[LTP] [PATCH] syscalls/prctl04: Fix false positive report when SECCOMP_MODE_FILTER is not supported

[LTP] [PATCH] syscalls/prctl04: Fix false positive report when SECCOMP_MODE_FILTER is not supported

[He Zhe]

The child process really should not receive the expected siganl, SIGSYS, when
kernel doesn't support SECCOMP_MODE_FILTER.

This patch makes the child process exit with 1 to indicate such case.

Before this patch:
root@xilinx-zynq:~# /opt/ltp/testcases/bin/prctl04
tst_test.c:1431: TINFO: Timeout per run is 0h 05m 00s
---- snip ----
prctl04.c:154: TCONF: kernel doesn't support SECCOMP_MODE_FILTER
prctl04.c:154: TCONF: kernel doesn't support SECCOMP_MODE_FILTER
prctl04.c:154: TCONF: kernel doesn't support SECCOMP_MODE_FILTER
prctl04.c:204: TFAIL: SECCOMP_MODE_FILTER permits exit() unexpectedly
prctl04.c:154: TCONF: kernel doesn't support SECCOMP_MODE_FILTER

After this patch:
root@xilinx-zynq:~# /opt/ltp/testcases/bin/prctl04
tst_test.c:1431: TINFO: Timeout per run is 0h 05m 00s
---- snip ----
prctl04.c:154: TCONF: kernel doesn't support SECCOMP_MODE_FILTER
prctl04.c:154: TCONF: kernel doesn't support SECCOMP_MODE_FILTER
prctl04.c:154: TCONF: kernel doesn't support SECCOMP_MODE_FILTER
prctl04.c:154: TCONF: kernel doesn't support SECCOMP_MODE_FILTER

Signed-off-by: He Zhe <zhe.he@windriver.com>
---
 testcases/kernel/syscalls/prctl/prctl04.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/testcases/kernel/syscalls/prctl/prctl04.c b/testcases/kernel/syscalls/prctl/prctl04.c
index b9f4c2a10..868b35a29 100644
--- a/testcases/kernel/syscalls/prctl/prctl04.c
+++ b/testcases/kernel/syscalls/prctl/prctl04.c
@@ -158,12 +158,14 @@ static void check_filter_mode(int val)
 
 	TEST(prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &strict));
 	if (TST_RET == -1) {
-		if (TST_ERR == EINVAL)
+		if (TST_ERR == EINVAL) {
 			tst_res(TCONF,
 				"kernel doesn't support SECCOMP_MODE_FILTER");
-		else
+			exit(1);
+		} else {
 			tst_res(TFAIL | TERRNO,
 				"prctl(PR_SET_SECCOMP) sets SECCOMP_MODE_FILTER failed");
+		}
 		return;
 	}
 
@@ -208,7 +210,7 @@ static void verify_prctl(unsigned int n)
 			return;
 		}
 
-		if (tc->pass_flag == 2)
+		if (!(WIFEXITED(status) && WEXITSTATUS(status) == 1) && tc->pass_flag == 2)
 			tst_res(TFAIL,
 				"SECCOMP_MODE_FILTER permits exit() unexpectedly");
 	}
-- 
2.25.1


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] syscalls/prctl04: Fix false positive report when SECCOMP_MODE_FILTER is not supported

[Cyril Hrubis]

Hi!
I did reply to the github issue already with:

Looking at the patch, maybe it would be cleaner if we did a test if
SECCOMP_MODE_FILTER is supported in the test setup and set up a global
variable based on that, something as:

diff --git a/testcases/kernel/syscalls/prctl/prctl04.c b/testcases/kernel/syscalls/prctl/prctl04.c
index b9f4c2a10..d4e44cb1b 100644
--- a/testcases/kernel/syscalls/prctl/prctl04.c
+++ b/testcases/kernel/syscalls/prctl/prctl04.c
@@ -61,6 +61,8 @@ static const struct sock_fprog  strict = {
        .filter = (struct sock_filter *)strict_filter
 };

+static int mode_filter_supported;
+
 static void check_strict_mode(int);
 static void check_filter_mode(int);

@@ -219,6 +221,16 @@ static void setup(void)
        TEST(prctl(PR_GET_SECCOMP));
        if (TST_RET == 0) {
                tst_res(TINFO, "kernel support PR_GET/SET_SECCOMP");
+
+               TEST(prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL));
+
+               if (TST_ERR == EFAULT) {
+                       mode_filter_supported = 1;
+                       tst_res(TINFO, "kernel support SECCOMP_MODE_FILTER");
+                       return;
+               }
+
+               tst_res(TINFO, "kernel doesn't support SECCOMP_MODE_FILTER");
                return;
        }

Then we can simply use the mode_filter_supported either not to print the
failure or even to skip the test to begin with.

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] syscalls/prctl04: Fix false positive report when SECCOMP_MODE_FILTER is not supported

[He Zhe]

On 11/18/22 21:33, Cyril Hrubis wrote:
> Hi!
> I did reply to the github issue already with:

Thanks for taking care of this. I'll send v2.

Zhe

>
> Looking at the patch, maybe it would be cleaner if we did a test if
> SECCOMP_MODE_FILTER is supported in the test setup and set up a global
> variable based on that, something as:
>
> diff --git a/testcases/kernel/syscalls/prctl/prctl04.c b/testcases/kernel/syscalls/prctl/prctl04.c
> index b9f4c2a10..d4e44cb1b 100644
> --- a/testcases/kernel/syscalls/prctl/prctl04.c
> +++ b/testcases/kernel/syscalls/prctl/prctl04.c
> @@ -61,6 +61,8 @@ static const struct sock_fprog  strict = {
>         .filter = (struct sock_filter *)strict_filter
>  };
>
> +static int mode_filter_supported;
> +
>  static void check_strict_mode(int);
>  static void check_filter_mode(int);
>
> @@ -219,6 +221,16 @@ static void setup(void)
>         TEST(prctl(PR_GET_SECCOMP));
>         if (TST_RET == 0) {
>                 tst_res(TINFO, "kernel support PR_GET/SET_SECCOMP");
> +
> +               TEST(prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL));
> +
> +               if (TST_ERR == EFAULT) {
> +                       mode_filter_supported = 1;
> +                       tst_res(TINFO, "kernel support SECCOMP_MODE_FILTER");
> +                       return;
> +               }
> +
> +               tst_res(TINFO, "kernel doesn't support SECCOMP_MODE_FILTER");
>                 return;
>         }
>
> Then we can simply use the mode_filter_supported either not to print the
> failure or even to skip the test to begin with.
>


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp