src/test/test-seccomp.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <poll.h>
   4 #include <sched.h>
   5 #include <stdlib.h>
   6 #include <sys/eventfd.h>
   7 #include <sys/mman.h>
   8 #include <sys/personality.h>
   9 #include <sys/shm.h>
  10 #include <sys/types.h>
  11 #include <unistd.h>
  12
  13 #include "alloc-util.h"
  14 #include "fd-util.h"
  15 #include "macro.h"
  16 #include "missing.h"
  17 #include "nsflags.h"
  18 #include "process-util.h"
  19 #include "raw-clone.h"
  20 #include "seccomp-util.h"
  21 #include "set.h"
  22 #include "string-util.h"
  23 #include "tests.h"
  24 #include "util.h"
  25 #include "virt.h"
  26
  27 #if SCMP_SYS(socket) < 0 || defined(__i386__) || defined(__s390x__) || defined(__s390__)
  28 /* On these archs, socket() is implemented via the socketcall() syscall multiplexer,
  29  * and we can't restrict it hence via seccomp. */
  30 #  define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 1
  31 #else
  32 #  define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 0
  33 #endif
  34
  35 static void test_seccomp_arch_to_string(void) {
  36         uint32_t a, b;
  37         const char *name;
  38
  39         log_info("/* %s */", __func__);
  40
  41         a = seccomp_arch_native();
  42         assert_se(a > 0);
  43         name = seccomp_arch_to_string(a);
  44         assert_se(name);
  45         assert_se(seccomp_arch_from_string(name, &b) >= 0);
  46         assert_se(a == b);
  47 }
  48
  49 static void test_architecture_table(void) {
  50         const char *n, *n2;
  51
  52         log_info("/* %s */", __func__);
  53
  54         NULSTR_FOREACH(n,
  55                        "native\0"
  56                        "x86\0"
  57                        "x86-64\0"
  58                        "x32\0"
  59                        "arm\0"
  60                        "arm64\0"
  61                        "mips\0"
  62                        "mips64\0"
  63                        "mips64-n32\0"
  64                        "mips-le\0"
  65                        "mips64-le\0"
  66                        "mips64-le-n32\0"
  67                        "ppc\0"
  68                        "ppc64\0"
  69                        "ppc64-le\0"
  70                        "s390\0"
  71                        "s390x\0") {
  72                 uint32_t c;
  73
  74                 assert_se(seccomp_arch_from_string(n, &c) >= 0);
  75                 n2 = seccomp_arch_to_string(c);
  76                 log_info("seccomp-arch: %s → 0x%"PRIx32" → %s", n, c, n2);
  77                 assert_se(streq_ptr(n, n2));
  78         }
  79 }
  80
  81 static void test_syscall_filter_set_find(void) {
  82         log_info("/* %s */", __func__);
  83
  84         assert_se(!syscall_filter_set_find(NULL));
  85         assert_se(!syscall_filter_set_find(""));
  86         assert_se(!syscall_filter_set_find("quux"));
  87         assert_se(!syscall_filter_set_find("@quux"));
  88
  89         assert_se(syscall_filter_set_find("@clock") == syscall_filter_sets + SYSCALL_FILTER_SET_CLOCK);
  90         assert_se(syscall_filter_set_find("@default") == syscall_filter_sets + SYSCALL_FILTER_SET_DEFAULT);
  91         assert_se(syscall_filter_set_find("@raw-io") == syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO);
  92 }
  93
  94 static void test_filter_sets(void) {
  95         unsigned i;
  96         int r;
  97
  98         log_info("/* %s */", __func__);
  99
 100         if (!is_seccomp_available()) {
 101                 log_notice("Seccomp not available, skipping %s", __func__);
 102                 return;
 103         }
 104         if (geteuid() != 0) {
 105                 log_notice("Not root, skipping %s", __func__);
 106                 return;
 107         }
 108
 109         for (i = 0; i < _SYSCALL_FILTER_SET_MAX; i++) {
 110                 pid_t pid;
 111
 112                 log_info("Testing %s", syscall_filter_sets[i].name);
 113
 114                 pid = fork();
 115                 assert_se(pid >= 0);
 116
 117                 if (pid == 0) { /* Child? */
 118                         int fd;
 119
 120                         /* If we look at the default set (or one that includes it), whitelist instead of blacklist */
 121                         if (IN_SET(i, SYSCALL_FILTER_SET_DEFAULT, SYSCALL_FILTER_SET_SYSTEM_SERVICE))
 122                                 r = seccomp_load_syscall_filter_set(SCMP_ACT_ERRNO(EUCLEAN), syscall_filter_sets + i, SCMP_ACT_ALLOW, true);
 123                         else
 124                                 r = seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + i, SCMP_ACT_ERRNO(EUCLEAN), true);
 125                         if (r < 0)
 126                                 _exit(EXIT_FAILURE);
 127
 128                         /* Test the sycall filter with one random system call */
 129                         fd = eventfd(0, EFD_NONBLOCK|EFD_CLOEXEC);
 130                         if (IN_SET(i, SYSCALL_FILTER_SET_IO_EVENT, SYSCALL_FILTER_SET_DEFAULT))
 131                                 assert_se(fd < 0 && errno == EUCLEAN);
 132                         else {
 133                                 assert_se(fd >= 0);
 134                                 safe_close(fd);
 135                         }
 136
 137                         _exit(EXIT_SUCCESS);
 138                 }
 139
 140                 assert_se(wait_for_terminate_and_check(syscall_filter_sets[i].name, pid, WAIT_LOG) == EXIT_SUCCESS);
 141         }
 142 }
 143
 144 static void test_filter_sets_ordered(void) {
 145         size_t i;
 146
 147         log_info("/* %s */", __func__);
 148
 149         /* Ensure "@default" always remains at the beginning of the list */
 150         assert_se(SYSCALL_FILTER_SET_DEFAULT == 0);
 151         assert_se(streq(syscall_filter_sets[0].name, "@default"));
 152
 153         for (i = 0; i < _SYSCALL_FILTER_SET_MAX; i++) {
 154                 const char *k, *p = NULL;
 155
 156                 /* Make sure each group has a description */
 157                 assert_se(!isempty(syscall_filter_sets[0].help));
 158
 159                 /* Make sure the groups are ordered alphabetically, except for the first entry */
 160                 assert_se(i < 2 || strcmp(syscall_filter_sets[i-1].name, syscall_filter_sets[i].name) < 0);
 161
 162                 NULSTR_FOREACH(k, syscall_filter_sets[i].value) {
 163
 164                         /* Ensure each syscall list is in itself ordered, but groups before names */
 165                         assert_se(!p ||
 166                                   (*p == '@' && *k != '@') ||
 167                                   (((*p == '@' && *k == '@') ||
 168                                     (*p != '@' && *k != '@')) &&
 169                                    strcmp(p, k) < 0));
 170
 171                         p = k;
 172                 }
 173         }
 174 }
 175
 176 static void test_restrict_namespace(void) {
 177         char *s = NULL;
 178         unsigned long ul;
 179         pid_t pid;
 180
 181         log_info("/* %s */", __func__);
 182
 183         assert_se(namespace_flags_to_string(0, &s) == 0 && streq(s, ""));
 184         s = mfree(s);
 185         assert_se(namespace_flags_to_string(CLONE_NEWNS, &s) == 0 && streq(s, "mnt"));
 186         s = mfree(s);
 187         assert_se(namespace_flags_to_string(CLONE_NEWNS|CLONE_NEWIPC, &s) == 0 && streq(s, "ipc mnt"));
 188         s = mfree(s);
 189         assert_se(namespace_flags_to_string(CLONE_NEWCGROUP, &s) == 0 && streq(s, "cgroup"));
 190         s = mfree(s);
 191
 192         assert_se(namespace_flags_from_string("mnt", &ul) == 0 && ul == CLONE_NEWNS);
 193         assert_se(namespace_flags_from_string(NULL, &ul) == 0 && ul == 0);
 194         assert_se(namespace_flags_from_string("", &ul) == 0 && ul == 0);
 195         assert_se(namespace_flags_from_string("uts", &ul) == 0 && ul == CLONE_NEWUTS);
 196         assert_se(namespace_flags_from_string("mnt uts ipc", &ul) == 0 && ul == (CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWIPC));
 197
 198         assert_se(namespace_flags_to_string(CLONE_NEWUTS, &s) == 0 && streq(s, "uts"));
 199         assert_se(namespace_flags_from_string(s, &ul) == 0 && ul == CLONE_NEWUTS);
 200         s = mfree(s);
 201         assert_se(namespace_flags_from_string("ipc", &ul) == 0 && ul == CLONE_NEWIPC);
 202         assert_se(namespace_flags_to_string(ul, &s) == 0 && streq(s, "ipc"));
 203         s = mfree(s);
 204
 205         assert_se(namespace_flags_to_string(NAMESPACE_FLAGS_ALL, &s) == 0);
 206         assert_se(streq(s, "cgroup ipc net mnt pid user uts"));
 207         assert_se(namespace_flags_from_string(s, &ul) == 0 && ul == NAMESPACE_FLAGS_ALL);
 208         s = mfree(s);
 209
 210         if (!is_seccomp_available()) {
 211                 log_notice("Seccomp not available, skipping remaining tests in %s", __func__);
 212                 return;
 213         }
 214         if (geteuid() != 0) {
 215                 log_notice("Not root, skipping remaining tests in %s", __func__);
 216                 return;
 217         }
 218
 219         pid = fork();
 220         assert_se(pid >= 0);
 221
 222         if (pid == 0) {
 223
 224                 assert_se(seccomp_restrict_namespaces(CLONE_NEWNS|CLONE_NEWNET) >= 0);
 225
 226                 assert_se(unshare(CLONE_NEWNS) == 0);
 227                 assert_se(unshare(CLONE_NEWNET) == 0);
 228                 assert_se(unshare(CLONE_NEWUTS) == -1);
 229                 assert_se(errno == EPERM);
 230                 assert_se(unshare(CLONE_NEWIPC) == -1);
 231                 assert_se(errno == EPERM);
 232                 assert_se(unshare(CLONE_NEWNET|CLONE_NEWUTS) == -1);
 233                 assert_se(errno == EPERM);
 234
 235                 /* We use fd 0 (stdin) here, which of course will fail with EINVAL on setns(). Except of course our
 236                  * seccomp filter worked, and hits first and makes it return EPERM */
 237                 assert_se(setns(0, CLONE_NEWNS) == -1);
 238                 assert_se(errno == EINVAL);
 239                 assert_se(setns(0, CLONE_NEWNET) == -1);
 240                 assert_se(errno == EINVAL);
 241                 assert_se(setns(0, CLONE_NEWUTS) == -1);
 242                 assert_se(errno == EPERM);
 243                 assert_se(setns(0, CLONE_NEWIPC) == -1);
 244                 assert_se(errno == EPERM);
 245                 assert_se(setns(0, CLONE_NEWNET|CLONE_NEWUTS) == -1);
 246                 assert_se(errno == EPERM);
 247                 assert_se(setns(0, 0) == -1);
 248                 assert_se(errno == EPERM);
 249
 250                 pid = raw_clone(CLONE_NEWNS);
 251                 assert_se(pid >= 0);
 252                 if (pid == 0)
 253                         _exit(EXIT_SUCCESS);
 254                 pid = raw_clone(CLONE_NEWNET);
 255                 assert_se(pid >= 0);
 256                 if (pid == 0)
 257                         _exit(EXIT_SUCCESS);
 258                 pid = raw_clone(CLONE_NEWUTS);
 259                 assert_se(pid < 0);
 260                 assert_se(errno == EPERM);
 261                 pid = raw_clone(CLONE_NEWIPC);
 262                 assert_se(pid < 0);
 263                 assert_se(errno == EPERM);
 264                 pid = raw_clone(CLONE_NEWNET|CLONE_NEWUTS);
 265                 assert_se(pid < 0);
 266                 assert_se(errno == EPERM);
 267
 268                 _exit(EXIT_SUCCESS);
 269         }
 270
 271         assert_se(wait_for_terminate_and_check("nsseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 272 }
 273
 274 static void test_protect_sysctl(void) {
 275         pid_t pid;
 276
 277         log_info("/* %s */", __func__);
 278
 279         if (!is_seccomp_available()) {
 280                 log_notice("Seccomp not available, skipping %s", __func__);
 281                 return;
 282         }
 283         if (geteuid() != 0) {
 284                 log_notice("Not root, skipping %s", __func__);
 285                 return;
 286         }
 287
 288         /* in containers _sysctl() is likely missing anyway */
 289         if (detect_container() > 0) {
 290                 log_notice("Testing in container, skipping %s", __func__);
 291                 return;
 292         }
 293
 294         pid = fork();
 295         assert_se(pid >= 0);
 296
 297         if (pid == 0) {
 298 #if __NR__sysctl > 0
 299                 assert_se(syscall(__NR__sysctl, NULL) < 0);
 300                 assert_se(errno == EFAULT);
 301 #endif
 302
 303                 assert_se(seccomp_protect_sysctl() >= 0);
 304
 305 #if __NR__sysctl > 0
 306                 assert_se(syscall(__NR__sysctl, 0, 0, 0) < 0);
 307                 assert_se(errno == EPERM);
 308 #endif
 309
 310                 _exit(EXIT_SUCCESS);
 311         }
 312
 313         assert_se(wait_for_terminate_and_check("sysctlseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 314 }
 315
 316 static void test_restrict_address_families(void) {
 317         pid_t pid;
 318
 319         log_info("/* %s */", __func__);
 320
 321         if (!is_seccomp_available()) {
 322                 log_notice("Seccomp not available, skipping %s", __func__);
 323                 return;
 324         }
 325         if (geteuid() != 0) {
 326                 log_notice("Not root, skipping %s", __func__);
 327                 return;
 328         }
 329
 330         pid = fork();
 331         assert_se(pid >= 0);
 332
 333         if (pid == 0) {
 334                 int fd;
 335                 Set *s;
 336
 337                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 338                 assert_se(fd >= 0);
 339                 safe_close(fd);
 340
 341                 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
 342                 assert_se(fd >= 0);
 343                 safe_close(fd);
 344
 345                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
 346                 assert_se(fd >= 0);
 347                 safe_close(fd);
 348
 349                 assert_se(s = set_new(NULL));
 350                 assert_se(set_put(s, INT_TO_PTR(AF_UNIX)) >= 0);
 351
 352                 assert_se(seccomp_restrict_address_families(s, false) >= 0);
 353
 354                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 355                 assert_se(fd >= 0);
 356                 safe_close(fd);
 357
 358                 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
 359 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
 360                 assert_se(fd >= 0);
 361                 safe_close(fd);
 362 #else
 363                 assert_se(fd < 0);
 364                 assert_se(errno == EAFNOSUPPORT);
 365 #endif
 366
 367                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
 368                 assert_se(fd >= 0);
 369                 safe_close(fd);
 370
 371                 set_clear(s);
 372
 373                 assert_se(set_put(s, INT_TO_PTR(AF_INET)) >= 0);
 374
 375                 assert_se(seccomp_restrict_address_families(s, true) >= 0);
 376
 377                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 378                 assert_se(fd >= 0);
 379                 safe_close(fd);
 380
 381                 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
 382 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
 383                 assert_se(fd >= 0);
 384                 safe_close(fd);
 385 #else
 386                 assert_se(fd < 0);
 387                 assert_se(errno == EAFNOSUPPORT);
 388 #endif
 389
 390                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
 391 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
 392                 assert_se(fd >= 0);
 393                 safe_close(fd);
 394 #else
 395                 assert_se(fd < 0);
 396                 assert_se(errno == EAFNOSUPPORT);
 397 #endif
 398
 399                 _exit(EXIT_SUCCESS);
 400         }
 401
 402         assert_se(wait_for_terminate_and_check("socketseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 403 }
 404
 405 static void test_restrict_realtime(void) {
 406         pid_t pid;
 407
 408         log_info("/* %s */", __func__);
 409
 410         if (!is_seccomp_available()) {
 411                 log_notice("Seccomp not available, skipping %s", __func__);
 412                 return;
 413         }
 414         if (geteuid() != 0) {
 415                 log_notice("Not root, skipping %s", __func__);
 416                 return;
 417         }
 418
 419         /* in containers RT privs are likely missing anyway */
 420         if (detect_container() > 0) {
 421                 log_notice("Testing in container, skipping %s", __func__);
 422                 return;
 423         }
 424
 425         pid = fork();
 426         assert_se(pid >= 0);
 427
 428         if (pid == 0) {
 429                 assert_se(sched_setscheduler(0, SCHED_FIFO, &(struct sched_param) { .sched_priority = 1 }) >= 0);
 430                 assert_se(sched_setscheduler(0, SCHED_RR, &(struct sched_param) { .sched_priority = 1 }) >= 0);
 431                 assert_se(sched_setscheduler(0, SCHED_IDLE, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 432                 assert_se(sched_setscheduler(0, SCHED_BATCH, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 433                 assert_se(sched_setscheduler(0, SCHED_OTHER, &(struct sched_param) {}) >= 0);
 434
 435                 assert_se(seccomp_restrict_realtime() >= 0);
 436
 437                 assert_se(sched_setscheduler(0, SCHED_IDLE, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 438                 assert_se(sched_setscheduler(0, SCHED_BATCH, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 439                 assert_se(sched_setscheduler(0, SCHED_OTHER, &(struct sched_param) {}) >= 0);
 440
 441                 assert_se(sched_setscheduler(0, SCHED_FIFO, &(struct sched_param) { .sched_priority = 1 }) < 0);
 442                 assert_se(errno == EPERM);
 443                 assert_se(sched_setscheduler(0, SCHED_RR, &(struct sched_param) { .sched_priority = 1 }) < 0);
 444                 assert_se(errno == EPERM);
 445
 446                 _exit(EXIT_SUCCESS);
 447         }
 448
 449         assert_se(wait_for_terminate_and_check("realtimeseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 450 }
 451
 452 static void test_memory_deny_write_execute_mmap(void) {
 453         pid_t pid;
 454
 455         log_info("/* %s */", __func__);
 456
 457         if (!is_seccomp_available()) {
 458                 log_notice("Seccomp not available, skipping %s", __func__);
 459                 return;
 460         }
 461         if (geteuid() != 0) {
 462                 log_notice("Not root, skipping %s", __func__);
 463                 return;
 464         }
 465
 466         pid = fork();
 467         assert_se(pid >= 0);
 468
 469         if (pid == 0) {
 470                 void *p;
 471
 472                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 473                 assert_se(p != MAP_FAILED);
 474                 assert_se(munmap(p, page_size()) >= 0);
 475
 476                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 477                 assert_se(p != MAP_FAILED);
 478                 assert_se(munmap(p, page_size()) >= 0);
 479
 480                 assert_se(seccomp_memory_deny_write_execute() >= 0);
 481
 482                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 483 #if defined(__x86_64__) || defined(__i386__) || defined(__powerpc64__) || defined(__arm__) || defined(__aarch64__)
 484                 assert_se(p == MAP_FAILED);
 485                 assert_se(errno == EPERM);
 486 #else /* unknown architectures */
 487                 assert_se(p != MAP_FAILED);
 488                 assert_se(munmap(p, page_size()) >= 0);
 489 #endif
 490
 491                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 492                 assert_se(p != MAP_FAILED);
 493                 assert_se(munmap(p, page_size()) >= 0);
 494
 495                 _exit(EXIT_SUCCESS);
 496         }
 497
 498         assert_se(wait_for_terminate_and_check("memoryseccomp-mmap", pid, WAIT_LOG) == EXIT_SUCCESS);
 499 }
 500
 501 static void test_memory_deny_write_execute_shmat(void) {
 502         int shmid;
 503         pid_t pid;
 504
 505         log_info("/* %s */", __func__);
 506
 507         if (!is_seccomp_available()) {
 508                 log_notice("Seccomp not available, skipping %s", __func__);
 509                 return;
 510         }
 511         if (geteuid() != 0) {
 512                 log_notice("Not root, skipping %s", __func__);
 513                 return;
 514         }
 515
 516         shmid = shmget(IPC_PRIVATE, page_size(), 0);
 517         assert_se(shmid >= 0);
 518
 519         pid = fork();
 520         assert_se(pid >= 0);
 521
 522         if (pid == 0) {
 523                 void *p;
 524
 525                 p = shmat(shmid, NULL, 0);
 526                 assert_se(p != MAP_FAILED);
 527                 assert_se(shmdt(p) == 0);
 528
 529                 p = shmat(shmid, NULL, SHM_EXEC);
 530                 assert_se(p != MAP_FAILED);
 531                 assert_se(shmdt(p) == 0);
 532
 533                 assert_se(seccomp_memory_deny_write_execute() >= 0);
 534
 535                 p = shmat(shmid, NULL, SHM_EXEC);
 536 #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__)
 537                 assert_se(p == MAP_FAILED);
 538                 assert_se(errno == EPERM);
 539 #else /* __i386__, __powerpc64__, and "unknown" architectures */
 540                 assert_se(p != MAP_FAILED);
 541                 assert_se(shmdt(p) == 0);
 542 #endif
 543
 544                 p = shmat(shmid, NULL, 0);
 545                 assert_se(p != MAP_FAILED);
 546                 assert_se(shmdt(p) == 0);
 547
 548                 _exit(EXIT_SUCCESS);
 549         }
 550
 551         assert_se(wait_for_terminate_and_check("memoryseccomp-shmat", pid, WAIT_LOG) == EXIT_SUCCESS);
 552 }
 553
 554 static void test_restrict_archs(void) {
 555         pid_t pid;
 556
 557         log_info("/* %s */", __func__);
 558
 559         if (!is_seccomp_available()) {
 560                 log_notice("Seccomp not available, skipping %s", __func__);
 561                 return;
 562         }
 563         if (geteuid() != 0) {
 564                 log_notice("Not root, skipping %s", __func__);
 565                 return;
 566         }
 567
 568         pid = fork();
 569         assert_se(pid >= 0);
 570
 571         if (pid == 0) {
 572                 _cleanup_set_free_ Set *s = NULL;
 573
 574                 assert_se(access("/", F_OK) >= 0);
 575
 576                 assert_se(s = set_new(NULL));
 577
 578 #ifdef __x86_64__
 579                 assert_se(set_put(s, UINT32_TO_PTR(SCMP_ARCH_X86+1)) >= 0);
 580 #endif
 581                 assert_se(seccomp_restrict_archs(s) >= 0);
 582
 583                 assert_se(access("/", F_OK) >= 0);
 584                 assert_se(seccomp_restrict_archs(NULL) >= 0);
 585
 586                 assert_se(access("/", F_OK) >= 0);
 587
 588                 _exit(EXIT_SUCCESS);
 589         }
 590
 591         assert_se(wait_for_terminate_and_check("archseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 592 }
 593
 594 static void test_load_syscall_filter_set_raw(void) {
 595         pid_t pid;
 596
 597         log_info("/* %s */", __func__);
 598
 599         if (!is_seccomp_available()) {
 600                 log_notice("Seccomp not available, skipping %s", __func__);
 601                 return;
 602         }
 603         if (geteuid() != 0) {
 604                 log_notice("Not root, skipping %s", __func__);
 605                 return;
 606         }
 607
 608         pid = fork();
 609         assert_se(pid >= 0);
 610
 611         if (pid == 0) {
 612                 _cleanup_hashmap_free_ Hashmap *s = NULL;
 613
 614                 assert_se(access("/", F_OK) >= 0);
 615                 assert_se(poll(NULL, 0, 0) == 0);
 616
 617                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, NULL, SCMP_ACT_KILL, true) >= 0);
 618                 assert_se(access("/", F_OK) >= 0);
 619                 assert_se(poll(NULL, 0, 0) == 0);
 620
 621                 assert_se(s = hashmap_new(NULL));
 622 #if SCMP_SYS(access) >= 0
 623                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_access + 1), INT_TO_PTR(-1)) >= 0);
 624 #else
 625                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_faccessat + 1), INT_TO_PTR(-1)) >= 0);
 626 #endif
 627
 628                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUCLEAN), true) >= 0);
 629
 630                 assert_se(access("/", F_OK) < 0);
 631                 assert_se(errno == EUCLEAN);
 632
 633                 assert_se(poll(NULL, 0, 0) == 0);
 634
 635                 s = hashmap_free(s);
 636
 637                 assert_se(s = hashmap_new(NULL));
 638 #if SCMP_SYS(access) >= 0
 639                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_access + 1), INT_TO_PTR(EILSEQ)) >= 0);
 640 #else
 641                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_faccessat + 1), INT_TO_PTR(EILSEQ)) >= 0);
 642 #endif
 643
 644                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUCLEAN), true) >= 0);
 645
 646                 assert_se(access("/", F_OK) < 0);
 647                 assert_se(errno == EILSEQ);
 648
 649                 assert_se(poll(NULL, 0, 0) == 0);
 650
 651                 s = hashmap_free(s);
 652
 653                 assert_se(s = hashmap_new(NULL));
 654 #if SCMP_SYS(poll) >= 0
 655                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_poll + 1), INT_TO_PTR(-1)) >= 0);
 656 #else
 657                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_ppoll + 1), INT_TO_PTR(-1)) >= 0);
 658 #endif
 659
 660                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUNATCH), true) >= 0);
 661
 662                 assert_se(access("/", F_OK) < 0);
 663                 assert_se(errno == EILSEQ);
 664
 665                 assert_se(poll(NULL, 0, 0) < 0);
 666                 assert_se(errno == EUNATCH);
 667
 668                 s = hashmap_free(s);
 669
 670                 assert_se(s = hashmap_new(NULL));
 671 #if SCMP_SYS(poll) >= 0
 672                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_poll + 1), INT_TO_PTR(EILSEQ)) >= 0);
 673 #else
 674                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_ppoll + 1), INT_TO_PTR(EILSEQ)) >= 0);
 675 #endif
 676
 677                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUNATCH), true) >= 0);
 678
 679                 assert_se(access("/", F_OK) < 0);
 680                 assert_se(errno == EILSEQ);
 681
 682                 assert_se(poll(NULL, 0, 0) < 0);
 683                 assert_se(errno == EILSEQ);
 684
 685                 _exit(EXIT_SUCCESS);
 686         }
 687
 688         assert_se(wait_for_terminate_and_check("syscallrawseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 689 }
 690
 691 static void test_lock_personality(void) {
 692         unsigned long current;
 693         pid_t pid;
 694
 695         log_info("/* %s */", __func__);
 696
 697         if (!is_seccomp_available()) {
 698                 log_notice("Seccomp not available, skipping %s", __func__);
 699                 return;
 700         }
 701         if (geteuid() != 0) {
 702                 log_notice("Not root, skipping %s", __func__);
 703                 return;
 704         }
 705
 706         assert_se(opinionated_personality(&current) >= 0);
 707
 708         log_info("current personality=%lu", current);
 709
 710         pid = fork();
 711         assert_se(pid >= 0);
 712
 713         if (pid == 0) {
 714                 assert_se(seccomp_lock_personality(current) >= 0);
 715
 716                 assert_se((unsigned long) safe_personality(current) == current);
 717
 718                 /* Note, we also test that safe_personality() works correctly, by checkig whether errno is properly
 719                  * set, in addition to the return value */
 720                 errno = 0;
 721                 assert_se(safe_personality(PER_LINUX | ADDR_NO_RANDOMIZE) == -EPERM);
 722                 assert_se(errno == EPERM);
 723
 724                 assert_se(safe_personality(PER_LINUX | MMAP_PAGE_ZERO) == -EPERM);
 725                 assert_se(safe_personality(PER_LINUX | ADDR_COMPAT_LAYOUT) == -EPERM);
 726                 assert_se(safe_personality(PER_LINUX | READ_IMPLIES_EXEC) == -EPERM);
 727                 assert_se(safe_personality(PER_LINUX_32BIT) == -EPERM);
 728                 assert_se(safe_personality(PER_SVR4) == -EPERM);
 729                 assert_se(safe_personality(PER_BSD) == -EPERM);
 730                 assert_se(safe_personality(current == PER_LINUX ? PER_LINUX32 : PER_LINUX) == -EPERM);
 731                 assert_se(safe_personality(PER_LINUX32_3GB) == -EPERM);
 732                 assert_se(safe_personality(PER_UW7) == -EPERM);
 733                 assert_se(safe_personality(0x42) == -EPERM);
 734
 735                 assert_se(safe_personality(PERSONALITY_INVALID) == -EPERM); /* maybe remove this later */
 736
 737                 assert_se((unsigned long) personality(current) == current);
 738                 _exit(EXIT_SUCCESS);
 739         }
 740
 741         assert_se(wait_for_terminate_and_check("lockpersonalityseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 742 }
 743
 744 int main(int argc, char *argv[]) {
 745         test_setup_logging(LOG_DEBUG);
 746
 747         test_seccomp_arch_to_string();
 748         test_architecture_table();
 749         test_syscall_filter_set_find();
 750         test_filter_sets();
 751         test_filter_sets_ordered();
 752         test_restrict_namespace();
 753         test_protect_sysctl();
 754         test_restrict_address_families();
 755         test_restrict_realtime();
 756         test_memory_deny_write_execute_mmap();
 757         test_memory_deny_write_execute_shmat();
 758         test_restrict_archs();
 759         test_load_syscall_filter_set_raw();
 760         test_lock_personality();
 761
 762         return 0;
 763 }