@@ -1608,7 +1608,16 @@ TEST_F(TRACE_poke, getpid_runs_normally)
1608
1608
#ifdef SYSCALL_NUM_RET_SHARE_REG
1609
1609
# define EXPECT_SYSCALL_RETURN (val , action ) EXPECT_EQ(-1, action)
1610
1610
#else
1611
- # define EXPECT_SYSCALL_RETURN (val , action ) EXPECT_EQ(val, action)
1611
+ # define EXPECT_SYSCALL_RETURN (val , action ) \
1612
+ do { \
1613
+ errno = 0; \
1614
+ if (val < 0) { \
1615
+ EXPECT_EQ(-1, action); \
1616
+ EXPECT_EQ(-(val), errno); \
1617
+ } else { \
1618
+ EXPECT_EQ(val, action); \
1619
+ } \
1620
+ } while (0)
1612
1621
#endif
1613
1622
1614
1623
/* Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
@@ -1647,7 +1656,7 @@ int get_syscall(struct __test_metadata *_metadata, pid_t tracee)
1647
1656
1648
1657
/* Architecture-specific syscall changing routine. */
1649
1658
void change_syscall (struct __test_metadata * _metadata ,
1650
- pid_t tracee , int syscall )
1659
+ pid_t tracee , int syscall , int result )
1651
1660
{
1652
1661
int ret ;
1653
1662
ARCH_REGS regs ;
@@ -1706,7 +1715,7 @@ void change_syscall(struct __test_metadata *_metadata,
1706
1715
#ifdef SYSCALL_NUM_RET_SHARE_REG
1707
1716
TH_LOG ("Can't modify syscall return on this architecture" );
1708
1717
#else
1709
- regs .SYSCALL_RET = EPERM ;
1718
+ regs .SYSCALL_RET = result ;
1710
1719
#endif
1711
1720
1712
1721
#ifdef HAVE_GETREGS
@@ -1734,14 +1743,19 @@ void tracer_syscall(struct __test_metadata *_metadata, pid_t tracee,
1734
1743
case 0x1002 :
1735
1744
/* change getpid to getppid. */
1736
1745
EXPECT_EQ (__NR_getpid , get_syscall (_metadata , tracee ));
1737
- change_syscall (_metadata , tracee , __NR_getppid );
1746
+ change_syscall (_metadata , tracee , __NR_getppid , 0 );
1738
1747
break ;
1739
1748
case 0x1003 :
1740
- /* skip gettid. */
1749
+ /* skip gettid with valid return code . */
1741
1750
EXPECT_EQ (__NR_gettid , get_syscall (_metadata , tracee ));
1742
- change_syscall (_metadata , tracee , -1 );
1751
+ change_syscall (_metadata , tracee , -1 , 45000 );
1743
1752
break ;
1744
1753
case 0x1004 :
1754
+ /* skip openat with error. */
1755
+ EXPECT_EQ (__NR_openat , get_syscall (_metadata , tracee ));
1756
+ change_syscall (_metadata , tracee , -1 , - ESRCH );
1757
+ break ;
1758
+ case 0x1005 :
1745
1759
/* do nothing (allow getppid) */
1746
1760
EXPECT_EQ (__NR_getppid , get_syscall (_metadata , tracee ));
1747
1761
break ;
@@ -1774,9 +1788,11 @@ void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
1774
1788
nr = get_syscall (_metadata , tracee );
1775
1789
1776
1790
if (nr == __NR_getpid )
1777
- change_syscall (_metadata , tracee , __NR_getppid );
1791
+ change_syscall (_metadata , tracee , __NR_getppid , 0 );
1792
+ if (nr == __NR_gettid )
1793
+ change_syscall (_metadata , tracee , -1 , 45000 );
1778
1794
if (nr == __NR_openat )
1779
- change_syscall (_metadata , tracee , -1 );
1795
+ change_syscall (_metadata , tracee , -1 , - ESRCH );
1780
1796
}
1781
1797
1782
1798
FIXTURE_DATA (TRACE_syscall ) {
@@ -1793,8 +1809,10 @@ FIXTURE_SETUP(TRACE_syscall)
1793
1809
BPF_STMT (BPF_RET |BPF_K , SECCOMP_RET_TRACE | 0x1002 ),
1794
1810
BPF_JUMP (BPF_JMP |BPF_JEQ |BPF_K , __NR_gettid , 0 , 1 ),
1795
1811
BPF_STMT (BPF_RET |BPF_K , SECCOMP_RET_TRACE | 0x1003 ),
1796
- BPF_JUMP (BPF_JMP |BPF_JEQ |BPF_K , __NR_getppid , 0 , 1 ),
1812
+ BPF_JUMP (BPF_JMP |BPF_JEQ |BPF_K , __NR_openat , 0 , 1 ),
1797
1813
BPF_STMT (BPF_RET |BPF_K , SECCOMP_RET_TRACE | 0x1004 ),
1814
+ BPF_JUMP (BPF_JMP |BPF_JEQ |BPF_K , __NR_getppid , 0 , 1 ),
1815
+ BPF_STMT (BPF_RET |BPF_K , SECCOMP_RET_TRACE | 0x1005 ),
1798
1816
BPF_STMT (BPF_RET |BPF_K , SECCOMP_RET_ALLOW ),
1799
1817
};
1800
1818
@@ -1842,15 +1860,26 @@ TEST_F(TRACE_syscall, ptrace_syscall_redirected)
1842
1860
EXPECT_NE (self -> mypid , syscall (__NR_getpid ));
1843
1861
}
1844
1862
1845
- TEST_F (TRACE_syscall , ptrace_syscall_dropped )
1863
+ TEST_F (TRACE_syscall , ptrace_syscall_errno )
1864
+ {
1865
+ /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
1866
+ teardown_trace_fixture (_metadata , self -> tracer );
1867
+ self -> tracer = setup_trace_fixture (_metadata , tracer_ptrace , NULL ,
1868
+ true);
1869
+
1870
+ /* Tracer should skip the open syscall, resulting in ESRCH. */
1871
+ EXPECT_SYSCALL_RETURN (- ESRCH , syscall (__NR_openat ));
1872
+ }
1873
+
1874
+ TEST_F (TRACE_syscall , ptrace_syscall_faked )
1846
1875
{
1847
1876
/* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
1848
1877
teardown_trace_fixture (_metadata , self -> tracer );
1849
1878
self -> tracer = setup_trace_fixture (_metadata , tracer_ptrace , NULL ,
1850
1879
true);
1851
1880
1852
- /* Tracer should skip the open syscall, resulting in EPERM . */
1853
- EXPECT_SYSCALL_RETURN (EPERM , syscall (__NR_openat ));
1881
+ /* Tracer should skip the gettid syscall, resulting fake pid . */
1882
+ EXPECT_SYSCALL_RETURN (45000 , syscall (__NR_gettid ));
1854
1883
}
1855
1884
1856
1885
TEST_F (TRACE_syscall , syscall_allowed )
@@ -1883,7 +1912,21 @@ TEST_F(TRACE_syscall, syscall_redirected)
1883
1912
EXPECT_NE (self -> mypid , syscall (__NR_getpid ));
1884
1913
}
1885
1914
1886
- TEST_F (TRACE_syscall , syscall_dropped )
1915
+ TEST_F (TRACE_syscall , syscall_errno )
1916
+ {
1917
+ long ret ;
1918
+
1919
+ ret = prctl (PR_SET_NO_NEW_PRIVS , 1 , 0 , 0 , 0 );
1920
+ ASSERT_EQ (0 , ret );
1921
+
1922
+ ret = prctl (PR_SET_SECCOMP , SECCOMP_MODE_FILTER , & self -> prog , 0 , 0 );
1923
+ ASSERT_EQ (0 , ret );
1924
+
1925
+ /* openat has been skipped and an errno return. */
1926
+ EXPECT_SYSCALL_RETURN (- ESRCH , syscall (__NR_openat ));
1927
+ }
1928
+
1929
+ TEST_F (TRACE_syscall , syscall_faked )
1887
1930
{
1888
1931
long ret ;
1889
1932
@@ -1894,8 +1937,7 @@ TEST_F(TRACE_syscall, syscall_dropped)
1894
1937
ASSERT_EQ (0 , ret );
1895
1938
1896
1939
/* gettid has been skipped and an altered return value stored. */
1897
- EXPECT_SYSCALL_RETURN (EPERM , syscall (__NR_gettid ));
1898
- EXPECT_NE (self -> mytid , syscall (__NR_gettid ));
1940
+ EXPECT_SYSCALL_RETURN (45000 , syscall (__NR_gettid ));
1899
1941
}
1900
1942
1901
1943
TEST_F (TRACE_syscall , skip_after_RET_TRACE )
0 commit comments