1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
6 #include <sys/eventfd.h>
8 #include <sys/personality.h>
10 #include <sys/syscall.h>
11 #include <sys/types.h>
14 #include "alloc-util.h"
18 #include "memory-util.h"
19 #include "missing_sched.h"
21 #include "nulstr-util.h"
22 #include "process-util.h"
23 #include "raw-clone.h"
25 #include "seccomp-util.h"
27 #include "string-util.h"
29 #include "tmpfile-util.h"
32 /* __NR_socket may be invalid due to libseccomp */
33 #if !defined(__NR_socket) || __NR_socket < 0 || defined(__i386__) || defined(__s390x__) || defined(__s390__)
34 /* On these archs, socket() is implemented via the socketcall() syscall multiplexer,
35 * and we can't restrict it hence via seccomp. */
36 # define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 1
38 # define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 0
41 static void test_seccomp_arch_to_string(void) {
45 log_info("/* %s */", __func__
);
47 a
= seccomp_arch_native();
49 name
= seccomp_arch_to_string(a
);
51 assert_se(seccomp_arch_from_string(name
, &b
) >= 0);
55 static void test_architecture_table(void) {
58 log_info("/* %s */", __func__
);
76 #ifdef SCMP_ARCH_RISCV64
83 assert_se(seccomp_arch_from_string(n
, &c
) >= 0);
84 n2
= seccomp_arch_to_string(c
);
85 log_info("seccomp-arch: %s → 0x%"PRIx32
" → %s", n
, c
, n2
);
86 assert_se(streq_ptr(n
, n2
));
90 static void test_syscall_filter_set_find(void) {
91 log_info("/* %s */", __func__
);
93 assert_se(!syscall_filter_set_find(NULL
));
94 assert_se(!syscall_filter_set_find(""));
95 assert_se(!syscall_filter_set_find("quux"));
96 assert_se(!syscall_filter_set_find("@quux"));
98 assert_se(syscall_filter_set_find("@clock") == syscall_filter_sets
+ SYSCALL_FILTER_SET_CLOCK
);
99 assert_se(syscall_filter_set_find("@default") == syscall_filter_sets
+ SYSCALL_FILTER_SET_DEFAULT
);
100 assert_se(syscall_filter_set_find("@raw-io") == syscall_filter_sets
+ SYSCALL_FILTER_SET_RAW_IO
);
103 static void test_filter_sets(void) {
104 log_info("/* %s */", __func__
);
106 if (!is_seccomp_available()) {
107 log_notice("Seccomp not available, skipping %s", __func__
);
110 if (geteuid() != 0) {
111 log_notice("Not root, skipping %s", __func__
);
115 for (unsigned i
= 0; i
< _SYSCALL_FILTER_SET_MAX
; i
++) {
118 log_info("Testing %s", syscall_filter_sets
[i
].name
);
123 if (pid
== 0) { /* Child? */
126 /* If we look at the default set (or one that includes it), allow-list instead of deny-list */
127 if (IN_SET(i
, SYSCALL_FILTER_SET_DEFAULT
,
128 SYSCALL_FILTER_SET_SYSTEM_SERVICE
,
129 SYSCALL_FILTER_SET_KNOWN
))
130 r
= seccomp_load_syscall_filter_set(SCMP_ACT_ERRNO(EUCLEAN
), syscall_filter_sets
+ i
, SCMP_ACT_ALLOW
, true);
132 r
= seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW
, syscall_filter_sets
+ i
, SCMP_ACT_ERRNO(EUCLEAN
), true);
136 /* Test the sycall filter with one random system call */
137 fd
= eventfd(0, EFD_NONBLOCK
|EFD_CLOEXEC
);
138 if (IN_SET(i
, SYSCALL_FILTER_SET_IO_EVENT
, SYSCALL_FILTER_SET_DEFAULT
))
139 assert_se(fd
< 0 && errno
== EUCLEAN
);
148 assert_se(wait_for_terminate_and_check(syscall_filter_sets
[i
].name
, pid
, WAIT_LOG
) == EXIT_SUCCESS
);
152 static void test_filter_sets_ordered(void) {
153 log_info("/* %s */", __func__
);
155 /* Ensure "@default" always remains at the beginning of the list */
156 assert_se(SYSCALL_FILTER_SET_DEFAULT
== 0);
157 assert_se(streq(syscall_filter_sets
[0].name
, "@default"));
159 /* Ensure "@known" always remains at the end of the list */
160 assert_se(SYSCALL_FILTER_SET_KNOWN
== _SYSCALL_FILTER_SET_MAX
- 1);
161 assert_se(streq(syscall_filter_sets
[SYSCALL_FILTER_SET_KNOWN
].name
, "@known"));
163 for (size_t i
= 0; i
< _SYSCALL_FILTER_SET_MAX
; i
++) {
164 const char *k
, *p
= NULL
;
166 /* Make sure each group has a description */
167 assert_se(!isempty(syscall_filter_sets
[0].help
));
169 /* Make sure the groups are ordered alphabetically, except for the first and last entries */
170 assert_se(i
< 2 || i
== _SYSCALL_FILTER_SET_MAX
- 1 ||
171 strcmp(syscall_filter_sets
[i
-1].name
, syscall_filter_sets
[i
].name
) < 0);
173 NULSTR_FOREACH(k
, syscall_filter_sets
[i
].value
) {
175 /* Ensure each syscall list is in itself ordered, but groups before names */
177 (*p
== '@' && *k
!= '@') ||
178 (((*p
== '@' && *k
== '@') ||
179 (*p
!= '@' && *k
!= '@')) &&
187 static void test_restrict_namespace(void) {
192 if (!have_namespaces()) {
193 log_notice("Testing without namespaces, skipping %s", __func__
);
197 log_info("/* %s */", __func__
);
199 assert_se(namespace_flags_to_string(0, &s
) == 0 && isempty(s
));
201 assert_se(namespace_flags_to_string(CLONE_NEWNS
, &s
) == 0 && streq(s
, "mnt"));
203 assert_se(namespace_flags_to_string(CLONE_NEWNS
|CLONE_NEWIPC
, &s
) == 0 && streq(s
, "ipc mnt"));
205 assert_se(namespace_flags_to_string(CLONE_NEWCGROUP
, &s
) == 0 && streq(s
, "cgroup"));
208 assert_se(namespace_flags_from_string("mnt", &ul
) == 0 && ul
== CLONE_NEWNS
);
209 assert_se(namespace_flags_from_string(NULL
, &ul
) == 0 && ul
== 0);
210 assert_se(namespace_flags_from_string("", &ul
) == 0 && ul
== 0);
211 assert_se(namespace_flags_from_string("uts", &ul
) == 0 && ul
== CLONE_NEWUTS
);
212 assert_se(namespace_flags_from_string("mnt uts ipc", &ul
) == 0 && ul
== (CLONE_NEWNS
|CLONE_NEWUTS
|CLONE_NEWIPC
));
214 assert_se(namespace_flags_to_string(CLONE_NEWUTS
, &s
) == 0 && streq(s
, "uts"));
215 assert_se(namespace_flags_from_string(s
, &ul
) == 0 && ul
== CLONE_NEWUTS
);
217 assert_se(namespace_flags_from_string("ipc", &ul
) == 0 && ul
== CLONE_NEWIPC
);
218 assert_se(namespace_flags_to_string(ul
, &s
) == 0 && streq(s
, "ipc"));
221 assert_se(namespace_flags_to_string(NAMESPACE_FLAGS_ALL
, &s
) == 0);
222 assert_se(streq(s
, "cgroup ipc net mnt pid user uts"));
223 assert_se(namespace_flags_from_string(s
, &ul
) == 0 && ul
== NAMESPACE_FLAGS_ALL
);
226 if (!is_seccomp_available()) {
227 log_notice("Seccomp not available, skipping remaining tests in %s", __func__
);
230 if (geteuid() != 0) {
231 log_notice("Not root, skipping remaining tests in %s", __func__
);
240 assert_se(seccomp_restrict_namespaces(CLONE_NEWNS
|CLONE_NEWNET
) >= 0);
242 assert_se(unshare(CLONE_NEWNS
) == 0);
243 assert_se(unshare(CLONE_NEWNET
) == 0);
244 assert_se(unshare(CLONE_NEWUTS
) == -1);
245 assert_se(errno
== EPERM
);
246 assert_se(unshare(CLONE_NEWIPC
) == -1);
247 assert_se(errno
== EPERM
);
248 assert_se(unshare(CLONE_NEWNET
|CLONE_NEWUTS
) == -1);
249 assert_se(errno
== EPERM
);
251 /* We use fd 0 (stdin) here, which of course will fail with EINVAL on setns(). Except of course our
252 * seccomp filter worked, and hits first and makes it return EPERM */
253 assert_se(setns(0, CLONE_NEWNS
) == -1);
254 assert_se(errno
== EINVAL
);
255 assert_se(setns(0, CLONE_NEWNET
) == -1);
256 assert_se(errno
== EINVAL
);
257 assert_se(setns(0, CLONE_NEWUTS
) == -1);
258 assert_se(errno
== EPERM
);
259 assert_se(setns(0, CLONE_NEWIPC
) == -1);
260 assert_se(errno
== EPERM
);
261 assert_se(setns(0, CLONE_NEWNET
|CLONE_NEWUTS
) == -1);
262 assert_se(errno
== EPERM
);
263 assert_se(setns(0, 0) == -1);
264 assert_se(errno
== EPERM
);
266 pid
= raw_clone(CLONE_NEWNS
);
270 pid
= raw_clone(CLONE_NEWNET
);
274 pid
= raw_clone(CLONE_NEWUTS
);
276 assert_se(errno
== EPERM
);
277 pid
= raw_clone(CLONE_NEWIPC
);
279 assert_se(errno
== EPERM
);
280 pid
= raw_clone(CLONE_NEWNET
|CLONE_NEWUTS
);
282 assert_se(errno
== EPERM
);
287 assert_se(wait_for_terminate_and_check("nsseccomp", pid
, WAIT_LOG
) == EXIT_SUCCESS
);
290 static void test_protect_sysctl(void) {
292 _cleanup_free_
char *seccomp
= NULL
;
294 log_info("/* %s */", __func__
);
296 if (!is_seccomp_available()) {
297 log_notice("Seccomp not available, skipping %s", __func__
);
300 if (geteuid() != 0) {
301 log_notice("Not root, skipping %s", __func__
);
305 /* in containers _sysctl() is likely missing anyway */
306 if (detect_container() > 0) {
307 log_notice("Testing in container, skipping %s", __func__
);
311 assert_se(get_proc_field("/proc/self/status", "Seccomp", WHITESPACE
, &seccomp
) == 0);
312 if (!streq(seccomp
, "0"))
313 log_warning("Warning: seccomp filter detected, results may be unreliable for %s", __func__
);
319 #if defined __NR__sysctl && __NR__sysctl >= 0
320 assert_se(syscall(__NR__sysctl
, NULL
) < 0);
321 assert_se(IN_SET(errno
, EFAULT
, ENOSYS
));
324 assert_se(seccomp_protect_sysctl() >= 0);
326 #if defined __NR__sysctl && __NR__sysctl >= 0
327 assert_se(syscall(__NR__sysctl
, 0, 0, 0) < 0);
328 assert_se(errno
== EPERM
);
334 assert_se(wait_for_terminate_and_check("sysctlseccomp", pid
, WAIT_LOG
) == EXIT_SUCCESS
);
337 static void test_protect_syslog(void) {
340 log_info("/* %s */", __func__
);
342 if (!is_seccomp_available()) {
343 log_notice("Seccomp not available, skipping %s", __func__
);
346 if (geteuid() != 0) {
347 log_notice("Not root, skipping %s", __func__
);
351 /* in containers syslog() is likely missing anyway */
352 if (detect_container() > 0) {
353 log_notice("Testing in container, skipping %s", __func__
);
361 #if defined __NR_syslog && __NR_syslog >= 0
362 assert_se(syscall(__NR_syslog
, -1, NULL
, 0) < 0);
363 assert_se(errno
== EINVAL
);
366 assert_se(seccomp_protect_syslog() >= 0);
368 #if defined __NR_syslog && __NR_syslog >= 0
369 assert_se(syscall(__NR_syslog
, 0, 0, 0) < 0);
370 assert_se(errno
== EPERM
);
376 assert_se(wait_for_terminate_and_check("syslogseccomp", pid
, WAIT_LOG
) == EXIT_SUCCESS
);
379 static void test_restrict_address_families(void) {
382 log_info("/* %s */", __func__
);
384 if (!is_seccomp_available()) {
385 log_notice("Seccomp not available, skipping %s", __func__
);
388 if (geteuid() != 0) {
389 log_notice("Not root, skipping %s", __func__
);
400 fd
= socket(AF_INET
, SOCK_DGRAM
, 0);
404 fd
= socket(AF_UNIX
, SOCK_DGRAM
, 0);
408 fd
= socket(AF_NETLINK
, SOCK_DGRAM
, 0);
412 assert_se(s
= set_new(NULL
));
413 assert_se(set_put(s
, INT_TO_PTR(AF_UNIX
)) >= 0);
415 assert_se(seccomp_restrict_address_families(s
, false) >= 0);
417 fd
= socket(AF_INET
, SOCK_DGRAM
, 0);
421 fd
= socket(AF_UNIX
, SOCK_DGRAM
, 0);
422 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
427 assert_se(errno
== EAFNOSUPPORT
);
430 fd
= socket(AF_NETLINK
, SOCK_DGRAM
, 0);
436 assert_se(set_put(s
, INT_TO_PTR(AF_INET
)) >= 0);
438 assert_se(seccomp_restrict_address_families(s
, true) >= 0);
440 fd
= socket(AF_INET
, SOCK_DGRAM
, 0);
444 fd
= socket(AF_UNIX
, SOCK_DGRAM
, 0);
445 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
450 assert_se(errno
== EAFNOSUPPORT
);
453 fd
= socket(AF_NETLINK
, SOCK_DGRAM
, 0);
454 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
459 assert_se(errno
== EAFNOSUPPORT
);
465 assert_se(wait_for_terminate_and_check("socketseccomp", pid
, WAIT_LOG
) == EXIT_SUCCESS
);
468 static void test_restrict_realtime(void) {
471 log_info("/* %s */", __func__
);
473 if (!is_seccomp_available()) {
474 log_notice("Seccomp not available, skipping %s", __func__
);
477 if (geteuid() != 0) {
478 log_notice("Not root, skipping %s", __func__
);
482 /* in containers RT privs are likely missing anyway */
483 if (detect_container() > 0) {
484 log_notice("Testing in container, skipping %s", __func__
);
492 assert_se(sched_setscheduler(0, SCHED_FIFO
, &(struct sched_param
) { .sched_priority
= 1 }) >= 0);
493 assert_se(sched_setscheduler(0, SCHED_RR
, &(struct sched_param
) { .sched_priority
= 1 }) >= 0);
494 assert_se(sched_setscheduler(0, SCHED_IDLE
, &(struct sched_param
) { .sched_priority
= 0 }) >= 0);
495 assert_se(sched_setscheduler(0, SCHED_BATCH
, &(struct sched_param
) { .sched_priority
= 0 }) >= 0);
496 assert_se(sched_setscheduler(0, SCHED_OTHER
, &(struct sched_param
) {}) >= 0);
498 assert_se(seccomp_restrict_realtime() >= 0);
500 assert_se(sched_setscheduler(0, SCHED_IDLE
, &(struct sched_param
) { .sched_priority
= 0 }) >= 0);
501 assert_se(sched_setscheduler(0, SCHED_BATCH
, &(struct sched_param
) { .sched_priority
= 0 }) >= 0);
502 assert_se(sched_setscheduler(0, SCHED_OTHER
, &(struct sched_param
) {}) >= 0);
504 assert_se(sched_setscheduler(0, SCHED_FIFO
, &(struct sched_param
) { .sched_priority
= 1 }) < 0);
505 assert_se(errno
== EPERM
);
506 assert_se(sched_setscheduler(0, SCHED_RR
, &(struct sched_param
) { .sched_priority
= 1 }) < 0);
507 assert_se(errno
== EPERM
);
512 assert_se(wait_for_terminate_and_check("realtimeseccomp", pid
, WAIT_LOG
) == EXIT_SUCCESS
);
515 static void test_memory_deny_write_execute_mmap(void) {
518 log_info("/* %s */", __func__
);
520 if (!is_seccomp_available()) {
521 log_notice("Seccomp not available, skipping %s", __func__
);
524 if (geteuid() != 0) {
525 log_notice("Not root, skipping %s", __func__
);
535 p
= mmap(NULL
, page_size(), PROT_WRITE
|PROT_EXEC
, MAP_PRIVATE
|MAP_ANONYMOUS
, -1,0);
536 assert_se(p
!= MAP_FAILED
);
537 assert_se(munmap(p
, page_size()) >= 0);
539 p
= mmap(NULL
, page_size(), PROT_WRITE
|PROT_READ
, MAP_PRIVATE
|MAP_ANONYMOUS
, -1,0);
540 assert_se(p
!= MAP_FAILED
);
541 assert_se(munmap(p
, page_size()) >= 0);
543 assert_se(seccomp_memory_deny_write_execute() >= 0);
545 p
= mmap(NULL
, page_size(), PROT_WRITE
|PROT_EXEC
, MAP_PRIVATE
|MAP_ANONYMOUS
, -1,0);
546 #if defined(__x86_64__) || defined(__i386__) || defined(__powerpc64__) || defined(__arm__) || defined(__aarch64__)
547 assert_se(p
== MAP_FAILED
);
548 assert_se(errno
== EPERM
);
550 /* Depending on kernel, libseccomp, and glibc versions, other architectures
551 * might fail or not. Let's not assert success. */
553 assert_se(munmap(p
, page_size()) == 0);
555 p
= mmap(NULL
, page_size(), PROT_WRITE
|PROT_READ
, MAP_PRIVATE
|MAP_ANONYMOUS
, -1,0);
556 assert_se(p
!= MAP_FAILED
);
557 assert_se(munmap(p
, page_size()) >= 0);
562 assert_se(wait_for_terminate_and_check("memoryseccomp-mmap", pid
, WAIT_LOG
) == EXIT_SUCCESS
);
565 static void test_memory_deny_write_execute_shmat(void) {
570 log_info("/* %s */", __func__
);
572 SECCOMP_FOREACH_LOCAL_ARCH(arch
) {
573 log_debug("arch %s: SCMP_SYS(mmap) = %d", seccomp_arch_to_string(arch
), SCMP_SYS(mmap
));
574 log_debug("arch %s: SCMP_SYS(mmap2) = %d", seccomp_arch_to_string(arch
), SCMP_SYS(mmap2
));
575 log_debug("arch %s: SCMP_SYS(shmget) = %d", seccomp_arch_to_string(arch
), SCMP_SYS(shmget
));
576 log_debug("arch %s: SCMP_SYS(shmat) = %d", seccomp_arch_to_string(arch
), SCMP_SYS(shmat
));
577 log_debug("arch %s: SCMP_SYS(shmdt) = %d", seccomp_arch_to_string(arch
), SCMP_SYS(shmdt
));
580 if (!is_seccomp_available()) {
581 log_notice("Seccomp not available, skipping %s", __func__
);
584 if (geteuid() != 0) {
585 log_notice("Not root, skipping %s", __func__
);
589 shmid
= shmget(IPC_PRIVATE
, page_size(), 0);
590 assert_se(shmid
>= 0);
598 p
= shmat(shmid
, NULL
, 0);
599 assert_se(p
!= MAP_FAILED
);
600 assert_se(shmdt(p
) == 0);
602 p
= shmat(shmid
, NULL
, SHM_EXEC
);
603 assert_se(p
!= MAP_FAILED
);
604 assert_se(shmdt(p
) == 0);
606 assert_se(seccomp_memory_deny_write_execute() >= 0);
608 p
= shmat(shmid
, NULL
, SHM_EXEC
);
609 log_debug_errno(p
== MAP_FAILED
? errno
: 0, "shmat(SHM_EXEC): %m");
610 #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__)
611 assert_se(p
== MAP_FAILED
);
612 assert_se(errno
== EPERM
);
614 /* Depending on kernel, libseccomp, and glibc versions, other architectures
615 * might fail or not. Let's not assert success. */
617 assert_se(shmdt(p
) == 0);
619 p
= shmat(shmid
, NULL
, 0);
620 log_debug_errno(p
== MAP_FAILED
? errno
: 0, "shmat(0): %m");
621 assert_se(p
!= MAP_FAILED
);
622 assert_se(shmdt(p
) == 0);
627 assert_se(wait_for_terminate_and_check("memoryseccomp-shmat", pid
, WAIT_LOG
) == EXIT_SUCCESS
);
630 static void test_restrict_archs(void) {
633 log_info("/* %s */", __func__
);
635 if (!is_seccomp_available()) {
636 log_notice("Seccomp not available, skipping %s", __func__
);
639 if (geteuid() != 0) {
640 log_notice("Not root, skipping %s", __func__
);
648 _cleanup_set_free_ Set
*s
= NULL
;
650 assert_se(access("/", F_OK
) >= 0);
652 assert_se(s
= set_new(NULL
));
655 assert_se(set_put(s
, UINT32_TO_PTR(SCMP_ARCH_X86
+1)) >= 0);
657 assert_se(seccomp_restrict_archs(s
) >= 0);
659 assert_se(access("/", F_OK
) >= 0);
660 assert_se(seccomp_restrict_archs(NULL
) >= 0);
662 assert_se(access("/", F_OK
) >= 0);
667 assert_se(wait_for_terminate_and_check("archseccomp", pid
, WAIT_LOG
) == EXIT_SUCCESS
);
670 static void test_load_syscall_filter_set_raw(void) {
673 log_info("/* %s */", __func__
);
675 if (!is_seccomp_available()) {
676 log_notice("Seccomp not available, skipping %s", __func__
);
679 if (geteuid() != 0) {
680 log_notice("Not root, skipping %s", __func__
);
688 _cleanup_hashmap_free_ Hashmap
*s
= NULL
;
690 assert_se(access("/", F_OK
) >= 0);
691 assert_se(poll(NULL
, 0, 0) == 0);
693 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW
, NULL
, scmp_act_kill_process(), true) >= 0);
694 assert_se(access("/", F_OK
) >= 0);
695 assert_se(poll(NULL
, 0, 0) == 0);
697 assert_se(s
= hashmap_new(NULL
));
698 #if defined __NR_access && __NR_access >= 0
699 assert_se(hashmap_put(s
, UINT32_TO_PTR(__NR_access
+ 1), INT_TO_PTR(-1)) >= 0);
701 assert_se(hashmap_put(s
, UINT32_TO_PTR(__NR_faccessat
+ 1), INT_TO_PTR(-1)) >= 0);
704 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW
, s
, SCMP_ACT_ERRNO(EUCLEAN
), true) >= 0);
706 assert_se(access("/", F_OK
) < 0);
707 assert_se(errno
== EUCLEAN
);
709 assert_se(poll(NULL
, 0, 0) == 0);
713 assert_se(s
= hashmap_new(NULL
));
714 #if defined __NR_access && __NR_access >= 0
715 assert_se(hashmap_put(s
, UINT32_TO_PTR(__NR_access
+ 1), INT_TO_PTR(EILSEQ
)) >= 0);
717 assert_se(hashmap_put(s
, UINT32_TO_PTR(__NR_faccessat
+ 1), INT_TO_PTR(EILSEQ
)) >= 0);
720 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW
, s
, SCMP_ACT_ERRNO(EUCLEAN
), true) >= 0);
722 assert_se(access("/", F_OK
) < 0);
723 assert_se(errno
== EILSEQ
);
725 assert_se(poll(NULL
, 0, 0) == 0);
729 assert_se(s
= hashmap_new(NULL
));
730 #if defined __NR_poll && __NR_poll >= 0
731 assert_se(hashmap_put(s
, UINT32_TO_PTR(__NR_poll
+ 1), INT_TO_PTR(-1)) >= 0);
733 assert_se(hashmap_put(s
, UINT32_TO_PTR(__NR_ppoll
+ 1), INT_TO_PTR(-1)) >= 0);
736 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW
, s
, SCMP_ACT_ERRNO(EUNATCH
), true) >= 0);
738 assert_se(access("/", F_OK
) < 0);
739 assert_se(errno
== EILSEQ
);
741 assert_se(poll(NULL
, 0, 0) < 0);
742 assert_se(errno
== EUNATCH
);
746 assert_se(s
= hashmap_new(NULL
));
747 #if defined __NR_poll && __NR_poll >= 0
748 assert_se(hashmap_put(s
, UINT32_TO_PTR(__NR_poll
+ 1), INT_TO_PTR(EILSEQ
)) >= 0);
750 assert_se(hashmap_put(s
, UINT32_TO_PTR(__NR_ppoll
+ 1), INT_TO_PTR(EILSEQ
)) >= 0);
753 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW
, s
, SCMP_ACT_ERRNO(EUNATCH
), true) >= 0);
755 assert_se(access("/", F_OK
) < 0);
756 assert_se(errno
== EILSEQ
);
758 assert_se(poll(NULL
, 0, 0) < 0);
759 assert_se(errno
== EILSEQ
);
764 assert_se(wait_for_terminate_and_check("syscallrawseccomp", pid
, WAIT_LOG
) == EXIT_SUCCESS
);
767 static void test_lock_personality(void) {
768 unsigned long current
;
771 log_info("/* %s */", __func__
);
773 if (!is_seccomp_available()) {
774 log_notice("Seccomp not available, skipping %s", __func__
);
777 if (geteuid() != 0) {
778 log_notice("Not root, skipping %s", __func__
);
782 assert_se(opinionated_personality(¤t
) >= 0);
784 log_info("current personality=%lu", current
);
790 assert_se(seccomp_lock_personality(current
) >= 0);
792 assert_se((unsigned long) safe_personality(current
) == current
);
794 /* Note, we also test that safe_personality() works correctly, by checkig whether errno is properly
795 * set, in addition to the return value */
797 assert_se(safe_personality(PER_LINUX
| ADDR_NO_RANDOMIZE
) == -EPERM
);
798 assert_se(errno
== EPERM
);
800 assert_se(safe_personality(PER_LINUX
| MMAP_PAGE_ZERO
) == -EPERM
);
801 assert_se(safe_personality(PER_LINUX
| ADDR_COMPAT_LAYOUT
) == -EPERM
);
802 assert_se(safe_personality(PER_LINUX
| READ_IMPLIES_EXEC
) == -EPERM
);
803 assert_se(safe_personality(PER_LINUX_32BIT
) == -EPERM
);
804 assert_se(safe_personality(PER_SVR4
) == -EPERM
);
805 assert_se(safe_personality(PER_BSD
) == -EPERM
);
806 assert_se(safe_personality(current
== PER_LINUX
? PER_LINUX32
: PER_LINUX
) == -EPERM
);
807 assert_se(safe_personality(PER_LINUX32_3GB
) == -EPERM
);
808 assert_se(safe_personality(PER_UW7
) == -EPERM
);
809 assert_se(safe_personality(0x42) == -EPERM
);
811 assert_se(safe_personality(PERSONALITY_INVALID
) == -EPERM
); /* maybe remove this later */
813 assert_se((unsigned long) personality(current
) == current
);
817 assert_se(wait_for_terminate_and_check("lockpersonalityseccomp", pid
, WAIT_LOG
) == EXIT_SUCCESS
);
820 static int real_open(const char *path
, int flags
, mode_t mode
) {
821 /* glibc internally calls openat() when open() is requested. Let's hence define our own wrapper for
822 * testing purposes that calls the real syscall, on architectures where SYS_open is defined. On
823 * other architectures, let's just fall back to the glibc call. */
825 #if defined __NR_open && __NR_open >= 0
826 return (int) syscall(__NR_open
, path
, flags
, mode
);
828 return open(path
, flags
, mode
);
832 static void test_restrict_suid_sgid(void) {
835 log_info("/* %s */", __func__
);
837 if (!is_seccomp_available()) {
838 log_notice("Seccomp not available, skipping %s", __func__
);
841 if (geteuid() != 0) {
842 log_notice("Not root, skipping %s", __func__
);
850 char path
[] = "/tmp/suidsgidXXXXXX", dir
[] = "/tmp/suidsgiddirXXXXXX";
854 fd
= mkostemp_safe(path
);
857 assert_se(mkdtemp(dir
));
858 z
= strjoina(dir
, "/test");
860 assert_se(chmod(path
, 0755 | S_ISUID
) >= 0);
861 assert_se(chmod(path
, 0755 | S_ISGID
) >= 0);
862 assert_se(chmod(path
, 0755 | S_ISGID
| S_ISUID
) >= 0);
863 assert_se(chmod(path
, 0755) >= 0);
865 assert_se(fchmod(fd
, 0755 | S_ISUID
) >= 0);
866 assert_se(fchmod(fd
, 0755 | S_ISGID
) >= 0);
867 assert_se(fchmod(fd
, 0755 | S_ISGID
| S_ISUID
) >= 0);
868 assert_se(fchmod(fd
, 0755) >= 0);
870 assert_se(fchmodat(AT_FDCWD
, path
, 0755 | S_ISUID
, 0) >= 0);
871 assert_se(fchmodat(AT_FDCWD
, path
, 0755 | S_ISGID
, 0) >= 0);
872 assert_se(fchmodat(AT_FDCWD
, path
, 0755 | S_ISGID
| S_ISUID
, 0) >= 0);
873 assert_se(fchmodat(AT_FDCWD
, path
, 0755, 0) >= 0);
875 k
= real_open(z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644 | S_ISUID
);
877 assert_se(unlink(z
) >= 0);
879 k
= real_open(z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644 | S_ISGID
);
881 assert_se(unlink(z
) >= 0);
883 k
= real_open(z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644 | S_ISUID
| S_ISGID
);
885 assert_se(unlink(z
) >= 0);
887 k
= real_open(z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644);
889 assert_se(unlink(z
) >= 0);
891 k
= creat(z
, 0644 | S_ISUID
);
893 assert_se(unlink(z
) >= 0);
895 k
= creat(z
, 0644 | S_ISGID
);
897 assert_se(unlink(z
) >= 0);
899 k
= creat(z
, 0644 | S_ISUID
| S_ISGID
);
901 assert_se(unlink(z
) >= 0);
905 assert_se(unlink(z
) >= 0);
907 k
= openat(AT_FDCWD
, z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644 | S_ISUID
);
909 assert_se(unlink(z
) >= 0);
911 k
= openat(AT_FDCWD
, z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644 | S_ISGID
);
913 assert_se(unlink(z
) >= 0);
915 k
= openat(AT_FDCWD
, z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644 | S_ISUID
| S_ISGID
);
917 assert_se(unlink(z
) >= 0);
919 k
= openat(AT_FDCWD
, z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644);
921 assert_se(unlink(z
) >= 0);
923 assert_se(mkdir(z
, 0755 | S_ISUID
) >= 0);
924 assert_se(rmdir(z
) >= 0);
925 assert_se(mkdir(z
, 0755 | S_ISGID
) >= 0);
926 assert_se(rmdir(z
) >= 0);
927 assert_se(mkdir(z
, 0755 | S_ISUID
| S_ISGID
) >= 0);
928 assert_se(rmdir(z
) >= 0);
929 assert_se(mkdir(z
, 0755) >= 0);
930 assert_se(rmdir(z
) >= 0);
932 assert_se(mkdirat(AT_FDCWD
, z
, 0755 | S_ISUID
) >= 0);
933 assert_se(rmdir(z
) >= 0);
934 assert_se(mkdirat(AT_FDCWD
, z
, 0755 | S_ISGID
) >= 0);
935 assert_se(rmdir(z
) >= 0);
936 assert_se(mkdirat(AT_FDCWD
, z
, 0755 | S_ISUID
| S_ISGID
) >= 0);
937 assert_se(rmdir(z
) >= 0);
938 assert_se(mkdirat(AT_FDCWD
, z
, 0755) >= 0);
939 assert_se(rmdir(z
) >= 0);
941 assert_se(mknod(z
, S_IFREG
| 0755 | S_ISUID
, 0) >= 0);
942 assert_se(unlink(z
) >= 0);
943 assert_se(mknod(z
, S_IFREG
| 0755 | S_ISGID
, 0) >= 0);
944 assert_se(unlink(z
) >= 0);
945 assert_se(mknod(z
, S_IFREG
| 0755 | S_ISUID
| S_ISGID
, 0) >= 0);
946 assert_se(unlink(z
) >= 0);
947 assert_se(mknod(z
, S_IFREG
| 0755, 0) >= 0);
948 assert_se(unlink(z
) >= 0);
950 assert_se(mknodat(AT_FDCWD
, z
, S_IFREG
| 0755 | S_ISUID
, 0) >= 0);
951 assert_se(unlink(z
) >= 0);
952 assert_se(mknodat(AT_FDCWD
, z
, S_IFREG
| 0755 | S_ISGID
, 0) >= 0);
953 assert_se(unlink(z
) >= 0);
954 assert_se(mknodat(AT_FDCWD
, z
, S_IFREG
| 0755 | S_ISUID
| S_ISGID
, 0) >= 0);
955 assert_se(unlink(z
) >= 0);
956 assert_se(mknodat(AT_FDCWD
, z
, S_IFREG
| 0755, 0) >= 0);
957 assert_se(unlink(z
) >= 0);
959 assert_se(seccomp_restrict_suid_sgid() >= 0);
961 assert_se(chmod(path
, 0775 | S_ISUID
) < 0 && errno
== EPERM
);
962 assert_se(chmod(path
, 0775 | S_ISGID
) < 0 && errno
== EPERM
);
963 assert_se(chmod(path
, 0775 | S_ISGID
| S_ISUID
) < 0 && errno
== EPERM
);
964 assert_se(chmod(path
, 0775) >= 0);
966 assert_se(fchmod(fd
, 0775 | S_ISUID
) < 0 && errno
== EPERM
);
967 assert_se(fchmod(fd
, 0775 | S_ISGID
) < 0 && errno
== EPERM
);
968 assert_se(fchmod(fd
, 0775 | S_ISGID
| S_ISUID
) < 0 && errno
== EPERM
);
969 assert_se(fchmod(fd
, 0775) >= 0);
971 assert_se(fchmodat(AT_FDCWD
, path
, 0755 | S_ISUID
, 0) < 0 && errno
== EPERM
);
972 assert_se(fchmodat(AT_FDCWD
, path
, 0755 | S_ISGID
, 0) < 0 && errno
== EPERM
);
973 assert_se(fchmodat(AT_FDCWD
, path
, 0755 | S_ISGID
| S_ISUID
, 0) < 0 && errno
== EPERM
);
974 assert_se(fchmodat(AT_FDCWD
, path
, 0755, 0) >= 0);
976 assert_se(real_open(z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644 | S_ISUID
) < 0 && errno
== EPERM
);
977 assert_se(real_open(z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644 | S_ISGID
) < 0 && errno
== EPERM
);
978 assert_se(real_open(z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644 | S_ISUID
| S_ISGID
) < 0 && errno
== EPERM
);
979 k
= real_open(z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644);
981 assert_se(unlink(z
) >= 0);
983 assert_se(creat(z
, 0644 | S_ISUID
) < 0 && errno
== EPERM
);
984 assert_se(creat(z
, 0644 | S_ISGID
) < 0 && errno
== EPERM
);
985 assert_se(creat(z
, 0644 | S_ISUID
| S_ISGID
) < 0 && errno
== EPERM
);
988 assert_se(unlink(z
) >= 0);
990 assert_se(openat(AT_FDCWD
, z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644 | S_ISUID
) < 0 && errno
== EPERM
);
991 assert_se(openat(AT_FDCWD
, z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644 | S_ISGID
) < 0 && errno
== EPERM
);
992 assert_se(openat(AT_FDCWD
, z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644 | S_ISUID
| S_ISGID
) < 0 && errno
== EPERM
);
993 k
= openat(AT_FDCWD
, z
, O_CREAT
|O_RDWR
|O_CLOEXEC
|O_EXCL
, 0644);
995 assert_se(unlink(z
) >= 0);
997 assert_se(mkdir(z
, 0755 | S_ISUID
) < 0 && errno
== EPERM
);
998 assert_se(mkdir(z
, 0755 | S_ISGID
) < 0 && errno
== EPERM
);
999 assert_se(mkdir(z
, 0755 | S_ISUID
| S_ISGID
) < 0 && errno
== EPERM
);
1000 assert_se(mkdir(z
, 0755) >= 0);
1001 assert_se(rmdir(z
) >= 0);
1003 assert_se(mkdirat(AT_FDCWD
, z
, 0755 | S_ISUID
) < 0 && errno
== EPERM
);
1004 assert_se(mkdirat(AT_FDCWD
, z
, 0755 | S_ISGID
) < 0 && errno
== EPERM
);
1005 assert_se(mkdirat(AT_FDCWD
, z
, 0755 | S_ISUID
| S_ISGID
) < 0 && errno
== EPERM
);
1006 assert_se(mkdirat(AT_FDCWD
, z
, 0755) >= 0);
1007 assert_se(rmdir(z
) >= 0);
1009 assert_se(mknod(z
, S_IFREG
| 0755 | S_ISUID
, 0) < 0 && errno
== EPERM
);
1010 assert_se(mknod(z
, S_IFREG
| 0755 | S_ISGID
, 0) < 0 && errno
== EPERM
);
1011 assert_se(mknod(z
, S_IFREG
| 0755 | S_ISUID
| S_ISGID
, 0) < 0 && errno
== EPERM
);
1012 assert_se(mknod(z
, S_IFREG
| 0755, 0) >= 0);
1013 assert_se(unlink(z
) >= 0);
1015 assert_se(mknodat(AT_FDCWD
, z
, S_IFREG
| 0755 | S_ISUID
, 0) < 0 && errno
== EPERM
);
1016 assert_se(mknodat(AT_FDCWD
, z
, S_IFREG
| 0755 | S_ISGID
, 0) < 0 && errno
== EPERM
);
1017 assert_se(mknodat(AT_FDCWD
, z
, S_IFREG
| 0755 | S_ISUID
| S_ISGID
, 0) < 0 && errno
== EPERM
);
1018 assert_se(mknodat(AT_FDCWD
, z
, S_IFREG
| 0755, 0) >= 0);
1019 assert_se(unlink(z
) >= 0);
1021 assert_se(unlink(path
) >= 0);
1022 assert_se(rm_rf(dir
, REMOVE_ROOT
|REMOVE_PHYSICAL
) >= 0);
1024 _exit(EXIT_SUCCESS
);
1027 assert_se(wait_for_terminate_and_check("suidsgidseccomp", pid
, WAIT_LOG
) == EXIT_SUCCESS
);
1030 int main(int argc
, char *argv
[]) {
1031 test_setup_logging(LOG_DEBUG
);
1033 test_seccomp_arch_to_string();
1034 test_architecture_table();
1035 test_syscall_filter_set_find();
1037 test_filter_sets_ordered();
1038 test_restrict_namespace();
1039 test_protect_sysctl();
1040 test_protect_syslog();
1041 test_restrict_address_families();
1042 test_restrict_realtime();
1043 test_memory_deny_write_execute_mmap();
1044 test_memory_deny_write_execute_shmat();
1045 test_restrict_archs();
1046 test_load_syscall_filter_set_raw();
1047 test_lock_personality();
1048 test_restrict_suid_sgid();