Skip to content
This repository was archived by the owner on Nov 8, 2023. It is now read-only.

Commit 39a73b4

Browse files
avaginkees
authored andcommitted
selftests/seccomp: add test for NOTIF_RECV and unused filters
Add a new test case to check that SECCOMP_IOCTL_NOTIF_RECV returns when all tasks have gone. Signed-off-by: Andrei Vagin <avagin@google.com> Link: https://lore.kernel.org/r/20240628021014.231976-4-avagin@google.com Reviewed-by: Tycho Andersen <tandersen@netflix.com> Signed-off-by: Kees Cook <kees@kernel.org>
1 parent bfafe5e commit 39a73b4

File tree

1 file changed

+54
-0
lines changed

1 file changed

+54
-0
lines changed

tools/testing/selftests/seccomp/seccomp_bpf.c

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3954,6 +3954,60 @@ TEST(user_notification_filter_empty)
39543954
EXPECT_GT((pollfd.revents & POLLHUP) ?: 0, 0);
39553955
}
39563956

3957+
TEST(user_ioctl_notification_filter_empty)
3958+
{
3959+
pid_t pid;
3960+
long ret;
3961+
int status, p[2];
3962+
struct __clone_args args = {
3963+
.flags = CLONE_FILES,
3964+
.exit_signal = SIGCHLD,
3965+
};
3966+
struct seccomp_notif req = {};
3967+
3968+
ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
3969+
ASSERT_EQ(0, ret) {
3970+
TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
3971+
}
3972+
3973+
if (__NR_clone3 < 0)
3974+
SKIP(return, "Test not built with clone3 support");
3975+
3976+
ASSERT_EQ(0, pipe(p));
3977+
3978+
pid = sys_clone3(&args, sizeof(args));
3979+
ASSERT_GE(pid, 0);
3980+
3981+
if (pid == 0) {
3982+
int listener;
3983+
3984+
listener = user_notif_syscall(__NR_mknodat, SECCOMP_FILTER_FLAG_NEW_LISTENER);
3985+
if (listener < 0)
3986+
_exit(EXIT_FAILURE);
3987+
3988+
if (dup2(listener, 200) != 200)
3989+
_exit(EXIT_FAILURE);
3990+
close(p[1]);
3991+
close(listener);
3992+
sleep(1);
3993+
3994+
_exit(EXIT_SUCCESS);
3995+
}
3996+
if (read(p[0], &status, 1) != 0)
3997+
_exit(EXIT_SUCCESS);
3998+
close(p[0]);
3999+
/*
4000+
* The seccomp filter has become unused so we should be notified once
4001+
* the kernel gets around to cleaning up task struct.
4002+
*/
4003+
EXPECT_EQ(ioctl(200, SECCOMP_IOCTL_NOTIF_RECV, &req), -1);
4004+
EXPECT_EQ(errno, ENOENT);
4005+
4006+
EXPECT_EQ(waitpid(pid, &status, 0), pid);
4007+
EXPECT_EQ(true, WIFEXITED(status));
4008+
EXPECT_EQ(0, WEXITSTATUS(status));
4009+
}
4010+
39574011
static void *do_thread(void *data)
39584012
{
39594013
return NULL;

0 commit comments

Comments
 (0)