Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751988AbdHCQ7z (ORCPT ); Thu, 3 Aug 2017 12:59:55 -0400 Received: from mail-yw0-f175.google.com ([209.85.161.175]:33889 "EHLO mail-yw0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751872AbdHCQ6c (ORCPT ); Thu, 3 Aug 2017 12:58:32 -0400 MIME-Version: 1.0 In-Reply-To: <1501275352-30045-7-git-send-email-tyhicks@canonical.com> References: <1501275352-30045-1-git-send-email-tyhicks@canonical.com> <1501275352-30045-7-git-send-email-tyhicks@canonical.com> From: Kees Cook Date: Thu, 3 Aug 2017 09:58:31 -0700 X-Google-Sender-Auth: llYjnkJjiqKxb9c0nZzvSgPGsRw Message-ID: Subject: Re: [PATCH v5 6/6] seccomp: Selftest for detection of filter flag support To: Tyler Hicks Cc: Andy Lutomirski , Will Drewry , Paul Moore , Eric Paris , John Crispin , linux-audit@redhat.com, LKML , Linux API Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3898 Lines: 103 On Fri, Jul 28, 2017 at 1:55 PM, Tyler Hicks wrote: > Userspace needs to be able to reliably detect the support of a filter > flag. A good way of doing that is by attempting to enter filter mode, > with the flag bit(s) in question set, and a NULL pointer for the args > parameter of seccomp(2). EFAULT indicates that the flag is valid and > EINVAL indicates that the flag is invalid. > > This patch adds a selftest that can be used to test this method of > detection in userspace. > > Signed-off-by: Tyler Hicks > --- > > * Changes since v4: > - This is a new patch > > tools/testing/selftests/seccomp/seccomp_bpf.c | 58 +++++++++++++++++++++++++++ > 1 file changed, 58 insertions(+) > > diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c > index 040e875..d221437 100644 > --- a/tools/testing/selftests/seccomp/seccomp_bpf.c > +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c > @@ -1885,6 +1885,64 @@ TEST(seccomp_syscall_mode_lock) > } > } > > +/* Test detection of known and unknown filter flags. Userspace needs to be able > + * to check if a filter flag is support by the current kernel and a good way of > + * doing that is by attempting to enter filter mode, with the flag bit in > + * question set, and a NULL pointer for the _args_ parameter. EFAULT indicates > + * that the flag is valid and EINVAL indicates that the flag is invalid. > + */ > +TEST(detect_seccomp_filter_flags) > +{ > + unsigned int flags[] = { SECCOMP_FILTER_FLAG_TSYNC, > + SECCOMP_FILTER_FLAG_LOG }; > + unsigned int flag, all_flags; > + int i; > + long ret; > + > + /* Test detection of known-good filter flags */ > + for (i = 0, all_flags = 0; i < ARRAY_SIZE(flags); i++) { > + flag = flags[i]; > + ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); > + ASSERT_NE(ENOSYS, errno) { > + TH_LOG("Kernel does not support seccomp syscall!"); > + } > + EXPECT_EQ(-1, ret); > + EXPECT_EQ(EFAULT, errno) { > + TH_LOG("Failed to detect that a known-good filter flag (0x%X) is supported!", > + flag); > + } > + > + all_flags |= flag; > + } > + > + /* Test detection of all known-good filter flags */ > + ret = seccomp(SECCOMP_SET_MODE_FILTER, all_flags, NULL); > + EXPECT_EQ(-1, ret); > + EXPECT_EQ(EFAULT, errno) { > + TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!", > + all_flags); > + } > + > + /* Test detection of an unknown filter flag */ > + flag = -1; > + ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); > + EXPECT_EQ(-1, ret); > + EXPECT_EQ(EINVAL, errno) { > + TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported!", > + flag); > + } > + > + /* Test detection of an unknown filter flag that may simply need to be > + * added to this test */ > + flag = flags[ARRAY_SIZE(flags) - 1] << 1; > + ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); > + EXPECT_EQ(-1, ret); > + EXPECT_EQ(EINVAL, errno) { > + TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported! Does a new flag need to be added to this test?", > + flag); > + } > +} > + > TEST(TSYNC_first) > { > struct sock_filter filter[] = { > -- > 2.7.4 > This is good, yes. Can you actually move it earlier in the series, so it will pass before adding ..._FLAG_LOG, and then the patch adding ..._FLAG_LOG will add it to this test too? Thanks! -Kees -- Kees Cook Pixel Security