src/test/test-seccomp.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <fcntl.h>
   4 #include <poll.h>
   5 #include <stdlib.h>
   6 #include <sys/eventfd.h>
   7 #include <sys/mman.h>
   8 #include <sys/personality.h>
   9 #include <sys/shm.h>
  10 #include <sys/syscall.h>
  11 #include <sys/types.h>
  12 #include <unistd.h>
  13
  14 #include "alloc-util.h"
  15 #include "fd-util.h"
  16 #include "fileio.h"
  17 #include "macro.h"
  18 #include "memory-util.h"
  19 #include "missing_sched.h"
  20 #include "nsflags.h"
  21 #include "nulstr-util.h"
  22 #include "process-util.h"
  23 #include "raw-clone.h"
  24 #include "rm-rf.h"
  25 #include "seccomp-util.h"
  26 #include "set.h"
  27 #include "string-util.h"
  28 #include "tests.h"
  29 #include "tmpfile-util.h"
  30 #include "virt.h"
  31
  32 /* __NR_socket may be invalid due to libseccomp */
  33 #if !defined(__NR_socket) || __NR_socket < 0 || defined(__i386__) || defined(__s390x__) || defined(__s390__)
  34 /* On these archs, socket() is implemented via the socketcall() syscall multiplexer,
  35  * and we can't restrict it hence via seccomp. */
  36 #  define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 1
  37 #else
  38 #  define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 0
  39 #endif
  40
  41 static void test_seccomp_arch_to_string(void) {
  42         uint32_t a, b;
  43         const char *name;
  44
  45         log_info("/* %s */", __func__);
  46
  47         a = seccomp_arch_native();
  48         assert_se(a > 0);
  49         name = seccomp_arch_to_string(a);
  50         assert_se(name);
  51         assert_se(seccomp_arch_from_string(name, &b) >= 0);
  52         assert_se(a == b);
  53 }
  54
  55 static void test_architecture_table(void) {
  56         const char *n, *n2;
  57
  58         log_info("/* %s */", __func__);
  59
  60         NULSTR_FOREACH(n,
  61                        "native\0"
  62                        "x86\0"
  63                        "x86-64\0"
  64                        "x32\0"
  65                        "arm\0"
  66                        "arm64\0"
  67                        "mips\0"
  68                        "mips64\0"
  69                        "mips64-n32\0"
  70                        "mips-le\0"
  71                        "mips64-le\0"
  72                        "mips64-le-n32\0"
  73                        "ppc\0"
  74                        "ppc64\0"
  75                        "ppc64-le\0"
  76                        "s390\0"
  77                        "s390x\0") {
  78                 uint32_t c;
  79
  80                 assert_se(seccomp_arch_from_string(n, &c) >= 0);
  81                 n2 = seccomp_arch_to_string(c);
  82                 log_info("seccomp-arch: %s → 0x%"PRIx32" → %s", n, c, n2);
  83                 assert_se(streq_ptr(n, n2));
  84         }
  85 }
  86
  87 static void test_syscall_filter_set_find(void) {
  88         log_info("/* %s */", __func__);
  89
  90         assert_se(!syscall_filter_set_find(NULL));
  91         assert_se(!syscall_filter_set_find(""));
  92         assert_se(!syscall_filter_set_find("quux"));
  93         assert_se(!syscall_filter_set_find("@quux"));
  94
  95         assert_se(syscall_filter_set_find("@clock") == syscall_filter_sets + SYSCALL_FILTER_SET_CLOCK);
  96         assert_se(syscall_filter_set_find("@default") == syscall_filter_sets + SYSCALL_FILTER_SET_DEFAULT);
  97         assert_se(syscall_filter_set_find("@raw-io") == syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO);
  98 }
  99
 100 static void test_filter_sets(void) {
 101         unsigned i;
 102         int r;
 103
 104         log_info("/* %s */", __func__);
 105
 106         if (!is_seccomp_available()) {
 107                 log_notice("Seccomp not available, skipping %s", __func__);
 108                 return;
 109         }
 110         if (geteuid() != 0) {
 111                 log_notice("Not root, skipping %s", __func__);
 112                 return;
 113         }
 114
 115         for (i = 0; i < _SYSCALL_FILTER_SET_MAX; i++) {
 116                 pid_t pid;
 117
 118                 log_info("Testing %s", syscall_filter_sets[i].name);
 119
 120                 pid = fork();
 121                 assert_se(pid >= 0);
 122
 123                 if (pid == 0) { /* Child? */
 124                         int fd;
 125
 126                         /* If we look at the default set (or one that includes it), allow-list instead of deny-list */
 127                         if (IN_SET(i, SYSCALL_FILTER_SET_DEFAULT, SYSCALL_FILTER_SET_SYSTEM_SERVICE))
 128                                 r = seccomp_load_syscall_filter_set(SCMP_ACT_ERRNO(EUCLEAN), syscall_filter_sets + i, SCMP_ACT_ALLOW, true);
 129                         else
 130                                 r = seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + i, SCMP_ACT_ERRNO(EUCLEAN), true);
 131                         if (r < 0)
 132                                 _exit(EXIT_FAILURE);
 133
 134                         /* Test the sycall filter with one random system call */
 135                         fd = eventfd(0, EFD_NONBLOCK|EFD_CLOEXEC);
 136                         if (IN_SET(i, SYSCALL_FILTER_SET_IO_EVENT, SYSCALL_FILTER_SET_DEFAULT))
 137                                 assert_se(fd < 0 && errno == EUCLEAN);
 138                         else {
 139                                 assert_se(fd >= 0);
 140                                 safe_close(fd);
 141                         }
 142
 143                         _exit(EXIT_SUCCESS);
 144                 }
 145
 146                 assert_se(wait_for_terminate_and_check(syscall_filter_sets[i].name, pid, WAIT_LOG) == EXIT_SUCCESS);
 147         }
 148 }
 149
 150 static void test_filter_sets_ordered(void) {
 151         size_t i;
 152
 153         log_info("/* %s */", __func__);
 154
 155         /* Ensure "@default" always remains at the beginning of the list */
 156         assert_se(SYSCALL_FILTER_SET_DEFAULT == 0);
 157         assert_se(streq(syscall_filter_sets[0].name, "@default"));
 158
 159         for (i = 0; i < _SYSCALL_FILTER_SET_MAX; i++) {
 160                 const char *k, *p = NULL;
 161
 162                 /* Make sure each group has a description */
 163                 assert_se(!isempty(syscall_filter_sets[0].help));
 164
 165                 /* Make sure the groups are ordered alphabetically, except for the first entry */
 166                 assert_se(i < 2 || strcmp(syscall_filter_sets[i-1].name, syscall_filter_sets[i].name) < 0);
 167
 168                 NULSTR_FOREACH(k, syscall_filter_sets[i].value) {
 169
 170                         /* Ensure each syscall list is in itself ordered, but groups before names */
 171                         assert_se(!p ||
 172                                   (*p == '@' && *k != '@') ||
 173                                   (((*p == '@' && *k == '@') ||
 174                                     (*p != '@' && *k != '@')) &&
 175                                    strcmp(p, k) < 0));
 176
 177                         p = k;
 178                 }
 179         }
 180 }
 181
 182 static void test_restrict_namespace(void) {
 183         char *s = NULL;
 184         unsigned long ul;
 185         pid_t pid;
 186
 187         if (!have_namespaces()) {
 188                 log_notice("Testing without namespaces, skipping %s", __func__);
 189                 return;
 190         }
 191
 192         log_info("/* %s */", __func__);
 193
 194         assert_se(namespace_flags_to_string(0, &s) == 0 && isempty(s));
 195         s = mfree(s);
 196         assert_se(namespace_flags_to_string(CLONE_NEWNS, &s) == 0 && streq(s, "mnt"));
 197         s = mfree(s);
 198         assert_se(namespace_flags_to_string(CLONE_NEWNS|CLONE_NEWIPC, &s) == 0 && streq(s, "ipc mnt"));
 199         s = mfree(s);
 200         assert_se(namespace_flags_to_string(CLONE_NEWCGROUP, &s) == 0 && streq(s, "cgroup"));
 201         s = mfree(s);
 202
 203         assert_se(namespace_flags_from_string("mnt", &ul) == 0 && ul == CLONE_NEWNS);
 204         assert_se(namespace_flags_from_string(NULL, &ul) == 0 && ul == 0);
 205         assert_se(namespace_flags_from_string("", &ul) == 0 && ul == 0);
 206         assert_se(namespace_flags_from_string("uts", &ul) == 0 && ul == CLONE_NEWUTS);
 207         assert_se(namespace_flags_from_string("mnt uts ipc", &ul) == 0 && ul == (CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWIPC));
 208
 209         assert_se(namespace_flags_to_string(CLONE_NEWUTS, &s) == 0 && streq(s, "uts"));
 210         assert_se(namespace_flags_from_string(s, &ul) == 0 && ul == CLONE_NEWUTS);
 211         s = mfree(s);
 212         assert_se(namespace_flags_from_string("ipc", &ul) == 0 && ul == CLONE_NEWIPC);
 213         assert_se(namespace_flags_to_string(ul, &s) == 0 && streq(s, "ipc"));
 214         s = mfree(s);
 215
 216         assert_se(namespace_flags_to_string(NAMESPACE_FLAGS_ALL, &s) == 0);
 217         assert_se(streq(s, "cgroup ipc net mnt pid user uts"));
 218         assert_se(namespace_flags_from_string(s, &ul) == 0 && ul == NAMESPACE_FLAGS_ALL);
 219         s = mfree(s);
 220
 221         if (!is_seccomp_available()) {
 222                 log_notice("Seccomp not available, skipping remaining tests in %s", __func__);
 223                 return;
 224         }
 225         if (geteuid() != 0) {
 226                 log_notice("Not root, skipping remaining tests in %s", __func__);
 227                 return;
 228         }
 229
 230         pid = fork();
 231         assert_se(pid >= 0);
 232
 233         if (pid == 0) {
 234
 235                 assert_se(seccomp_restrict_namespaces(CLONE_NEWNS|CLONE_NEWNET) >= 0);
 236
 237                 assert_se(unshare(CLONE_NEWNS) == 0);
 238                 assert_se(unshare(CLONE_NEWNET) == 0);
 239                 assert_se(unshare(CLONE_NEWUTS) == -1);
 240                 assert_se(errno == EPERM);
 241                 assert_se(unshare(CLONE_NEWIPC) == -1);
 242                 assert_se(errno == EPERM);
 243                 assert_se(unshare(CLONE_NEWNET|CLONE_NEWUTS) == -1);
 244                 assert_se(errno == EPERM);
 245
 246                 /* We use fd 0 (stdin) here, which of course will fail with EINVAL on setns(). Except of course our
 247                  * seccomp filter worked, and hits first and makes it return EPERM */
 248                 assert_se(setns(0, CLONE_NEWNS) == -1);
 249                 assert_se(errno == EINVAL);
 250                 assert_se(setns(0, CLONE_NEWNET) == -1);
 251                 assert_se(errno == EINVAL);
 252                 assert_se(setns(0, CLONE_NEWUTS) == -1);
 253                 assert_se(errno == EPERM);
 254                 assert_se(setns(0, CLONE_NEWIPC) == -1);
 255                 assert_se(errno == EPERM);
 256                 assert_se(setns(0, CLONE_NEWNET|CLONE_NEWUTS) == -1);
 257                 assert_se(errno == EPERM);
 258                 assert_se(setns(0, 0) == -1);
 259                 assert_se(errno == EPERM);
 260
 261                 pid = raw_clone(CLONE_NEWNS);
 262                 assert_se(pid >= 0);
 263                 if (pid == 0)
 264                         _exit(EXIT_SUCCESS);
 265                 pid = raw_clone(CLONE_NEWNET);
 266                 assert_se(pid >= 0);
 267                 if (pid == 0)
 268                         _exit(EXIT_SUCCESS);
 269                 pid = raw_clone(CLONE_NEWUTS);
 270                 assert_se(pid < 0);
 271                 assert_se(errno == EPERM);
 272                 pid = raw_clone(CLONE_NEWIPC);
 273                 assert_se(pid < 0);
 274                 assert_se(errno == EPERM);
 275                 pid = raw_clone(CLONE_NEWNET|CLONE_NEWUTS);
 276                 assert_se(pid < 0);
 277                 assert_se(errno == EPERM);
 278
 279                 _exit(EXIT_SUCCESS);
 280         }
 281
 282         assert_se(wait_for_terminate_and_check("nsseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 283 }
 284
 285 static void test_protect_sysctl(void) {
 286         pid_t pid;
 287         _cleanup_free_ char *seccomp = NULL;
 288
 289         log_info("/* %s */", __func__);
 290
 291         if (!is_seccomp_available()) {
 292                 log_notice("Seccomp not available, skipping %s", __func__);
 293                 return;
 294         }
 295         if (geteuid() != 0) {
 296                 log_notice("Not root, skipping %s", __func__);
 297                 return;
 298         }
 299
 300         /* in containers _sysctl() is likely missing anyway */
 301         if (detect_container() > 0) {
 302                 log_notice("Testing in container, skipping %s", __func__);
 303                 return;
 304         }
 305
 306         assert_se(get_proc_field("/proc/self/status", "Seccomp", WHITESPACE, &seccomp) == 0);
 307         if (!streq(seccomp, "0"))
 308                 log_warning("Warning: seccomp filter detected, results may be unreliable for %s", __func__);
 309
 310         pid = fork();
 311         assert_se(pid >= 0);
 312
 313         if (pid == 0) {
 314 #if defined __NR__sysctl && __NR__sysctl >= 0
 315                 assert_se(syscall(__NR__sysctl, NULL) < 0);
 316                 assert_se(errno == EFAULT);
 317 #endif
 318
 319                 assert_se(seccomp_protect_sysctl() >= 0);
 320
 321 #if defined __NR__sysctl && __NR__sysctl >= 0
 322                 assert_se(syscall(__NR__sysctl, 0, 0, 0) < 0);
 323                 assert_se(errno == EPERM);
 324 #endif
 325
 326                 _exit(EXIT_SUCCESS);
 327         }
 328
 329         assert_se(wait_for_terminate_and_check("sysctlseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 330 }
 331
 332 static void test_protect_syslog(void) {
 333         pid_t pid;
 334
 335         log_info("/* %s */", __func__);
 336
 337         if (!is_seccomp_available()) {
 338                 log_notice("Seccomp not available, skipping %s", __func__);
 339                 return;
 340         }
 341         if (geteuid() != 0) {
 342                 log_notice("Not root, skipping %s", __func__);
 343                 return;
 344         }
 345
 346         /* in containers syslog() is likely missing anyway */
 347         if (detect_container() > 0) {
 348                 log_notice("Testing in container, skipping %s", __func__);
 349                 return;
 350         }
 351
 352         pid = fork();
 353         assert_se(pid >= 0);
 354
 355         if (pid == 0) {
 356 #if defined __NR_syslog && __NR_syslog >= 0
 357                 assert_se(syscall(__NR_syslog, -1, NULL, 0) < 0);
 358                 assert_se(errno == EINVAL);
 359 #endif
 360
 361                 assert_se(seccomp_protect_syslog() >= 0);
 362
 363 #if defined __NR_syslog && __NR_syslog >= 0
 364                 assert_se(syscall(__NR_syslog, 0, 0, 0) < 0);
 365                 assert_se(errno == EPERM);
 366 #endif
 367
 368                 _exit(EXIT_SUCCESS);
 369         }
 370
 371         assert_se(wait_for_terminate_and_check("syslogseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 372 }
 373
 374 static void test_restrict_address_families(void) {
 375         pid_t pid;
 376
 377         log_info("/* %s */", __func__);
 378
 379         if (!is_seccomp_available()) {
 380                 log_notice("Seccomp not available, skipping %s", __func__);
 381                 return;
 382         }
 383         if (geteuid() != 0) {
 384                 log_notice("Not root, skipping %s", __func__);
 385                 return;
 386         }
 387
 388         pid = fork();
 389         assert_se(pid >= 0);
 390
 391         if (pid == 0) {
 392                 int fd;
 393                 Set *s;
 394
 395                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 396                 assert_se(fd >= 0);
 397                 safe_close(fd);
 398
 399                 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
 400                 assert_se(fd >= 0);
 401                 safe_close(fd);
 402
 403                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
 404                 assert_se(fd >= 0);
 405                 safe_close(fd);
 406
 407                 assert_se(s = set_new(NULL));
 408                 assert_se(set_put(s, INT_TO_PTR(AF_UNIX)) >= 0);
 409
 410                 assert_se(seccomp_restrict_address_families(s, false) >= 0);
 411
 412                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 413                 assert_se(fd >= 0);
 414                 safe_close(fd);
 415
 416                 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
 417 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
 418                 assert_se(fd >= 0);
 419                 safe_close(fd);
 420 #else
 421                 assert_se(fd < 0);
 422                 assert_se(errno == EAFNOSUPPORT);
 423 #endif
 424
 425                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
 426                 assert_se(fd >= 0);
 427                 safe_close(fd);
 428
 429                 set_clear(s);
 430
 431                 assert_se(set_put(s, INT_TO_PTR(AF_INET)) >= 0);
 432
 433                 assert_se(seccomp_restrict_address_families(s, true) >= 0);
 434
 435                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 436                 assert_se(fd >= 0);
 437                 safe_close(fd);
 438
 439                 fd = socket(AF_UNIX, SOCK_DGRAM, 0);
 440 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
 441                 assert_se(fd >= 0);
 442                 safe_close(fd);
 443 #else
 444                 assert_se(fd < 0);
 445                 assert_se(errno == EAFNOSUPPORT);
 446 #endif
 447
 448                 fd = socket(AF_NETLINK, SOCK_DGRAM, 0);
 449 #if SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN
 450                 assert_se(fd >= 0);
 451                 safe_close(fd);
 452 #else
 453                 assert_se(fd < 0);
 454                 assert_se(errno == EAFNOSUPPORT);
 455 #endif
 456
 457                 _exit(EXIT_SUCCESS);
 458         }
 459
 460         assert_se(wait_for_terminate_and_check("socketseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 461 }
 462
 463 static void test_restrict_realtime(void) {
 464         pid_t pid;
 465
 466         log_info("/* %s */", __func__);
 467
 468         if (!is_seccomp_available()) {
 469                 log_notice("Seccomp not available, skipping %s", __func__);
 470                 return;
 471         }
 472         if (geteuid() != 0) {
 473                 log_notice("Not root, skipping %s", __func__);
 474                 return;
 475         }
 476
 477         /* in containers RT privs are likely missing anyway */
 478         if (detect_container() > 0) {
 479                 log_notice("Testing in container, skipping %s", __func__);
 480                 return;
 481         }
 482
 483         pid = fork();
 484         assert_se(pid >= 0);
 485
 486         if (pid == 0) {
 487                 assert_se(sched_setscheduler(0, SCHED_FIFO, &(struct sched_param) { .sched_priority = 1 }) >= 0);
 488                 assert_se(sched_setscheduler(0, SCHED_RR, &(struct sched_param) { .sched_priority = 1 }) >= 0);
 489                 assert_se(sched_setscheduler(0, SCHED_IDLE, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 490                 assert_se(sched_setscheduler(0, SCHED_BATCH, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 491                 assert_se(sched_setscheduler(0, SCHED_OTHER, &(struct sched_param) {}) >= 0);
 492
 493                 assert_se(seccomp_restrict_realtime() >= 0);
 494
 495                 assert_se(sched_setscheduler(0, SCHED_IDLE, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 496                 assert_se(sched_setscheduler(0, SCHED_BATCH, &(struct sched_param) { .sched_priority = 0 }) >= 0);
 497                 assert_se(sched_setscheduler(0, SCHED_OTHER, &(struct sched_param) {}) >= 0);
 498
 499                 assert_se(sched_setscheduler(0, SCHED_FIFO, &(struct sched_param) { .sched_priority = 1 }) < 0);
 500                 assert_se(errno == EPERM);
 501                 assert_se(sched_setscheduler(0, SCHED_RR, &(struct sched_param) { .sched_priority = 1 }) < 0);
 502                 assert_se(errno == EPERM);
 503
 504                 _exit(EXIT_SUCCESS);
 505         }
 506
 507         assert_se(wait_for_terminate_and_check("realtimeseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 508 }
 509
 510 static void test_memory_deny_write_execute_mmap(void) {
 511         pid_t pid;
 512
 513         log_info("/* %s */", __func__);
 514
 515         if (!is_seccomp_available()) {
 516                 log_notice("Seccomp not available, skipping %s", __func__);
 517                 return;
 518         }
 519         if (geteuid() != 0) {
 520                 log_notice("Not root, skipping %s", __func__);
 521                 return;
 522         }
 523
 524         pid = fork();
 525         assert_se(pid >= 0);
 526
 527         if (pid == 0) {
 528                 void *p;
 529
 530                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 531                 assert_se(p != MAP_FAILED);
 532                 assert_se(munmap(p, page_size()) >= 0);
 533
 534                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 535                 assert_se(p != MAP_FAILED);
 536                 assert_se(munmap(p, page_size()) >= 0);
 537
 538                 assert_se(seccomp_memory_deny_write_execute() >= 0);
 539
 540                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 541 #if defined(__x86_64__) || defined(__i386__) || defined(__powerpc64__) || defined(__arm__) || defined(__aarch64__)
 542                 assert_se(p == MAP_FAILED);
 543                 assert_se(errno == EPERM);
 544 #endif
 545                 /* Depending on kernel, libseccomp, and glibc versions, other architectures
 546                  * might fail or not. Let's not assert success. */
 547                 if (p != MAP_FAILED)
 548                         assert_se(munmap(p, page_size()) == 0);
 549
 550                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1,0);
 551                 assert_se(p != MAP_FAILED);
 552                 assert_se(munmap(p, page_size()) >= 0);
 553
 554                 _exit(EXIT_SUCCESS);
 555         }
 556
 557         assert_se(wait_for_terminate_and_check("memoryseccomp-mmap", pid, WAIT_LOG) == EXIT_SUCCESS);
 558 }
 559
 560 static void test_memory_deny_write_execute_shmat(void) {
 561         int shmid;
 562         pid_t pid;
 563         uint32_t arch;
 564
 565         log_info("/* %s */", __func__);
 566
 567         SECCOMP_FOREACH_LOCAL_ARCH(arch) {
 568                 log_debug("arch %s: SCMP_SYS(mmap) = %d", seccomp_arch_to_string(arch), SCMP_SYS(mmap));
 569                 log_debug("arch %s: SCMP_SYS(mmap2) = %d", seccomp_arch_to_string(arch), SCMP_SYS(mmap2));
 570                 log_debug("arch %s: SCMP_SYS(shmget) = %d", seccomp_arch_to_string(arch), SCMP_SYS(shmget));
 571                 log_debug("arch %s: SCMP_SYS(shmat) = %d", seccomp_arch_to_string(arch), SCMP_SYS(shmat));
 572                 log_debug("arch %s: SCMP_SYS(shmdt) = %d", seccomp_arch_to_string(arch), SCMP_SYS(shmdt));
 573         }
 574
 575         if (!is_seccomp_available()) {
 576                 log_notice("Seccomp not available, skipping %s", __func__);
 577                 return;
 578         }
 579         if (geteuid() != 0) {
 580                 log_notice("Not root, skipping %s", __func__);
 581                 return;
 582         }
 583
 584         shmid = shmget(IPC_PRIVATE, page_size(), 0);
 585         assert_se(shmid >= 0);
 586
 587         pid = fork();
 588         assert_se(pid >= 0);
 589
 590         if (pid == 0) {
 591                 void *p;
 592
 593                 p = shmat(shmid, NULL, 0);
 594                 assert_se(p != MAP_FAILED);
 595                 assert_se(shmdt(p) == 0);
 596
 597                 p = shmat(shmid, NULL, SHM_EXEC);
 598                 assert_se(p != MAP_FAILED);
 599                 assert_se(shmdt(p) == 0);
 600
 601                 assert_se(seccomp_memory_deny_write_execute() >= 0);
 602
 603                 p = shmat(shmid, NULL, SHM_EXEC);
 604                 log_debug_errno(p == MAP_FAILED ? errno : 0, "shmat(SHM_EXEC): %m");
 605 #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__)
 606                 assert_se(p == MAP_FAILED);
 607                 assert_se(errno == EPERM);
 608 #endif
 609                 /* Depending on kernel, libseccomp, and glibc versions, other architectures
 610                  * might fail or not. Let's not assert success. */
 611                 if (p != MAP_FAILED)
 612                         assert_se(shmdt(p) == 0);
 613
 614                 p = shmat(shmid, NULL, 0);
 615                 log_debug_errno(p == MAP_FAILED ? errno : 0, "shmat(0): %m");
 616                 assert_se(p != MAP_FAILED);
 617                 assert_se(shmdt(p) == 0);
 618
 619                 _exit(EXIT_SUCCESS);
 620         }
 621
 622         assert_se(wait_for_terminate_and_check("memoryseccomp-shmat", pid, WAIT_LOG) == EXIT_SUCCESS);
 623 }
 624
 625 static void test_restrict_archs(void) {
 626         pid_t pid;
 627
 628         log_info("/* %s */", __func__);
 629
 630         if (!is_seccomp_available()) {
 631                 log_notice("Seccomp not available, skipping %s", __func__);
 632                 return;
 633         }
 634         if (geteuid() != 0) {
 635                 log_notice("Not root, skipping %s", __func__);
 636                 return;
 637         }
 638
 639         pid = fork();
 640         assert_se(pid >= 0);
 641
 642         if (pid == 0) {
 643                 _cleanup_set_free_ Set *s = NULL;
 644
 645                 assert_se(access("/", F_OK) >= 0);
 646
 647                 assert_se(s = set_new(NULL));
 648
 649 #ifdef __x86_64__
 650                 assert_se(set_put(s, UINT32_TO_PTR(SCMP_ARCH_X86+1)) >= 0);
 651 #endif
 652                 assert_se(seccomp_restrict_archs(s) >= 0);
 653
 654                 assert_se(access("/", F_OK) >= 0);
 655                 assert_se(seccomp_restrict_archs(NULL) >= 0);
 656
 657                 assert_se(access("/", F_OK) >= 0);
 658
 659                 _exit(EXIT_SUCCESS);
 660         }
 661
 662         assert_se(wait_for_terminate_and_check("archseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 663 }
 664
 665 static void test_load_syscall_filter_set_raw(void) {
 666         pid_t pid;
 667
 668         log_info("/* %s */", __func__);
 669
 670         if (!is_seccomp_available()) {
 671                 log_notice("Seccomp not available, skipping %s", __func__);
 672                 return;
 673         }
 674         if (geteuid() != 0) {
 675                 log_notice("Not root, skipping %s", __func__);
 676                 return;
 677         }
 678
 679         pid = fork();
 680         assert_se(pid >= 0);
 681
 682         if (pid == 0) {
 683                 _cleanup_hashmap_free_ Hashmap *s = NULL;
 684
 685                 assert_se(access("/", F_OK) >= 0);
 686                 assert_se(poll(NULL, 0, 0) == 0);
 687
 688                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, NULL, scmp_act_kill_process(), true) >= 0);
 689                 assert_se(access("/", F_OK) >= 0);
 690                 assert_se(poll(NULL, 0, 0) == 0);
 691
 692                 assert_se(s = hashmap_new(NULL));
 693 #if defined __NR_access && __NR_access >= 0
 694                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_access + 1), INT_TO_PTR(-1)) >= 0);
 695 #else
 696                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_faccessat + 1), INT_TO_PTR(-1)) >= 0);
 697 #endif
 698
 699                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUCLEAN), true) >= 0);
 700
 701                 assert_se(access("/", F_OK) < 0);
 702                 assert_se(errno == EUCLEAN);
 703
 704                 assert_se(poll(NULL, 0, 0) == 0);
 705
 706                 s = hashmap_free(s);
 707
 708                 assert_se(s = hashmap_new(NULL));
 709 #if defined __NR_access && __NR_access >= 0
 710                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_access + 1), INT_TO_PTR(EILSEQ)) >= 0);
 711 #else
 712                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_faccessat + 1), INT_TO_PTR(EILSEQ)) >= 0);
 713 #endif
 714
 715                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUCLEAN), true) >= 0);
 716
 717                 assert_se(access("/", F_OK) < 0);
 718                 assert_se(errno == EILSEQ);
 719
 720                 assert_se(poll(NULL, 0, 0) == 0);
 721
 722                 s = hashmap_free(s);
 723
 724                 assert_se(s = hashmap_new(NULL));
 725 #if defined __NR_poll && __NR_poll >= 0
 726                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_poll + 1), INT_TO_PTR(-1)) >= 0);
 727 #else
 728                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_ppoll + 1), INT_TO_PTR(-1)) >= 0);
 729 #endif
 730
 731                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUNATCH), true) >= 0);
 732
 733                 assert_se(access("/", F_OK) < 0);
 734                 assert_se(errno == EILSEQ);
 735
 736                 assert_se(poll(NULL, 0, 0) < 0);
 737                 assert_se(errno == EUNATCH);
 738
 739                 s = hashmap_free(s);
 740
 741                 assert_se(s = hashmap_new(NULL));
 742 #if defined __NR_poll && __NR_poll >= 0
 743                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_poll + 1), INT_TO_PTR(EILSEQ)) >= 0);
 744 #else
 745                 assert_se(hashmap_put(s, UINT32_TO_PTR(__NR_ppoll + 1), INT_TO_PTR(EILSEQ)) >= 0);
 746 #endif
 747
 748                 assert_se(seccomp_load_syscall_filter_set_raw(SCMP_ACT_ALLOW, s, SCMP_ACT_ERRNO(EUNATCH), true) >= 0);
 749
 750                 assert_se(access("/", F_OK) < 0);
 751                 assert_se(errno == EILSEQ);
 752
 753                 assert_se(poll(NULL, 0, 0) < 0);
 754                 assert_se(errno == EILSEQ);
 755
 756                 _exit(EXIT_SUCCESS);
 757         }
 758
 759         assert_se(wait_for_terminate_and_check("syscallrawseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 760 }
 761
 762 static void test_lock_personality(void) {
 763         unsigned long current;
 764         pid_t pid;
 765
 766         log_info("/* %s */", __func__);
 767
 768         if (!is_seccomp_available()) {
 769                 log_notice("Seccomp not available, skipping %s", __func__);
 770                 return;
 771         }
 772         if (geteuid() != 0) {
 773                 log_notice("Not root, skipping %s", __func__);
 774                 return;
 775         }
 776
 777         assert_se(opinionated_personality(&current) >= 0);
 778
 779         log_info("current personality=%lu", current);
 780
 781         pid = fork();
 782         assert_se(pid >= 0);
 783
 784         if (pid == 0) {
 785                 assert_se(seccomp_lock_personality(current) >= 0);
 786
 787                 assert_se((unsigned long) safe_personality(current) == current);
 788
 789                 /* Note, we also test that safe_personality() works correctly, by checkig whether errno is properly
 790                  * set, in addition to the return value */
 791                 errno = 0;
 792                 assert_se(safe_personality(PER_LINUX | ADDR_NO_RANDOMIZE) == -EPERM);
 793                 assert_se(errno == EPERM);
 794
 795                 assert_se(safe_personality(PER_LINUX | MMAP_PAGE_ZERO) == -EPERM);
 796                 assert_se(safe_personality(PER_LINUX | ADDR_COMPAT_LAYOUT) == -EPERM);
 797                 assert_se(safe_personality(PER_LINUX | READ_IMPLIES_EXEC) == -EPERM);
 798                 assert_se(safe_personality(PER_LINUX_32BIT) == -EPERM);
 799                 assert_se(safe_personality(PER_SVR4) == -EPERM);
 800                 assert_se(safe_personality(PER_BSD) == -EPERM);
 801                 assert_se(safe_personality(current == PER_LINUX ? PER_LINUX32 : PER_LINUX) == -EPERM);
 802                 assert_se(safe_personality(PER_LINUX32_3GB) == -EPERM);
 803                 assert_se(safe_personality(PER_UW7) == -EPERM);
 804                 assert_se(safe_personality(0x42) == -EPERM);
 805
 806                 assert_se(safe_personality(PERSONALITY_INVALID) == -EPERM); /* maybe remove this later */
 807
 808                 assert_se((unsigned long) personality(current) == current);
 809                 _exit(EXIT_SUCCESS);
 810         }
 811
 812         assert_se(wait_for_terminate_and_check("lockpersonalityseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
 813 }
 814
 815 static int real_open(const char *path, int flags, mode_t mode) {
 816         /* glibc internally calls openat() when open() is requested. Let's hence define our own wrapper for
 817          * testing purposes that calls the real syscall, on architectures where SYS_open is defined. On
 818          * other architectures, let's just fall back to the glibc call. */
 819
 820 #if defined __NR_open && __NR_open >= 0
 821         return (int) syscall(__NR_open, path, flags, mode);
 822 #else
 823         return open(path, flags, mode);
 824 #endif
 825 }
 826
 827 static void test_restrict_suid_sgid(void) {
 828         pid_t pid;
 829
 830         log_info("/* %s */", __func__);
 831
 832         if (!is_seccomp_available()) {
 833                 log_notice("Seccomp not available, skipping %s", __func__);
 834                 return;
 835         }
 836         if (geteuid() != 0) {
 837                 log_notice("Not root, skipping %s", __func__);
 838                 return;
 839         }
 840
 841         pid = fork();
 842         assert_se(pid >= 0);
 843
 844         if (pid == 0) {
 845                 char path[] = "/tmp/suidsgidXXXXXX", dir[] = "/tmp/suidsgiddirXXXXXX";
 846                 int fd = -1, k = -1;
 847                 const char *z;
 848
 849                 fd = mkostemp_safe(path);
 850                 assert_se(fd >= 0);
 851
 852                 assert_se(mkdtemp(dir));
 853                 z = strjoina(dir, "/test");
 854
 855                 assert_se(chmod(path, 0755 | S_ISUID) >= 0);
 856                 assert_se(chmod(path, 0755 | S_ISGID) >= 0);
 857                 assert_se(chmod(path, 0755 | S_ISGID | S_ISUID) >= 0);
 858                 assert_se(chmod(path, 0755) >= 0);
 859
 860                 assert_se(fchmod(fd, 0755 | S_ISUID) >= 0);
 861                 assert_se(fchmod(fd, 0755 | S_ISGID) >= 0);
 862                 assert_se(fchmod(fd, 0755 | S_ISGID | S_ISUID) >= 0);
 863                 assert_se(fchmod(fd, 0755) >= 0);
 864
 865                 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISUID, 0) >= 0);
 866                 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISGID, 0) >= 0);
 867                 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISGID | S_ISUID, 0) >= 0);
 868                 assert_se(fchmodat(AT_FDCWD, path, 0755, 0) >= 0);
 869
 870                 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID);
 871                 k = safe_close(k);
 872                 assert_se(unlink(z) >= 0);
 873
 874                 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISGID);
 875                 k = safe_close(k);
 876                 assert_se(unlink(z) >= 0);
 877
 878                 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID | S_ISGID);
 879                 k = safe_close(k);
 880                 assert_se(unlink(z) >= 0);
 881
 882                 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644);
 883                 k = safe_close(k);
 884                 assert_se(unlink(z) >= 0);
 885
 886                 k = creat(z, 0644 | S_ISUID);
 887                 k = safe_close(k);
 888                 assert_se(unlink(z) >= 0);
 889
 890                 k = creat(z, 0644 | S_ISGID);
 891                 k = safe_close(k);
 892                 assert_se(unlink(z) >= 0);
 893
 894                 k = creat(z, 0644 | S_ISUID | S_ISGID);
 895                 k = safe_close(k);
 896                 assert_se(unlink(z) >= 0);
 897
 898                 k = creat(z, 0644);
 899                 k = safe_close(k);
 900                 assert_se(unlink(z) >= 0);
 901
 902                 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID);
 903                 k = safe_close(k);
 904                 assert_se(unlink(z) >= 0);
 905
 906                 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISGID);
 907                 k = safe_close(k);
 908                 assert_se(unlink(z) >= 0);
 909
 910                 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID | S_ISGID);
 911                 k = safe_close(k);
 912                 assert_se(unlink(z) >= 0);
 913
 914                 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644);
 915                 k = safe_close(k);
 916                 assert_se(unlink(z) >= 0);
 917
 918                 assert_se(mkdir(z, 0755 | S_ISUID) >= 0);
 919                 assert_se(rmdir(z) >= 0);
 920                 assert_se(mkdir(z, 0755 | S_ISGID) >= 0);
 921                 assert_se(rmdir(z) >= 0);
 922                 assert_se(mkdir(z, 0755 | S_ISUID | S_ISGID) >= 0);
 923                 assert_se(rmdir(z) >= 0);
 924                 assert_se(mkdir(z, 0755) >= 0);
 925                 assert_se(rmdir(z) >= 0);
 926
 927                 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISUID) >= 0);
 928                 assert_se(rmdir(z) >= 0);
 929                 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISGID) >= 0);
 930                 assert_se(rmdir(z) >= 0);
 931                 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISUID | S_ISGID) >= 0);
 932                 assert_se(rmdir(z) >= 0);
 933                 assert_se(mkdirat(AT_FDCWD, z, 0755) >= 0);
 934                 assert_se(rmdir(z) >= 0);
 935
 936                 assert_se(mknod(z, S_IFREG | 0755 | S_ISUID, 0) >= 0);
 937                 assert_se(unlink(z) >= 0);
 938                 assert_se(mknod(z, S_IFREG | 0755 | S_ISGID, 0) >= 0);
 939                 assert_se(unlink(z) >= 0);
 940                 assert_se(mknod(z, S_IFREG | 0755 | S_ISUID | S_ISGID, 0) >= 0);
 941                 assert_se(unlink(z) >= 0);
 942                 assert_se(mknod(z, S_IFREG | 0755, 0) >= 0);
 943                 assert_se(unlink(z) >= 0);
 944
 945                 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISUID, 0) >= 0);
 946                 assert_se(unlink(z) >= 0);
 947                 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISGID, 0) >= 0);
 948                 assert_se(unlink(z) >= 0);
 949                 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISUID | S_ISGID, 0) >= 0);
 950                 assert_se(unlink(z) >= 0);
 951                 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755, 0) >= 0);
 952                 assert_se(unlink(z) >= 0);
 953
 954                 assert_se(seccomp_restrict_suid_sgid() >= 0);
 955
 956                 assert_se(chmod(path, 0775 | S_ISUID) < 0 && errno == EPERM);
 957                 assert_se(chmod(path, 0775 | S_ISGID) < 0  && errno == EPERM);
 958                 assert_se(chmod(path, 0775 | S_ISGID | S_ISUID) < 0  && errno == EPERM);
 959                 assert_se(chmod(path, 0775) >= 0);
 960
 961                 assert_se(fchmod(fd, 0775 | S_ISUID) < 0 && errno == EPERM);
 962                 assert_se(fchmod(fd, 0775 | S_ISGID) < 0  && errno == EPERM);
 963                 assert_se(fchmod(fd, 0775 | S_ISGID | S_ISUID) < 0  && errno == EPERM);
 964                 assert_se(fchmod(fd, 0775) >= 0);
 965
 966                 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISUID, 0) < 0 && errno == EPERM);
 967                 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISGID, 0) < 0 && errno == EPERM);
 968                 assert_se(fchmodat(AT_FDCWD, path, 0755 | S_ISGID | S_ISUID, 0) < 0 && errno == EPERM);
 969                 assert_se(fchmodat(AT_FDCWD, path, 0755, 0) >= 0);
 970
 971                 assert_se(real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID) < 0 && errno == EPERM);
 972                 assert_se(real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISGID) < 0 && errno == EPERM);
 973                 assert_se(real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
 974                 k = real_open(z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644);
 975                 k = safe_close(k);
 976                 assert_se(unlink(z) >= 0);
 977
 978                 assert_se(creat(z, 0644 | S_ISUID) < 0 && errno == EPERM);
 979                 assert_se(creat(z, 0644 | S_ISGID) < 0 && errno == EPERM);
 980                 assert_se(creat(z, 0644 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
 981                 k = creat(z, 0644);
 982                 k = safe_close(k);
 983                 assert_se(unlink(z) >= 0);
 984
 985                 assert_se(openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID) < 0 && errno == EPERM);
 986                 assert_se(openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISGID) < 0 && errno == EPERM);
 987                 assert_se(openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
 988                 k = openat(AT_FDCWD, z, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL, 0644);
 989                 k = safe_close(k);
 990                 assert_se(unlink(z) >= 0);
 991
 992                 assert_se(mkdir(z, 0755 | S_ISUID) < 0 && errno == EPERM);
 993                 assert_se(mkdir(z, 0755 | S_ISGID) < 0 && errno == EPERM);
 994                 assert_se(mkdir(z, 0755 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
 995                 assert_se(mkdir(z, 0755) >= 0);
 996                 assert_se(rmdir(z) >= 0);
 997
 998                 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISUID) < 0 && errno == EPERM);
 999                 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISGID) < 0 && errno == EPERM);
1000                 assert_se(mkdirat(AT_FDCWD, z, 0755 | S_ISUID | S_ISGID) < 0 && errno == EPERM);
1001                 assert_se(mkdirat(AT_FDCWD, z, 0755) >= 0);
1002                 assert_se(rmdir(z) >= 0);
1003
1004                 assert_se(mknod(z, S_IFREG | 0755 | S_ISUID, 0) < 0 && errno == EPERM);
1005                 assert_se(mknod(z, S_IFREG | 0755 | S_ISGID, 0) < 0 && errno == EPERM);
1006                 assert_se(mknod(z, S_IFREG | 0755 | S_ISUID | S_ISGID, 0) < 0 && errno == EPERM);
1007                 assert_se(mknod(z, S_IFREG | 0755, 0) >= 0);
1008                 assert_se(unlink(z) >= 0);
1009
1010                 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISUID, 0) < 0 && errno == EPERM);
1011                 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISGID, 0) < 0 && errno == EPERM);
1012                 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755 | S_ISUID | S_ISGID, 0) < 0 && errno == EPERM);
1013                 assert_se(mknodat(AT_FDCWD, z, S_IFREG | 0755, 0) >= 0);
1014                 assert_se(unlink(z) >= 0);
1015
1016                 assert_se(unlink(path) >= 0);
1017                 assert_se(rm_rf(dir, REMOVE_ROOT|REMOVE_PHYSICAL) >= 0);
1018
1019                 _exit(EXIT_SUCCESS);
1020         }
1021
1022         assert_se(wait_for_terminate_and_check("suidsgidseccomp", pid, WAIT_LOG) == EXIT_SUCCESS);
1023 }
1024
1025 int main(int argc, char *argv[]) {
1026         test_setup_logging(LOG_DEBUG);
1027
1028         test_seccomp_arch_to_string();
1029         test_architecture_table();
1030         test_syscall_filter_set_find();
1031         test_filter_sets();
1032         test_filter_sets_ordered();
1033         test_restrict_namespace();
1034         test_protect_sysctl();
1035         test_protect_syslog();
1036         test_restrict_address_families();
1037         test_restrict_realtime();
1038         test_memory_deny_write_execute_mmap();
1039         test_memory_deny_write_execute_shmat();
1040         test_restrict_archs();
1041         test_load_syscall_filter_set_raw();
1042         test_lock_personality();
1043         test_restrict_suid_sgid();
1044
1045         return 0;
1046 }