netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2151 from xiaobo55x:seccomp_test

Browse Source 
PiperOrigin-RevId: 302987344
This commit is contained in:
gVisor bot
2020-03-25 15:59:53 -07:00
parent 5f03dca522 333b74dc28
commit 3afbe5461a
1 changed files with 25 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/syscalls/linux/seccomp.cc
+25 -15
View File
@@ -70,20 +70,27 @@ void ApplySeccompFilter(uint32_t sysno, uint32_t filtered_result,
MaybeSave();
struct sock_filter filter[] = {
// A = seccomp_data.arch
BPF_STMT(BPF_LD | BPF_ABS | BPF_W, 4),
// if (A != AUDIT_ARCH_X86_64) goto kill
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, AUDIT_ARCH_X86_64, 0, 4),
// A = seccomp_data.nr
BPF_STMT(BPF_LD | BPF_ABS | BPF_W, 0),
// if (A != sysno) goto allow
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, sysno, 0, 1),
// return filtered_result
BPF_STMT(BPF_RET | BPF_K, filtered_result),
// allow: return SECCOMP_RET_ALLOW
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
// kill: return SECCOMP_RET_KILL
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL),
// A = seccomp_data.arch
BPF_STMT(BPF_LD | BPF_ABS | BPF_W, 4),
#if defined(__x86_64__)
// if (A != AUDIT_ARCH_X86_64) goto kill
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, AUDIT_ARCH_X86_64, 0, 4),
#elif defined(__aarch64__)
// if (A != AUDIT_ARCH_AARCH64) goto kill
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, AUDIT_ARCH_AARCH64, 0, 4),
#else
#error "Unknown architecture"
#endif
// A = seccomp_data.nr
BPF_STMT(BPF_LD | BPF_ABS | BPF_W, 0),
// if (A != sysno) goto allow
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, sysno, 0, 1),
// return filtered_result
BPF_STMT(BPF_RET | BPF_K, filtered_result),
// allow: return SECCOMP_RET_ALLOW
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
// kill: return SECCOMP_RET_KILL
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL),
};
struct sock_fprog prog;
prog.len = ABSL_ARRAYSIZE(filter);
@@ -179,9 +186,12 @@ TEST(SeccompTest, RetTrapCausesSIGSYS) {
TEST_CHECK(info->si_errno == kTrapValue);
TEST_CHECK(info->si_call_addr != nullptr);
TEST_CHECK(info->si_syscall == kFilteredSyscall);
#ifdef __x86_64__
#if defined(__x86_64__)
TEST_CHECK(info->si_arch == AUDIT_ARCH_X86_64);
TEST_CHECK(uc->uc_mcontext.gregs[REG_RAX] == kFilteredSyscall);
#elif defined(__aarch64__)
TEST_CHECK(info->si_arch == AUDIT_ARCH_AARCH64);
TEST_CHECK(uc->uc_mcontext.regs[8] == kFilteredSyscall);
#endif // defined(__x86_64__)
_exit(0);
});