From: Kees Cook <keescook@chromium.org>
To: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: "Kees Cook" <keescook@chromium.org>,
"Christian Brauner" <brauner@kernel.org>,
"Andy Lutomirski" <luto@amacapital.net>,
"Robert Święcki" <robert@swiecki.net>,
"Jann Horn" <jannh@google.com>, "Oleg Nesterov" <oleg@redhat.com>,
"Thomas Gleixner" <tglx@linutronix.de>,
"Ingo Molnar" <mingo@redhat.com>,
linux-kernel@vger.kernel.org, linux-api@vger.kernel.org,
linux-hardening@vger.kernel.org
Subject: [PATCH 2/2] selftests/seccomp: Check for waitid() behavior
Date: Mon, 14 Feb 2022 13:38:23 -0800 [thread overview]
Message-ID: <20220214213823.3297816-3-keescook@chromium.org> (raw)
In-Reply-To: <20220214213823.3297816-1-keescook@chromium.org>
Verify we can fetch child's siginfo_t from waitid() with __WCHILDSIGINFO.
Skip if it's not available.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
tools/testing/selftests/seccomp/seccomp_bpf.c | 130 ++++++++++++++++++
1 file changed, 130 insertions(+)
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 9d126d7fabdb..0c803c2b450e 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -268,6 +268,14 @@ struct seccomp_notif_addfd_big {
#define SECCOMP_FILTER_FLAG_TSYNC_ESRCH (1UL << 4)
#endif
+#ifndef SYS_SECCOMP
+#define SYS_SECCOMP 1
+#endif
+
+#ifndef __WCHILDSIGINFO
+#define __WCHILDSIGINFO 0x10000000
+#endif
+
#ifndef seccomp
int seccomp(unsigned int op, unsigned int flags, void *args)
{
@@ -765,6 +773,128 @@ TEST_SIGNAL(KILL_one_arg_six, SIGSYS)
close(fd);
}
+FIXTURE(SIGINFO) {
+ pid_t child_pid;
+};
+
+FIXTURE_SETUP(SIGINFO)
+{
+ self->child_pid = 0;
+}
+
+FIXTURE_TEARDOWN(SIGINFO)
+{
+ if (self->child_pid > 0)
+ waitpid(self->child_pid, NULL, WNOHANG);
+}
+
+TEST_F(SIGINFO, child)
+{
+ int status;
+ siginfo_t info = { };
+ /* Kill only when calling __NR_prctl. */
+ struct sock_filter filter[] = {
+ BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
+ offsetof(struct seccomp_data, nr)),
+ BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
+ BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_PROCESS | 0xBA),
+ BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
+ };
+ struct sock_fprog prog = {
+ .len = (unsigned short)ARRAY_SIZE(filter),
+ .filter = filter,
+ };
+
+ self->child_pid = fork();
+ ASSERT_LE(0, self->child_pid);
+ if (self->child_pid == 0) {
+ ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
+ TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
+ }
+ ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog));
+ prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
+ /* Should have died now. */
+ _exit(37);
+ }
+
+ /* Check siginfo_t contents. */
+ EXPECT_EQ(waitid(P_PID, self->child_pid, &info, WEXITED | WNOWAIT), 0);
+#if 0
+ struct {
+ int si_signo;
+ int si_code;
+ int si_errno;
+ union __sifields _sifields;
+ }
+
+ /* SIGCHLD */
+ struct {
+ __kernel_pid_t _pid; /* which child */
+ __kernel_uid32_t _uid; /* sender's uid */
+ int _status; /* exit code */
+ __ARCH_SI_CLOCK_T _utime;
+ __ARCH_SI_CLOCK_T _stime;
+ } _sigchld;
+#endif
+ ASSERT_EQ(info.si_signo, SIGCHLD);
+ EXPECT_TRUE(info.si_code == CLD_KILLED || info.si_code == CLD_DUMPED);
+ EXPECT_TRUE(info.si_errno == 0);
+ EXPECT_EQ(info.si_pid, self->child_pid);
+
+ ASSERT_TRUE(WIFSIGNALED(info.si_status));
+ /* TODO: why doesn't this WCOREDUMP() agree with below? */
+ /* EXPECT_TRUE(WCOREDUMP(status)); */
+ EXPECT_EQ(WTERMSIG(info.si_status), SIGSYS);
+
+
+ memset(&info, 0, sizeof(info));
+ status = waitid(P_PID, self->child_pid, &info,
+ WEXITED | WNOWAIT | __WCHILDSIGINFO);
+ EXPECT_EQ(status, 0) {
+ if (status < 0 && errno == EINVAL)
+ SKIP(goto skip_siginfo, "Kernel does not support waitid() with __WCHILDSIGINFO");
+ }
+#if 0
+ /* SIGSYS */
+ struct {
+ void __user *_call_addr;/* calling user insn */
+ int _syscall; /* triggering system call number */
+ unsigned int _arch; /* AUDIT_ARCH_* of syscall */
+ } _sigsys;
+
+ info.si_signo = SIGSYS;
+ info.si_code = SYS_SECCOMP;
+ info.si_call_addr = (void __user *)KSTK_EIP(current);
+ info.si_errno = reason;
+ info.si_arch = syscall_get_arch(current);
+ info.si_syscall = syscall;
+
+#endif
+ ASSERT_EQ(info.si_signo, SIGSYS);
+ EXPECT_EQ(info.si_code, SYS_SECCOMP);
+ /* EXPECT_EQ(info.si_arch, ...native arch...); */
+ EXPECT_EQ(info.si_syscall, __NR_prctl);
+ /*
+ * The syscall will have happened somewhere near the libc
+ * prctl implementation.
+ */
+ EXPECT_TRUE(info.si_call_addr >= (void *)prctl &&
+ info.si_call_addr <= (void *)prctl + PAGE_SIZE) {
+ TH_LOG("info.si_call_addr: %p", info.si_call_addr);
+ TH_LOG("prctl : %p", prctl);
+ }
+ EXPECT_EQ(info.si_errno, 0xBA);
+
+skip_siginfo:
+ /* Check status contents. */
+ ASSERT_EQ(waitpid(self->child_pid, &status, 0), self->child_pid);
+ ASSERT_TRUE(WIFSIGNALED(status));
+ /* TODO: why doesn't this WCOREDUMP() agree with above? */
+ /* EXPECT_TRUE(WCOREDUMP(status)); */
+ EXPECT_EQ(WTERMSIG(status), SIGSYS);
+ self->child_pid = 0;
+}
+
/* This is a thread task to die via seccomp filter violation. */
void *kill_thread(void *data)
{
--
2.30.2
prev parent reply other threads:[~2022-02-14 21:38 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-14 21:38 [PATCH 0/2] exit: Introduce __WCHILDSIGINFO for waitid Kees Cook
2022-02-14 21:38 ` [PATCH 1/2] " Kees Cook
2022-02-15 9:14 ` Christian Brauner
2022-02-14 21:38 ` Kees Cook [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220214213823.3297816-3-keescook@chromium.org \
--to=keescook@chromium.org \
--cc=brauner@kernel.org \
--cc=ebiederm@xmission.com \
--cc=jannh@google.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=mingo@redhat.com \
--cc=oleg@redhat.com \
--cc=robert@swiecki.net \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).