Re: [PATCH] selftests/seccomp: Fix seccomp failure by adding missing headers

[Shuah Khan <skhan@linuxfoundation.org>]

On 2/3/22 1:46 PM, Sherry Yang wrote:
> 
>> On Feb 3, 2022, at 12:20 PM, Kees Cook <keescook@chromium.org> wrote:
>>
>> On Thu, Feb 03, 2022 at 07:40:46PM +0000, Sherry Yang wrote:
>>>> This didn't look right to me. That's outside the build tree, yes?
>>>
>>> It’s inside the build tree. “../../../../usr/include“ may look a little confusing, it’s actually linux/usr/include (linux/ is top directory of the repo we git clone), i.e. https://urldefense.com/v3/__https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/usr/include?h=v5.17-rc2__;!!ACWV5N9M2RV99hQ!cP8-SXVNX-k1LuWYjfUYvCYlrOJsInLi9l7hNsqLoXiFULd7xqRS9HRF9WnTno3nBg$
>>> The file tools/testing/sefltests/Makefile can install kernel headers in default path “usr/include”. “../../../../usr/include“ is also used in other Makefile of selftests, like https://urldefense.com/v3/__https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/testing/selftests/clone3/Makefile?h=v5.17-rc2__;!!ACWV5N9M2RV99hQ!cP8-SXVNX-k1LuWYjfUYvCYlrOJsInLi9l7hNsqLoXiFULd7xqRS9HRF9WmhyH6mcQ$
>>
>> Ah-ha, thanks. Following the other example, should it just be -I instead
>> of -isystem?
> 
> In this case, “-I” works but gcc gives warnings, shown below
> 
> ———Warning Begin———
> gcc -Wl,-no-as-needed -Wall -I../../../../usr/include/  -lpthread  seccomp_bpf.c  -o /home/opc/linux/tools/testing/selftests/seccomp/seccomp_bpf
> In file included from seccomp_bpf.c:29:
> ../../../../usr/include/linux/ptrace.h:50: warning: "PTRACE_GETREGSET" redefined
>   #define PTRACE_GETREGSET 0x4204
>   
> In file included from seccomp_bpf.c:26:
> /usr/include/sys/ptrace.h:153: note: this is the location of the previous definition
>   #define PTRACE_GETREGSET PTRACE_GETREGSET

> ———Warning End———
> 
> So there is redefinition problem between glibc and kernel headers. I tried updating kernel headers, the ptrace.h installed in /usr/include/linux/ptrace.h is the same as we installed in the sandbox ../../../../usr/include/linux/ptrace.h, however, gcc doesn’t throw these warnings if we compile seccomp_bpf.c using /usr/include/linux/ptrace.h. This is because system headers will automatically suppress these warnings (refer to https://gcc.gnu.org/onlinedocs/cpp/System-Headers.html). In my opinion, it’s fair to use “-isystem”, since they're actually generated kernel headers.
> 
> Sherry

Sounds like -i works - I will queue this up for Linux 5.17-rc5.

thanks,
-- Shuah