Skip to content

Commit c98c68e

Browse files
drakenclimberdrakenclimber
committed
tests: Add test for kernel version attribute
Add a test, 63-sim-kernel_version.[c|py], to test the kernel version logic. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com>
1 parent 3b37f01 commit c98c68e

5 files changed

Lines changed: 198 additions & 3 deletions

File tree

‎tests/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,3 +70,4 @@ util.pyc
7070
60-sim-precompute
7171
61-sim-transactions
7272
62-sim-arch_transactions
73+
63-sim-kernel_version

‎tests/63-sim-kernel_version.c‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
/**
2+
* Seccomp Library test program
3+
*
4+
* Copyright (c) 2025 Oracle and/or its affiliates.
5+
* Author: Tom Hromatka <tom.hromatka@oracle.com>
6+
*/
7+
8+
/*
9+
* This library is free software; you can redistribute it and/or modify it
10+
* under the terms of version 2.1 of the GNU Lesser General Public License as
11+
* published by the Free Software Foundation.
12+
*
13+
* This library is distributed in the hope that it will be useful, but WITHOUT
14+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
15+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
16+
* for more details.
17+
*
18+
* You should have received a copy of the GNU Lesser General Public License
19+
* along with this library; if not, see <http://www.gnu.org/licenses>.
20+
*/
21+
22+
#include <errno.h>
23+
#include <unistd.h>
24+
25+
#include <seccomp.h>
26+
27+
#include "util.h"
28+
29+
#include <stdio.h>
30+
int main(int argc, char *argv[])
31+
{
32+
int rc;
33+
struct util_options opts;
34+
scmp_filter_ctx ctx = NULL;
35+
36+
rc = util_getopt(argc, argv, &opts);
37+
if (rc < 0)
38+
goto out;
39+
40+
ctx = seccomp_init(SCMP_ACT_KILL);
41+
if (ctx == NULL)
42+
return ENOMEM;
43+
44+
rc = seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE);
45+
if (rc != 0)
46+
goto out;
47+
48+
rc = seccomp_arch_add(ctx, SCMP_ARCH_X86_64);
49+
if (rc != 0)
50+
goto out;
51+
rc = seccomp_arch_add(ctx, SCMP_ARCH_X32);
52+
if (rc != 0)
53+
goto out;
54+
55+
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
56+
if (rc != 0)
57+
goto out;
58+
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0);
59+
if (rc != 0)
60+
goto out;
61+
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(poll), 0);
62+
if (rc != 0)
63+
goto out;
64+
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(nanosleep), 0);
65+
if (rc != 0)
66+
goto out;
67+
68+
rc = seccomp_attr_set(ctx, SCMP_FLTATR_CTL_OPTIMIZE, 2);
69+
if (rc != 0)
70+
goto out;
71+
rc = seccomp_attr_set(ctx, SCMP_FLTATR_ACT_ENOSYS, SCMP_ACT_ERRNO(3));
72+
if (rc != 0)
73+
goto out;
74+
rc = seccomp_attr_set(ctx, SCMP_FLTATR_CTL_KVERMAX, SCMP_KV_6_5);
75+
if (rc != 0)
76+
goto out;
77+
78+
/* unknown action must be set before the kernel version is set */
79+
rc = seccomp_attr_set(ctx, SCMP_FLTATR_ACT_ENOSYS, SCMP_ACT_ERRNO(9));
80+
if (rc != -EINVAL)
81+
goto out;
82+
83+
/*
84+
* Attempt to add a rule after the maximum kernel version has been
85+
* set. This should fail because libseccomp currently does not
86+
* support overwriting existing rules.
87+
*/
88+
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 0);
89+
if (rc != -EINVAL)
90+
goto out;
91+
92+
rc = util_filter_output(&opts, ctx);
93+
if (rc)
94+
goto out;
95+
96+
out:
97+
seccomp_release(ctx);
98+
return (rc < 0 ? -rc : rc);
99+
}

‎tests/63-sim-kernel_version.py‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
#!/usr/bin/env python
2+
3+
#
4+
# Seccomp Library test program
5+
#
6+
# Copyright (c) 2025 Oracle and/or its affiliates.
7+
# Author: Tom Hromatka <tom.hromatka@oracle.com>
8+
#
9+
10+
#
11+
# This library is free software; you can redistribute it and/or modify it
12+
# under the terms of version 2.1 of the GNU Lesser General Public License as
13+
# published by the Free Software Foundation.
14+
#
15+
# This library is distributed in the hope that it will be useful, but WITHOUT
16+
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
17+
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
18+
# for more details.
19+
#
20+
# You should have received a copy of the GNU Lesser General Public License
21+
# along with this library; if not, see <http://www.gnu.org/licenses>.
22+
#
23+
24+
import argparse
25+
import sys
26+
27+
import util
28+
29+
from seccomp import *
30+
31+
def test(args):
32+
f = SyscallFilter(KILL)
33+
# NOTE: some of these arch functions are not strictly necessary, but are
34+
# here for test sanity/coverage
35+
f.remove_arch(Arch())
36+
f.add_arch(Arch("x86_64"))
37+
f.add_arch(Arch("x32"))
38+
39+
f.add_rule(ALLOW, "read")
40+
f.add_rule(ALLOW, "write")
41+
f.add_rule(ALLOW, "poll")
42+
f.add_rule(ALLOW, "nanosleep")
43+
44+
f.set_attr(Attr.CTL_OPTIMIZE, 2)
45+
f.set_attr(Attr.ACT_ENOSYS, ERRNO(3))
46+
f.set_attr(Attr.CTL_KVERMAX, Kver.v6_5)
47+
48+
return f
49+
50+
args = util.get_opt()
51+
ctx = test(args)
52+
util.filter_output(args, ctx)
53+
54+
# kate: syntax python;
55+
# kate: indent-mode python; space-indent on; indent-width 4; mixedindent off;

‎tests/63-sim-kernel_version.tests‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#
2+
# libseccomp regression test automation data
3+
#
4+
# Copyright (c) 2025 Oracle and/or its affiliates.
5+
# Author: Tom Hromatka <tom.hromatka@oracle.com>
6+
#
7+
8+
test type: bpf-sim
9+
10+
# Testname Arch Syscall Arg0 Arg1 Arg2 Arg3 Arg4 Arg5 Result
11+
63-sim-kernel_version +x86_64,+x32 read N N N N N N ALLOW
12+
63-sim-kernel_version +x86_64,+x32 write N N N N N N ALLOW
13+
63-sim-kernel_version +x86_64,+x32 poll N N N N N N ALLOW
14+
63-sim-kernel_version +x86_64,+x32 nanosleep N N N N N N ALLOW
15+
16+
63-sim-kernel_version +x86_64,+x32 2-6 N N N N N N KILL
17+
63-sim-kernel_version +x86_64,+x32 8-34 N N N N N N KILL
18+
63-sim-kernel_version +x86_64,+x32 36-133 N N N N N N KILL
19+
63-sim-kernel_version +x86_64,+x32 135-155 N N N N N N KILL
20+
63-sim-kernel_version +x86_64,+x32 158-173 N N N N N N KILL
21+
63-sim-kernel_version +x86_64,+x32 179 N N N N N N KILL
22+
63-sim-kernel_version +x86_64,+x32 186-235 N N N N N N KILL
23+
63-sim-kernel_version +x86_64,+x32 237-313 N N N N N N KILL
24+
63-sim-kernel_version +x86_64,+x32 335 N N N N N N ERRNO(3)
25+
63-sim-kernel_version +x86_64,+x32 424-451 N N N N N N KILL
26+
27+
63-sim-kernel_version +x86_64,+x32 452-466 N N N N N N ERRNO(3)
28+
29+
test type: bpf-sim-fuzz
30+
31+
# Testname StressCount
32+
63-sim-kernel_version 5
33+
34+
test type: bpf-valgrind
35+
36+
# Testname
37+
63-sim-kernel_version

‎tests/Makefile.am‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,8 @@ check_PROGRAMS = \
9797
59-basic-empty_binary_tree \
9898
60-sim-precompute \
9999
61-sim-transactions \
100-
62-sim-arch_transactions
100+
62-sim-arch_transactions \
101+
63-sim-kernel_version
101102

102103
EXTRA_DIST_TESTPYTHON = \
103104
util.py \
@@ -160,7 +161,8 @@ EXTRA_DIST_TESTPYTHON = \
160161
59-basic-empty_binary_tree.py \
161162
60-sim-precompute.py \
162163
61-sim-transactions.py \
163-
62-sim-arch_transactions.py
164+
62-sim-arch_transactions.py \
165+
63-sim-kernel_version.py
164166

165167
EXTRA_DIST_TESTCFGS = \
166168
01-sim-allow.tests \
@@ -224,7 +226,8 @@ EXTRA_DIST_TESTCFGS = \
224226
59-basic-empty_binary_tree.tests \
225227
60-sim-precompute.tests \
226228
61-sim-transactions.tests \
227-
62-sim-arch_transactions.tests
229+
62-sim-arch_transactions.tests \
230+
63-sim-kernel_version.tests
228231

229232
EXTRA_DIST_TESTSCRIPTS = \
230233
38-basic-pfc_coverage.sh 38-basic-pfc_coverage.pfc \

0 commit comments

Comments
 (0)