tools/testing/selftests/seccomp/seccomp_bpf.c

   1 /*
   2  * Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
   3  * Use of this source code is governed by the GPLv2 license.
   4  *
   5  * Test code for seccomp bpf.
   6  */
   7
   8 #include <asm/siginfo.h>
   9 #define __have_siginfo_t 1
  10 #define __have_sigval_t 1
  11 #define __have_sigevent_t 1
  12
  13 #include <errno.h>
  14 #include <linux/filter.h>
  15 #include <sys/prctl.h>
  16 #include <sys/ptrace.h>
  17 #include <sys/types.h>
  18 #include <sys/user.h>
  19 #include <linux/prctl.h>
  20 #include <linux/ptrace.h>
  21 #include <linux/seccomp.h>
  22 #include <pthread.h>
  23 #include <semaphore.h>
  24 #include <signal.h>
  25 #include <stddef.h>
  26 #include <stdbool.h>
  27 #include <string.h>
  28 #include <time.h>
  29 #include <linux/elf.h>
  30 #include <sys/uio.h>
  31 #include <sys/utsname.h>
  32 #include <sys/fcntl.h>
  33 #include <sys/mman.h>
  34 #include <sys/times.h>
  35
  36 #define _GNU_SOURCE
  37 #include <unistd.h>
  38 #include <sys/syscall.h>
  39
  40 #include "test_harness.h"
  41
  42 #ifndef PR_SET_PTRACER
  43 # define PR_SET_PTRACER 0x59616d61
  44 #endif
  45
  46 #ifndef PR_SET_NO_NEW_PRIVS
  47 #define PR_SET_NO_NEW_PRIVS 38
  48 #define PR_GET_NO_NEW_PRIVS 39
  49 #endif
  50
  51 #ifndef PR_SECCOMP_EXT
  52 #define PR_SECCOMP_EXT 43
  53 #endif
  54
  55 #ifndef SECCOMP_EXT_ACT
  56 #define SECCOMP_EXT_ACT 1
  57 #endif
  58
  59 #ifndef SECCOMP_EXT_ACT_TSYNC
  60 #define SECCOMP_EXT_ACT_TSYNC 1
  61 #endif
  62
  63 #ifndef SECCOMP_MODE_STRICT
  64 #define SECCOMP_MODE_STRICT 1
  65 #endif
  66
  67 #ifndef SECCOMP_MODE_FILTER
  68 #define SECCOMP_MODE_FILTER 2
  69 #endif
  70
  71 #ifndef SECCOMP_RET_KILL
  72 #define SECCOMP_RET_KILL        0x00000000U /* kill the task immediately */
  73 #define SECCOMP_RET_TRAP        0x00030000U /* disallow and force a SIGSYS */
  74 #define SECCOMP_RET_ERRNO       0x00050000U /* returns an errno */
  75 #define SECCOMP_RET_TRACE       0x7ff00000U /* pass to a tracer or disallow */
  76 #define SECCOMP_RET_ALLOW       0x7fff0000U /* allow */
  77
  78 /* Masks for the return value sections. */
  79 #define SECCOMP_RET_ACTION      0x7fff0000U
  80 #define SECCOMP_RET_DATA        0x0000ffffU
  81
  82 struct seccomp_data {
  83         int nr;
  84         __u32 arch;
  85         __u64 instruction_pointer;
  86         __u64 args[6];
  87 };
  88 #endif
  89
  90 #if __BYTE_ORDER == __LITTLE_ENDIAN
  91 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
  92 #elif __BYTE_ORDER == __BIG_ENDIAN
  93 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]) + sizeof(__u32))
  94 #else
  95 #error "wut? Unknown __BYTE_ORDER?!"
  96 #endif
  97
  98 #define SIBLING_EXIT_UNKILLED   0xbadbeef
  99 #define SIBLING_EXIT_FAILURE    0xbadface
 100 #define SIBLING_EXIT_NEWPRIVS   0xbadfeed
 101
 102 TEST(mode_strict_support)
 103 {
 104         long ret;
 105
 106         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL);
 107         ASSERT_EQ(0, ret) {
 108                 TH_LOG("Kernel does not support CONFIG_SECCOMP");
 109         }
 110         syscall(__NR_exit, 1);
 111 }
 112
 113 TEST_SIGNAL(mode_strict_cannot_call_prctl, SIGKILL)
 114 {
 115         long ret;
 116
 117         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, NULL, NULL);
 118         ASSERT_EQ(0, ret) {
 119                 TH_LOG("Kernel does not support CONFIG_SECCOMP");
 120         }
 121         syscall(__NR_prctl, PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
 122                 NULL, NULL, NULL);
 123         EXPECT_FALSE(true) {
 124                 TH_LOG("Unreachable!");
 125         }
 126 }
 127
 128 /* Note! This doesn't test no new privs behavior */
 129 TEST(no_new_privs_support)
 130 {
 131         long ret;
 132
 133         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 134         EXPECT_EQ(0, ret) {
 135                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
 136         }
 137 }
 138
 139 /* Tests kernel support by checking for a copy_from_user() fault on * NULL. */
 140 TEST(mode_filter_support)
 141 {
 142         long ret;
 143
 144         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
 145         ASSERT_EQ(0, ret) {
 146                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
 147         }
 148         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, NULL, NULL);
 149         EXPECT_EQ(-1, ret);
 150         EXPECT_EQ(EFAULT, errno) {
 151                 TH_LOG("Kernel does not support CONFIG_SECCOMP_FILTER!");
 152         }
 153 }
 154
 155 TEST(mode_filter_without_nnp)
 156 {
 157         struct sock_filter filter[] = {
 158                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 159         };
 160         struct sock_fprog prog = {
 161                 .len = (unsigned short)ARRAY_SIZE(filter),
 162                 .filter = filter,
 163         };
 164         long ret;
 165
 166         ret = prctl(PR_GET_NO_NEW_PRIVS, 0, NULL, 0, 0);
 167         ASSERT_LE(0, ret) {
 168                 TH_LOG("Expected 0 or unsupported for NO_NEW_PRIVS");
 169         }
 170         errno = 0;
 171         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 172         /* Succeeds with CAP_SYS_ADMIN, fails without */
 173         /* TODO(wad) check caps not euid */
 174         if (geteuid()) {
 175                 EXPECT_EQ(-1, ret);
 176                 EXPECT_EQ(EACCES, errno);
 177         } else {
 178                 EXPECT_EQ(0, ret);
 179         }
 180 }
 181
 182 #define MAX_INSNS_PER_PATH 32768
 183
 184 TEST(filter_size_limits)
 185 {
 186         int i;
 187         int count = BPF_MAXINSNS + 1;
 188         struct sock_filter allow[] = {
 189                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 190         };
 191         struct sock_filter *filter;
 192         struct sock_fprog prog = { };
 193         long ret;
 194
 195         filter = calloc(count, sizeof(*filter));
 196         ASSERT_NE(NULL, filter);
 197
 198         for (i = 0; i < count; i++)
 199                 filter[i] = allow[0];
 200
 201         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 202         ASSERT_EQ(0, ret);
 203
 204         prog.filter = filter;
 205         prog.len = count;
 206
 207         /* Too many filter instructions in a single filter. */
 208         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 209         ASSERT_NE(0, ret) {
 210                 TH_LOG("Installing %d insn filter was allowed", prog.len);
 211         }
 212
 213         /* One less is okay, though. */
 214         prog.len -= 1;
 215         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 216         ASSERT_EQ(0, ret) {
 217                 TH_LOG("Installing %d insn filter wasn't allowed", prog.len);
 218         }
 219 }
 220
 221 TEST(filter_chain_limits)
 222 {
 223         int i;
 224         int count = BPF_MAXINSNS;
 225         struct sock_filter allow[] = {
 226                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 227         };
 228         struct sock_filter *filter;
 229         struct sock_fprog prog = { };
 230         long ret;
 231
 232         filter = calloc(count, sizeof(*filter));
 233         ASSERT_NE(NULL, filter);
 234
 235         for (i = 0; i < count; i++)
 236                 filter[i] = allow[0];
 237
 238         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 239         ASSERT_EQ(0, ret);
 240
 241         prog.filter = filter;
 242         prog.len = 1;
 243
 244         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 245         ASSERT_EQ(0, ret);
 246
 247         prog.len = count;
 248
 249         /* Too many total filter instructions. */
 250         for (i = 0; i < MAX_INSNS_PER_PATH; i++) {
 251                 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 252                 if (ret != 0)
 253                         break;
 254         }
 255         ASSERT_NE(0, ret) {
 256                 TH_LOG("Allowed %d %d-insn filters (total with penalties:%d)",
 257                        i, count, i * (count + 4));
 258         }
 259 }
 260
 261 TEST(mode_filter_cannot_move_to_strict)
 262 {
 263         struct sock_filter filter[] = {
 264                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 265         };
 266         struct sock_fprog prog = {
 267                 .len = (unsigned short)ARRAY_SIZE(filter),
 268                 .filter = filter,
 269         };
 270         long ret;
 271
 272         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 273         ASSERT_EQ(0, ret);
 274
 275         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 276         ASSERT_EQ(0, ret);
 277
 278         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, NULL, 0, 0);
 279         EXPECT_EQ(-1, ret);
 280         EXPECT_EQ(EINVAL, errno);
 281 }
 282
 283
 284 TEST(mode_filter_get_seccomp)
 285 {
 286         struct sock_filter filter[] = {
 287                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 288         };
 289         struct sock_fprog prog = {
 290                 .len = (unsigned short)ARRAY_SIZE(filter),
 291                 .filter = filter,
 292         };
 293         long ret;
 294
 295         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 296         ASSERT_EQ(0, ret);
 297
 298         ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
 299         EXPECT_EQ(0, ret);
 300
 301         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
 302         ASSERT_EQ(0, ret);
 303
 304         ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
 305         EXPECT_EQ(2, ret);
 306 }
 307
 308
 309 TEST(ALLOW_all)
 310 {
 311         struct sock_filter filter[] = {
 312                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 313         };
 314         struct sock_fprog prog = {
 315                 .len = (unsigned short)ARRAY_SIZE(filter),
 316                 .filter = filter,
 317         };
 318         long ret;
 319
 320         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 321         ASSERT_EQ(0, ret);
 322
 323         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 324         ASSERT_EQ(0, ret);
 325 }
 326
 327 TEST(empty_prog)
 328 {
 329         struct sock_filter filter[] = {
 330         };
 331         struct sock_fprog prog = {
 332                 .len = (unsigned short)ARRAY_SIZE(filter),
 333                 .filter = filter,
 334         };
 335         long ret;
 336
 337         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 338         ASSERT_EQ(0, ret);
 339
 340         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 341         EXPECT_EQ(-1, ret);
 342         EXPECT_EQ(EINVAL, errno);
 343 }
 344
 345 TEST_SIGNAL(unknown_ret_is_kill_inside, SIGSYS)
 346 {
 347         struct sock_filter filter[] = {
 348                 BPF_STMT(BPF_RET|BPF_K, 0x10000000U),
 349         };
 350         struct sock_fprog prog = {
 351                 .len = (unsigned short)ARRAY_SIZE(filter),
 352                 .filter = filter,
 353         };
 354         long ret;
 355
 356         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 357         ASSERT_EQ(0, ret);
 358
 359         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 360         ASSERT_EQ(0, ret);
 361         EXPECT_EQ(0, syscall(__NR_getpid)) {
 362                 TH_LOG("getpid() shouldn't ever return");
 363         }
 364 }
 365
 366 /* return code >= 0x80000000 is unused. */
 367 TEST_SIGNAL(unknown_ret_is_kill_above_allow, SIGSYS)
 368 {
 369         struct sock_filter filter[] = {
 370                 BPF_STMT(BPF_RET|BPF_K, 0x90000000U),
 371         };
 372         struct sock_fprog prog = {
 373                 .len = (unsigned short)ARRAY_SIZE(filter),
 374                 .filter = filter,
 375         };
 376         long ret;
 377
 378         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 379         ASSERT_EQ(0, ret);
 380
 381         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 382         ASSERT_EQ(0, ret);
 383         EXPECT_EQ(0, syscall(__NR_getpid)) {
 384                 TH_LOG("getpid() shouldn't ever return");
 385         }
 386 }
 387
 388 TEST_SIGNAL(KILL_all, SIGSYS)
 389 {
 390         struct sock_filter filter[] = {
 391                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 392         };
 393         struct sock_fprog prog = {
 394                 .len = (unsigned short)ARRAY_SIZE(filter),
 395                 .filter = filter,
 396         };
 397         long ret;
 398
 399         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 400         ASSERT_EQ(0, ret);
 401
 402         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 403         ASSERT_EQ(0, ret);
 404 }
 405
 406 TEST_SIGNAL(KILL_one, SIGSYS)
 407 {
 408         struct sock_filter filter[] = {
 409                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 410                         offsetof(struct seccomp_data, nr)),
 411                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
 412                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 413                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 414         };
 415         struct sock_fprog prog = {
 416                 .len = (unsigned short)ARRAY_SIZE(filter),
 417                 .filter = filter,
 418         };
 419         long ret;
 420         pid_t parent = getppid();
 421
 422         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 423         ASSERT_EQ(0, ret);
 424
 425         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 426         ASSERT_EQ(0, ret);
 427
 428         EXPECT_EQ(parent, syscall(__NR_getppid));
 429         /* getpid() should never return. */
 430         EXPECT_EQ(0, syscall(__NR_getpid));
 431 }
 432
 433 TEST_SIGNAL(KILL_one_arg_one, SIGSYS)
 434 {
 435         void *fatal_address;
 436         struct sock_filter filter[] = {
 437                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 438                         offsetof(struct seccomp_data, nr)),
 439                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_times, 1, 0),
 440                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 441                 /* Only both with lower 32-bit for now. */
 442                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(0)),
 443                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K,
 444                         (unsigned long)&fatal_address, 0, 1),
 445                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 446                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 447         };
 448         struct sock_fprog prog = {
 449                 .len = (unsigned short)ARRAY_SIZE(filter),
 450                 .filter = filter,
 451         };
 452         long ret;
 453         pid_t parent = getppid();
 454         struct tms timebuf;
 455         clock_t clock = times(&timebuf);
 456
 457         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 458         ASSERT_EQ(0, ret);
 459
 460         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 461         ASSERT_EQ(0, ret);
 462
 463         EXPECT_EQ(parent, syscall(__NR_getppid));
 464         EXPECT_LE(clock, syscall(__NR_times, &timebuf));
 465         /* times() should never return. */
 466         EXPECT_EQ(0, syscall(__NR_times, &fatal_address));
 467 }
 468
 469 TEST_SIGNAL(KILL_one_arg_six, SIGSYS)
 470 {
 471 #ifndef __NR_mmap2
 472         int sysno = __NR_mmap;
 473 #else
 474         int sysno = __NR_mmap2;
 475 #endif
 476         struct sock_filter filter[] = {
 477                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 478                         offsetof(struct seccomp_data, nr)),
 479                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, sysno, 1, 0),
 480                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 481                 /* Only both with lower 32-bit for now. */
 482                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(5)),
 483                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 0x0C0FFEE, 0, 1),
 484                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 485                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 486         };
 487         struct sock_fprog prog = {
 488                 .len = (unsigned short)ARRAY_SIZE(filter),
 489                 .filter = filter,
 490         };
 491         long ret;
 492         pid_t parent = getppid();
 493         int fd;
 494         void *map1, *map2;
 495
 496         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 497         ASSERT_EQ(0, ret);
 498
 499         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 500         ASSERT_EQ(0, ret);
 501
 502         fd = open("/dev/zero", O_RDONLY);
 503         ASSERT_NE(-1, fd);
 504
 505         EXPECT_EQ(parent, syscall(__NR_getppid));
 506         map1 = (void *)syscall(sysno,
 507                 NULL, PAGE_SIZE, PROT_READ, MAP_PRIVATE, fd, PAGE_SIZE);
 508         EXPECT_NE(MAP_FAILED, map1);
 509         /* mmap2() should never return. */
 510         map2 = (void *)syscall(sysno,
 511                  NULL, PAGE_SIZE, PROT_READ, MAP_PRIVATE, fd, 0x0C0FFEE);
 512         EXPECT_EQ(MAP_FAILED, map2);
 513
 514         /* The test failed, so clean up the resources. */
 515         munmap(map1, PAGE_SIZE);
 516         munmap(map2, PAGE_SIZE);
 517         close(fd);
 518 }
 519
 520 /* TODO(wad) add 64-bit versus 32-bit arg tests. */
 521 TEST(arg_out_of_range)
 522 {
 523         struct sock_filter filter[] = {
 524                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg(6)),
 525                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 526         };
 527         struct sock_fprog prog = {
 528                 .len = (unsigned short)ARRAY_SIZE(filter),
 529                 .filter = filter,
 530         };
 531         long ret;
 532
 533         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 534         ASSERT_EQ(0, ret);
 535
 536         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 537         EXPECT_EQ(-1, ret);
 538         EXPECT_EQ(EINVAL, errno);
 539 }
 540
 541 TEST(ERRNO_valid)
 542 {
 543         struct sock_filter filter[] = {
 544                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 545                         offsetof(struct seccomp_data, nr)),
 546                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
 547                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | E2BIG),
 548                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 549         };
 550         struct sock_fprog prog = {
 551                 .len = (unsigned short)ARRAY_SIZE(filter),
 552                 .filter = filter,
 553         };
 554         long ret;
 555         pid_t parent = getppid();
 556
 557         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 558         ASSERT_EQ(0, ret);
 559
 560         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 561         ASSERT_EQ(0, ret);
 562
 563         EXPECT_EQ(parent, syscall(__NR_getppid));
 564         EXPECT_EQ(-1, read(0, NULL, 0));
 565         EXPECT_EQ(E2BIG, errno);
 566 }
 567
 568 TEST(ERRNO_zero)
 569 {
 570         struct sock_filter filter[] = {
 571                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 572                         offsetof(struct seccomp_data, nr)),
 573                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
 574                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | 0),
 575                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 576         };
 577         struct sock_fprog prog = {
 578                 .len = (unsigned short)ARRAY_SIZE(filter),
 579                 .filter = filter,
 580         };
 581         long ret;
 582         pid_t parent = getppid();
 583
 584         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 585         ASSERT_EQ(0, ret);
 586
 587         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 588         ASSERT_EQ(0, ret);
 589
 590         EXPECT_EQ(parent, syscall(__NR_getppid));
 591         /* "errno" of 0 is ok. */
 592         EXPECT_EQ(0, read(0, NULL, 0));
 593 }
 594
 595 TEST(ERRNO_capped)
 596 {
 597         struct sock_filter filter[] = {
 598                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 599                         offsetof(struct seccomp_data, nr)),
 600                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
 601                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | 4096),
 602                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 603         };
 604         struct sock_fprog prog = {
 605                 .len = (unsigned short)ARRAY_SIZE(filter),
 606                 .filter = filter,
 607         };
 608         long ret;
 609         pid_t parent = getppid();
 610
 611         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 612         ASSERT_EQ(0, ret);
 613
 614         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
 615         ASSERT_EQ(0, ret);
 616
 617         EXPECT_EQ(parent, syscall(__NR_getppid));
 618         EXPECT_EQ(-1, read(0, NULL, 0));
 619         EXPECT_EQ(4095, errno);
 620 }
 621
 622 FIXTURE_DATA(TRAP) {
 623         struct sock_fprog prog;
 624 };
 625
 626 FIXTURE_SETUP(TRAP)
 627 {
 628         struct sock_filter filter[] = {
 629                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 630                         offsetof(struct seccomp_data, nr)),
 631                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
 632                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
 633                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 634         };
 635
 636         memset(&self->prog, 0, sizeof(self->prog));
 637         self->prog.filter = malloc(sizeof(filter));
 638         ASSERT_NE(NULL, self->prog.filter);
 639         memcpy(self->prog.filter, filter, sizeof(filter));
 640         self->prog.len = (unsigned short)ARRAY_SIZE(filter);
 641 }
 642
 643 FIXTURE_TEARDOWN(TRAP)
 644 {
 645         if (self->prog.filter)
 646                 free(self->prog.filter);
 647 }
 648
 649 TEST_F_SIGNAL(TRAP, dfl, SIGSYS)
 650 {
 651         long ret;
 652
 653         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 654         ASSERT_EQ(0, ret);
 655
 656         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
 657         ASSERT_EQ(0, ret);
 658         syscall(__NR_getpid);
 659 }
 660
 661 /* Ensure that SIGSYS overrides SIG_IGN */
 662 TEST_F_SIGNAL(TRAP, ign, SIGSYS)
 663 {
 664         long ret;
 665
 666         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 667         ASSERT_EQ(0, ret);
 668
 669         signal(SIGSYS, SIG_IGN);
 670
 671         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
 672         ASSERT_EQ(0, ret);
 673         syscall(__NR_getpid);
 674 }
 675
 676 static struct siginfo TRAP_info;
 677 static volatile int TRAP_nr;
 678 static void TRAP_action(int nr, siginfo_t *info, void *void_context)
 679 {
 680         memcpy(&TRAP_info, info, sizeof(TRAP_info));
 681         TRAP_nr = nr;
 682 }
 683
 684 TEST_F(TRAP, handler)
 685 {
 686         int ret, test;
 687         struct sigaction act;
 688         sigset_t mask;
 689
 690         memset(&act, 0, sizeof(act));
 691         sigemptyset(&mask);
 692         sigaddset(&mask, SIGSYS);
 693
 694         act.sa_sigaction = &TRAP_action;
 695         act.sa_flags = SA_SIGINFO;
 696         ret = sigaction(SIGSYS, &act, NULL);
 697         ASSERT_EQ(0, ret) {
 698                 TH_LOG("sigaction failed");
 699         }
 700         ret = sigprocmask(SIG_UNBLOCK, &mask, NULL);
 701         ASSERT_EQ(0, ret) {
 702                 TH_LOG("sigprocmask failed");
 703         }
 704
 705         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 706         ASSERT_EQ(0, ret);
 707         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog);
 708         ASSERT_EQ(0, ret);
 709         TRAP_nr = 0;
 710         memset(&TRAP_info, 0, sizeof(TRAP_info));
 711         /* Expect the registers to be rolled back. (nr = error) may vary
 712          * based on arch. */
 713         ret = syscall(__NR_getpid);
 714         /* Silence gcc warning about volatile. */
 715         test = TRAP_nr;
 716         EXPECT_EQ(SIGSYS, test);
 717         struct local_sigsys {
 718                 void *_call_addr;       /* calling user insn */
 719                 int _syscall;           /* triggering system call number */
 720                 unsigned int _arch;     /* AUDIT_ARCH_* of syscall */
 721         } *sigsys = (struct local_sigsys *)
 722 #ifdef si_syscall
 723                 &(TRAP_info.si_call_addr);
 724 #else
 725                 &TRAP_info.si_pid;
 726 #endif
 727         EXPECT_EQ(__NR_getpid, sigsys->_syscall);
 728         /* Make sure arch is non-zero. */
 729         EXPECT_NE(0, sigsys->_arch);
 730         EXPECT_NE(0, (unsigned long)sigsys->_call_addr);
 731 }
 732
 733 FIXTURE_DATA(precedence) {
 734         struct sock_fprog allow;
 735         struct sock_fprog trace;
 736         struct sock_fprog error;
 737         struct sock_fprog trap;
 738         struct sock_fprog kill;
 739 };
 740
 741 FIXTURE_SETUP(precedence)
 742 {
 743         struct sock_filter allow_insns[] = {
 744                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 745         };
 746         struct sock_filter trace_insns[] = {
 747                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 748                         offsetof(struct seccomp_data, nr)),
 749                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
 750                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 751                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE),
 752         };
 753         struct sock_filter error_insns[] = {
 754                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 755                         offsetof(struct seccomp_data, nr)),
 756                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
 757                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 758                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO),
 759         };
 760         struct sock_filter trap_insns[] = {
 761                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 762                         offsetof(struct seccomp_data, nr)),
 763                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
 764                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 765                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP),
 766         };
 767         struct sock_filter kill_insns[] = {
 768                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
 769                         offsetof(struct seccomp_data, nr)),
 770                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
 771                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
 772                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
 773         };
 774
 775         memset(self, 0, sizeof(*self));
 776 #define FILTER_ALLOC(_x) \
 777         self->_x.filter = malloc(sizeof(_x##_insns)); \
 778         ASSERT_NE(NULL, self->_x.filter); \
 779         memcpy(self->_x.filter, &_x##_insns, sizeof(_x##_insns)); \
 780         self->_x.len = (unsigned short)ARRAY_SIZE(_x##_insns)
 781         FILTER_ALLOC(allow);
 782         FILTER_ALLOC(trace);
 783         FILTER_ALLOC(error);
 784         FILTER_ALLOC(trap);
 785         FILTER_ALLOC(kill);
 786 }
 787
 788 FIXTURE_TEARDOWN(precedence)
 789 {
 790 #define FILTER_FREE(_x) if (self->_x.filter) free(self->_x.filter)
 791         FILTER_FREE(allow);
 792         FILTER_FREE(trace);
 793         FILTER_FREE(error);
 794         FILTER_FREE(trap);
 795         FILTER_FREE(kill);
 796 }
 797
 798 TEST_F(precedence, allow_ok)
 799 {
 800         pid_t parent, res = 0;
 801         long ret;
 802
 803         parent = getppid();
 804         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 805         ASSERT_EQ(0, ret);
 806
 807         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 808         ASSERT_EQ(0, ret);
 809         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 810         ASSERT_EQ(0, ret);
 811         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
 812         ASSERT_EQ(0, ret);
 813         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
 814         ASSERT_EQ(0, ret);
 815         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
 816         ASSERT_EQ(0, ret);
 817         /* Should work just fine. */
 818         res = syscall(__NR_getppid);
 819         EXPECT_EQ(parent, res);
 820 }
 821
 822 TEST_F_SIGNAL(precedence, kill_is_highest, SIGSYS)
 823 {
 824         pid_t parent, res = 0;
 825         long ret;
 826
 827         parent = getppid();
 828         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 829         ASSERT_EQ(0, ret);
 830
 831         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 832         ASSERT_EQ(0, ret);
 833         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 834         ASSERT_EQ(0, ret);
 835         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
 836         ASSERT_EQ(0, ret);
 837         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
 838         ASSERT_EQ(0, ret);
 839         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
 840         ASSERT_EQ(0, ret);
 841         /* Should work just fine. */
 842         res = syscall(__NR_getppid);
 843         EXPECT_EQ(parent, res);
 844         /* getpid() should never return. */
 845         res = syscall(__NR_getpid);
 846         EXPECT_EQ(0, res);
 847 }
 848
 849 TEST_F_SIGNAL(precedence, kill_is_highest_in_any_order, SIGSYS)
 850 {
 851         pid_t parent;
 852         long ret;
 853
 854         parent = getppid();
 855         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 856         ASSERT_EQ(0, ret);
 857
 858         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 859         ASSERT_EQ(0, ret);
 860         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->kill);
 861         ASSERT_EQ(0, ret);
 862         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
 863         ASSERT_EQ(0, ret);
 864         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 865         ASSERT_EQ(0, ret);
 866         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
 867         ASSERT_EQ(0, ret);
 868         /* Should work just fine. */
 869         EXPECT_EQ(parent, syscall(__NR_getppid));
 870         /* getpid() should never return. */
 871         EXPECT_EQ(0, syscall(__NR_getpid));
 872 }
 873
 874 TEST_F_SIGNAL(precedence, trap_is_second, SIGSYS)
 875 {
 876         pid_t parent;
 877         long ret;
 878
 879         parent = getppid();
 880         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 881         ASSERT_EQ(0, ret);
 882
 883         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 884         ASSERT_EQ(0, ret);
 885         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 886         ASSERT_EQ(0, ret);
 887         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
 888         ASSERT_EQ(0, ret);
 889         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
 890         ASSERT_EQ(0, ret);
 891         /* Should work just fine. */
 892         EXPECT_EQ(parent, syscall(__NR_getppid));
 893         /* getpid() should never return. */
 894         EXPECT_EQ(0, syscall(__NR_getpid));
 895 }
 896
 897 TEST_F_SIGNAL(precedence, trap_is_second_in_any_order, SIGSYS)
 898 {
 899         pid_t parent;
 900         long ret;
 901
 902         parent = getppid();
 903         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 904         ASSERT_EQ(0, ret);
 905
 906         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 907         ASSERT_EQ(0, ret);
 908         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
 909         ASSERT_EQ(0, ret);
 910         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 911         ASSERT_EQ(0, ret);
 912         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
 913         ASSERT_EQ(0, ret);
 914         /* Should work just fine. */
 915         EXPECT_EQ(parent, syscall(__NR_getppid));
 916         /* getpid() should never return. */
 917         EXPECT_EQ(0, syscall(__NR_getpid));
 918 }
 919
 920 TEST_F(precedence, errno_is_third)
 921 {
 922         pid_t parent;
 923         long ret;
 924
 925         parent = getppid();
 926         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 927         ASSERT_EQ(0, ret);
 928
 929         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 930         ASSERT_EQ(0, ret);
 931         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 932         ASSERT_EQ(0, ret);
 933         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
 934         ASSERT_EQ(0, ret);
 935         /* Should work just fine. */
 936         EXPECT_EQ(parent, syscall(__NR_getppid));
 937         EXPECT_EQ(0, syscall(__NR_getpid));
 938 }
 939
 940 TEST_F(precedence, errno_is_third_in_any_order)
 941 {
 942         pid_t parent;
 943         long ret;
 944
 945         parent = getppid();
 946         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 947         ASSERT_EQ(0, ret);
 948
 949         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
 950         ASSERT_EQ(0, ret);
 951         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 952         ASSERT_EQ(0, ret);
 953         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 954         ASSERT_EQ(0, ret);
 955         /* Should work just fine. */
 956         EXPECT_EQ(parent, syscall(__NR_getppid));
 957         EXPECT_EQ(0, syscall(__NR_getpid));
 958 }
 959
 960 TEST_F(precedence, trace_is_fourth)
 961 {
 962         pid_t parent;
 963         long ret;
 964
 965         parent = getppid();
 966         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 967         ASSERT_EQ(0, ret);
 968
 969         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 970         ASSERT_EQ(0, ret);
 971         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 972         ASSERT_EQ(0, ret);
 973         /* Should work just fine. */
 974         EXPECT_EQ(parent, syscall(__NR_getppid));
 975         /* No ptracer */
 976         EXPECT_EQ(-1, syscall(__NR_getpid));
 977 }
 978
 979 TEST_F(precedence, trace_is_fourth_in_any_order)
 980 {
 981         pid_t parent;
 982         long ret;
 983
 984         parent = getppid();
 985         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 986         ASSERT_EQ(0, ret);
 987
 988         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
 989         ASSERT_EQ(0, ret);
 990         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
 991         ASSERT_EQ(0, ret);
 992         /* Should work just fine. */
 993         EXPECT_EQ(parent, syscall(__NR_getppid));
 994         /* No ptracer */
 995         EXPECT_EQ(-1, syscall(__NR_getpid));
 996 }
 997
 998 #ifndef PTRACE_O_TRACESECCOMP
 999 #define PTRACE_O_TRACESECCOMP   0x00000080
1000 #endif
1001
1002 /* Catch the Ubuntu 12.04 value error. */
1003 #if PTRACE_EVENT_SECCOMP != 7
1004 #undef PTRACE_EVENT_SECCOMP
1005 #endif
1006
1007 #ifndef PTRACE_EVENT_SECCOMP
1008 #define PTRACE_EVENT_SECCOMP 7
1009 #endif
1010
1011 #define IS_SECCOMP_EVENT(status) ((status >> 16) == PTRACE_EVENT_SECCOMP)
1012 bool tracer_running;
1013 void tracer_stop(int sig)
1014 {
1015         tracer_running = false;
1016 }
1017
1018 typedef void tracer_func_t(struct __test_metadata *_metadata,
1019                            pid_t tracee, int status, void *args);
1020
1021 void tracer(struct __test_metadata *_metadata, int fd, pid_t tracee,
1022             tracer_func_t tracer_func, void *args)
1023 {
1024         int ret = -1;
1025         struct sigaction action = {
1026                 .sa_handler = tracer_stop,
1027         };
1028
1029         /* Allow external shutdown. */
1030         tracer_running = true;
1031         ASSERT_EQ(0, sigaction(SIGUSR1, &action, NULL));
1032
1033         errno = 0;
1034         while (ret == -1 && errno != EINVAL)
1035                 ret = ptrace(PTRACE_ATTACH, tracee, NULL, 0);
1036         ASSERT_EQ(0, ret) {
1037                 kill(tracee, SIGKILL);
1038         }
1039         /* Wait for attach stop */
1040         wait(NULL);
1041
1042         ret = ptrace(PTRACE_SETOPTIONS, tracee, NULL, PTRACE_O_TRACESECCOMP);
1043         ASSERT_EQ(0, ret) {
1044                 TH_LOG("Failed to set PTRACE_O_TRACESECCOMP");
1045                 kill(tracee, SIGKILL);
1046         }
1047         ptrace(PTRACE_CONT, tracee, NULL, 0);
1048
1049         /* Unblock the tracee */
1050         ASSERT_EQ(1, write(fd, "A", 1));
1051         ASSERT_EQ(0, close(fd));
1052
1053         /* Run until we're shut down. Must assert to stop execution. */
1054         while (tracer_running) {
1055                 int status;
1056
1057                 if (wait(&status) != tracee)
1058                         continue;
1059                 if (WIFSIGNALED(status) || WIFEXITED(status))
1060                         /* Child is dead. Time to go. */
1061                         return;
1062
1063                 /* Make sure this is a seccomp event. */
1064                 ASSERT_EQ(true, IS_SECCOMP_EVENT(status));
1065
1066                 tracer_func(_metadata, tracee, status, args);
1067
1068                 ret = ptrace(PTRACE_CONT, tracee, NULL, NULL);
1069                 ASSERT_EQ(0, ret);
1070         }
1071         /* Directly report the status of our test harness results. */
1072         syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS : EXIT_FAILURE);
1073 }
1074
1075 /* Common tracer setup/teardown functions. */
1076 void cont_handler(int num)
1077 { }
1078 pid_t setup_trace_fixture(struct __test_metadata *_metadata,
1079                           tracer_func_t func, void *args)
1080 {
1081         char sync;
1082         int pipefd[2];
1083         pid_t tracer_pid;
1084         pid_t tracee = getpid();
1085
1086         /* Setup a pipe for clean synchronization. */
1087         ASSERT_EQ(0, pipe(pipefd));
1088
1089         /* Fork a child which we'll promote to tracer */
1090         tracer_pid = fork();
1091         ASSERT_LE(0, tracer_pid);
1092         signal(SIGALRM, cont_handler);
1093         if (tracer_pid == 0) {
1094                 close(pipefd[0]);
1095                 tracer(_metadata, pipefd[1], tracee, func, args);
1096                 syscall(__NR_exit, 0);
1097         }
1098         close(pipefd[1]);
1099         prctl(PR_SET_PTRACER, tracer_pid, 0, 0, 0);
1100         read(pipefd[0], &sync, 1);
1101         close(pipefd[0]);
1102
1103         return tracer_pid;
1104 }
1105 void teardown_trace_fixture(struct __test_metadata *_metadata,
1106                             pid_t tracer)
1107 {
1108         if (tracer) {
1109                 int status;
1110                 /*
1111                  * Extract the exit code from the other process and
1112                  * adopt it for ourselves in case its asserts failed.
1113                  */
1114                 ASSERT_EQ(0, kill(tracer, SIGUSR1));
1115                 ASSERT_EQ(tracer, waitpid(tracer, &status, 0));
1116                 if (WEXITSTATUS(status))
1117                         _metadata->passed = 0;
1118         }
1119 }
1120
1121 /* "poke" tracer arguments and function. */
1122 struct tracer_args_poke_t {
1123         unsigned long poke_addr;
1124 };
1125
1126 void tracer_poke(struct __test_metadata *_metadata, pid_t tracee, int status,
1127                  void *args)
1128 {
1129         int ret;
1130         unsigned long msg;
1131         struct tracer_args_poke_t *info = (struct tracer_args_poke_t *)args;
1132
1133         ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
1134         EXPECT_EQ(0, ret);
1135         /* If this fails, don't try to recover. */
1136         ASSERT_EQ(0x1001, msg) {
1137                 kill(tracee, SIGKILL);
1138         }
1139         /*
1140          * Poke in the message.
1141          * Registers are not touched to try to keep this relatively arch
1142          * agnostic.
1143          */
1144         ret = ptrace(PTRACE_POKEDATA, tracee, info->poke_addr, 0x1001);
1145         EXPECT_EQ(0, ret);
1146 }
1147
1148 FIXTURE_DATA(TRACE_poke) {
1149         struct sock_fprog prog;
1150         pid_t tracer;
1151         long poked;
1152         struct tracer_args_poke_t tracer_args;
1153 };
1154
1155 FIXTURE_SETUP(TRACE_poke)
1156 {
1157         struct sock_filter filter[] = {
1158                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1159                         offsetof(struct seccomp_data, nr)),
1160                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
1161                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1001),
1162                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1163         };
1164
1165         self->poked = 0;
1166         memset(&self->prog, 0, sizeof(self->prog));
1167         self->prog.filter = malloc(sizeof(filter));
1168         ASSERT_NE(NULL, self->prog.filter);
1169         memcpy(self->prog.filter, filter, sizeof(filter));
1170         self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1171
1172         /* Set up tracer args. */
1173         self->tracer_args.poke_addr = (unsigned long)&self->poked;
1174
1175         /* Launch tracer. */
1176         self->tracer = setup_trace_fixture(_metadata, tracer_poke,
1177                                            &self->tracer_args);
1178 }
1179
1180 FIXTURE_TEARDOWN(TRACE_poke)
1181 {
1182         teardown_trace_fixture(_metadata, self->tracer);
1183         if (self->prog.filter)
1184                 free(self->prog.filter);
1185 }
1186
1187 TEST_F(TRACE_poke, read_has_side_effects)
1188 {
1189         ssize_t ret;
1190
1191         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1192         ASSERT_EQ(0, ret);
1193
1194         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1195         ASSERT_EQ(0, ret);
1196
1197         EXPECT_EQ(0, self->poked);
1198         ret = read(-1, NULL, 0);
1199         EXPECT_EQ(-1, ret);
1200         EXPECT_EQ(0x1001, self->poked);
1201 }
1202
1203 TEST_F(TRACE_poke, getpid_runs_normally)
1204 {
1205         long ret;
1206
1207         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1208         ASSERT_EQ(0, ret);
1209
1210         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1211         ASSERT_EQ(0, ret);
1212
1213         EXPECT_EQ(0, self->poked);
1214         EXPECT_NE(0, syscall(__NR_getpid));
1215         EXPECT_EQ(0, self->poked);
1216 }
1217
1218 #if defined(__x86_64__)
1219 # define ARCH_REGS      struct user_regs_struct
1220 # define SYSCALL_NUM    orig_rax
1221 # define SYSCALL_RET    rax
1222 #elif defined(__i386__)
1223 # define ARCH_REGS      struct user_regs_struct
1224 # define SYSCALL_NUM    orig_eax
1225 # define SYSCALL_RET    eax
1226 #elif defined(__arm__)
1227 # define ARCH_REGS      struct pt_regs
1228 # define SYSCALL_NUM    ARM_r7
1229 # define SYSCALL_RET    ARM_r0
1230 #elif defined(__aarch64__)
1231 # define ARCH_REGS      struct user_pt_regs
1232 # define SYSCALL_NUM    regs[8]
1233 # define SYSCALL_RET    regs[0]
1234 #elif defined(__powerpc__)
1235 # define ARCH_REGS      struct pt_regs
1236 # define SYSCALL_NUM    gpr[0]
1237 # define SYSCALL_RET    gpr[3]
1238 #elif defined(__s390__)
1239 # define ARCH_REGS     s390_regs
1240 # define SYSCALL_NUM   gprs[2]
1241 # define SYSCALL_RET   gprs[2]
1242 #else
1243 # error "Do not know how to find your architecture's registers and syscalls"
1244 #endif
1245
1246 /* Architecture-specific syscall fetching routine. */
1247 int get_syscall(struct __test_metadata *_metadata, pid_t tracee)
1248 {
1249         struct iovec iov;
1250         ARCH_REGS regs;
1251
1252         iov.iov_base = &regs;
1253         iov.iov_len = sizeof(regs);
1254         EXPECT_EQ(0, ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &iov)) {
1255                 TH_LOG("PTRACE_GETREGSET failed");
1256                 return -1;
1257         }
1258
1259         return regs.SYSCALL_NUM;
1260 }
1261
1262 /* Architecture-specific syscall changing routine. */
1263 void change_syscall(struct __test_metadata *_metadata,
1264                     pid_t tracee, int syscall)
1265 {
1266         struct iovec iov;
1267         int ret;
1268         ARCH_REGS regs;
1269
1270         iov.iov_base = &regs;
1271         iov.iov_len = sizeof(regs);
1272         ret = ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &iov);
1273         EXPECT_EQ(0, ret);
1274
1275 #if defined(__x86_64__) || defined(__i386__) || defined(__powerpc__) || \
1276     defined(__s390__)
1277         {
1278                 regs.SYSCALL_NUM = syscall;
1279         }
1280
1281 #elif defined(__arm__)
1282 # ifndef PTRACE_SET_SYSCALL
1283 #  define PTRACE_SET_SYSCALL   23
1284 # endif
1285         {
1286                 ret = ptrace(PTRACE_SET_SYSCALL, tracee, NULL, syscall);
1287                 EXPECT_EQ(0, ret);
1288         }
1289
1290 #elif defined(__aarch64__)
1291 # ifndef NT_ARM_SYSTEM_CALL
1292 #  define NT_ARM_SYSTEM_CALL 0x404
1293 # endif
1294         {
1295                 iov.iov_base = &syscall;
1296                 iov.iov_len = sizeof(syscall);
1297                 ret = ptrace(PTRACE_SETREGSET, tracee, NT_ARM_SYSTEM_CALL,
1298                              &iov);
1299                 EXPECT_EQ(0, ret);
1300         }
1301
1302 #else
1303         ASSERT_EQ(1, 0) {
1304                 TH_LOG("How is the syscall changed on this architecture?");
1305         }
1306 #endif
1307
1308         /* If syscall is skipped, change return value. */
1309         if (syscall == -1)
1310                 regs.SYSCALL_RET = 1;
1311
1312         iov.iov_base = &regs;
1313         iov.iov_len = sizeof(regs);
1314         ret = ptrace(PTRACE_SETREGSET, tracee, NT_PRSTATUS, &iov);
1315         EXPECT_EQ(0, ret);
1316 }
1317
1318 void tracer_syscall(struct __test_metadata *_metadata, pid_t tracee,
1319                     int status, void *args)
1320 {
1321         int ret;
1322         unsigned long msg;
1323
1324         /* Make sure we got the right message. */
1325         ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
1326         EXPECT_EQ(0, ret);
1327
1328         /* Validate and take action on expected syscalls. */
1329         switch (msg) {
1330         case 0x1002:
1331                 /* change getpid to getppid. */
1332                 EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee));
1333                 change_syscall(_metadata, tracee, __NR_getppid);
1334                 break;
1335         case 0x1003:
1336                 /* skip gettid. */
1337                 EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee));
1338                 change_syscall(_metadata, tracee, -1);
1339                 break;
1340         case 0x1004:
1341                 /* do nothing (allow getppid) */
1342                 EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee));
1343                 break;
1344         default:
1345                 EXPECT_EQ(0, msg) {
1346                         TH_LOG("Unknown PTRACE_GETEVENTMSG: 0x%lx", msg);
1347                         kill(tracee, SIGKILL);
1348                 }
1349         }
1350
1351 }
1352
1353 FIXTURE_DATA(TRACE_syscall) {
1354         struct sock_fprog prog;
1355         pid_t tracer, mytid, mypid, parent;
1356 };
1357
1358 FIXTURE_SETUP(TRACE_syscall)
1359 {
1360         struct sock_filter filter[] = {
1361                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1362                         offsetof(struct seccomp_data, nr)),
1363                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
1364                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002),
1365                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1),
1366                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003),
1367                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
1368                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004),
1369                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1370         };
1371
1372         memset(&self->prog, 0, sizeof(self->prog));
1373         self->prog.filter = malloc(sizeof(filter));
1374         ASSERT_NE(NULL, self->prog.filter);
1375         memcpy(self->prog.filter, filter, sizeof(filter));
1376         self->prog.len = (unsigned short)ARRAY_SIZE(filter);
1377
1378         /* Prepare some testable syscall results. */
1379         self->mytid = syscall(__NR_gettid);
1380         ASSERT_GT(self->mytid, 0);
1381         ASSERT_NE(self->mytid, 1) {
1382                 TH_LOG("Running this test as init is not supported. :)");
1383         }
1384
1385         self->mypid = getpid();
1386         ASSERT_GT(self->mypid, 0);
1387         ASSERT_EQ(self->mytid, self->mypid);
1388
1389         self->parent = getppid();
1390         ASSERT_GT(self->parent, 0);
1391         ASSERT_NE(self->parent, self->mypid);
1392
1393         /* Launch tracer. */
1394         self->tracer = setup_trace_fixture(_metadata, tracer_syscall, NULL);
1395 }
1396
1397 FIXTURE_TEARDOWN(TRACE_syscall)
1398 {
1399         teardown_trace_fixture(_metadata, self->tracer);
1400         if (self->prog.filter)
1401                 free(self->prog.filter);
1402 }
1403
1404 TEST_F(TRACE_syscall, syscall_allowed)
1405 {
1406         long ret;
1407
1408         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1409         ASSERT_EQ(0, ret);
1410
1411         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1412         ASSERT_EQ(0, ret);
1413
1414         /* getppid works as expected (no changes). */
1415         EXPECT_EQ(self->parent, syscall(__NR_getppid));
1416         EXPECT_NE(self->mypid, syscall(__NR_getppid));
1417 }
1418
1419 TEST_F(TRACE_syscall, syscall_redirected)
1420 {
1421         long ret;
1422
1423         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1424         ASSERT_EQ(0, ret);
1425
1426         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1427         ASSERT_EQ(0, ret);
1428
1429         /* getpid has been redirected to getppid as expected. */
1430         EXPECT_EQ(self->parent, syscall(__NR_getpid));
1431         EXPECT_NE(self->mypid, syscall(__NR_getpid));
1432 }
1433
1434 TEST_F(TRACE_syscall, syscall_dropped)
1435 {
1436         long ret;
1437
1438         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1439         ASSERT_EQ(0, ret);
1440
1441         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
1442         ASSERT_EQ(0, ret);
1443
1444         /* gettid has been skipped and an altered return value stored. */
1445         EXPECT_EQ(1, syscall(__NR_gettid));
1446         EXPECT_NE(self->mytid, syscall(__NR_gettid));
1447 }
1448
1449 #ifndef __NR_seccomp
1450 # if defined(__i386__)
1451 #  define __NR_seccomp 354
1452 # elif defined(__x86_64__)
1453 #  define __NR_seccomp 317
1454 # elif defined(__arm__)
1455 #  define __NR_seccomp 383
1456 # elif defined(__aarch64__)
1457 #  define __NR_seccomp 277
1458 # elif defined(__powerpc__)
1459 #  define __NR_seccomp 358
1460 # elif defined(__s390__)
1461 #  define __NR_seccomp 348
1462 # else
1463 #  warning "seccomp syscall number unknown for this architecture"
1464 #  define __NR_seccomp 0xffff
1465 # endif
1466 #endif
1467
1468 #ifndef SECCOMP_SET_MODE_STRICT
1469 #define SECCOMP_SET_MODE_STRICT 0
1470 #endif
1471
1472 #ifndef SECCOMP_SET_MODE_FILTER
1473 #define SECCOMP_SET_MODE_FILTER 1
1474 #endif
1475
1476 #ifndef SECCOMP_FLAG_FILTER_TSYNC
1477 #define SECCOMP_FLAG_FILTER_TSYNC 1
1478 #endif
1479
1480 #ifndef seccomp
1481 int seccomp(unsigned int op, unsigned int flags, struct sock_fprog *filter)
1482 {
1483         errno = 0;
1484         return syscall(__NR_seccomp, op, flags, filter);
1485 }
1486 #endif
1487
1488 TEST(seccomp_syscall)
1489 {
1490         struct sock_filter filter[] = {
1491                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1492         };
1493         struct sock_fprog prog = {
1494                 .len = (unsigned short)ARRAY_SIZE(filter),
1495                 .filter = filter,
1496         };
1497         long ret;
1498
1499         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
1500         ASSERT_EQ(0, ret) {
1501                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
1502         }
1503
1504         /* Reject insane operation. */
1505         ret = seccomp(-1, 0, &prog);
1506         ASSERT_NE(ENOSYS, errno) {
1507                 TH_LOG("Kernel does not support seccomp syscall!");
1508         }
1509         EXPECT_EQ(EINVAL, errno) {
1510                 TH_LOG("Did not reject crazy op value!");
1511         }
1512
1513         /* Reject strict with flags or pointer. */
1514         ret = seccomp(SECCOMP_SET_MODE_STRICT, -1, NULL);
1515         EXPECT_EQ(EINVAL, errno) {
1516                 TH_LOG("Did not reject mode strict with flags!");
1517         }
1518         ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, &prog);
1519         EXPECT_EQ(EINVAL, errno) {
1520                 TH_LOG("Did not reject mode strict with uargs!");
1521         }
1522
1523         /* Reject insane args for filter. */
1524         ret = seccomp(SECCOMP_SET_MODE_FILTER, -1, &prog);
1525         EXPECT_EQ(EINVAL, errno) {
1526                 TH_LOG("Did not reject crazy filter flags!");
1527         }
1528         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, NULL);
1529         EXPECT_EQ(EFAULT, errno) {
1530                 TH_LOG("Did not reject NULL filter!");
1531         }
1532
1533         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
1534         EXPECT_EQ(0, errno) {
1535                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER: %s",
1536                         strerror(errno));
1537         }
1538 }
1539
1540 TEST(seccomp_syscall_mode_lock)
1541 {
1542         struct sock_filter filter[] = {
1543                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1544         };
1545         struct sock_fprog prog = {
1546                 .len = (unsigned short)ARRAY_SIZE(filter),
1547                 .filter = filter,
1548         };
1549         long ret;
1550
1551         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
1552         ASSERT_EQ(0, ret) {
1553                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
1554         }
1555
1556         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
1557         ASSERT_NE(ENOSYS, errno) {
1558                 TH_LOG("Kernel does not support seccomp syscall!");
1559         }
1560         EXPECT_EQ(0, ret) {
1561                 TH_LOG("Could not install filter!");
1562         }
1563
1564         /* Make sure neither entry point will switch to strict. */
1565         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT, 0, 0, 0);
1566         EXPECT_EQ(EINVAL, errno) {
1567                 TH_LOG("Switched to mode strict!");
1568         }
1569
1570         ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, NULL);
1571         EXPECT_EQ(EINVAL, errno) {
1572                 TH_LOG("Switched to mode strict!");
1573         }
1574 }
1575
1576 TEST(TSYNC_first)
1577 {
1578         struct sock_filter filter[] = {
1579                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1580         };
1581         struct sock_fprog prog = {
1582                 .len = (unsigned short)ARRAY_SIZE(filter),
1583                 .filter = filter,
1584         };
1585         long ret;
1586
1587         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, NULL, 0, 0);
1588         ASSERT_EQ(0, ret) {
1589                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
1590         }
1591
1592         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FLAG_FILTER_TSYNC,
1593                       &prog);
1594         ASSERT_NE(ENOSYS, errno) {
1595                 TH_LOG("Kernel does not support seccomp syscall!");
1596         }
1597         EXPECT_EQ(0, ret) {
1598                 TH_LOG("Could not install initial filter with TSYNC!");
1599         }
1600 }
1601
1602 #define TSYNC_SIBLINGS 2
1603 struct tsync_sibling {
1604         pthread_t tid;
1605         pid_t system_tid;
1606         sem_t *started;
1607         pthread_cond_t *cond;
1608         pthread_mutex_t *mutex;
1609         int diverge;
1610         int num_waits;
1611         struct sock_fprog *prog;
1612         struct __test_metadata *metadata;
1613 };
1614
1615 FIXTURE_DATA(TSYNC) {
1616         struct sock_fprog root_prog, apply_prog;
1617         struct tsync_sibling sibling[TSYNC_SIBLINGS];
1618         sem_t started;
1619         pthread_cond_t cond;
1620         pthread_mutex_t mutex;
1621         int sibling_count;
1622 };
1623
1624 FIXTURE_SETUP(TSYNC)
1625 {
1626         struct sock_filter root_filter[] = {
1627                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1628         };
1629         struct sock_filter apply_filter[] = {
1630                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1631                         offsetof(struct seccomp_data, nr)),
1632                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
1633                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
1634                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1635         };
1636
1637         memset(&self->root_prog, 0, sizeof(self->root_prog));
1638         memset(&self->apply_prog, 0, sizeof(self->apply_prog));
1639         memset(&self->sibling, 0, sizeof(self->sibling));
1640         self->root_prog.filter = malloc(sizeof(root_filter));
1641         ASSERT_NE(NULL, self->root_prog.filter);
1642         memcpy(self->root_prog.filter, &root_filter, sizeof(root_filter));
1643         self->root_prog.len = (unsigned short)ARRAY_SIZE(root_filter);
1644
1645         self->apply_prog.filter = malloc(sizeof(apply_filter));
1646         ASSERT_NE(NULL, self->apply_prog.filter);
1647         memcpy(self->apply_prog.filter, &apply_filter, sizeof(apply_filter));
1648         self->apply_prog.len = (unsigned short)ARRAY_SIZE(apply_filter);
1649
1650         self->sibling_count = 0;
1651         pthread_mutex_init(&self->mutex, NULL);
1652         pthread_cond_init(&self->cond, NULL);
1653         sem_init(&self->started, 0, 0);
1654         self->sibling[0].tid = 0;
1655         self->sibling[0].cond = &self->cond;
1656         self->sibling[0].started = &self->started;
1657         self->sibling[0].mutex = &self->mutex;
1658         self->sibling[0].diverge = 0;
1659         self->sibling[0].num_waits = 1;
1660         self->sibling[0].prog = &self->root_prog;
1661         self->sibling[0].metadata = _metadata;
1662         self->sibling[1].tid = 0;
1663         self->sibling[1].cond = &self->cond;
1664         self->sibling[1].started = &self->started;
1665         self->sibling[1].mutex = &self->mutex;
1666         self->sibling[1].diverge = 0;
1667         self->sibling[1].prog = &self->root_prog;
1668         self->sibling[1].num_waits = 1;
1669         self->sibling[1].metadata = _metadata;
1670 }
1671
1672 FIXTURE_TEARDOWN(TSYNC)
1673 {
1674         int sib = 0;
1675
1676         if (self->root_prog.filter)
1677                 free(self->root_prog.filter);
1678         if (self->apply_prog.filter)
1679                 free(self->apply_prog.filter);
1680
1681         for ( ; sib < self->sibling_count; ++sib) {
1682                 struct tsync_sibling *s = &self->sibling[sib];
1683                 void *status;
1684
1685                 if (!s->tid)
1686                         continue;
1687                 if (pthread_kill(s->tid, 0)) {
1688                         pthread_cancel(s->tid);
1689                         pthread_join(s->tid, &status);
1690                 }
1691         }
1692         pthread_mutex_destroy(&self->mutex);
1693         pthread_cond_destroy(&self->cond);
1694         sem_destroy(&self->started);
1695 }
1696
1697 void *tsync_sibling(void *data)
1698 {
1699         long ret = 0;
1700         struct tsync_sibling *me = data;
1701
1702         me->system_tid = syscall(__NR_gettid);
1703
1704         pthread_mutex_lock(me->mutex);
1705         if (me->diverge) {
1706                 /* Just re-apply the root prog to fork the tree */
1707                 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
1708                                 me->prog, 0, 0);
1709         }
1710         sem_post(me->started);
1711         /* Return outside of started so parent notices failures. */
1712         if (ret) {
1713                 pthread_mutex_unlock(me->mutex);
1714                 return (void *)SIBLING_EXIT_FAILURE;
1715         }
1716         do {
1717                 pthread_cond_wait(me->cond, me->mutex);
1718                 me->num_waits = me->num_waits - 1;
1719         } while (me->num_waits);
1720         pthread_mutex_unlock(me->mutex);
1721
1722         ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
1723         if (!ret)
1724                 return (void *)SIBLING_EXIT_NEWPRIVS;
1725         read(0, NULL, 0);
1726         return (void *)SIBLING_EXIT_UNKILLED;
1727 }
1728
1729 void tsync_start_sibling(struct tsync_sibling *sibling)
1730 {
1731         pthread_create(&sibling->tid, NULL, tsync_sibling, (void *)sibling);
1732 }
1733
1734 TEST_F(TSYNC, siblings_fail_prctl)
1735 {
1736         long ret;
1737         void *status;
1738         struct sock_filter filter[] = {
1739                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
1740                         offsetof(struct seccomp_data, nr)),
1741                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
1742                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EINVAL),
1743                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
1744         };
1745         struct sock_fprog prog = {
1746                 .len = (unsigned short)ARRAY_SIZE(filter),
1747                 .filter = filter,
1748         };
1749
1750         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
1751                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
1752         }
1753
1754         /* Check prctl failure detection by requesting sib 0 diverge. */
1755         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
1756         ASSERT_NE(ENOSYS, errno) {
1757                 TH_LOG("Kernel does not support seccomp syscall!");
1758         }
1759         ASSERT_EQ(0, ret) {
1760                 TH_LOG("setting filter failed");
1761         }
1762
1763         self->sibling[0].diverge = 1;
1764         tsync_start_sibling(&self->sibling[0]);
1765         tsync_start_sibling(&self->sibling[1]);
1766
1767         while (self->sibling_count < TSYNC_SIBLINGS) {
1768                 sem_wait(&self->started);
1769                 self->sibling_count++;
1770         }
1771
1772         /* Signal the threads to clean up*/
1773         pthread_mutex_lock(&self->mutex);
1774         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
1775                 TH_LOG("cond broadcast non-zero");
1776         }
1777         pthread_mutex_unlock(&self->mutex);
1778
1779         /* Ensure diverging sibling failed to call prctl. */
1780         pthread_join(self->sibling[0].tid, &status);
1781         EXPECT_EQ(SIBLING_EXIT_FAILURE, (long)status);
1782         pthread_join(self->sibling[1].tid, &status);
1783         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
1784 }
1785
1786 TEST_F(TSYNC, two_siblings_with_ancestor)
1787 {
1788         long ret;
1789         void *status;
1790
1791         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
1792                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
1793         }
1794
1795         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
1796         ASSERT_NE(ENOSYS, errno) {
1797                 TH_LOG("Kernel does not support seccomp syscall!");
1798         }
1799         ASSERT_EQ(0, ret) {
1800                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
1801         }
1802         tsync_start_sibling(&self->sibling[0]);
1803         tsync_start_sibling(&self->sibling[1]);
1804
1805         while (self->sibling_count < TSYNC_SIBLINGS) {
1806                 sem_wait(&self->started);
1807                 self->sibling_count++;
1808         }
1809
1810         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FLAG_FILTER_TSYNC,
1811                       &self->apply_prog);
1812         ASSERT_EQ(0, ret) {
1813                 TH_LOG("Could install filter on all threads!");
1814         }
1815         /* Tell the siblings to test the policy */
1816         pthread_mutex_lock(&self->mutex);
1817         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
1818                 TH_LOG("cond broadcast non-zero");
1819         }
1820         pthread_mutex_unlock(&self->mutex);
1821         /* Ensure they are both killed and don't exit cleanly. */
1822         pthread_join(self->sibling[0].tid, &status);
1823         EXPECT_EQ(0x0, (long)status);
1824         pthread_join(self->sibling[1].tid, &status);
1825         EXPECT_EQ(0x0, (long)status);
1826 }
1827
1828 TEST_F(TSYNC, two_sibling_want_nnp)
1829 {
1830         void *status;
1831
1832         /* start siblings before any prctl() operations */
1833         tsync_start_sibling(&self->sibling[0]);
1834         tsync_start_sibling(&self->sibling[1]);
1835         while (self->sibling_count < TSYNC_SIBLINGS) {
1836                 sem_wait(&self->started);
1837                 self->sibling_count++;
1838         }
1839
1840         /* Tell the siblings to test no policy */
1841         pthread_mutex_lock(&self->mutex);
1842         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
1843                 TH_LOG("cond broadcast non-zero");
1844         }
1845         pthread_mutex_unlock(&self->mutex);
1846
1847         /* Ensure they are both upset about lacking nnp. */
1848         pthread_join(self->sibling[0].tid, &status);
1849         EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status);
1850         pthread_join(self->sibling[1].tid, &status);
1851         EXPECT_EQ(SIBLING_EXIT_NEWPRIVS, (long)status);
1852 }
1853
1854 TEST_F(TSYNC, two_siblings_with_no_filter)
1855 {
1856         long ret;
1857         void *status;
1858
1859         /* start siblings before any prctl() operations */
1860         tsync_start_sibling(&self->sibling[0]);
1861         tsync_start_sibling(&self->sibling[1]);
1862         while (self->sibling_count < TSYNC_SIBLINGS) {
1863                 sem_wait(&self->started);
1864                 self->sibling_count++;
1865         }
1866
1867         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
1868                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
1869         }
1870
1871         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FLAG_FILTER_TSYNC,
1872                       &self->apply_prog);
1873         ASSERT_NE(ENOSYS, errno) {
1874                 TH_LOG("Kernel does not support seccomp syscall!");
1875         }
1876         ASSERT_EQ(0, ret) {
1877                 TH_LOG("Could install filter on all threads!");
1878         }
1879
1880         /* Tell the siblings to test the policy */
1881         pthread_mutex_lock(&self->mutex);
1882         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
1883                 TH_LOG("cond broadcast non-zero");
1884         }
1885         pthread_mutex_unlock(&self->mutex);
1886
1887         /* Ensure they are both killed and don't exit cleanly. */
1888         pthread_join(self->sibling[0].tid, &status);
1889         EXPECT_EQ(0x0, (long)status);
1890         pthread_join(self->sibling[1].tid, &status);
1891         EXPECT_EQ(0x0, (long)status);
1892 }
1893
1894 TEST_F(TSYNC, two_siblings_with_one_divergence)
1895 {
1896         long ret;
1897         void *status;
1898
1899         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
1900                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
1901         }
1902
1903         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
1904         ASSERT_NE(ENOSYS, errno) {
1905                 TH_LOG("Kernel does not support seccomp syscall!");
1906         }
1907         ASSERT_EQ(0, ret) {
1908                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
1909         }
1910         self->sibling[0].diverge = 1;
1911         tsync_start_sibling(&self->sibling[0]);
1912         tsync_start_sibling(&self->sibling[1]);
1913
1914         while (self->sibling_count < TSYNC_SIBLINGS) {
1915                 sem_wait(&self->started);
1916                 self->sibling_count++;
1917         }
1918
1919         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FLAG_FILTER_TSYNC,
1920                       &self->apply_prog);
1921         ASSERT_EQ(self->sibling[0].system_tid, ret) {
1922                 TH_LOG("Did not fail on diverged sibling.");
1923         }
1924
1925         /* Wake the threads */
1926         pthread_mutex_lock(&self->mutex);
1927         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
1928                 TH_LOG("cond broadcast non-zero");
1929         }
1930         pthread_mutex_unlock(&self->mutex);
1931
1932         /* Ensure they are both unkilled. */
1933         pthread_join(self->sibling[0].tid, &status);
1934         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
1935         pthread_join(self->sibling[1].tid, &status);
1936         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
1937 }
1938
1939 TEST_F(TSYNC, two_siblings_not_under_filter)
1940 {
1941         long ret, sib;
1942         void *status;
1943
1944         ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
1945                 TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
1946         }
1947
1948         /*
1949          * Sibling 0 will have its own seccomp policy
1950          * and Sibling 1 will not be under seccomp at
1951          * all. Sibling 1 will enter seccomp and 0
1952          * will cause failure.
1953          */
1954         self->sibling[0].diverge = 1;
1955         tsync_start_sibling(&self->sibling[0]);
1956         tsync_start_sibling(&self->sibling[1]);
1957
1958         while (self->sibling_count < TSYNC_SIBLINGS) {
1959                 sem_wait(&self->started);
1960                 self->sibling_count++;
1961         }
1962
1963         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
1964         ASSERT_NE(ENOSYS, errno) {
1965                 TH_LOG("Kernel does not support seccomp syscall!");
1966         }
1967         ASSERT_EQ(0, ret) {
1968                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
1969         }
1970
1971         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FLAG_FILTER_TSYNC,
1972                       &self->apply_prog);
1973         ASSERT_EQ(ret, self->sibling[0].system_tid) {
1974                 TH_LOG("Did not fail on diverged sibling.");
1975         }
1976         sib = 1;
1977         if (ret == self->sibling[0].system_tid)
1978                 sib = 0;
1979
1980         pthread_mutex_lock(&self->mutex);
1981
1982         /* Increment the other siblings num_waits so we can clean up
1983          * the one we just saw.
1984          */
1985         self->sibling[!sib].num_waits += 1;
1986
1987         /* Signal the thread to clean up*/
1988         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
1989                 TH_LOG("cond broadcast non-zero");
1990         }
1991         pthread_mutex_unlock(&self->mutex);
1992         pthread_join(self->sibling[sib].tid, &status);
1993         EXPECT_EQ(SIBLING_EXIT_UNKILLED, (long)status);
1994         /* Poll for actual task death. pthread_join doesn't guarantee it. */
1995         while (!kill(self->sibling[sib].system_tid, 0))
1996                 sleep(0.1);
1997         /* Switch to the remaining sibling */
1998         sib = !sib;
1999
2000         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FLAG_FILTER_TSYNC,
2001                       &self->apply_prog);
2002         ASSERT_EQ(0, ret) {
2003                 TH_LOG("Expected the remaining sibling to sync");
2004         };
2005
2006         pthread_mutex_lock(&self->mutex);
2007
2008         /* If remaining sibling didn't have a chance to wake up during
2009          * the first broadcast, manually reduce the num_waits now.
2010          */
2011         if (self->sibling[sib].num_waits > 1)
2012                 self->sibling[sib].num_waits = 1;
2013         ASSERT_EQ(0, pthread_cond_broadcast(&self->cond)) {
2014                 TH_LOG("cond broadcast non-zero");
2015         }
2016         pthread_mutex_unlock(&self->mutex);
2017         pthread_join(self->sibling[sib].tid, &status);
2018         EXPECT_EQ(0, (long)status);
2019         /* Poll for actual task death. pthread_join doesn't guarantee it. */
2020         while (!kill(self->sibling[sib].system_tid, 0))
2021                 sleep(0.1);
2022
2023         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FLAG_FILTER_TSYNC,
2024                       &self->apply_prog);
2025         ASSERT_EQ(0, ret);  /* just us chickens */
2026 }
2027
2028 /* Make sure restarted syscalls are seen directly as "restart_syscall". */
2029 TEST(syscall_restart)
2030 {
2031         long ret;
2032         unsigned long msg;
2033         pid_t child_pid;
2034         int pipefd[2];
2035         int status;
2036         siginfo_t info = { };
2037         struct sock_filter filter[] = {
2038                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
2039                          offsetof(struct seccomp_data, nr)),
2040
2041 #ifdef __NR_sigreturn
2042                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_sigreturn, 6, 0),
2043 #endif
2044                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 5, 0),
2045                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_exit, 4, 0),
2046                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_rt_sigreturn, 3, 0),
2047                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_nanosleep, 4, 0),
2048                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_restart_syscall, 4, 0),
2049
2050                 /* Allow __NR_write for easy logging. */
2051                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_write, 0, 1),
2052                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
2053                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
2054                 /* The nanosleep jump target. */
2055                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x100),
2056                 /* The restart_syscall jump target. */
2057                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE|0x200),
2058         };
2059         struct sock_fprog prog = {
2060                 .len = (unsigned short)ARRAY_SIZE(filter),
2061                 .filter = filter,
2062         };
2063 #if defined(__arm__)
2064         struct utsname utsbuf;
2065 #endif
2066
2067         ASSERT_EQ(0, pipe(pipefd));
2068
2069         child_pid = fork();
2070         ASSERT_LE(0, child_pid);
2071         if (child_pid == 0) {
2072                 /* Child uses EXPECT not ASSERT to deliver status correctly. */
2073                 char buf = ' ';
2074                 struct timespec timeout = { };
2075
2076                 /* Attach parent as tracer and stop. */
2077                 EXPECT_EQ(0, ptrace(PTRACE_TRACEME));
2078                 EXPECT_EQ(0, raise(SIGSTOP));
2079
2080                 EXPECT_EQ(0, close(pipefd[1]));
2081
2082                 EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
2083                         TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
2084                 }
2085
2086                 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
2087                 EXPECT_EQ(0, ret) {
2088                         TH_LOG("Failed to install filter!");
2089                 }
2090
2091                 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) {
2092                         TH_LOG("Failed to read() sync from parent");
2093                 }
2094                 EXPECT_EQ('.', buf) {
2095                         TH_LOG("Failed to get sync data from read()");
2096                 }
2097
2098                 /* Start nanosleep to be interrupted. */
2099                 timeout.tv_sec = 1;
2100                 errno = 0;
2101                 EXPECT_EQ(0, nanosleep(&timeout, NULL)) {
2102                         TH_LOG("Call to nanosleep() failed (errno %d)", errno);
2103                 }
2104
2105                 /* Read final sync from parent. */
2106                 EXPECT_EQ(1, read(pipefd[0], &buf, 1)) {
2107                         TH_LOG("Failed final read() from parent");
2108                 }
2109                 EXPECT_EQ('!', buf) {
2110                         TH_LOG("Failed to get final data from read()");
2111                 }
2112
2113                 /* Directly report the status of our test harness results. */
2114                 syscall(__NR_exit, _metadata->passed ? EXIT_SUCCESS
2115                                                      : EXIT_FAILURE);
2116         }
2117         EXPECT_EQ(0, close(pipefd[0]));
2118
2119         /* Attach to child, setup options, and release. */
2120         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
2121         ASSERT_EQ(true, WIFSTOPPED(status));
2122         ASSERT_EQ(0, ptrace(PTRACE_SETOPTIONS, child_pid, NULL,
2123                             PTRACE_O_TRACESECCOMP));
2124         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
2125         ASSERT_EQ(1, write(pipefd[1], ".", 1));
2126
2127         /* Wait for nanosleep() to start. */
2128         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
2129         ASSERT_EQ(true, WIFSTOPPED(status));
2130         ASSERT_EQ(SIGTRAP, WSTOPSIG(status));
2131         ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16));
2132         ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg));
2133         ASSERT_EQ(0x100, msg);
2134         EXPECT_EQ(__NR_nanosleep, get_syscall(_metadata, child_pid));
2135
2136         /* Might as well check siginfo for sanity while we're here. */
2137         ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info));
2138         ASSERT_EQ(SIGTRAP, info.si_signo);
2139         ASSERT_EQ(SIGTRAP | (PTRACE_EVENT_SECCOMP << 8), info.si_code);
2140         EXPECT_EQ(0, info.si_errno);
2141         EXPECT_EQ(getuid(), info.si_uid);
2142         /* Verify signal delivery came from child (seccomp-triggered). */
2143         EXPECT_EQ(child_pid, info.si_pid);
2144
2145         /* Interrupt nanosleep with SIGSTOP (which we'll need to handle). */
2146         ASSERT_EQ(0, kill(child_pid, SIGSTOP));
2147         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
2148         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
2149         ASSERT_EQ(true, WIFSTOPPED(status));
2150         ASSERT_EQ(SIGSTOP, WSTOPSIG(status));
2151         /* Verify signal delivery came from parent now. */
2152         ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info));
2153         EXPECT_EQ(getpid(), info.si_pid);
2154
2155         /* Restart nanosleep with SIGCONT, which triggers restart_syscall. */
2156         ASSERT_EQ(0, kill(child_pid, SIGCONT));
2157         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
2158         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
2159         ASSERT_EQ(true, WIFSTOPPED(status));
2160         ASSERT_EQ(SIGCONT, WSTOPSIG(status));
2161         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
2162
2163         /* Wait for restart_syscall() to start. */
2164         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
2165         ASSERT_EQ(true, WIFSTOPPED(status));
2166         ASSERT_EQ(SIGTRAP, WSTOPSIG(status));
2167         ASSERT_EQ(PTRACE_EVENT_SECCOMP, (status >> 16));
2168         ASSERT_EQ(0, ptrace(PTRACE_GETEVENTMSG, child_pid, NULL, &msg));
2169
2170         ASSERT_EQ(0x200, msg);
2171         ret = get_syscall(_metadata, child_pid);
2172 #if defined(__arm__)
2173         /*
2174          * FIXME:
2175          * - native ARM registers do NOT expose true syscall.
2176          * - compat ARM registers on ARM64 DO expose true syscall.
2177          */
2178         ASSERT_EQ(0, uname(&utsbuf));
2179         if (strncmp(utsbuf.machine, "arm", 3) == 0) {
2180                 EXPECT_EQ(__NR_nanosleep, ret);
2181         } else
2182 #endif
2183         {
2184                 EXPECT_EQ(__NR_restart_syscall, ret);
2185         }
2186
2187         /* Write again to end test. */
2188         ASSERT_EQ(0, ptrace(PTRACE_CONT, child_pid, NULL, 0));
2189         ASSERT_EQ(1, write(pipefd[1], "!", 1));
2190         EXPECT_EQ(0, close(pipefd[1]));
2191
2192         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
2193         if (WIFSIGNALED(status) || WEXITSTATUS(status))
2194                 _metadata->passed = 0;
2195 }
2196
2197 /*
2198  * TODO:
2199  * - add microbenchmarks
2200  * - expand NNP testing
2201  * - better arch-specific TRACE and TRAP handlers.
2202  * - endianness checking when appropriate
2203  * - 64-bit arg prodding
2204  * - arch value testing (x86 modes especially)
2205  * - ...
2206  */
2207
2208 TEST_HARNESS_MAIN