prctl-seccomp-strict.c revision c5f6863a18976ed448026c6673517e24ffa29fc3
1c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin/*
2c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * Copyright (c) 2016 Dmitry V. Levin <ldv@altlinux.org>
3c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * All rights reserved.
4c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin *
5c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * Redistribution and use in source and binary forms, with or without
6c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * modification, are permitted provided that the following conditions
7c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * are met:
8c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * 1. Redistributions of source code must retain the above copyright
9c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin *    notice, this list of conditions and the following disclaimer.
10c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * 2. Redistributions in binary form must reproduce the above copyright
11c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin *    notice, this list of conditions and the following disclaimer in the
12c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin *    documentation and/or other materials provided with the distribution.
13c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * 3. The name of the author may not be used to endorse or promote products
14c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin *    derived from this software without specific prior written permission.
15c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin *
16c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin */
27c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin
28c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin#include "tests.h"
29c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin#include <sys/syscall.h>
30c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin#ifdef HAVE_PRCTL
31c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin# include <sys/prctl.h>
32c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin#endif
33c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin
34c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin#if defined HAVE_PRCTL && defined PR_SET_SECCOMP && defined __NR_exit
35c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin
36c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin# include <stdio.h>
37c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin# include <unistd.h>
38c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin
39c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levinint
40c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levinmain(void)
41c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin{
42c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin	static const char text1[] =
43c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin		"prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT) = 0\n";
44c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin	static const char text2[] = "+++ exited with 0 +++\n";
45c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin
46abde241e685b0bd45885fa5a9a5c7049f79843a1Dmitry V. Levin	int rc = prctl(PR_SET_SECCOMP, -1L, 1, 2, 3);
47c5f6863a18976ed448026c6673517e24ffa29fc3Dmitry V. Levin	printf("prctl(PR_SET_SECCOMP, %#lx /* SECCOMP_MODE_??? */, 0x1, 0x2, 0x3)"
48c5f6863a18976ed448026c6673517e24ffa29fc3Dmitry V. Levin	       " = %d %s (%m)\n", -1L, rc, errno2name());
49c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin	fflush(stdout);
50c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin
51abde241e685b0bd45885fa5a9a5c7049f79843a1Dmitry V. Levin	rc = prctl(PR_SET_SECCOMP, 1);
52abde241e685b0bd45885fa5a9a5c7049f79843a1Dmitry V. Levin	if (rc) {
53abde241e685b0bd45885fa5a9a5c7049f79843a1Dmitry V. Levin		printf("prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT)"
54abde241e685b0bd45885fa5a9a5c7049f79843a1Dmitry V. Levin		       " = %d %s (%m)\n", rc, errno2name());
55c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin		fflush(stdout);
56abde241e685b0bd45885fa5a9a5c7049f79843a1Dmitry V. Levin		rc = 0;
57c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin	} else {
58e8a8f6d6e80df43e4946fef3882d25dfdf5aa76aDmitry V. Levin		/*
59e8a8f6d6e80df43e4946fef3882d25dfdf5aa76aDmitry V. Levin		 * If kernel implementaton of SECCOMP_MODE_STRICT is buggy,
60e8a8f6d6e80df43e4946fef3882d25dfdf5aa76aDmitry V. Levin		 * the following syscall will result to SIGKILL.
61e8a8f6d6e80df43e4946fef3882d25dfdf5aa76aDmitry V. Levin		 */
62abde241e685b0bd45885fa5a9a5c7049f79843a1Dmitry V. Levin		rc = write(1, text1, LENGTH_OF(text1)) != LENGTH_OF(text1);
63c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin	}
64c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin
65c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin	rc += write(1, text2, LENGTH_OF(text2)) != LENGTH_OF(text2);
66c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin	return !!syscall(__NR_exit, rc);
67c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin}
68c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin
69c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin#else
70c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin
71c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. LevinSKIP_MAIN_UNDEFINED("HAVE_PRCTL && PR_SET_SECCOMP && __NR_exit")
72c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin
73c1aa7373253ea99059dc5e29159a15a3c3340fd7Dmitry V. Levin#endif
74