From 9b751b88ed507d4efd1e89ed72cdc857f7d709b1 Mon Sep 17 00:00:00 2001
From: Zach Koopmans <zkoopmans@google.com>
Date: Wed, 1 Jun 2022 16:25:50 -0700
Subject: [PATCH] [bugs] Refactor seccomp test.

PiperOrigin-RevId: 452409930
---
 pkg/seccomp/seccomp_test.go        | 65 ++++++++++++++++--------------
 pkg/seccomp/seccomp_test_victim.go | 11 +++--
 2 files changed, 42 insertions(+), 34 deletions(-)

diff --git a/pkg/seccomp/seccomp_test.go b/pkg/seccomp/seccomp_test.go
index 68feddf31..f79aa64d1 100644
--- a/pkg/seccomp/seccomp_test.go
+++ b/pkg/seccomp/seccomp_test.go
@@ -965,44 +965,49 @@ func TestRandom(t *testing.T) {
 // that it doesn't die when the filter is not triggered.
 func TestRealDeal(t *testing.T) {
 	for _, test := range []struct {
+		name string
 		die  bool
 		want string
 	}{
-		{die: true, want: "bad system call"},
-		{die: false, want: "Syscall was allowed!!!"},
+		{name: "bad syscall", die: true, want: "bad system call"},
+		{name: "allowed syscall", die: false, want: "Syscall was allowed!!!"},
 	} {
-		victim, err := newVictim()
-		if err != nil {
-			t.Fatalf("unable to get victim: %v", err)
-		}
-		defer os.Remove(victim)
-		dieFlag := fmt.Sprintf("-die=%v", test.die)
-		cmd := exec.Command(victim, dieFlag)
-
-		out, err := cmd.CombinedOutput()
-		if test.die {
-			if err == nil {
-				t.Errorf("victim was not killed as expected, output: %s", out)
-				continue
-			}
-			// Depending on kernel version, either RET_TRAP or RET_KILL_PROCESS is
-			// used. RET_TRAP dumps reason for exit in output, while RET_KILL_PROCESS
-			// returns SIGSYS as exit status.
-			if !strings.Contains(string(out), test.want) &&
-				!strings.Contains(err.Error(), test.want) {
-				t.Errorf("Victim error is wrong, got: %v, err: %v, want: %v", string(out), err, test.want)
-				continue
-			}
-		} else {
+		t.Run(test.name, func(t *testing.T) {
+			victim, err := newVictim()
 			if err != nil {
-				t.Errorf("victim failed to execute, err: %v", err)
-				continue
+				t.Fatalf("unable to get victim: %v", err)
+			}
+			defer func() {
+				if err := os.Remove(victim); err != nil {
+					t.Fatalf("Unable to remove victim: %v", err)
+				}
+			}()
+
+			dieFlag := fmt.Sprintf("-die=%v", test.die)
+			cmd := exec.Command(victim, dieFlag)
+			out, err := cmd.CombinedOutput()
+			if test.die {
+				if err == nil {
+					t.Fatalf("Victim was not killed as expected, output: %s", out)
+				}
+				// Depending on kernel version, either RET_TRAP or RET_KILL_PROCESS is
+				// used. RET_TRAP dumps reason for exit in output, while RET_KILL_PROCESS
+				// returns SIGSYS as exit status.
+				if !strings.Contains(string(out), test.want) &&
+					!strings.Contains(err.Error(), test.want) {
+					t.Fatalf("Victim error is wrong, got: %v, err: %v, want: %v", string(out), err, test.want)
+				}
+				return
+			}
+			// test.die is false
+			if err != nil {
+				t.Logf("out: %s", string(out))
+				t.Fatalf("Victim failed to execute, err: %v", err)
 			}
 			if !strings.Contains(string(out), test.want) {
-				t.Errorf("Victim output is wrong, got: %v, want: %v", string(out), test.want)
-				continue
+				t.Fatalf("Victim output is wrong, got: %v, want: %v", string(out), test.want)
 			}
-		}
+		})
 	}
 }
 
diff --git a/pkg/seccomp/seccomp_test_victim.go b/pkg/seccomp/seccomp_test_victim.go
index 49e60bb06..fa434e7c8 100644
--- a/pkg/seccomp/seccomp_test_victim.go
+++ b/pkg/seccomp/seccomp_test_victim.go
@@ -96,11 +96,11 @@ func main() {
 	}
 
 	arch_syscalls(syscalls)
-
 	// We choose a syscall that is unlikely to be called by Go runtime,
 	// even with race or other instrumentation enabled.
 	syscall := uintptr(unix.SYS_AFS_SYSCALL)
-	syscallArg := uintptr(10)
+	// This test goes up to 11.
+	syscallArg := uintptr(11)
 
 	die := *dieFlag
 	if !die {
@@ -112,11 +112,14 @@ func main() {
 	}
 
 	if err := seccomp.Install(syscalls, nil); err != nil {
-		fmt.Printf("Failed to install seccomp: %v", err)
+		fmt.Printf("Failed to install seccomp: %v\n", err)
 		os.Exit(1)
 	}
 	fmt.Printf("Filters installed\n")
 
-	unix.RawSyscall(syscall, syscallArg, 0, 0)
+	if _, _, err := unix.RawSyscall(syscall, syscallArg, 0, 0); err != unix.Errno(0) {
+		fmt.Printf("syscall error: %v\n", err)
+	}
+
 	fmt.Printf("Syscall was allowed!!!\n")
 }