diff mbox series

selftests/seccomp: Add test for unknown SECCOMP_RET kill behavior

Message ID 202009081232.92206075F7@keescook
State Accepted
Commit 3932fcecd96221e18100055d623b736d0ff873a4
Headers show
Series selftests/seccomp: Add test for unknown SECCOMP_RET kill behavior | expand

Commit Message

Kees Cook Sept. 8, 2020, 7:35 p.m. UTC
While we testing for the behavior of unknown seccomp filter return
values, there was no test for how it acted in a thread group. Add
a test in the thread group tests for this.

Signed-off-by: Kees Cook <keescook@chromium.org>
---
(This is going via the seccomp tree.)
---
 tools/testing/selftests/seccomp/seccomp_bpf.c | 43 ++++++++++++++++---
 1 file changed, 37 insertions(+), 6 deletions(-)

Comments

Shuah Khan Sept. 8, 2020, 8:07 p.m. UTC | #1
On 9/8/20 1:35 PM, Kees Cook wrote:
> While we testing for the behavior of unknown seccomp filter return
> values, there was no test for how it acted in a thread group. Add
> a test in the thread group tests for this.
> 
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> (This is going via the seccomp tree.)

Cool.

> ---
>   tools/testing/selftests/seccomp/seccomp_bpf.c | 43 ++++++++++++++++---
>   1 file changed, 37 insertions(+), 6 deletions(-)

Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>

thanks,
-- Shuah
Christian Brauner Sept. 8, 2020, 8:21 p.m. UTC | #2
On Tue, Sep 08, 2020 at 12:35:18PM -0700, Kees Cook wrote:
> While we testing for the behavior of unknown seccomp filter return

s/we/we're/

> values, there was no test for how it acted in a thread group. Add
> a test in the thread group tests for this.
> 
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> (This is going via the seccomp tree.)
> ---

Thanks!
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>

>  tools/testing/selftests/seccomp/seccomp_bpf.c | 43 ++++++++++++++++---
>  1 file changed, 37 insertions(+), 6 deletions(-)
> 
> diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
> index 7a6d40286a42..bfb382580493 100644
> --- a/tools/testing/selftests/seccomp/seccomp_bpf.c
> +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
> @@ -774,8 +774,15 @@ void *kill_thread(void *data)
>  	return (void *)SIBLING_EXIT_UNKILLED;
>  }
>  
> +enum kill_t {
> +	KILL_THREAD,
> +	KILL_PROCESS,
> +	RET_UNKNOWN
> +};
> +
>  /* Prepare a thread that will kill itself or both of us. */
> -void kill_thread_or_group(struct __test_metadata *_metadata, bool kill_process)
> +void kill_thread_or_group(struct __test_metadata *_metadata,
> +			  enum kill_t kill_how)
>  {
>  	pthread_t thread;
>  	void *status;
> @@ -791,11 +798,12 @@ void kill_thread_or_group(struct __test_metadata *_metadata, bool kill_process)
>  		.len = (unsigned short)ARRAY_SIZE(filter_thread),
>  		.filter = filter_thread,
>  	};
> +	int kill = kill_how == KILL_PROCESS ? SECCOMP_RET_KILL_PROCESS : 0xAAAAAAAAA;
>  	struct sock_filter filter_process[] = {
>  		BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
>  			offsetof(struct seccomp_data, nr)),
>  		BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
> -		BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_PROCESS),
> +		BPF_STMT(BPF_RET|BPF_K, kill),
>  		BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
>  	};
>  	struct sock_fprog prog_process = {
> @@ -808,13 +816,15 @@ void kill_thread_or_group(struct __test_metadata *_metadata, bool kill_process)
>  	}
>  
>  	ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0,
> -			     kill_process ? &prog_process : &prog_thread));
> +			     kill_how == KILL_THREAD ? &prog_thread
> +						     : &prog_process));
>  
>  	/*
>  	 * Add the KILL_THREAD rule again to make sure that the KILL_PROCESS
>  	 * flag cannot be downgraded by a new filter.
>  	 */
> -	ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread));
> +	if (kill_how == KILL_PROCESS)
> +		ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread));

(Ok, meaning that you still need to observe that the thread-group gets
taken down not just a single thread.)

>  
>  	/* Start a thread that will exit immediately. */
>  	ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)false));
> @@ -842,7 +852,7 @@ TEST(KILL_thread)
>  	child_pid = fork();
>  	ASSERT_LE(0, child_pid);
>  	if (child_pid == 0) {
> -		kill_thread_or_group(_metadata, false);
> +		kill_thread_or_group(_metadata, KILL_THREAD);
>  		_exit(38);
>  	}
>  
> @@ -861,7 +871,7 @@ TEST(KILL_process)
>  	child_pid = fork();
>  	ASSERT_LE(0, child_pid);
>  	if (child_pid == 0) {
> -		kill_thread_or_group(_metadata, true);
> +		kill_thread_or_group(_metadata, KILL_PROCESS);
>  		_exit(38);
>  	}
>  
> @@ -872,6 +882,27 @@ TEST(KILL_process)
>  	ASSERT_EQ(SIGSYS, WTERMSIG(status));
>  }
>  
> +TEST(KILL_unknown)
> +{
> +	int status;
> +	pid_t child_pid;
> +
> +	child_pid = fork();
> +	ASSERT_LE(0, child_pid);
> +	if (child_pid == 0) {
> +		kill_thread_or_group(_metadata, RET_UNKNOWN);
> +		_exit(38);
> +	}
> +
> +	ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
> +
> +	/* If the entire process was killed, we'll see SIGSYS. */
> +	EXPECT_TRUE(WIFSIGNALED(status)) {
> +		TH_LOG("Unknown SECCOMP_RET is only killing the thread?");
> +	}
> +	ASSERT_EQ(SIGSYS, WTERMSIG(status));
> +}
> +
>  /* TODO(wad) add 64-bit versus 32-bit arg tests. */
>  TEST(arg_out_of_range)
>  {
> -- 
> 2.25.1
> 
> 
> -- 
> Kees Cook
diff mbox series

Patch

diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 7a6d40286a42..bfb382580493 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -774,8 +774,15 @@  void *kill_thread(void *data)
 	return (void *)SIBLING_EXIT_UNKILLED;
 }
 
+enum kill_t {
+	KILL_THREAD,
+	KILL_PROCESS,
+	RET_UNKNOWN
+};
+
 /* Prepare a thread that will kill itself or both of us. */
-void kill_thread_or_group(struct __test_metadata *_metadata, bool kill_process)
+void kill_thread_or_group(struct __test_metadata *_metadata,
+			  enum kill_t kill_how)
 {
 	pthread_t thread;
 	void *status;
@@ -791,11 +798,12 @@  void kill_thread_or_group(struct __test_metadata *_metadata, bool kill_process)
 		.len = (unsigned short)ARRAY_SIZE(filter_thread),
 		.filter = filter_thread,
 	};
+	int kill = kill_how == KILL_PROCESS ? SECCOMP_RET_KILL_PROCESS : 0xAAAAAAAAA;
 	struct sock_filter filter_process[] = {
 		BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 			offsetof(struct seccomp_data, nr)),
 		BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
-		BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_PROCESS),
+		BPF_STMT(BPF_RET|BPF_K, kill),
 		BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 	};
 	struct sock_fprog prog_process = {
@@ -808,13 +816,15 @@  void kill_thread_or_group(struct __test_metadata *_metadata, bool kill_process)
 	}
 
 	ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0,
-			     kill_process ? &prog_process : &prog_thread));
+			     kill_how == KILL_THREAD ? &prog_thread
+						     : &prog_process));
 
 	/*
 	 * Add the KILL_THREAD rule again to make sure that the KILL_PROCESS
 	 * flag cannot be downgraded by a new filter.
 	 */
-	ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread));
+	if (kill_how == KILL_PROCESS)
+		ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread));
 
 	/* Start a thread that will exit immediately. */
 	ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)false));
@@ -842,7 +852,7 @@  TEST(KILL_thread)
 	child_pid = fork();
 	ASSERT_LE(0, child_pid);
 	if (child_pid == 0) {
-		kill_thread_or_group(_metadata, false);
+		kill_thread_or_group(_metadata, KILL_THREAD);
 		_exit(38);
 	}
 
@@ -861,7 +871,7 @@  TEST(KILL_process)
 	child_pid = fork();
 	ASSERT_LE(0, child_pid);
 	if (child_pid == 0) {
-		kill_thread_or_group(_metadata, true);
+		kill_thread_or_group(_metadata, KILL_PROCESS);
 		_exit(38);
 	}
 
@@ -872,6 +882,27 @@  TEST(KILL_process)
 	ASSERT_EQ(SIGSYS, WTERMSIG(status));
 }
 
+TEST(KILL_unknown)
+{
+	int status;
+	pid_t child_pid;
+
+	child_pid = fork();
+	ASSERT_LE(0, child_pid);
+	if (child_pid == 0) {
+		kill_thread_or_group(_metadata, RET_UNKNOWN);
+		_exit(38);
+	}
+
+	ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
+
+	/* If the entire process was killed, we'll see SIGSYS. */
+	EXPECT_TRUE(WIFSIGNALED(status)) {
+		TH_LOG("Unknown SECCOMP_RET is only killing the thread?");
+	}
+	ASSERT_EQ(SIGSYS, WTERMSIG(status));
+}
+
 /* TODO(wad) add 64-bit versus 32-bit arg tests. */
 TEST(arg_out_of_range)
 {