From b6570455c1800b3cc682344ca67ccf33fdd08304 Mon Sep 17 00:00:00 2001
From: Nicolas Lacasse <nlacasse@google.com>
Date: Wed, 1 Jun 2022 14:33:12 -0700
Subject: [PATCH] Fix seccomp test under gotsan.

Gotsan makes use of the `openat()` system call, which this test was relying on
to trigger a seccomp violation. This caused unexpected failures when running
with gotsan.

This CL adds `openat` to the allowed set of systemcalls, and instead uses
`fork` to trigger a violation.

PiperOrigin-RevId: 452386392
---
 pkg/seccomp/seccomp_test_victim.go | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkg/seccomp/seccomp_test_victim.go b/pkg/seccomp/seccomp_test_victim.go
index 10ff0df7e..49e60bb06 100644
--- a/pkg/seccomp/seccomp_test_victim.go
+++ b/pkg/seccomp/seccomp_test_victim.go
@@ -66,6 +66,7 @@ func main() {
 		unix.SYS_MUNLOCK:         {},
 		unix.SYS_MUNMAP:          {},
 		unix.SYS_NANOSLEEP:       {},
+		unix.SYS_OPENAT:          {},
 		unix.SYS_PPOLL:           {},
 		unix.SYS_PREAD64:         {},
 		unix.SYS_PSELECT6:        {},
@@ -96,11 +97,16 @@ func main() {
 
 	arch_syscalls(syscalls)
 
+	// We choose a syscall that is unlikely to be called by Go runtime,
+	// even with race or other instrumentation enabled.
+	syscall := uintptr(unix.SYS_AFS_SYSCALL)
+	syscallArg := uintptr(10)
+
 	die := *dieFlag
 	if !die {
-		syscalls[unix.SYS_OPENAT] = []seccomp.Rule{
+		syscalls[syscall] = []seccomp.Rule{
 			{
-				seccomp.EqualTo(10),
+				seccomp.EqualTo(syscallArg),
 			},
 		}
 	}
@@ -111,6 +117,6 @@ func main() {
 	}
 	fmt.Printf("Filters installed\n")
 
-	unix.RawSyscall(unix.SYS_OPENAT, 10, 0, 0)
+	unix.RawSyscall(syscall, syscallArg, 0, 0)
 	fmt.Printf("Syscall was allowed!!!\n")
 }