Some seccomp flags will become exclusive, so the selftest needs to
be adjusted to mask those out and test them individually for the "all
flags" tests.
Cc: stable(a)vger.kernel.org # v5.0+
Signed-off-by: Kees Cook <keescook(a)chromium.org>
---
tools/testing/selftests/seccomp/seccomp_bpf.c | 34 ++++++++++++++-----
1 file changed, 25 insertions(+), 9 deletions(-)
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index f69d2ee29742..5019cdae5d0b 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -2166,11 +2166,14 @@ TEST(detect_seccomp_filter_flags)
SECCOMP_FILTER_FLAG_LOG,
SECCOMP_FILTER_FLAG_SPEC_ALLOW,
SECCOMP_FILTER_FLAG_NEW_LISTENER };
- unsigned int flag, all_flags;
+ unsigned int exclusive[] = {
+ SECCOMP_FILTER_FLAG_TSYNC,
+ SECCOMP_FILTER_FLAG_NEW_LISTENER };
+ unsigned int flag, all_flags, exclusive_mask;
int i;
long ret;
- /* Test detection of known-good filter flags */
+ /* Test detection of individual known-good filter flags */
for (i = 0, all_flags = 0; i < ARRAY_SIZE(flags); i++) {
int bits = 0;
@@ -2197,16 +2200,29 @@ TEST(detect_seccomp_filter_flags)
all_flags |= flag;
}
- /* Test detection of all known-good filter flags */
- ret = seccomp(SECCOMP_SET_MODE_FILTER, all_flags, NULL);
- EXPECT_EQ(-1, ret);
- EXPECT_EQ(EFAULT, errno) {
- TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!",
- all_flags);
+ /*
+ * Test detection of all known-good filter flags combined. But
+ * for the exclusive flags we need to mask them out and try them
+ * individually for the "all flags" testing.
+ */
+ exclusive_mask = 0;
+ for (i = 0; i < ARRAY_SIZE(exclusive); i++)
+ exclusive_mask |= exclusive[i];
+ for (i = 0; i < ARRAY_SIZE(exclusive); i++) {
+ flag = all_flags & ~exclusive_mask;
+ flag |= exclusive[i];
+
+ ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
+ EXPECT_EQ(-1, ret);
+ EXPECT_EQ(EFAULT, errno) {
+ TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!",
+ flag);
+ }
}
- /* Test detection of an unknown filter flag */
+ /* Test detection of an unknown filter flags, without exclusives. */
flag = -1;
+ flag &= ~exclusive_mask;
ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
EXPECT_EQ(-1, ret);
EXPECT_EQ(EINVAL, errno) {
--
2.17.1
On 04/25 Christian wrote:
>On Wed, Apr 24, 2019 at 6:16 PM Oleg Nesterov <oleg(a)redhat.com> wrote:
>>
>> On 04/24, weizhenliang wrote:
>> >
>> > On 04/24, Oleg wrote:
>> > >On 04/24, Christian Brauner wrote:
>> > >>
>> > >> On Wed, Apr 24, 2019 at 08:52:38PM +0800, Zhenliang Wei wrote:
>> > >>
>> > >> > Reviewed-by: Oleg Nesterov <oleg(a)redhat.com>
>> > >
>> > >Yes, but ...
>> > >
>> > >> > Reported-by: kbuild test robot <lkp(a)intel.com>
>> > >
>> > >Hmm, really?
>> >
>> > Yes, the kbuild test robot says that if I fix the problem with the
>> > third parameter type, I should add this tag. What is wrong or missing?
>>
>> But this patch does not fix the problem reported by robot, your patch
>> (which introduced that problem) was dropped, the problem has gone.
>>
>> With this "Reported-by: kbuild test robot <lkp(a)intel.com>" tag it
>> looks as if test-robot has found the problem you are trying to fix:
>> the lack of trace_signal_deliver(SIGKILL).
>
>Yeah, Oleg's absolutely right. That tag should just go.
>The Fixes line is all that we want, I think.
Got it ~
Thank you (Oleg and Christian) for the kind guidance
And I will update the patch as soon as possible
Wei.