4072 TEST(user_notification_addfd_rlimit)
4073 {
4074         pid_t pid;
4075         long ret;
4076         int status, listener, memfd;
4077         struct seccomp_notif_addfd addfd = {};
4078         struct seccomp_notif req = {};
4079         struct seccomp_notif_resp resp = {};
4080         const struct rlimit lim = {
4081                 .rlim_cur       = 0,
4082                 .rlim_max       = 0,
4083         };
4084
4085         memfd = memfd_create("test", 0);
4086         ASSERT_GE(memfd, 0);
4087
4088         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
4089         ASSERT_EQ(0, ret) {
4090                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
4091         }
4092
4093         /* Check that the basic notification machinery works */
4094         listener = user_notif_syscall(__NR_getppid,
4095                                       SECCOMP_FILTER_FLAG_NEW_LISTENER);
4096         ASSERT_GE(listener, 0);
4097
4098         pid = fork();
4099         ASSERT_GE(pid, 0);
4100
4101         if (pid == 0)
4102                 exit(syscall(__NR_getppid) != USER_NOTIF_MAGIC);
4103
4104
4105         ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
4106
4107         ASSERT_EQ(prlimit(pid, RLIMIT_NOFILE, &lim, NULL), 0);
4108
4109         addfd.srcfd = memfd;
4110         addfd.newfd_flags = O_CLOEXEC;
4111         addfd.newfd = 0;
4112         addfd.id = req.id;
4113         addfd.flags = 0;
4114
4115         /* Should probably spot check /proc/sys/fs/file-nr */
4116         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4117         EXPECT_EQ(errno, EMFILE);
4118
4119         addfd.newfd = 100;
4120         addfd.flags = SECCOMP_ADDFD_FLAG_SETFD;
4121         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), -1);
4122         EXPECT_EQ(errno, EBADF);
4123
4124         resp.id = req.id;
4125         resp.error = 0;
4126         resp.val = USER_NOTIF_MAGIC;
4127
4128         EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0);
4129
4130         /* Wait for child to finish. */
4131         EXPECT_EQ(waitpid(pid, &status, 0), pid);
4132         EXPECT_EQ(true, WIFEXITED(status));
4133         EXPECT_EQ(0, WEXITSTATUS(status));
4134
4135         close(memfd);
4136 }
4137
4138 /*
4139  * TODO:
4140  * - expand NNP testing
4141  * - better arch-specific TRACE and TRAP handlers.
4142  * - endianness checking when appropriate
4143  * - 64-bit arg prodding
4144  * - arch value testing (x86 modes especially)
4145  * - verify that FILTER_FLAG_LOG filters generate log messages
4146  * - verify that RET_LOG generates log messages
4147  */
4148
4149 TEST_HARNESS_MAIN