]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/test/test-seccomp.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
tree-wide: avoid some loaded terms
[thirdparty/systemd.git] / src / test / test-seccomp.c
CommitLineData
53e1b683 1/* SPDX-License-Identifier: LGPL-2.1+ */
f6281133 2
f5947a5e 3#include <fcntl.h>
d7e454ba 4#include <poll.h>
f6281133
LP		 5#include <stdlib.h>
6#include <sys/eventfd.h>
469830d1 7#include <sys/mman.h>
78e864e5 8#include <sys/personality.h>
2a65bd94 9#include <sys/shm.h>
dff6c629 10#include <sys/syscall.h>
2a65bd94
ZJS		 11#include <sys/types.h>
12#include <unistd.h>
f6281133 13
add00535 14#include "alloc-util.h"
f6281133 15#include "fd-util.h"
3c14dc61 16#include "fileio.h"
f6281133 17#include "macro.h"
0a970718 18#include "memory-util.h"
f5947a5e 19#include "missing_sched.h"
add00535 20#include "nsflags.h"
d8b4d14d 21#include "nulstr-util.h"
f6281133 22#include "process-util.h"
add00535 23#include "raw-clone.h"
167fc10c 24#include "rm-rf.h"
f6281133 25#include "seccomp-util.h"
469830d1 26#include "set.h"
aa34055f 27#include "string-util.h"
6d7c4033 28#include "tests.h"
167fc10c 29#include "tmpfile-util.h"
469830d1 30#include "virt.h"
f6281133 31
4df8fe84 32/* __NR_socket may be invalid due to libseccomp */
fb4b0465 33#if !defined(__NR_socket) || __NR_socket < 0 || defined(__i386__) || defined(__s390x__) || defined(__s390__)
da1921a5
ZJS		 34/* On these archs, socket() is implemented via the socketcall() syscall multiplexer,
35 * and we can't restrict it hence via seccomp. */
36# define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 1
37#else
38# define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 0
39#endif
40
f6281133
LP		 41static void test_seccomp_arch_to_string(void) {
42 uint32_t a, b;
43 const char *name;
44
f09da7cc
ZJS		 45 log_info("/* %s */", __func__);
46
f6281133
LP		 47 a = seccomp_arch_native();
48 assert_se(a > 0);
49 name = seccomp_arch_to_string(a);
50 assert_se(name);
51 assert_se(seccomp_arch_from_string(name, &b) >= 0);
52 assert_se(a == b);
53}
54
aa34055f
ZJS		 55static void test_architecture_table(void) {
56 const char *n, *n2;
57
f09da7cc
ZJS		 58 log_info("/* %s */", __func__);
59
aa34055f
ZJS		 60 NULSTR_FOREACH(n,
61 "native\0"
62 "x86\0"
63 "x86-64\0"
64 "x32\0"
65 "arm\0"
66 "arm64\0"
67 "mips\0"
68 "mips64\0"
69 "mips64-n32\0"
70 "mips-le\0"
71 "mips64-le\0"
72 "mips64-le-n32\0"
73 "ppc\0"
74 "ppc64\0"
75 "ppc64-le\0"
76 "s390\0"
77 "s390x\0") {
78 uint32_t c;
79
80 assert_se(seccomp_arch_from_string(n, &c) >= 0);
81 n2 = seccomp_arch_to_string(c);
82 log_info("seccomp-arch: %s → 0x%"PRIx32" → %s", n, c, n2);
83 assert_se(streq_ptr(n, n2));
84 }
85}
86
f6281133 87static void test_syscall_filter_set_find(void) {
f09da7cc
ZJS		 88 log_info("/* %s */", __func__);
89
f6281133
LP		 90 assert_se(!syscall_filter_set_find(NULL));
91 assert_se(!syscall_filter_set_find(""));
92 assert_se(!syscall_filter_set_find("quux"));
93 assert_se(!syscall_filter_set_find("@quux"));
94
95 assert_se(syscall_filter_set_find("@clock") == syscall_filter_sets + SYSCALL_FILTER_SET_CLOCK);
96 assert_se(syscall_filter_set_find("@default") == syscall_filter_sets + SYSCALL_FILTER_SET_DEFAULT);
97 assert_se(syscall_filter_set_find("@raw-io") == syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO);
98}
99
100static void test_filter_sets(void) {
101 unsigned i;
102 int r;
103
f09da7cc
ZJS		 104 log_info("/* %s */", __func__);
105
cd90ec75
YW		 106 if (!is_seccomp_available()) {
107 log_notice("Seccomp not available, skipping %s", __func__);
f6281133 108 return;
cd90ec75
YW		 109 }
110 if (geteuid() != 0) {
111 log_notice("Not root, skipping %s", __func__);
f6281133 112 return;
cd90ec75 113 }
f6281133
LP		 114
115 for (i = 0; i < _SYSCALL_FILTER_SET_MAX; i++) {
116 pid_t pid;
117
118 log_info("Testing %s", syscall_filter_sets[i].name);
119
120 pid = fork();
121 assert_se(pid >= 0);
122
123 if (pid == 0) { /* Child? */
124 int fd;
125
6b000af4 126 /* If we look at the default set (or one that includes it), allow-list instead of deny-list */
70526841 127 if (IN_SET(i, SYSCALL_FILTER_SET_DEFAULT, SYSCALL_FILTER_SET_SYSTEM_SERVICE))
b54f36c6 128 r = seccomp_load_syscall_filter_set(SCMP_ACT_ERRNO(EUCLEAN), syscall_filter_sets + i, SCMP_ACT_ALLOW, true);
f6281133 129 else
b54f36c6 130 r = seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + i, SCMP_ACT_ERRNO(EUCLEAN), true);
f6281133
LP		 131 if (r < 0)
132 _exit(EXIT_FAILURE);
133
134 /* Test the sycall filter with one random system call */
135 fd = eventfd(0, EFD_NONBLOCK|EFD_CLOEXEC);
136 if (IN_SET(i, SYSCALL_FILTER_SET_IO_EVENT, SYSCALL_FILTER_SET_DEFAULT))
469830d1 137 assert_se(fd < 0 && errno == EUCLEAN);
f6281133
LP		 138 else {
139 assert_se(fd >= 0);
140 safe_close(fd);
141 }
142
143 _exit(EXIT_SUCCESS);
144 }
145
7d4904fe 146 assert_se(wait_for_terminate_and_check(syscall_filter_sets[i].name, pid, WAIT_LOG) == EXIT_SUCCESS);
f6281133
LP		 147 }
148}
149
23e12f8e
ZJS		 150static void test_filter_sets_ordered(void) {
151 size_t i;
152
f09da7cc
ZJS		 153 log_info("/* %s */", __func__);
154
23e12f8e
ZJS		 155 /* Ensure "@default" always remains at the beginning of the list */
156 assert_se(SYSCALL_FILTER_SET_DEFAULT == 0);
157 assert_se(streq(syscall_filter_sets[0].name, "@default"));
158
159 for (i = 0; i < _SYSCALL_FILTER_SET_MAX; i++) {
160 const char *k, *p = NULL;
161
162 /* Make sure each group has a description */
163 assert_se(!isempty(syscall_filter_sets[0].help));
164
165 /* Make sure the groups are ordered alphabetically, except for the first entry */
166 assert_se(i < 2 || strcmp(syscall_filter_sets[i-1].name, syscall_filter_sets[i].name) < 0);
167
168 NULSTR_FOREACH(k, syscall_filter_sets[i].value) {
169
170 /* Ensure each syscall list is in itself ordered, but groups before names */
171 assert_se(!p ||
172 (*p == '@' && *k != '@') ||
173 (((*p == '@' && *k == '@') ||
174 (*p != '@' && *k != '@')) &&
175 strcmp(p, k) < 0));
176
177 p = k;
178 }
179 }
180}
181
add00535 182static void test_restrict_namespace(void) {
86c2a9f1 183 char *s = NULL;
add00535 184 unsigned long ul;
469830d1 185 pid_t pid;
add00535 186
5f00dc4d
LP		 187 if (!have_namespaces()) {
188 log_notice("Testing without namespaces, skipping %s", __func__);
189 return;
190 }
191
f09da7cc
ZJS		 192 log_info("/* %s */", __func__);
193
dd0395b5 194 assert_se(namespace_flags_to_string(0, &s) == 0 && isempty(s));
86c2a9f1
YW		 195 s = mfree(s);
196 assert_se(namespace_flags_to_string(CLONE_NEWNS, &s) == 0 && streq(s, "mnt"));
197 s = mfree(s);
198 assert_se(namespace_flags_to_string(CLONE_NEWNS|CLONE_NEWIPC, &s) == 0 && streq(s, "ipc mnt"));
199 s = mfree(s);
200 assert_se(namespace_flags_to_string(CLONE_NEWCGROUP, &s) == 0 && streq(s, "cgroup"));
201 s = mfree(s);
202
203 assert_se(namespace_flags_from_string("mnt", &ul) == 0 && ul == CLONE_NEWNS);
204 assert_se(namespace_flags_from_string(NULL, &ul) == 0 && ul == 0);
205 assert_se(namespace_flags_from_string("", &ul) == 0 && ul == 0);
206 assert_se(namespace_flags_from_string("uts", &ul) == 0 && ul == CLONE_NEWUTS);
207 assert_se(namespace_flags_from_string("mnt uts ipc", &ul) == 0 && ul == (CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWIPC));
208
209 assert_se(namespace_flags_to_string(CLONE_NEWUTS, &s) == 0 && streq(s, "uts"));
210 assert_se(namespace_flags_from_string(s, &ul) == 0 && ul == CLONE_NEWUTS);
211 s = mfree(s);
212 assert_se(namespace_flags_from_string("ipc", &ul) == 0 && ul == CLONE_NEWIPC);
213 assert_se(namespace_flags_to_string(ul, &s) == 0 && streq(s, "ipc"));
214 s = mfree(s);
215
216 assert_se(namespace_flags_to_string(NAMESPACE_FLAGS_ALL, &s) == 0);
add00535 217 assert_se(streq(s, "cgroup ipc net mnt pid user uts"));
86c2a9f1
YW		 218 assert_se(namespace_flags_from_string(s, &ul) == 0 && ul == NAMESPACE_FLAGS_ALL);
219 s = mfree(s);
add00535 220
cd90ec75
YW		 221 if (!is_seccomp_available()) {
222 log_notice("Seccomp not available, skipping remaining tests in %s", __func__);
add00535 223 return;
cd90ec75
YW		 224 }
225 if (geteuid() != 0) {
226 log_notice("Not root, skipping remaining tests in %s", __func__);
add00535 227 return;
cd90ec75 228 }
add00535
LP		 229
230 pid = fork();
231 assert_se(pid >= 0);
232
233 if (pid == 0) {
234
235 assert_se(seccomp_restrict_namespaces(CLONE_NEWNS|CLONE_NEWNET) >= 0);
236
237 assert_se(unshare(CLONE_NEWNS) == 0);
238 assert_se(unshare(CLONE_NEWNET) == 0);
239 assert_se(unshare(CLONE_NEWUTS) == -1);
240 assert_se(errno == EPERM);
241 assert_se(unshare(CLONE_NEWIPC) == -1);
242 assert_se(errno == EPERM);
243 assert_se(unshare(CLONE_NEWNET|CLONE_NEWUTS) == -1);
244 assert_se(errno == EPERM);
245
246 /* We use fd 0 (stdin) here, which of course will fail with EINVAL on setns(). Except of course our
247 * seccomp filter worked, and hits first and makes it return EPERM */
248 assert_se(setns(0, CLONE_NEWNS) == -1);
249 assert_se(errno == EINVAL);
250 assert_se(setns(0, CLONE_NEWNET) == -1);
251 assert_se(errno == EINVAL);
252 assert_se(setns(0, CLONE_NEWUTS) == -1);
253 assert_se(errno == EPERM);
254 assert_se(setns(0, CLONE_NEWIPC) == -1);
255 assert_se(errno == EPERM);
256 assert_se(setns(0, CLONE_NEWNET|CLONE_NEWUTS) == -1);
257 assert_se(errno == EPERM);
258 assert_se(setns(0, 0) == -1);
259 assert_se(errno == EPERM);
260
261 pid = raw_clone(CLONE_NEWNS);
262 assert_se(pid >= 0);
263 if (pid == 0)
264 _exit(EXIT_SUCCESS);
265 pid = raw_clone(CLONE_NEWNET);
266 assert_se(pid >= 0);
267 if (pid == 0)
268 _exit(EXIT_SUCCESS);
269 pid = raw_clone(CLONE_NEWUTS);
270 assert_se(pid < 0);
271 assert_se(errno == EPERM);
272 pid = raw_clone(CLONE_NEWIPC);
273 assert_se(pid < 0);
274 assert_se(errno == EPERM);
275 pid = raw_clone(CLONE_NEWNET|CLONE_NEWUTS);
276 assert_se(pid < 0);
277 assert_se(errno == EPERM);
278
279 _exit(EXIT_SUCCESS);
280 }
281
7d4904fe 282 assert_se(wait_for_terminate_and_check("nsseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
add00535
LP		 283}
284
469830d1
LP		 285static void test_protect_sysctl(void) {
286 pid_t pid;
3c14dc61 287 _cleanup_free_ char *seccomp = NULL;
469830d1 288
f09da7cc
ZJS		 289 log_info("/* %s */", __func__);
290
cd90ec75
YW		 291 if (!is_seccomp_available()) {
292 log_notice("Seccomp not available, skipping %s", __func__);
469830d1 293 return;
cd90ec75
YW		 294 }
295 if (geteuid() != 0) {
296 log_notice("Not root, skipping %s", __func__);
469830d1 297 return;
cd90ec75 298 }
469830d1 299
cd90ec75
YW		 300 /* in containers _sysctl() is likely missing anyway */
301 if (detect_container() > 0) {
302 log_notice("Testing in container, skipping %s", __func__);
469830d1 303 return;
cd90ec75 304 }
469830d1 305
3c14dc61
TM		 306 assert_se(get_proc_field("/proc/self/status", "Seccomp", WHITESPACE, &seccomp) == 0);
307 if (!streq(seccomp, "0"))
308 log_warning("Warning: seccomp filter detected, results may be unreliable for %s", __func__);
309
469830d1
LP		 310 pid = fork();
311 assert_se(pid >= 0);
312
313 if (pid == 0) {
fb4b0465 314#if defined __NR__sysctl && __NR__sysctl >= 0
469830d1
LP		 315 assert_se(syscall(__NR__sysctl, NULL) < 0);
316 assert_se(errno == EFAULT);
2e64e8f4 317#endif
469830d1
LP		 318
319 assert_se(seccomp_protect_sysctl() >= 0);
320
fb4b0465 321#if defined __NR__sysctl && __NR__sysctl >= 0
469830d1
LP		 322 assert_se(syscall(__NR__sysctl, 0, 0, 0) < 0);
323 assert_se(errno == EPERM);
2e64e8f4 324#endif
469830d1
LP		 325
326 _exit(EXIT_SUCCESS);
327 }
328
7d4904fe 329 assert_se(wait_for_terminate_and_check("sysctlseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
469830d1
LP		 330}
331
97d05f3b
KK		 332static void test_protect_syslog(void) {
333 pid_t pid;
334
335 log_info("/* %s */", __func__);
336
337 if (!is_seccomp_available()) {
338 log_notice("Seccomp not available, skipping %s", __func__);
339 return;
340 }
341 if (geteuid() != 0) {
342 log_notice("Not root, skipping %s", __func__);
343 return;
344 }
345
346 /* in containers syslog() is likely missing anyway */
347 if (detect_container() > 0) {
348 log_notice("Testing in container, skipping %s", __func__);
349 return;
350 }
351
352 pid = fork();
353 assert_se(pid >= 0);
354
355 if (pid == 0) {
fb4b0465 356#if defined __NR_syslog && __NR_syslog >= 0
97d05f3b
KK		 357 assert_se(syscall(__NR_syslog, -1, NULL, 0) < 0);
358 assert_se(errno == EINVAL);
359#endif
360
361 assert_se(seccomp_protect_syslog() >= 0);
362
fb4b0465 363#if defined __NR_syslog && __NR_syslog >= 0
97d05f3b
KK		 364 assert_se(syscall(__NR_syslog, 0, 0, 0) < 0);
365 assert_se(errno == EPERM);
366#endif
367
368 _exit(EXIT_SUCCESS);
369 }
370
371 assert_se(wait_for_terminate_and_check("syslogseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
372}
373
469830d1
LP		 374static void test_restrict_address_families(void) {
375 pid_t pid;
376
f09da7cc
ZJS		 377 log_info("/* %s */", __func__);
378
cd90ec75
YW		 379 if (!is_seccomp_available()) {
380 log_notice("Seccomp not available, skipping %s", __func__);
469830d1 381 return;
cd90ec75
YW		 382 }
383 if (geteuid() != 0) {
384 log_notice("Not root, skipping %s", __func__);
469830d1 385 return;
cd90ec75 386 }
469830d1
LP		 387
388 pid = fork();
389 assert_se(pid >= 0);
390
391 if (pid == 0) {
392 int fd;
393 Set *s;
394
395 fd = socket(AF_INET, SOCK_DGRAM, 0);
396 assert_se(fd >= 0);
397 safe_close(fd);
398
399 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
400 assert_se(fd >= 0);
401 safe_close(fd);
402
403 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
404 assert_se(fd >= 0);
405 safe_close(fd);
406
407 assert_se(s = set_new(NULL));
408 assert_se(set_put(s, INT_TO_PTR(AF_UNIX)) >= 0);
409
410 assert_se(seccomp_restrict_address_families(s, false) >= 0);
411
412 fd = socket(AF_INET, SOCK_DGRAM, 0);
413 assert_se(fd >= 0);
414 safe_close(fd);
415
ad8f1479 416 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
dce0e620 417#if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
ad8f1479
LP		 418 assert_se(fd >= 0);
419 safe_close(fd);
420#else
dce0e620 421 assert_se(fd < 0);
469830d1 422 assert_se(errno == EAFNOSUPPORT);
ad8f1479 423#endif
469830d1
LP		 424
425 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
426 assert_se(fd >= 0);
427 safe_close(fd);
428
429 set_clear(s);
430
431 assert_se(set_put(s, INT_TO_PTR(AF_INET)) >= 0);
432
433 assert_se(seccomp_restrict_address_families(s, true) >= 0);
434
435 fd = socket(AF_INET, SOCK_DGRAM, 0);
436 assert_se(fd >= 0);
437 safe_close(fd);
438
ad8f1479 439 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
dce0e620 440#if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
ad8f1479
LP		 441 assert_se(fd >= 0);
442 safe_close(fd);
dce0e620
ZJS		 443#else
444 assert_se(fd < 0);
445 assert_se(errno == EAFNOSUPPORT);
446#endif
ad8f1479
LP		 447
448 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
dce0e620 449#if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
ad8f1479
LP		 450 assert_se(fd >= 0);
451 safe_close(fd);
452#else
dce0e620 453 assert_se(fd < 0);
469830d1 454 assert_se(errno == EAFNOSUPPORT);
ad8f1479 455#endif
469830d1
LP		 456
457 _exit(EXIT_SUCCESS);
458 }
459
7d4904fe 460 assert_se(wait_for_terminate_and_check("socketseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
469830d1
LP		 461}
462
463static void test_restrict_realtime(void) {
464 pid_t pid;
465
f09da7cc
ZJS		 466 log_info("/* %s */", __func__);
467
cd90ec75
YW		 468 if (!is_seccomp_available()) {
469 log_notice("Seccomp not available, skipping %s", __func__);
469830d1 470 return;
cd90ec75
YW		 471 }
472 if (geteuid() != 0) {
473 log_notice("Not root, skipping %s", __func__);
469830d1 474 return;
cd90ec75 475 }
469830d1 476
cd90ec75
YW		 477 /* in containers RT privs are likely missing anyway */
478 if (detect_container() > 0) {
479 log_notice("Testing in container, skipping %s", __func__);
469830d1 480 return;
cd90ec75 481 }
469830d1
LP		 482
483 pid = fork();
484 assert_se(pid >= 0);
485
486 if (pid == 0) {
487 assert_se(sched_setscheduler(0, SCHED_FIFO, &(struct sched_param) { .sched_priority = 1 }) >= 0);
488 assert_se(sched_setscheduler(0, SCHED_RR, &(struct sched_param) { .sched_priority = 1 }) >= 0);
489 assert_se(sched_setscheduler(0, SCHED_IDLE, &(struct sched_param) { .sched_priority = 0 }) >= 0);
490 assert_se(sched_setscheduler(0, SCHED_BATCH, &(struct sched_param) { .sched_priority = 0 }) >= 0);
491 assert_se(sched_setscheduler(0, SCHED_OTHER, &(struct sched_param) {}) >= 0);
492
493 assert_se(seccomp_restrict_realtime() >= 0);
494
495 assert_se(sched_setscheduler(0, SCHED_IDLE, &(struct sched_param) { .sched_priority = 0 }) >= 0);
496 assert_se(sched_setscheduler(0, SCHED_BATCH, &(struct sched_param) { .sched_priority = 0 }) >= 0);
497 assert_se(sched_setscheduler(0, SCHED_OTHER, &(struct sched_param) {}) >= 0);
498
499 assert_se(sched_setscheduler(0, SCHED_FIFO, &(struct sched_param) { .sched_priority = 1 }) < 0);
500 assert_se(errno == EPERM);
501 assert_se(sched_setscheduler(0, SCHED_RR, &(struct sched_param) { .sched_priority = 1 }) < 0);
502 assert_se(errno == EPERM);
503
504 _exit(EXIT_SUCCESS);
505 }
506
7d4904fe 507 assert_se(wait_for_terminate_and_check("realtimeseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
469830d1
LP		 508}
509
2a65bd94 510static void test_memory_deny_write_execute_mmap(void) {
469830d1
LP		 511 pid_t pid;
512
f09da7cc
ZJS		 513 log_info("/* %s */", __func__);
514
cd90ec75
YW		 515 if (!is_seccomp_available()) {
516 log_notice("Seccomp not available, skipping %s", __func__);
469830d1 517 return;
cd90ec75
YW		 518 }
519 if (geteuid() != 0) {
520 log_notice("Not root, skipping %s", __func__);
469830d1 521 return;
cd90ec75 522 }
469830d1
LP		 523
524 pid = fork();
525 assert_se(pid >= 0);
526
527 if (pid == 0) {
528 void *p;
529
530 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
531 assert_se(p != MAP_FAILED);
532 assert_se(munmap(p, page_size()) >= 0);
533
8a50cf69
LP		 534 p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
535 assert_se(p != MAP_FAILED);
536 assert_se(munmap(p, page_size()) >= 0);
469830d1 537
8a50cf69
LP		 538 assert_se(seccomp_memory_deny_write_execute() >= 0);
539
8a50cf69 540 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
4278d1f5 541#if defined(__x86_64__) || defined(__i386__) || defined(__powerpc64__) || defined(__arm__) || defined(__aarch64__)
469830d1
LP		 542 assert_se(p == MAP_FAILED);
543 assert_se(errno == EPERM);
8a50cf69 544#endif
49219b5c
CE		 545 /* Depending on kernel, libseccomp, and glibc versions, other architectures
546 * might fail or not. Let's not assert success. */
547 if (p != MAP_FAILED)
548 assert_se(munmap(p, page_size()) == 0);
469830d1
LP		 549
550 p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
551 assert_se(p != MAP_FAILED);
552 assert_se(munmap(p, page_size()) >= 0);
553
554 _exit(EXIT_SUCCESS);
555 }
556
7d4904fe 557 assert_se(wait_for_terminate_and_check("memoryseccomp-mmap", pid, WAIT_LOG) == EXIT_SUCCESS);
2a65bd94
ZJS		 558}
559
560static void test_memory_deny_write_execute_shmat(void) {
561 int shmid;
562 pid_t pid;
e55bdf9b 563 uint32_t arch;
2a65bd94 564
f09da7cc
ZJS		 565 log_info("/* %s */", __func__);
566
e55bdf9b
ZJS		 567 SECCOMP_FOREACH_LOCAL_ARCH(arch) {
568 log_debug("arch %s: SCMP_SYS(mmap) = %d", seccomp_arch_to_string(arch), SCMP_SYS(mmap));
569 log_debug("arch %s: SCMP_SYS(mmap2) = %d", seccomp_arch_to_string(arch), SCMP_SYS(mmap2));
570 log_debug("arch %s: SCMP_SYS(shmget) = %d", seccomp_arch_to_string(arch), SCMP_SYS(shmget));
571 log_debug("arch %s: SCMP_SYS(shmat) = %d", seccomp_arch_to_string(arch), SCMP_SYS(shmat));
572 log_debug("arch %s: SCMP_SYS(shmdt) = %d", seccomp_arch_to_string(arch), SCMP_SYS(shmdt));
573 }
574
cd90ec75
YW		 575 if (!is_seccomp_available()) {
576 log_notice("Seccomp not available, skipping %s", __func__);
2a65bd94 577 return;
cd90ec75
YW		 578 }
579 if (geteuid() != 0) {
580 log_notice("Not root, skipping %s", __func__);
2a65bd94 581 return;
cd90ec75 582 }
2a65bd94
ZJS		 583
584 shmid = shmget(IPC_PRIVATE, page_size(), 0);
585 assert_se(shmid >= 0);
586
587 pid = fork();
588 assert_se(pid >= 0);
589
590 if (pid == 0) {
591 void *p;
592
593 p = shmat(shmid, NULL, 0);
594 assert_se(p != MAP_FAILED);
595 assert_se(shmdt(p) == 0);
596
597 p = shmat(shmid, NULL, SHM_EXEC);
598 assert_se(p != MAP_FAILED);
599 assert_se(shmdt(p) == 0);
600
601 assert_se(seccomp_memory_deny_write_execute() >= 0);
602
603 p = shmat(shmid, NULL, SHM_EXEC);
67fb5f33 604 log_debug_errno(p == MAP_FAILED ? errno : 0, "shmat(SHM_EXEC): %m");
4278d1f5 605#if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__)
2a65bd94
ZJS		 606 assert_se(p == MAP_FAILED);
607 assert_se(errno == EPERM);
2a65bd94 608#endif
67fb5f33
ZJS		 609 /* Depending on kernel, libseccomp, and glibc versions, other architectures
610 * might fail or not. Let's not assert success. */
611 if (p != MAP_FAILED)
612 assert_se(shmdt(p) == 0);
2a65bd94
ZJS		 613
614 p = shmat(shmid, NULL, 0);
67fb5f33 615 log_debug_errno(p == MAP_FAILED ? errno : 0, "shmat(0): %m");
2a65bd94
ZJS		 616 assert_se(p != MAP_FAILED);
617 assert_se(shmdt(p) == 0);
618
619 _exit(EXIT_SUCCESS);
620 }
621
7d4904fe 622 assert_se(wait_for_terminate_and_check("memoryseccomp-shmat", pid, WAIT_LOG) == EXIT_SUCCESS);
469830d1
LP		 623}
624
625static void test_restrict_archs(void) {
626 pid_t pid;
627
f09da7cc
ZJS		 628 log_info("/* %s */", __func__);
629
cd90ec75
YW		 630 if (!is_seccomp_available()) {
631 log_notice("Seccomp not available, skipping %s", __func__);
469830d1 632 return;
cd90ec75
YW		 633 }
634 if (geteuid() != 0) {
635 log_notice("Not root, skipping %s", __func__);
469830d1 636 return;
cd90ec75 637 }
469830d1
LP		 638
639 pid = fork();
640 assert_se(pid >= 0);
641
642 if (pid == 0) {
643 _cleanup_set_free_ Set *s = NULL;
644
645 assert_se(access("/", F_OK) >= 0);
646
647 assert_se(s = set_new(NULL));
648
649#ifdef __x86_64__
650 assert_se(set_put(s, UINT32_TO_PTR(SCMP_ARCH_X86+1)) >= 0);
651#endif
652 assert_se(seccomp_restrict_archs(s) >= 0);
653
654 assert_se(access("/", F_OK) >= 0);
655 assert_se(seccomp_restrict_archs(NULL) >= 0);
656
657 assert_se(access("/", F_OK) >= 0);
658
659 _exit(EXIT_SUCCESS);
660 }
661
7d4904fe 662 assert_se(wait_for_terminate_and_check("archseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
469830d1
LP		 663}
664
665static void test_load_syscall_filter_set_raw(void) {
666 pid_t pid;
667
f09da7cc
ZJS		 668 log_info("/* %s */", __func__);
669
cd90ec75
YW		 670 if (!is_seccomp_available()) {
671 log_notice("Seccomp not available, skipping %s", __func__);
469830d1 672 return;
cd90ec75
YW		 673 }
674 if (geteuid() != 0) {
675 log_notice("Not root, skipping %s", __func__);
469830d1 676 return;
cd90ec75 677 }
469830d1
LP		 678
679 pid = fork();
680 assert_se(pid >= 0);
681
682 if (pid == 0) {
b4891260 683 _cleanup_hashmap_free_ Hashmap *s = NULL;
469830d1
LP		 684
685 assert_se(access("/", F_OK) >= 0);
686 assert_se(poll(NULL, 0, 0) == 0);
687
7bbc229c 688 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, NULL, scmp_act_kill_process(), true) >= 0);
469830d1
LP		 689 assert_se(access("/", F_OK) >= 0);
690 assert_se(poll(NULL, 0, 0) == 0);
691
b4891260 692 assert_se(s = hashmap_new(NULL));
fb4b0465 693#if defined __NR_access && __NR_access >= 0
b4891260 694 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_access + 1), INT_TO_PTR(-1)) >= 0);
f60a865a 695#else
b4891260 696 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_faccessat + 1), INT_TO_PTR(-1)) >= 0);
f60a865a 697#endif
469830d1 698
b54f36c6 699 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUCLEAN), true) >= 0);
469830d1
LP		 700
701 assert_se(access("/", F_OK) < 0);
702 assert_se(errno == EUCLEAN);
703
704 assert_se(poll(NULL, 0, 0) == 0);
705
b4891260 706 s = hashmap_free(s);
469830d1 707
b4891260 708 assert_se(s = hashmap_new(NULL));
fb4b0465 709#if defined __NR_access && __NR_access >= 0
b4891260
YW		 710 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_access + 1), INT_TO_PTR(EILSEQ)) >= 0);
711#else
712 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_faccessat + 1), INT_TO_PTR(EILSEQ)) >= 0);
713#endif
714
b54f36c6 715 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUCLEAN), true) >= 0);
b4891260
YW		 716
717 assert_se(access("/", F_OK) < 0);
718 assert_se(errno == EILSEQ);
719
720 assert_se(poll(NULL, 0, 0) == 0);
721
722 s = hashmap_free(s);
723
724 assert_se(s = hashmap_new(NULL));
fb4b0465 725#if defined __NR_poll && __NR_poll >= 0
b4891260 726 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_poll + 1), INT_TO_PTR(-1)) >= 0);
f60a865a 727#else
b4891260 728 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_ppoll + 1), INT_TO_PTR(-1)) >= 0);
f60a865a 729#endif
469830d1 730
b54f36c6 731 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUNATCH), true) >= 0);
469830d1
LP		 732
733 assert_se(access("/", F_OK) < 0);
b4891260 734 assert_se(errno == EILSEQ);
469830d1
LP		 735
736 assert_se(poll(NULL, 0, 0) < 0);
737 assert_se(errno == EUNATCH);
738
b4891260
YW		 739 s = hashmap_free(s);
740
741 assert_se(s = hashmap_new(NULL));
fb4b0465 742#if defined __NR_poll && __NR_poll >= 0
b4891260
YW		 743 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_poll + 1), INT_TO_PTR(EILSEQ)) >= 0);
744#else
745 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_ppoll + 1), INT_TO_PTR(EILSEQ)) >= 0);
746#endif
747
b54f36c6 748 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUNATCH), true) >= 0);
b4891260
YW		 749
750 assert_se(access("/", F_OK) < 0);
751 assert_se(errno == EILSEQ);
752
753 assert_se(poll(NULL, 0, 0) < 0);
754 assert_se(errno == EILSEQ);
755
469830d1
LP		 756 _exit(EXIT_SUCCESS);
757 }
758
7d4904fe 759 assert_se(wait_for_terminate_and_check("syscallrawseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
469830d1
LP		 760}
761
78e864e5 762static void test_lock_personality(void) {
e8132d63 763 unsigned long current;
78e864e5
TM		 764 pid_t pid;
765
f09da7cc
ZJS		 766 log_info("/* %s */", __func__);
767
cd90ec75
YW		 768 if (!is_seccomp_available()) {
769 log_notice("Seccomp not available, skipping %s", __func__);
78e864e5 770 return;
cd90ec75
YW		 771 }
772 if (geteuid() != 0) {
773 log_notice("Not root, skipping %s", __func__);
78e864e5 774 return;
cd90ec75 775 }
78e864e5 776
e8132d63
LP		 777 assert_se(opinionated_personality(&current) >= 0);
778
779 log_info("current personality=%lu", current);
780
78e864e5
TM		 781 pid = fork();
782 assert_se(pid >= 0);
783
784 if (pid == 0) {
e8132d63 785 assert_se(seccomp_lock_personality(current) >= 0);
78e864e5 786
21022b9d 787 assert_se((unsigned long) safe_personality(current) == current);
e8132d63 788
21022b9d
LP		 789 /* Note, we also test that safe_personality() works correctly, by checkig whether errno is properly
790 * set, in addition to the return value */
791 errno = 0;
792 assert_se(safe_personality(PER_LINUX | ADDR_NO_RANDOMIZE) == -EPERM);
793 assert_se(errno == EPERM);
e8132d63 794
21022b9d
LP		 795 assert_se(safe_personality(PER_LINUX | MMAP_PAGE_ZERO) == -EPERM);
796 assert_se(safe_personality(PER_LINUX | ADDR_COMPAT_LAYOUT) == -EPERM);
797 assert_se(safe_personality(PER_LINUX | READ_IMPLIES_EXEC) == -EPERM);
798 assert_se(safe_personality(PER_LINUX_32BIT) == -EPERM);
799 assert_se(safe_personality(PER_SVR4) == -EPERM);
800 assert_se(safe_personality(PER_BSD) == -EPERM);
801 assert_se(safe_personality(current == PER_LINUX ? PER_LINUX32 : PER_LINUX) == -EPERM);
802 assert_se(safe_personality(PER_LINUX32_3GB) == -EPERM);
803 assert_se(safe_personality(PER_UW7) == -EPERM);
804 assert_se(safe_personality(0x42) == -EPERM);
805
806 assert_se(safe_personality(PERSONALITY_INVALID) == -EPERM); /* maybe remove this later */
e8132d63
LP		 807
808 assert_se((unsigned long) personality(current) == current);
78e864e5
TM		 809 _exit(EXIT_SUCCESS);
810 }
811
7d4904fe 812 assert_se(wait_for_terminate_and_check("lockpersonalityseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
78e864e5
TM		 813}
814
167fc10c
LP		 815static int real_open(const char *path, int flags, mode_t mode) {
816 /* glibc internally calls openat() when open() is requested. Let's hence define our own wrapper for
dff6c629
ZJS		 817 * testing purposes that calls the real syscall, on architectures where SYS_open is defined. On
818 * other architectures, let's just fall back to the glibc call. */
167fc10c 819
fb4b0465 820#if defined __NR_open && __NR_open >= 0
4df8fe84 821 return (int) syscall(__NR_open, path, flags, mode);
dff6c629
ZJS		 822#else
823 return open(path, flags, mode);
824#endif
167fc10c
LP		 825}
826
827static void test_restrict_suid_sgid(void) {
828 pid_t pid;
829
830 log_info("/* %s */", __func__);
831
832 if (!is_seccomp_available()) {
833 log_notice("Seccomp not available, skipping %s", __func__);
834 return;
835 }
836 if (geteuid() != 0) {
837 log_notice("Not root, skipping %s", __func__);
838 return;
839 }
840
841 pid = fork();
842 assert_se(pid >= 0);
843
844 if (pid == 0) {
845 char path[] = "/tmp/suidsgidXXXXXX", dir[] = "/tmp/suidsgiddirXXXXXX";
846 int fd = -1, k = -1;
847 const char *z;
848
849 fd = mkostemp_safe(path);
850 assert_se(fd >= 0);
851
852 assert_se(mkdtemp(dir));
853 z = strjoina(dir, "/test");
854
855 assert_se(chmod(path, 0755 | S_ISUID) >= 0);
856 assert_se(chmod(path, 0755 | S_ISGID) >= 0);
857 assert_se(chmod(path, 0755 | S_ISGID | S_ISUID) >= 0);
858 assert_se(chmod(path, 0755) >= 0);
859
860 assert_se(fchmod(fd, 0755 | S_ISUID) >= 0);
861 assert_se(fchmod(fd, 0755 | S_ISGID) >= 0);
862 assert_se(fchmod(fd, 0755 | S_ISGID | S_ISUID) >= 0);
863 assert_se(fchmod(fd, 0755) >= 0);
864
865 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISUID, 0) >= 0);
866 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISGID, 0) >= 0);
867 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISGID | S_ISUID, 0) >= 0);
868 assert_se(fchmodat(AT_FDCWD, path, 0755, 0) >= 0);
869
870 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID);
871 k = safe_close(k);
872 assert_se(unlink(z) >= 0);
873
874 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISGID);
875 k = safe_close(k);
876 assert_se(unlink(z) >= 0);
877
878 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID | S_ISGID);
879 k = safe_close(k);
880 assert_se(unlink(z) >= 0);
881
882 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644);
883 k = safe_close(k);
884 assert_se(unlink(z) >= 0);
885
886 k = creat(z, 0644 | S_ISUID);
887 k = safe_close(k);
888 assert_se(unlink(z) >= 0);
889
890 k = creat(z, 0644 | S_ISGID);
891 k = safe_close(k);
892 assert_se(unlink(z) >= 0);
893
894 k = creat(z, 0644 | S_ISUID | S_ISGID);
895 k = safe_close(k);
896 assert_se(unlink(z) >= 0);
897
898 k = creat(z, 0644);
899 k = safe_close(k);
900 assert_se(unlink(z) >= 0);
901
902 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID);
903 k = safe_close(k);
904 assert_se(unlink(z) >= 0);
905
906 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISGID);
907 k = safe_close(k);
908 assert_se(unlink(z) >= 0);
909
910 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID | S_ISGID);
911 k = safe_close(k);
912 assert_se(unlink(z) >= 0);
913
914 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644);
915 k = safe_close(k);
916 assert_se(unlink(z) >= 0);
917
918 assert_se(mkdir(z, 0755 | S_ISUID) >= 0);
919 assert_se(rmdir(z) >= 0);
920 assert_se(mkdir(z, 0755 | S_ISGID) >= 0);
921 assert_se(rmdir(z) >= 0);
922 assert_se(mkdir(z, 0755 | S_ISUID | S_ISGID) >= 0);
923 assert_se(rmdir(z) >= 0);
924 assert_se(mkdir(z, 0755) >= 0);
925 assert_se(rmdir(z) >= 0);
926
927 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISUID) >= 0);
928 assert_se(rmdir(z) >= 0);
929 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISGID) >= 0);
930 assert_se(rmdir(z) >= 0);
931 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISUID | S_ISGID) >= 0);
932 assert_se(rmdir(z) >= 0);
933 assert_se(mkdirat(AT_FDCWD, z, 0755) >= 0);
934 assert_se(rmdir(z) >= 0);
935
936 assert_se(mknod(z, S_IFREG | 0755 | S_ISUID, 0) >= 0);
937 assert_se(unlink(z) >= 0);
938 assert_se(mknod(z, S_IFREG | 0755 | S_ISGID, 0) >= 0);
939 assert_se(unlink(z) >= 0);
940 assert_se(mknod(z, S_IFREG | 0755 | S_ISUID | S_ISGID, 0) >= 0);
941 assert_se(unlink(z) >= 0);
942 assert_se(mknod(z, S_IFREG | 0755, 0) >= 0);
943 assert_se(unlink(z) >= 0);
944
945 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISUID, 0) >= 0);
946 assert_se(unlink(z) >= 0);
947 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISGID, 0) >= 0);
948 assert_se(unlink(z) >= 0);
949 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISUID | S_ISGID, 0) >= 0);
950 assert_se(unlink(z) >= 0);
951 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755, 0) >= 0);
952 assert_se(unlink(z) >= 0);
953
954 assert_se(seccomp_restrict_suid_sgid() >= 0);
955
956 assert_se(chmod(path, 0775 | S_ISUID) < 0 && errno == EPERM);
957 assert_se(chmod(path, 0775 | S_ISGID) < 0 && errno == EPERM);
958 assert_se(chmod(path, 0775 | S_ISGID | S_ISUID) < 0 && errno == EPERM);
959 assert_se(chmod(path, 0775) >= 0);
960
961 assert_se(fchmod(fd, 0775 | S_ISUID) < 0 && errno == EPERM);
962 assert_se(fchmod(fd, 0775 | S_ISGID) < 0 && errno == EPERM);
963 assert_se(fchmod(fd, 0775 | S_ISGID | S_ISUID) < 0 && errno == EPERM);
964 assert_se(fchmod(fd, 0775) >= 0);
965
966 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISUID, 0) < 0 && errno == EPERM);
967 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISGID, 0) < 0 && errno == EPERM);
968 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISGID | S_ISUID, 0) < 0 && errno == EPERM);
969 assert_se(fchmodat(AT_FDCWD, path, 0755, 0) >= 0);
970
971 assert_se(real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID) < 0 && errno == EPERM);
972 assert_se(real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISGID) < 0 && errno == EPERM);
973 assert_se(real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
974 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644);
975 k = safe_close(k);
976 assert_se(unlink(z) >= 0);
977
978 assert_se(creat(z, 0644 | S_ISUID) < 0 && errno == EPERM);
979 assert_se(creat(z, 0644 | S_ISGID) < 0 && errno == EPERM);
980 assert_se(creat(z, 0644 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
981 k = creat(z, 0644);
982 k = safe_close(k);
983 assert_se(unlink(z) >= 0);
984
985 assert_se(openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID) < 0 && errno == EPERM);
986 assert_se(openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISGID) < 0 && errno == EPERM);
987 assert_se(openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
988 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644);
989 k = safe_close(k);
990 assert_se(unlink(z) >= 0);
991
992 assert_se(mkdir(z, 0755 | S_ISUID) < 0 && errno == EPERM);
993 assert_se(mkdir(z, 0755 | S_ISGID) < 0 && errno == EPERM);
994 assert_se(mkdir(z, 0755 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
995 assert_se(mkdir(z, 0755) >= 0);
996 assert_se(rmdir(z) >= 0);
997
998 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISUID) < 0 && errno == EPERM);
999 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISGID) < 0 && errno == EPERM);
1000 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
1001 assert_se(mkdirat(AT_FDCWD, z, 0755) >= 0);
1002 assert_se(rmdir(z) >= 0);
1003
1004 assert_se(mknod(z, S_IFREG | 0755 | S_ISUID, 0) < 0 && errno == EPERM);
1005 assert_se(mknod(z, S_IFREG | 0755 | S_ISGID, 0) < 0 && errno == EPERM);
1006 assert_se(mknod(z, S_IFREG | 0755 | S_ISUID | S_ISGID, 0) < 0 && errno == EPERM);
1007 assert_se(mknod(z, S_IFREG | 0755, 0) >= 0);
1008 assert_se(unlink(z) >= 0);
1009
1010 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISUID, 0) < 0 && errno == EPERM);
1011 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISGID, 0) < 0 && errno == EPERM);
1012 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISUID | S_ISGID, 0) < 0 && errno == EPERM);
1013 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755, 0) >= 0);
1014 assert_se(unlink(z) >= 0);
1015
1016 assert_se(unlink(path) >= 0);
1017 assert_se(rm_rf(dir, REMOVE_ROOT|REMOVE_PHYSICAL) >= 0);
1018
1019 _exit(EXIT_SUCCESS);
1020 }
1021
1022 assert_se(wait_for_terminate_and_check("suidsgidseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
1023}
1024
f6281133 1025int main(int argc, char *argv[]) {
6d7c4033 1026 test_setup_logging(LOG_DEBUG);
add00535 1027
f6281133 1028 test_seccomp_arch_to_string();
aa34055f 1029 test_architecture_table();
f6281133
LP		 1030 test_syscall_filter_set_find();
1031 test_filter_sets();
23e12f8e 1032 test_filter_sets_ordered();
add00535 1033 test_restrict_namespace();
469830d1 1034 test_protect_sysctl();
97d05f3b 1035 test_protect_syslog();
469830d1
LP		 1036 test_restrict_address_families();
1037 test_restrict_realtime();
2a65bd94
ZJS		 1038 test_memory_deny_write_execute_mmap();
1039 test_memory_deny_write_execute_shmat();
469830d1
LP		 1040 test_restrict_archs();
1041 test_load_syscall_filter_set_raw();
78e864e5 1042 test_lock_personality();
167fc10c 1043 test_restrict_suid_sgid();
f6281133
LP		 1044
1045 return 0;
1046}
Unnamed repository; edit this file 'description' to name the repository.