]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/test/test-seccomp.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
license: LGPL-2.1+ -> LGPL-2.1-or-later
[thirdparty/systemd.git] / src / test / test-seccomp.c
CommitLineData
db9ecf05 1/* SPDX-License-Identifier: LGPL-2.1-or-later */
f6281133 2
f5947a5e 3#include <fcntl.h>
d7e454ba 4#include <poll.h>
f6281133
LP		 5#include <stdlib.h>
6#include <sys/eventfd.h>
469830d1 7#include <sys/mman.h>
78e864e5 8#include <sys/personality.h>
2a65bd94 9#include <sys/shm.h>
dff6c629 10#include <sys/syscall.h>
2a65bd94
ZJS		 11#include <sys/types.h>
12#include <unistd.h>
f6281133 13
add00535 14#include "alloc-util.h"
f6281133 15#include "fd-util.h"
3c14dc61 16#include "fileio.h"
f6281133 17#include "macro.h"
0a970718 18#include "memory-util.h"
f5947a5e 19#include "missing_sched.h"
add00535 20#include "nsflags.h"
d8b4d14d 21#include "nulstr-util.h"
f6281133 22#include "process-util.h"
add00535 23#include "raw-clone.h"
167fc10c 24#include "rm-rf.h"
f6281133 25#include "seccomp-util.h"
469830d1 26#include "set.h"
aa34055f 27#include "string-util.h"
6d7c4033 28#include "tests.h"
167fc10c 29#include "tmpfile-util.h"
469830d1 30#include "virt.h"
f6281133 31
4df8fe84 32/* __NR_socket may be invalid due to libseccomp */
fb4b0465 33#if !defined(__NR_socket) || __NR_socket < 0 || defined(__i386__) || defined(__s390x__) || defined(__s390__)
da1921a5
ZJS		 34/* On these archs, socket() is implemented via the socketcall() syscall multiplexer,
35 * and we can't restrict it hence via seccomp. */
36# define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 1
37#else
38# define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 0
39#endif
40
f6281133
LP		 41static void test_seccomp_arch_to_string(void) {
42 uint32_t a, b;
43 const char *name;
44
f09da7cc
ZJS		 45 log_info("/* %s */", __func__);
46
f6281133
LP		 47 a = seccomp_arch_native();
48 assert_se(a > 0);
49 name = seccomp_arch_to_string(a);
50 assert_se(name);
51 assert_se(seccomp_arch_from_string(name, &b) >= 0);
52 assert_se(a == b);
53}
54
aa34055f
ZJS		 55static void test_architecture_table(void) {
56 const char *n, *n2;
57
f09da7cc
ZJS		 58 log_info("/* %s */", __func__);
59
aa34055f
ZJS		 60 NULSTR_FOREACH(n,
61 "native\0"
62 "x86\0"
63 "x86-64\0"
64 "x32\0"
65 "arm\0"
66 "arm64\0"
67 "mips\0"
68 "mips64\0"
69 "mips64-n32\0"
70 "mips-le\0"
71 "mips64-le\0"
72 "mips64-le-n32\0"
73 "ppc\0"
74 "ppc64\0"
75 "ppc64-le\0"
f9252236
AJ		 76#ifdef SCMP_ARCH_RISCV64
77 "riscv64\0"
78#endif
aa34055f
ZJS		 79 "s390\0"
80 "s390x\0") {
81 uint32_t c;
82
83 assert_se(seccomp_arch_from_string(n, &c) >= 0);
84 n2 = seccomp_arch_to_string(c);
85 log_info("seccomp-arch: %s → 0x%"PRIx32" → %s", n, c, n2);
86 assert_se(streq_ptr(n, n2));
87 }
88}
89
f6281133 90static void test_syscall_filter_set_find(void) {
f09da7cc
ZJS		 91 log_info("/* %s */", __func__);
92
f6281133
LP		 93 assert_se(!syscall_filter_set_find(NULL));
94 assert_se(!syscall_filter_set_find(""));
95 assert_se(!syscall_filter_set_find("quux"));
96 assert_se(!syscall_filter_set_find("@quux"));
97
98 assert_se(syscall_filter_set_find("@clock") == syscall_filter_sets + SYSCALL_FILTER_SET_CLOCK);
99 assert_se(syscall_filter_set_find("@default") == syscall_filter_sets + SYSCALL_FILTER_SET_DEFAULT);
100 assert_se(syscall_filter_set_find("@raw-io") == syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO);
101}
102
103static void test_filter_sets(void) {
f09da7cc
ZJS		 104 log_info("/* %s */", __func__);
105
cd90ec75
YW		 106 if (!is_seccomp_available()) {
107 log_notice("Seccomp not available, skipping %s", __func__);
f6281133 108 return;
cd90ec75
YW		 109 }
110 if (geteuid() != 0) {
111 log_notice("Not root, skipping %s", __func__);
f6281133 112 return;
cd90ec75 113 }
f6281133 114
604b163a 115 for (unsigned i = 0; i < _SYSCALL_FILTER_SET_MAX; i++) {
f6281133
LP		 116 pid_t pid;
117
118 log_info("Testing %s", syscall_filter_sets[i].name);
119
120 pid = fork();
121 assert_se(pid >= 0);
122
123 if (pid == 0) { /* Child? */
604b163a 124 int fd, r;
f6281133 125
6b000af4 126 /* If we look at the default set (or one that includes it), allow-list instead of deny-list */
95aac012
ZJS		 127 if (IN_SET(i, SYSCALL_FILTER_SET_DEFAULT,
128 SYSCALL_FILTER_SET_SYSTEM_SERVICE,
129 SYSCALL_FILTER_SET_KNOWN))
b54f36c6 130 r = seccomp_load_syscall_filter_set(SCMP_ACT_ERRNO(EUCLEAN), syscall_filter_sets + i, SCMP_ACT_ALLOW, true);
f6281133 131 else
b54f36c6 132 r = seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + i, SCMP_ACT_ERRNO(EUCLEAN), true);
f6281133
LP		 133 if (r < 0)
134 _exit(EXIT_FAILURE);
135
136 /* Test the sycall filter with one random system call */
137 fd = eventfd(0, EFD_NONBLOCK|EFD_CLOEXEC);
138 if (IN_SET(i, SYSCALL_FILTER_SET_IO_EVENT, SYSCALL_FILTER_SET_DEFAULT))
469830d1 139 assert_se(fd < 0 && errno == EUCLEAN);
f6281133
LP		 140 else {
141 assert_se(fd >= 0);
142 safe_close(fd);
143 }
144
145 _exit(EXIT_SUCCESS);
146 }
147
7d4904fe 148 assert_se(wait_for_terminate_and_check(syscall_filter_sets[i].name, pid, WAIT_LOG) == EXIT_SUCCESS);
f6281133
LP		 149 }
150}
151
23e12f8e 152static void test_filter_sets_ordered(void) {
f09da7cc
ZJS		 153 log_info("/* %s */", __func__);
154
23e12f8e
ZJS		 155 /* Ensure "@default" always remains at the beginning of the list */
156 assert_se(SYSCALL_FILTER_SET_DEFAULT == 0);
157 assert_se(streq(syscall_filter_sets[0].name, "@default"));
158
95aac012
ZJS		 159 /* Ensure "@known" always remains at the end of the list */
160 assert_se(SYSCALL_FILTER_SET_KNOWN == _SYSCALL_FILTER_SET_MAX - 1);
161 assert_se(streq(syscall_filter_sets[SYSCALL_FILTER_SET_KNOWN].name, "@known"));
162
163 for (size_t i = 0; i < _SYSCALL_FILTER_SET_MAX; i++) {
23e12f8e
ZJS		 164 const char *k, *p = NULL;
165
166 /* Make sure each group has a description */
167 assert_se(!isempty(syscall_filter_sets[0].help));
168
95aac012
ZJS		 169 /* Make sure the groups are ordered alphabetically, except for the first and last entries */
170 assert_se(i < 2 || i == _SYSCALL_FILTER_SET_MAX - 1 ||
171 strcmp(syscall_filter_sets[i-1].name, syscall_filter_sets[i].name) < 0);
23e12f8e
ZJS		 172
173 NULSTR_FOREACH(k, syscall_filter_sets[i].value) {
174
175 /* Ensure each syscall list is in itself ordered, but groups before names */
176 assert_se(!p ||
177 (*p == '@' && *k != '@') ||
178 (((*p == '@' && *k == '@') ||
179 (*p != '@' && *k != '@')) &&
180 strcmp(p, k) < 0));
181
182 p = k;
183 }
184 }
185}
186
add00535 187static void test_restrict_namespace(void) {
86c2a9f1 188 char *s = NULL;
add00535 189 unsigned long ul;
469830d1 190 pid_t pid;
add00535 191
5f00dc4d
LP		 192 if (!have_namespaces()) {
193 log_notice("Testing without namespaces, skipping %s", __func__);
194 return;
195 }
196
f09da7cc
ZJS		 197 log_info("/* %s */", __func__);
198
dd0395b5 199 assert_se(namespace_flags_to_string(0, &s) == 0 && isempty(s));
86c2a9f1
YW		 200 s = mfree(s);
201 assert_se(namespace_flags_to_string(CLONE_NEWNS, &s) == 0 && streq(s, "mnt"));
202 s = mfree(s);
203 assert_se(namespace_flags_to_string(CLONE_NEWNS|CLONE_NEWIPC, &s) == 0 && streq(s, "ipc mnt"));
204 s = mfree(s);
205 assert_se(namespace_flags_to_string(CLONE_NEWCGROUP, &s) == 0 && streq(s, "cgroup"));
206 s = mfree(s);
207
208 assert_se(namespace_flags_from_string("mnt", &ul) == 0 && ul == CLONE_NEWNS);
209 assert_se(namespace_flags_from_string(NULL, &ul) == 0 && ul == 0);
210 assert_se(namespace_flags_from_string("", &ul) == 0 && ul == 0);
211 assert_se(namespace_flags_from_string("uts", &ul) == 0 && ul == CLONE_NEWUTS);
212 assert_se(namespace_flags_from_string("mnt uts ipc", &ul) == 0 && ul == (CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWIPC));
213
214 assert_se(namespace_flags_to_string(CLONE_NEWUTS, &s) == 0 && streq(s, "uts"));
215 assert_se(namespace_flags_from_string(s, &ul) == 0 && ul == CLONE_NEWUTS);
216 s = mfree(s);
217 assert_se(namespace_flags_from_string("ipc", &ul) == 0 && ul == CLONE_NEWIPC);
218 assert_se(namespace_flags_to_string(ul, &s) == 0 && streq(s, "ipc"));
219 s = mfree(s);
220
221 assert_se(namespace_flags_to_string(NAMESPACE_FLAGS_ALL, &s) == 0);
add00535 222 assert_se(streq(s, "cgroup ipc net mnt pid user uts"));
86c2a9f1
YW		 223 assert_se(namespace_flags_from_string(s, &ul) == 0 && ul == NAMESPACE_FLAGS_ALL);
224 s = mfree(s);
add00535 225
cd90ec75
YW		 226 if (!is_seccomp_available()) {
227 log_notice("Seccomp not available, skipping remaining tests in %s", __func__);
add00535 228 return;
cd90ec75
YW		 229 }
230 if (geteuid() != 0) {
231 log_notice("Not root, skipping remaining tests in %s", __func__);
add00535 232 return;
cd90ec75 233 }
add00535
LP		 234
235 pid = fork();
236 assert_se(pid >= 0);
237
238 if (pid == 0) {
239
240 assert_se(seccomp_restrict_namespaces(CLONE_NEWNS|CLONE_NEWNET) >= 0);
241
242 assert_se(unshare(CLONE_NEWNS) == 0);
243 assert_se(unshare(CLONE_NEWNET) == 0);
244 assert_se(unshare(CLONE_NEWUTS) == -1);
245 assert_se(errno == EPERM);
246 assert_se(unshare(CLONE_NEWIPC) == -1);
247 assert_se(errno == EPERM);
248 assert_se(unshare(CLONE_NEWNET|CLONE_NEWUTS) == -1);
249 assert_se(errno == EPERM);
250
251 /* We use fd 0 (stdin) here, which of course will fail with EINVAL on setns(). Except of course our
252 * seccomp filter worked, and hits first and makes it return EPERM */
253 assert_se(setns(0, CLONE_NEWNS) == -1);
254 assert_se(errno == EINVAL);
255 assert_se(setns(0, CLONE_NEWNET) == -1);
256 assert_se(errno == EINVAL);
257 assert_se(setns(0, CLONE_NEWUTS) == -1);
258 assert_se(errno == EPERM);
259 assert_se(setns(0, CLONE_NEWIPC) == -1);
260 assert_se(errno == EPERM);
261 assert_se(setns(0, CLONE_NEWNET|CLONE_NEWUTS) == -1);
262 assert_se(errno == EPERM);
263 assert_se(setns(0, 0) == -1);
264 assert_se(errno == EPERM);
265
266 pid = raw_clone(CLONE_NEWNS);
267 assert_se(pid >= 0);
268 if (pid == 0)
269 _exit(EXIT_SUCCESS);
270 pid = raw_clone(CLONE_NEWNET);
271 assert_se(pid >= 0);
272 if (pid == 0)
273 _exit(EXIT_SUCCESS);
274 pid = raw_clone(CLONE_NEWUTS);
275 assert_se(pid < 0);
276 assert_se(errno == EPERM);
277 pid = raw_clone(CLONE_NEWIPC);
278 assert_se(pid < 0);
279 assert_se(errno == EPERM);
280 pid = raw_clone(CLONE_NEWNET|CLONE_NEWUTS);
281 assert_se(pid < 0);
282 assert_se(errno == EPERM);
283
284 _exit(EXIT_SUCCESS);
285 }
286
7d4904fe 287 assert_se(wait_for_terminate_and_check("nsseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
add00535
LP		 288}
289
469830d1
LP		 290static void test_protect_sysctl(void) {
291 pid_t pid;
3c14dc61 292 _cleanup_free_ char *seccomp = NULL;
469830d1 293
f09da7cc
ZJS		 294 log_info("/* %s */", __func__);
295
cd90ec75
YW		 296 if (!is_seccomp_available()) {
297 log_notice("Seccomp not available, skipping %s", __func__);
469830d1 298 return;
cd90ec75
YW		 299 }
300 if (geteuid() != 0) {
301 log_notice("Not root, skipping %s", __func__);
469830d1 302 return;
cd90ec75 303 }
469830d1 304
cd90ec75
YW		 305 /* in containers _sysctl() is likely missing anyway */
306 if (detect_container() > 0) {
307 log_notice("Testing in container, skipping %s", __func__);
469830d1 308 return;
cd90ec75 309 }
469830d1 310
3c14dc61
TM		 311 assert_se(get_proc_field("/proc/self/status", "Seccomp", WHITESPACE, &seccomp) == 0);
312 if (!streq(seccomp, "0"))
313 log_warning("Warning: seccomp filter detected, results may be unreliable for %s", __func__);
314
469830d1
LP		 315 pid = fork();
316 assert_se(pid >= 0);
317
318 if (pid == 0) {
fb4b0465 319#if defined __NR__sysctl && __NR__sysctl >= 0
469830d1 320 assert_se(syscall(__NR__sysctl, NULL) < 0);
0af05e48 321 assert_se(IN_SET(errno, EFAULT, ENOSYS));
2e64e8f4 322#endif
469830d1
LP		 323
324 assert_se(seccomp_protect_sysctl() >= 0);
325
fb4b0465 326#if defined __NR__sysctl && __NR__sysctl >= 0
469830d1
LP		 327 assert_se(syscall(__NR__sysctl, 0, 0, 0) < 0);
328 assert_se(errno == EPERM);
2e64e8f4 329#endif
469830d1
LP		 330
331 _exit(EXIT_SUCCESS);
332 }
333
7d4904fe 334 assert_se(wait_for_terminate_and_check("sysctlseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
469830d1
LP		 335}
336
97d05f3b
KK		 337static void test_protect_syslog(void) {
338 pid_t pid;
339
340 log_info("/* %s */", __func__);
341
342 if (!is_seccomp_available()) {
343 log_notice("Seccomp not available, skipping %s", __func__);
344 return;
345 }
346 if (geteuid() != 0) {
347 log_notice("Not root, skipping %s", __func__);
348 return;
349 }
350
351 /* in containers syslog() is likely missing anyway */
352 if (detect_container() > 0) {
353 log_notice("Testing in container, skipping %s", __func__);
354 return;
355 }
356
357 pid = fork();
358 assert_se(pid >= 0);
359
360 if (pid == 0) {
fb4b0465 361#if defined __NR_syslog && __NR_syslog >= 0
97d05f3b
KK		 362 assert_se(syscall(__NR_syslog, -1, NULL, 0) < 0);
363 assert_se(errno == EINVAL);
364#endif
365
366 assert_se(seccomp_protect_syslog() >= 0);
367
fb4b0465 368#if defined __NR_syslog && __NR_syslog >= 0
97d05f3b
KK		 369 assert_se(syscall(__NR_syslog, 0, 0, 0) < 0);
370 assert_se(errno == EPERM);
371#endif
372
373 _exit(EXIT_SUCCESS);
374 }
375
376 assert_se(wait_for_terminate_and_check("syslogseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
377}
378
469830d1
LP		 379static void test_restrict_address_families(void) {
380 pid_t pid;
381
f09da7cc
ZJS		 382 log_info("/* %s */", __func__);
383
cd90ec75
YW		 384 if (!is_seccomp_available()) {
385 log_notice("Seccomp not available, skipping %s", __func__);
469830d1 386 return;
cd90ec75
YW		 387 }
388 if (geteuid() != 0) {
389 log_notice("Not root, skipping %s", __func__);
469830d1 390 return;
cd90ec75 391 }
469830d1
LP		 392
393 pid = fork();
394 assert_se(pid >= 0);
395
396 if (pid == 0) {
397 int fd;
398 Set *s;
399
400 fd = socket(AF_INET, SOCK_DGRAM, 0);
401 assert_se(fd >= 0);
402 safe_close(fd);
403
404 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
405 assert_se(fd >= 0);
406 safe_close(fd);
407
408 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
409 assert_se(fd >= 0);
410 safe_close(fd);
411
412 assert_se(s = set_new(NULL));
413 assert_se(set_put(s, INT_TO_PTR(AF_UNIX)) >= 0);
414
415 assert_se(seccomp_restrict_address_families(s, false) >= 0);
416
417 fd = socket(AF_INET, SOCK_DGRAM, 0);
418 assert_se(fd >= 0);
419 safe_close(fd);
420
ad8f1479 421 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
dce0e620 422#if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
ad8f1479
LP		 423 assert_se(fd >= 0);
424 safe_close(fd);
425#else
dce0e620 426 assert_se(fd < 0);
469830d1 427 assert_se(errno == EAFNOSUPPORT);
ad8f1479 428#endif
469830d1
LP		 429
430 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
431 assert_se(fd >= 0);
432 safe_close(fd);
433
434 set_clear(s);
435
436 assert_se(set_put(s, INT_TO_PTR(AF_INET)) >= 0);
437
438 assert_se(seccomp_restrict_address_families(s, true) >= 0);
439
440 fd = socket(AF_INET, SOCK_DGRAM, 0);
441 assert_se(fd >= 0);
442 safe_close(fd);
443
ad8f1479 444 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
dce0e620 445#if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
ad8f1479
LP		 446 assert_se(fd >= 0);
447 safe_close(fd);
dce0e620
ZJS		 448#else
449 assert_se(fd < 0);
450 assert_se(errno == EAFNOSUPPORT);
451#endif
ad8f1479
LP		 452
453 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
dce0e620 454#if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
ad8f1479
LP		 455 assert_se(fd >= 0);
456 safe_close(fd);
457#else
dce0e620 458 assert_se(fd < 0);
469830d1 459 assert_se(errno == EAFNOSUPPORT);
ad8f1479 460#endif
469830d1
LP		 461
462 _exit(EXIT_SUCCESS);
463 }
464
7d4904fe 465 assert_se(wait_for_terminate_and_check("socketseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
469830d1
LP		 466}
467
468static void test_restrict_realtime(void) {
469 pid_t pid;
470
f09da7cc
ZJS		 471 log_info("/* %s */", __func__);
472
cd90ec75
YW		 473 if (!is_seccomp_available()) {
474 log_notice("Seccomp not available, skipping %s", __func__);
469830d1 475 return;
cd90ec75
YW		 476 }
477 if (geteuid() != 0) {
478 log_notice("Not root, skipping %s", __func__);
469830d1 479 return;
cd90ec75 480 }
469830d1 481
cd90ec75
YW		 482 /* in containers RT privs are likely missing anyway */
483 if (detect_container() > 0) {
484 log_notice("Testing in container, skipping %s", __func__);
469830d1 485 return;
cd90ec75 486 }
469830d1
LP		 487
488 pid = fork();
489 assert_se(pid >= 0);
490
491 if (pid == 0) {
492 assert_se(sched_setscheduler(0, SCHED_FIFO, &(struct sched_param) { .sched_priority = 1 }) >= 0);
493 assert_se(sched_setscheduler(0, SCHED_RR, &(struct sched_param) { .sched_priority = 1 }) >= 0);
494 assert_se(sched_setscheduler(0, SCHED_IDLE, &(struct sched_param) { .sched_priority = 0 }) >= 0);
495 assert_se(sched_setscheduler(0, SCHED_BATCH, &(struct sched_param) { .sched_priority = 0 }) >= 0);
496 assert_se(sched_setscheduler(0, SCHED_OTHER, &(struct sched_param) {}) >= 0);
497
498 assert_se(seccomp_restrict_realtime() >= 0);
499
500 assert_se(sched_setscheduler(0, SCHED_IDLE, &(struct sched_param) { .sched_priority = 0 }) >= 0);
501 assert_se(sched_setscheduler(0, SCHED_BATCH, &(struct sched_param) { .sched_priority = 0 }) >= 0);
502 assert_se(sched_setscheduler(0, SCHED_OTHER, &(struct sched_param) {}) >= 0);
503
504 assert_se(sched_setscheduler(0, SCHED_FIFO, &(struct sched_param) { .sched_priority = 1 }) < 0);
505 assert_se(errno == EPERM);
506 assert_se(sched_setscheduler(0, SCHED_RR, &(struct sched_param) { .sched_priority = 1 }) < 0);
507 assert_se(errno == EPERM);
508
509 _exit(EXIT_SUCCESS);
510 }
511
7d4904fe 512 assert_se(wait_for_terminate_and_check("realtimeseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
469830d1
LP		 513}
514
2a65bd94 515static void test_memory_deny_write_execute_mmap(void) {
469830d1
LP		 516 pid_t pid;
517
f09da7cc
ZJS		 518 log_info("/* %s */", __func__);
519
cd90ec75
YW		 520 if (!is_seccomp_available()) {
521 log_notice("Seccomp not available, skipping %s", __func__);
469830d1 522 return;
cd90ec75
YW		 523 }
524 if (geteuid() != 0) {
525 log_notice("Not root, skipping %s", __func__);
469830d1 526 return;
cd90ec75 527 }
469830d1
LP		 528
529 pid = fork();
530 assert_se(pid >= 0);
531
532 if (pid == 0) {
533 void *p;
534
535 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
536 assert_se(p != MAP_FAILED);
537 assert_se(munmap(p, page_size()) >= 0);
538
8a50cf69
LP		 539 p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
540 assert_se(p != MAP_FAILED);
541 assert_se(munmap(p, page_size()) >= 0);
469830d1 542
8a50cf69
LP		 543 assert_se(seccomp_memory_deny_write_execute() >= 0);
544
8a50cf69 545 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
4278d1f5 546#if defined(__x86_64__) || defined(__i386__) || defined(__powerpc64__) || defined(__arm__) || defined(__aarch64__)
469830d1
LP		 547 assert_se(p == MAP_FAILED);
548 assert_se(errno == EPERM);
8a50cf69 549#endif
49219b5c
CE		 550 /* Depending on kernel, libseccomp, and glibc versions, other architectures
551 * might fail or not. Let's not assert success. */
552 if (p != MAP_FAILED)
553 assert_se(munmap(p, page_size()) == 0);
469830d1
LP		 554
555 p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
556 assert_se(p != MAP_FAILED);
557 assert_se(munmap(p, page_size()) >= 0);
558
559 _exit(EXIT_SUCCESS);
560 }
561
7d4904fe 562 assert_se(wait_for_terminate_and_check("memoryseccomp-mmap", pid, WAIT_LOG) == EXIT_SUCCESS);
2a65bd94
ZJS		 563}
564
565static void test_memory_deny_write_execute_shmat(void) {
566 int shmid;
567 pid_t pid;
e55bdf9b 568 uint32_t arch;
2a65bd94 569
f09da7cc
ZJS		 570 log_info("/* %s */", __func__);
571
e55bdf9b
ZJS		 572 SECCOMP_FOREACH_LOCAL_ARCH(arch) {
573 log_debug("arch %s: SCMP_SYS(mmap) = %d", seccomp_arch_to_string(arch), SCMP_SYS(mmap));
574 log_debug("arch %s: SCMP_SYS(mmap2) = %d", seccomp_arch_to_string(arch), SCMP_SYS(mmap2));
575 log_debug("arch %s: SCMP_SYS(shmget) = %d", seccomp_arch_to_string(arch), SCMP_SYS(shmget));
576 log_debug("arch %s: SCMP_SYS(shmat) = %d", seccomp_arch_to_string(arch), SCMP_SYS(shmat));
577 log_debug("arch %s: SCMP_SYS(shmdt) = %d", seccomp_arch_to_string(arch), SCMP_SYS(shmdt));
578 }
579
cd90ec75
YW		 580 if (!is_seccomp_available()) {
581 log_notice("Seccomp not available, skipping %s", __func__);
2a65bd94 582 return;
cd90ec75
YW		 583 }
584 if (geteuid() != 0) {
585 log_notice("Not root, skipping %s", __func__);
2a65bd94 586 return;
cd90ec75 587 }
2a65bd94
ZJS		 588
589 shmid = shmget(IPC_PRIVATE, page_size(), 0);
590 assert_se(shmid >= 0);
591
592 pid = fork();
593 assert_se(pid >= 0);
594
595 if (pid == 0) {
596 void *p;
597
598 p = shmat(shmid, NULL, 0);
599 assert_se(p != MAP_FAILED);
600 assert_se(shmdt(p) == 0);
601
602 p = shmat(shmid, NULL, SHM_EXEC);
603 assert_se(p != MAP_FAILED);
604 assert_se(shmdt(p) == 0);
605
606 assert_se(seccomp_memory_deny_write_execute() >= 0);
607
608 p = shmat(shmid, NULL, SHM_EXEC);
67fb5f33 609 log_debug_errno(p == MAP_FAILED ? errno : 0, "shmat(SHM_EXEC): %m");
4278d1f5 610#if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__)
2a65bd94
ZJS		 611 assert_se(p == MAP_FAILED);
612 assert_se(errno == EPERM);
2a65bd94 613#endif
67fb5f33
ZJS		 614 /* Depending on kernel, libseccomp, and glibc versions, other architectures
615 * might fail or not. Let's not assert success. */
616 if (p != MAP_FAILED)
617 assert_se(shmdt(p) == 0);
2a65bd94
ZJS		 618
619 p = shmat(shmid, NULL, 0);
67fb5f33 620 log_debug_errno(p == MAP_FAILED ? errno : 0, "shmat(0): %m");
2a65bd94
ZJS		 621 assert_se(p != MAP_FAILED);
622 assert_se(shmdt(p) == 0);
623
624 _exit(EXIT_SUCCESS);
625 }
626
7d4904fe 627 assert_se(wait_for_terminate_and_check("memoryseccomp-shmat", pid, WAIT_LOG) == EXIT_SUCCESS);
469830d1
LP		 628}
629
630static void test_restrict_archs(void) {
631 pid_t pid;
632
f09da7cc
ZJS		 633 log_info("/* %s */", __func__);
634
cd90ec75
YW		 635 if (!is_seccomp_available()) {
636 log_notice("Seccomp not available, skipping %s", __func__);
469830d1 637 return;
cd90ec75
YW		 638 }
639 if (geteuid() != 0) {
640 log_notice("Not root, skipping %s", __func__);
469830d1 641 return;
cd90ec75 642 }
469830d1
LP		 643
644 pid = fork();
645 assert_se(pid >= 0);
646
647 if (pid == 0) {
648 _cleanup_set_free_ Set *s = NULL;
649
650 assert_se(access("/", F_OK) >= 0);
651
652 assert_se(s = set_new(NULL));
653
654#ifdef __x86_64__
655 assert_se(set_put(s, UINT32_TO_PTR(SCMP_ARCH_X86+1)) >= 0);
656#endif
657 assert_se(seccomp_restrict_archs(s) >= 0);
658
659 assert_se(access("/", F_OK) >= 0);
660 assert_se(seccomp_restrict_archs(NULL) >= 0);
661
662 assert_se(access("/", F_OK) >= 0);
663
664 _exit(EXIT_SUCCESS);
665 }
666
7d4904fe 667 assert_se(wait_for_terminate_and_check("archseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
469830d1
LP		 668}
669
670static void test_load_syscall_filter_set_raw(void) {
671 pid_t pid;
672
f09da7cc
ZJS		 673 log_info("/* %s */", __func__);
674
cd90ec75
YW		 675 if (!is_seccomp_available()) {
676 log_notice("Seccomp not available, skipping %s", __func__);
469830d1 677 return;
cd90ec75
YW		 678 }
679 if (geteuid() != 0) {
680 log_notice("Not root, skipping %s", __func__);
469830d1 681 return;
cd90ec75 682 }
469830d1
LP		 683
684 pid = fork();
685 assert_se(pid >= 0);
686
687 if (pid == 0) {
b4891260 688 _cleanup_hashmap_free_ Hashmap *s = NULL;
469830d1
LP		 689
690 assert_se(access("/", F_OK) >= 0);
691 assert_se(poll(NULL, 0, 0) == 0);
692
7bbc229c 693 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, NULL, scmp_act_kill_process(), true) >= 0);
469830d1
LP		 694 assert_se(access("/", F_OK) >= 0);
695 assert_se(poll(NULL, 0, 0) == 0);
696
b4891260 697 assert_se(s = hashmap_new(NULL));
fb4b0465 698#if defined __NR_access && __NR_access >= 0
b4891260 699 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_access + 1), INT_TO_PTR(-1)) >= 0);
f60a865a 700#else
b4891260 701 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_faccessat + 1), INT_TO_PTR(-1)) >= 0);
f60a865a 702#endif
469830d1 703
b54f36c6 704 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUCLEAN), true) >= 0);
469830d1
LP		 705
706 assert_se(access("/", F_OK) < 0);
707 assert_se(errno == EUCLEAN);
708
709 assert_se(poll(NULL, 0, 0) == 0);
710
b4891260 711 s = hashmap_free(s);
469830d1 712
b4891260 713 assert_se(s = hashmap_new(NULL));
fb4b0465 714#if defined __NR_access && __NR_access >= 0
b4891260
YW		 715 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_access + 1), INT_TO_PTR(EILSEQ)) >= 0);
716#else
717 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_faccessat + 1), INT_TO_PTR(EILSEQ)) >= 0);
718#endif
719
b54f36c6 720 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUCLEAN), true) >= 0);
b4891260
YW		 721
722 assert_se(access("/", F_OK) < 0);
723 assert_se(errno == EILSEQ);
724
725 assert_se(poll(NULL, 0, 0) == 0);
726
727 s = hashmap_free(s);
728
729 assert_se(s = hashmap_new(NULL));
fb4b0465 730#if defined __NR_poll && __NR_poll >= 0
b4891260 731 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_poll + 1), INT_TO_PTR(-1)) >= 0);
f60a865a 732#else
b4891260 733 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_ppoll + 1), INT_TO_PTR(-1)) >= 0);
f60a865a 734#endif
469830d1 735
b54f36c6 736 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUNATCH), true) >= 0);
469830d1
LP		 737
738 assert_se(access("/", F_OK) < 0);
b4891260 739 assert_se(errno == EILSEQ);
469830d1
LP		 740
741 assert_se(poll(NULL, 0, 0) < 0);
742 assert_se(errno == EUNATCH);
743
b4891260
YW		 744 s = hashmap_free(s);
745
746 assert_se(s = hashmap_new(NULL));
fb4b0465 747#if defined __NR_poll && __NR_poll >= 0
b4891260
YW		 748 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_poll + 1), INT_TO_PTR(EILSEQ)) >= 0);
749#else
750 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_ppoll + 1), INT_TO_PTR(EILSEQ)) >= 0);
751#endif
752
b54f36c6 753 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUNATCH), true) >= 0);
b4891260
YW		 754
755 assert_se(access("/", F_OK) < 0);
756 assert_se(errno == EILSEQ);
757
758 assert_se(poll(NULL, 0, 0) < 0);
759 assert_se(errno == EILSEQ);
760
469830d1
LP		 761 _exit(EXIT_SUCCESS);
762 }
763
7d4904fe 764 assert_se(wait_for_terminate_and_check("syscallrawseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
469830d1
LP		 765}
766
78e864e5 767static void test_lock_personality(void) {
e8132d63 768 unsigned long current;
78e864e5
TM		 769 pid_t pid;
770
f09da7cc
ZJS		 771 log_info("/* %s */", __func__);
772
cd90ec75
YW		 773 if (!is_seccomp_available()) {
774 log_notice("Seccomp not available, skipping %s", __func__);
78e864e5 775 return;
cd90ec75
YW		 776 }
777 if (geteuid() != 0) {
778 log_notice("Not root, skipping %s", __func__);
78e864e5 779 return;
cd90ec75 780 }
78e864e5 781
e8132d63
LP		 782 assert_se(opinionated_personality(&current) >= 0);
783
784 log_info("current personality=%lu", current);
785
78e864e5
TM		 786 pid = fork();
787 assert_se(pid >= 0);
788
789 if (pid == 0) {
e8132d63 790 assert_se(seccomp_lock_personality(current) >= 0);
78e864e5 791
21022b9d 792 assert_se((unsigned long) safe_personality(current) == current);
e8132d63 793
21022b9d
LP		 794 /* Note, we also test that safe_personality() works correctly, by checkig whether errno is properly
795 * set, in addition to the return value */
796 errno = 0;
797 assert_se(safe_personality(PER_LINUX | ADDR_NO_RANDOMIZE) == -EPERM);
798 assert_se(errno == EPERM);
e8132d63 799
21022b9d
LP		 800 assert_se(safe_personality(PER_LINUX | MMAP_PAGE_ZERO) == -EPERM);
801 assert_se(safe_personality(PER_LINUX | ADDR_COMPAT_LAYOUT) == -EPERM);
802 assert_se(safe_personality(PER_LINUX | READ_IMPLIES_EXEC) == -EPERM);
803 assert_se(safe_personality(PER_LINUX_32BIT) == -EPERM);
804 assert_se(safe_personality(PER_SVR4) == -EPERM);
805 assert_se(safe_personality(PER_BSD) == -EPERM);
806 assert_se(safe_personality(current == PER_LINUX ? PER_LINUX32 : PER_LINUX) == -EPERM);
807 assert_se(safe_personality(PER_LINUX32_3GB) == -EPERM);
808 assert_se(safe_personality(PER_UW7) == -EPERM);
809 assert_se(safe_personality(0x42) == -EPERM);
810
811 assert_se(safe_personality(PERSONALITY_INVALID) == -EPERM); /* maybe remove this later */
e8132d63
LP		 812
813 assert_se((unsigned long) personality(current) == current);
78e864e5
TM		 814 _exit(EXIT_SUCCESS);
815 }
816
7d4904fe 817 assert_se(wait_for_terminate_and_check("lockpersonalityseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
78e864e5
TM		 818}
819
167fc10c
LP		 820static int real_open(const char *path, int flags, mode_t mode) {
821 /* glibc internally calls openat() when open() is requested. Let's hence define our own wrapper for
dff6c629
ZJS		 822 * testing purposes that calls the real syscall, on architectures where SYS_open is defined. On
823 * other architectures, let's just fall back to the glibc call. */
167fc10c 824
fb4b0465 825#if defined __NR_open && __NR_open >= 0
4df8fe84 826 return (int) syscall(__NR_open, path, flags, mode);
dff6c629
ZJS		 827#else
828 return open(path, flags, mode);
829#endif
167fc10c
LP		 830}
831
832static void test_restrict_suid_sgid(void) {
833 pid_t pid;
834
835 log_info("/* %s */", __func__);
836
837 if (!is_seccomp_available()) {
838 log_notice("Seccomp not available, skipping %s", __func__);
839 return;
840 }
841 if (geteuid() != 0) {
842 log_notice("Not root, skipping %s", __func__);
843 return;
844 }
845
846 pid = fork();
847 assert_se(pid >= 0);
848
849 if (pid == 0) {
850 char path[] = "/tmp/suidsgidXXXXXX", dir[] = "/tmp/suidsgiddirXXXXXX";
851 int fd = -1, k = -1;
852 const char *z;
853
854 fd = mkostemp_safe(path);
855 assert_se(fd >= 0);
856
857 assert_se(mkdtemp(dir));
858 z = strjoina(dir, "/test");
859
860 assert_se(chmod(path, 0755 | S_ISUID) >= 0);
861 assert_se(chmod(path, 0755 | S_ISGID) >= 0);
862 assert_se(chmod(path, 0755 | S_ISGID | S_ISUID) >= 0);
863 assert_se(chmod(path, 0755) >= 0);
864
865 assert_se(fchmod(fd, 0755 | S_ISUID) >= 0);
866 assert_se(fchmod(fd, 0755 | S_ISGID) >= 0);
867 assert_se(fchmod(fd, 0755 | S_ISGID | S_ISUID) >= 0);
868 assert_se(fchmod(fd, 0755) >= 0);
869
870 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISUID, 0) >= 0);
871 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISGID, 0) >= 0);
872 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISGID | S_ISUID, 0) >= 0);
873 assert_se(fchmodat(AT_FDCWD, path, 0755, 0) >= 0);
874
875 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID);
876 k = safe_close(k);
877 assert_se(unlink(z) >= 0);
878
879 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISGID);
880 k = safe_close(k);
881 assert_se(unlink(z) >= 0);
882
883 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID | S_ISGID);
884 k = safe_close(k);
885 assert_se(unlink(z) >= 0);
886
887 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644);
888 k = safe_close(k);
889 assert_se(unlink(z) >= 0);
890
891 k = creat(z, 0644 | S_ISUID);
892 k = safe_close(k);
893 assert_se(unlink(z) >= 0);
894
895 k = creat(z, 0644 | S_ISGID);
896 k = safe_close(k);
897 assert_se(unlink(z) >= 0);
898
899 k = creat(z, 0644 | S_ISUID | S_ISGID);
900 k = safe_close(k);
901 assert_se(unlink(z) >= 0);
902
903 k = creat(z, 0644);
904 k = safe_close(k);
905 assert_se(unlink(z) >= 0);
906
907 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID);
908 k = safe_close(k);
909 assert_se(unlink(z) >= 0);
910
911 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISGID);
912 k = safe_close(k);
913 assert_se(unlink(z) >= 0);
914
915 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID | S_ISGID);
916 k = safe_close(k);
917 assert_se(unlink(z) >= 0);
918
919 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644);
920 k = safe_close(k);
921 assert_se(unlink(z) >= 0);
922
923 assert_se(mkdir(z, 0755 | S_ISUID) >= 0);
924 assert_se(rmdir(z) >= 0);
925 assert_se(mkdir(z, 0755 | S_ISGID) >= 0);
926 assert_se(rmdir(z) >= 0);
927 assert_se(mkdir(z, 0755 | S_ISUID | S_ISGID) >= 0);
928 assert_se(rmdir(z) >= 0);
929 assert_se(mkdir(z, 0755) >= 0);
930 assert_se(rmdir(z) >= 0);
931
932 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISUID) >= 0);
933 assert_se(rmdir(z) >= 0);
934 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISGID) >= 0);
935 assert_se(rmdir(z) >= 0);
936 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISUID | S_ISGID) >= 0);
937 assert_se(rmdir(z) >= 0);
938 assert_se(mkdirat(AT_FDCWD, z, 0755) >= 0);
939 assert_se(rmdir(z) >= 0);
940
941 assert_se(mknod(z, S_IFREG | 0755 | S_ISUID, 0) >= 0);
942 assert_se(unlink(z) >= 0);
943 assert_se(mknod(z, S_IFREG | 0755 | S_ISGID, 0) >= 0);
944 assert_se(unlink(z) >= 0);
945 assert_se(mknod(z, S_IFREG | 0755 | S_ISUID | S_ISGID, 0) >= 0);
946 assert_se(unlink(z) >= 0);
947 assert_se(mknod(z, S_IFREG | 0755, 0) >= 0);
948 assert_se(unlink(z) >= 0);
949
950 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISUID, 0) >= 0);
951 assert_se(unlink(z) >= 0);
952 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISGID, 0) >= 0);
953 assert_se(unlink(z) >= 0);
954 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISUID | S_ISGID, 0) >= 0);
955 assert_se(unlink(z) >= 0);
956 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755, 0) >= 0);
957 assert_se(unlink(z) >= 0);
958
959 assert_se(seccomp_restrict_suid_sgid() >= 0);
960
961 assert_se(chmod(path, 0775 | S_ISUID) < 0 && errno == EPERM);
962 assert_se(chmod(path, 0775 | S_ISGID) < 0 && errno == EPERM);
963 assert_se(chmod(path, 0775 | S_ISGID | S_ISUID) < 0 && errno == EPERM);
964 assert_se(chmod(path, 0775) >= 0);
965
966 assert_se(fchmod(fd, 0775 | S_ISUID) < 0 && errno == EPERM);
967 assert_se(fchmod(fd, 0775 | S_ISGID) < 0 && errno == EPERM);
968 assert_se(fchmod(fd, 0775 | S_ISGID | S_ISUID) < 0 && errno == EPERM);
969 assert_se(fchmod(fd, 0775) >= 0);
970
971 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISUID, 0) < 0 && errno == EPERM);
972 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISGID, 0) < 0 && errno == EPERM);
973 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISGID | S_ISUID, 0) < 0 && errno == EPERM);
974 assert_se(fchmodat(AT_FDCWD, path, 0755, 0) >= 0);
975
976 assert_se(real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID) < 0 && errno == EPERM);
977 assert_se(real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISGID) < 0 && errno == EPERM);
978 assert_se(real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
979 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644);
980 k = safe_close(k);
981 assert_se(unlink(z) >= 0);
982
983 assert_se(creat(z, 0644 | S_ISUID) < 0 && errno == EPERM);
984 assert_se(creat(z, 0644 | S_ISGID) < 0 && errno == EPERM);
985 assert_se(creat(z, 0644 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
986 k = creat(z, 0644);
987 k = safe_close(k);
988 assert_se(unlink(z) >= 0);
989
990 assert_se(openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID) < 0 && errno == EPERM);
991 assert_se(openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISGID) < 0 && errno == EPERM);
992 assert_se(openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
993 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644);
994 k = safe_close(k);
995 assert_se(unlink(z) >= 0);
996
997 assert_se(mkdir(z, 0755 | S_ISUID) < 0 && errno == EPERM);
998 assert_se(mkdir(z, 0755 | S_ISGID) < 0 && errno == EPERM);
999 assert_se(mkdir(z, 0755 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
1000 assert_se(mkdir(z, 0755) >= 0);
1001 assert_se(rmdir(z) >= 0);
1002
1003 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISUID) < 0 && errno == EPERM);
1004 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISGID) < 0 && errno == EPERM);
1005 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
1006 assert_se(mkdirat(AT_FDCWD, z, 0755) >= 0);
1007 assert_se(rmdir(z) >= 0);
1008
1009 assert_se(mknod(z, S_IFREG | 0755 | S_ISUID, 0) < 0 && errno == EPERM);
1010 assert_se(mknod(z, S_IFREG | 0755 | S_ISGID, 0) < 0 && errno == EPERM);
1011 assert_se(mknod(z, S_IFREG | 0755 | S_ISUID | S_ISGID, 0) < 0 && errno == EPERM);
1012 assert_se(mknod(z, S_IFREG | 0755, 0) >= 0);
1013 assert_se(unlink(z) >= 0);
1014
1015 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISUID, 0) < 0 && errno == EPERM);
1016 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISGID, 0) < 0 && errno == EPERM);
1017 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISUID | S_ISGID, 0) < 0 && errno == EPERM);
1018 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755, 0) >= 0);
1019 assert_se(unlink(z) >= 0);
1020
1021 assert_se(unlink(path) >= 0);
1022 assert_se(rm_rf(dir, REMOVE_ROOT|REMOVE_PHYSICAL) >= 0);
1023
1024 _exit(EXIT_SUCCESS);
1025 }
1026
1027 assert_se(wait_for_terminate_and_check("suidsgidseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
1028}
1029
f6281133 1030int main(int argc, char *argv[]) {
6d7c4033 1031 test_setup_logging(LOG_DEBUG);
add00535 1032
f6281133 1033 test_seccomp_arch_to_string();
aa34055f 1034 test_architecture_table();
f6281133
LP		 1035 test_syscall_filter_set_find();
1036 test_filter_sets();
23e12f8e 1037 test_filter_sets_ordered();
add00535 1038 test_restrict_namespace();
469830d1 1039 test_protect_sysctl();
97d05f3b 1040 test_protect_syslog();
469830d1
LP		 1041 test_restrict_address_families();
1042 test_restrict_realtime();
2a65bd94
ZJS		 1043 test_memory_deny_write_execute_mmap();
1044 test_memory_deny_write_execute_shmat();
469830d1
LP		 1045 test_restrict_archs();
1046 test_load_syscall_filter_set_raw();
78e864e5 1047 test_lock_personality();
167fc10c 1048 test_restrict_suid_sgid();
f6281133
LP		 1049
1050 return 0;
1051}
Unnamed repository; edit this file 'description' to name the repository.