src/test/test-seccomp.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2016 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <stdlib.h>
  21 #include <sys/eventfd.h>
  22 #include <unistd.h>
  23
  24 #include "fd-util.h"
  25 #include "macro.h"
  26 #include "process-util.h"
  27 #include "seccomp-util.h"
  28
  29 static void test_seccomp_arch_to_string(void) {
  30         uint32_t a, b;
  31         const char *name;
  32
  33         a = seccomp_arch_native();
  34         assert_se(a > 0);
  35         name = seccomp_arch_to_string(a);
  36         assert_se(name);
  37         assert_se(seccomp_arch_from_string(name, &b) >= 0);
  38         assert_se(a == b);
  39 }
  40
  41 static void test_syscall_filter_set_find(void) {
  42         assert_se(!syscall_filter_set_find(NULL));
  43         assert_se(!syscall_filter_set_find(""));
  44         assert_se(!syscall_filter_set_find("quux"));
  45         assert_se(!syscall_filter_set_find("@quux"));
  46
  47         assert_se(syscall_filter_set_find("@clock") == syscall_filter_sets + SYSCALL_FILTER_SET_CLOCK);
  48         assert_se(syscall_filter_set_find("@default") == syscall_filter_sets + SYSCALL_FILTER_SET_DEFAULT);
  49         assert_se(syscall_filter_set_find("@raw-io") == syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO);
  50 }
  51
  52 static void test_filter_sets(void) {
  53         unsigned i;
  54         int r;
  55
  56         if (!is_seccomp_available())
  57                 return;
  58
  59         if (geteuid() != 0)
  60                 return;
  61
  62         for (i = 0; i < _SYSCALL_FILTER_SET_MAX; i++) {
  63                 pid_t pid;
  64
  65                 log_info("Testing %s", syscall_filter_sets[i].name);
  66
  67                 pid = fork();
  68                 assert_se(pid >= 0);
  69
  70                 if (pid == 0) { /* Child? */
  71                         int fd;
  72
  73                         if (i == SYSCALL_FILTER_SET_DEFAULT) /* if we look at the default set, whitelist instead of blacklist */
  74                                 r = seccomp_load_filter_set(SCMP_ACT_ERRNO(EPERM), syscall_filter_sets + i, SCMP_ACT_ALLOW);
  75                         else
  76                                 r = seccomp_load_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + i, SCMP_ACT_ERRNO(EPERM));
  77                         if (r < 0)
  78                                 _exit(EXIT_FAILURE);
  79
  80                         /* Test the sycall filter with one random system call */
  81                         fd = eventfd(0, EFD_NONBLOCK|EFD_CLOEXEC);
  82                         if (IN_SET(i, SYSCALL_FILTER_SET_IO_EVENT, SYSCALL_FILTER_SET_DEFAULT))
  83                                 assert_se(fd < 0 && errno == EPERM);
  84                         else {
  85                                 assert_se(fd >= 0);
  86                                 safe_close(fd);
  87                         }
  88
  89                         _exit(EXIT_SUCCESS);
  90                 }
  91
  92                 assert_se(wait_for_terminate_and_warn(syscall_filter_sets[i].name, pid, true) == EXIT_SUCCESS);
  93         }
  94 }
  95
  96 int main(int argc, char *argv[]) {
  97
  98         test_seccomp_arch_to_string();
  99         test_syscall_filter_set_find();
 100         test_filter_sets();
 101
 102         return 0;
 103 }