[PATCH v3 3/3] selftests/seccomp: Test seccomp filter load and attach

From: Hengqi Chen
Date: Wed Nov 29 2023 - 00:35:36 EST


Add testcases to exercise the newly added seccomp filter
load and attach functionalities.

Signed-off-by: Hengqi Chen <hengqi.chen@xxxxxxxxx>
---
tools/testing/selftests/seccomp/seccomp_bpf.c | 71 +++++++++++++++++++
1 file changed, 71 insertions(+)

diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 38f651469968..66eb72e6c1a3 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -4735,6 +4735,77 @@ TEST(user_notification_wait_killable_fatal)
EXPECT_EQ(SIGTERM, WTERMSIG(status));
}

+TEST(seccomp_filter_load_and_attach)
+{
+ struct sock_filter filter[] = {
+ BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
+ };
+ struct sock_fprog prog = {
+ .len = (unsigned short)ARRAY_SIZE(filter),
+ .filter = filter,
+ };
+ int fd, ret, flags;
+
+ ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+ ASSERT_EQ(0, ret)
+ {
+ TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
+ }
+
+ flags = 0;
+ fd = seccomp(SECCOMP_LOAD_FILTER, flags, &prog);
+ ASSERT_GT(fd, -1);
+
+ flags = SECCOMP_FILTER_FLAG_FILTER_FD;
+ ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &fd);
+ ASSERT_EQ(ret, 0);
+
+ flags = SECCOMP_FILTER_FLAG_FILTER_FD;
+ ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &fd);
+ ASSERT_EQ(ret, -1);
+ ASSERT_EQ(errno, EEXIST);
+
+ flags = 0;
+ ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog);
+ ASSERT_EQ(ret, 0);
+
+ close(fd);
+}
+
+TEST(seccomp_attach_fd_failed)
+{
+ int fd, ret, flags;
+
+ ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+ ASSERT_EQ(0, ret)
+ {
+ TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
+ }
+
+ fd = socket(AF_UNIX, SOCK_STREAM, 0);
+ ASSERT_GT(fd, -1);
+
+ /* copy a sock_fprog from a fd */
+ flags = 0;
+ ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &fd);
+ ASSERT_EQ(ret, -1);
+ ASSERT_EQ(errno, EFAULT);
+
+ /* pass a non seccomp filter fd */
+ flags = SECCOMP_FILTER_FLAG_FILTER_FD;
+ ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &fd);
+ ASSERT_EQ(ret, -1);
+ ASSERT_EQ(errno, EINVAL);
+ close(fd);
+
+ /* pass a invalid fd */
+ fd = -1;
+ flags = SECCOMP_FILTER_FLAG_FILTER_FD;
+ ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &fd);
+ ASSERT_EQ(ret, -1);
+ ASSERT_EQ(errno, EBADF);
+}
+
/*
* TODO:
* - expand NNP testing
--
2.34.1