[PATCH v2] selftests/seccomp: Fix seccomp failure by adding missing headers

[PATCH v2] selftests/seccomp: Fix seccomp failure by adding missing headers

[Sherry Yang]

seccomp_bpf failed on tests 47 global.user_notification_filter_empty
and 48 global.user_notification_filter_empty_threaded when it's
tested on updated kernel but with old kernel headers. Because old
kernel headers don't have definition of macro __NR_clone3 which is
required for these two tests. Since under selftests/, we can install
headers once for all tests (the default INSTALL_HDR_PATH is
usr/include), fix it by adding usr/include to the list of directories
to be searched. Use "-isystem" to indicate it's a system directory as
the real kernel headers directories are.

Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
Tested-by: Sherry Yang <sherry.yang@oracle.com>
---
 tools/testing/selftests/seccomp/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile
index 0ebfe8b0e147..585f7a0c10cb 100644
--- a/tools/testing/selftests/seccomp/Makefile
+++ b/tools/testing/selftests/seccomp/Makefile
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
-CFLAGS += -Wl,-no-as-needed -Wall
+CFLAGS += -Wl,-no-as-needed -Wall -isystem ../../../../usr/include/
 LDFLAGS += -lpthread
 
 TEST_GEN_PROGS := seccomp_bpf seccomp_benchmark
-- 
2.31.1

Re: [PATCH v2] selftests/seccomp: Fix seccomp failure by adding missing headers

[Kees Cook]

On Thu, Feb 10, 2022 at 12:30:49PM -0800, Sherry Yang wrote:
> seccomp_bpf failed on tests 47 global.user_notification_filter_empty
> and 48 global.user_notification_filter_empty_threaded when it's
> tested on updated kernel but with old kernel headers. Because old
> kernel headers don't have definition of macro __NR_clone3 which is
> required for these two tests. Since under selftests/, we can install
> headers once for all tests (the default INSTALL_HDR_PATH is
> usr/include), fix it by adding usr/include to the list of directories
> to be searched. Use "-isystem" to indicate it's a system directory as
> the real kernel headers directories are.
> 
> Signed-off-by: Sherry Yang <sherry.yang@oracle.com>

Thanks!

Reviewed-by: Kees Cook <keescook@chromium.org>

-- 
Kees Cook

Re: [PATCH v2] selftests/seccomp: Fix seccomp failure by adding missing headers

[Shuah Khan]

On 2/10/22 2:16 PM, Kees Cook wrote:
> On Thu, Feb 10, 2022 at 12:30:49PM -0800, Sherry Yang wrote:
>> seccomp_bpf failed on tests 47 global.user_notification_filter_empty
>> and 48 global.user_notification_filter_empty_threaded when it's
>> tested on updated kernel but with old kernel headers. Because old
>> kernel headers don't have definition of macro __NR_clone3 which is
>> required for these two tests. Since under selftests/, we can install
>> headers once for all tests (the default INSTALL_HDR_PATH is
>> usr/include), fix it by adding usr/include to the list of directories
>> to be searched. Use "-isystem" to indicate it's a system directory as
>> the real kernel headers directories are.
>>
>> Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
> 
> Thanks!
> 
> Reviewed-by: Kees Cook <keescook@chromium.org>
> 

Thank you. I will queue this up for rc5.

thanks,
-- Shuah

Re: [PATCH v2] selftests/seccomp: Fix seccomp failure by adding missing headers

[Muhammad Usama Anjum]

On 2/11/22 1:30 AM, Sherry Yang wrote:
> seccomp_bpf failed on tests 47 global.user_notification_filter_empty
> and 48 global.user_notification_filter_empty_threaded when it's
> tested on updated kernel but with old kernel headers. Because old
> kernel headers don't have definition of macro __NR_clone3 which is
> required for these two tests. Since under selftests/, we can install
> headers once for all tests (the default INSTALL_HDR_PATH is
> usr/include), fix it by adding usr/include to the list of directories
> to be searched. Use "-isystem" to indicate it's a system directory as
> the real kernel headers directories are.
> 
> Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
> Tested-by: Sherry Yang <sherry.yang@oracle.com>
> ---
>  tools/testing/selftests/seccomp/Makefile | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile
> index 0ebfe8b0e147..585f7a0c10cb 100644
> --- a/tools/testing/selftests/seccomp/Makefile
> +++ b/tools/testing/selftests/seccomp/Makefile
> @@ -1,5 +1,5 @@
>  # SPDX-License-Identifier: GPL-2.0
> -CFLAGS += -Wl,-no-as-needed -Wall
> +CFLAGS += -Wl,-no-as-needed -Wall -isystem ../../../../usr/include/"../../../../usr/include/" directory doesn't have header files if
different output directory is used for kselftests build like "make -C
tools/tests/selftest O=build". Can you try adding recently added
variable, KHDR_INCLUDES here which makes this kind of headers inclusion
easy and correct for other build combinations as well?

Re: [PATCH v2] selftests/seccomp: Fix seccomp failure by adding missing headers

[Muhammad Usama Anjum]

On 2/11/22 1:30 AM, Sherry Yang wrote:
> seccomp_bpf failed on tests 47 global.user_notification_filter_empty
> and 48 global.user_notification_filter_empty_threaded when it's
> tested on updated kernel but with old kernel headers. Because old
> kernel headers don't have definition of macro __NR_clone3 which is
> required for these two tests. Since under selftests/, we can install
> headers once for all tests (the default INSTALL_HDR_PATH is
> usr/include), fix it by adding usr/include to the list of directories
> to be searched. Use "-isystem" to indicate it's a system directory as
> the real kernel headers directories are.
> 
> Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
> Tested-by: Sherry Yang <sherry.yang@oracle.com>
> ---
>  tools/testing/selftests/seccomp/Makefile | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile
> index 0ebfe8b0e147..585f7a0c10cb 100644
> --- a/tools/testing/selftests/seccomp/Makefile
> +++ b/tools/testing/selftests/seccomp/Makefile
> @@ -1,5 +1,5 @@
>  # SPDX-License-Identifier: GPL-2.0
> -CFLAGS += -Wl,-no-as-needed -Wall
> +CFLAGS += -Wl,-no-as-needed -Wall -isystem ../../../../usr/include/

"../../../../usr/include/" directory doesn't have header files if
different output directory is used for kselftests build like "make -C
tools/tests/selftest O=build". Can you try adding recently added
variable, KHDR_INCLUDES here which makes this kind of headers inclusion
easy and correct for other build combinations as well?

Re: [PATCH v2] selftests/seccomp: Fix seccomp failure by adding missing headers

[Kees Cook]

On Fri, Feb 11, 2022 at 04:14:17AM +0500, Muhammad Usama Anjum wrote:
> On 2/11/22 1:30 AM, Sherry Yang wrote:
> > seccomp_bpf failed on tests 47 global.user_notification_filter_empty
> > and 48 global.user_notification_filter_empty_threaded when it's
> > tested on updated kernel but with old kernel headers. Because old
> > kernel headers don't have definition of macro __NR_clone3 which is
> > required for these two tests. Since under selftests/, we can install
> > headers once for all tests (the default INSTALL_HDR_PATH is
> > usr/include), fix it by adding usr/include to the list of directories
> > to be searched. Use "-isystem" to indicate it's a system directory as
> > the real kernel headers directories are.
> > 
> > Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
> > Tested-by: Sherry Yang <sherry.yang@oracle.com>
> > ---
> >  tools/testing/selftests/seccomp/Makefile | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile
> > index 0ebfe8b0e147..585f7a0c10cb 100644
> > --- a/tools/testing/selftests/seccomp/Makefile
> > +++ b/tools/testing/selftests/seccomp/Makefile
> > @@ -1,5 +1,5 @@
> >  # SPDX-License-Identifier: GPL-2.0
> > -CFLAGS += -Wl,-no-as-needed -Wall
> > +CFLAGS += -Wl,-no-as-needed -Wall -isystem ../../../../usr/include/
> 
> "../../../../usr/include/" directory doesn't have header files if
> different output directory is used for kselftests build like "make -C
> tools/tests/selftest O=build". Can you try adding recently added
> variable, KHDR_INCLUDES here which makes this kind of headers inclusion
> easy and correct for other build combinations as well?

Ah, if that's true I think there are some other instances in the tree
that need fixing too.

-- 
Kees Cook

Re: [PATCH v2] selftests/seccomp: Fix seccomp failure by adding missing headers

[Sherry Yang]

> On Feb 10, 2022, at 3:14 PM, Muhammad Usama Anjum <usama.anjum@collabora.com> wrote:
> 
> On 2/11/22 1:30 AM, Sherry Yang wrote:
>> seccomp_bpf failed on tests 47 global.user_notification_filter_empty
>> and 48 global.user_notification_filter_empty_threaded when it's
>> tested on updated kernel but with old kernel headers. Because old
>> kernel headers don't have definition of macro __NR_clone3 which is
>> required for these two tests. Since under selftests/, we can install
>> headers once for all tests (the default INSTALL_HDR_PATH is
>> usr/include), fix it by adding usr/include to the list of directories
>> to be searched. Use "-isystem" to indicate it's a system directory as
>> the real kernel headers directories are.
>> 
>> Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
>> Tested-by: Sherry Yang <sherry.yang@oracle.com>
>> ---
>> tools/testing/selftests/seccomp/Makefile | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>> 
>> diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile
>> index 0ebfe8b0e147..585f7a0c10cb 100644
>> --- a/tools/testing/selftests/seccomp/Makefile
>> +++ b/tools/testing/selftests/seccomp/Makefile
>> @@ -1,5 +1,5 @@
>> # SPDX-License-Identifier: GPL-2.0
>> -CFLAGS += -Wl,-no-as-needed -Wall
>> +CFLAGS += -Wl,-no-as-needed -Wall -isystem ../../../../usr/include/
> 
> "../../../../usr/include/" directory doesn't have header files if
> different output directory is used for kselftests build like "make -C
> tools/tests/selftest O=build". Can you try adding recently added
> variable, KHDR_INCLUDES here which makes this kind of headers inclusion
> easy and correct for other build combinations as well?
> 
> 

Hi Muhammad,

I just pulled linux-next, and tried with KHDR_INCLUDES. It works. Very nice 
work! I really appreciate you made headers inclusion compatible. However, 
my case is a little more complicated. It will throw warnings with -I, using 
-isystem can suppress these warnings, more details please refer to 
https://lore.kernel.org/all/C340461A-6FD2-440A-8EFC-D7E85BF48DB5@oracle.com/

According to this case, do you think will it be better to export header path 
(KHDR_INCLUDES) without “-I”?

Thanks,
Sherry

Re: [PATCH v2] selftests/seccomp: Fix seccomp failure by adding missing headers

[Muhammad Usama Anjum]

>> "../../../../usr/include/" directory doesn't have header files if
>> different output directory is used for kselftests build like "make -C
>> tools/tests/selftest O=build". Can you try adding recently added
>> variable, KHDR_INCLUDES here which makes this kind of headers inclusion
>> easy and correct for other build combinations as well?
>>
>>
> 
> Hi Muhammad,
> 
> I just pulled linux-next, and tried with KHDR_INCLUDES. It works. Very nice 
> work! I really appreciate you made headers inclusion compatible. However, 
> my case is a little more complicated. It will throw warnings with -I, using 
> -isystem can suppress these warnings, more details please refer to 
> https://lore.kernel.org/all/C340461A-6FD2-440A-8EFC-D7E85BF48DB5@oracle.com/
> 
> According to this case, do you think will it be better to export header path 
> (KHDR_INCLUDES) without “-I”?
Well said. I've thought about it and it seems like -isystem is better
than -I. I've sent a patch:
https://lore.kernel.org/linux-kselftest/20220214160756.3543590-1-usama.anjum@collabora.com/
I'm looking forward to discussion on it.

Thanks,
Usama

Re: [PATCH v2] selftests/seccomp: Fix seccomp failure by adding missing headers

[Muhammad Usama Anjum]

On 2/14/22 9:12 PM, Muhammad Usama Anjum wrote:
>>> "../../../../usr/include/" directory doesn't have header files if
>>> different output directory is used for kselftests build like "make -C
>>> tools/tests/selftest O=build". Can you try adding recently added
>>> variable, KHDR_INCLUDES here which makes this kind of headers inclusion
>>> easy and correct for other build combinations as well?
>>>
>>>
>>
>> Hi Muhammad,
>>
>> I just pulled linux-next, and tried with KHDR_INCLUDES. It works. Very nice 
>> work! I really appreciate you made headers inclusion compatible. However, 
>> my case is a little more complicated. It will throw warnings with -I, using 
>> -isystem can suppress these warnings, more details please refer to 
>> https://lore.kernel.org/all/C340461A-6FD2-440A-8EFC-D7E85BF48DB5@oracle.com/
>>
>> According to this case, do you think will it be better to export header path 
>> (KHDR_INCLUDES) without “-I”?
> Well said. I've thought about it and it seems like -isystem is better
> than -I. I've sent a patch:
> https://lore.kernel.org/linux-kselftest/20220214160756.3543590-1-usama.anjum@collabora.com/
> I'm looking forward to discussion on it.
The patch has been accepted. It should appear in linux-next soon. You
should be able to use KHDR_INCLUDES easily now.

Thanks,
Usama

Re: [PATCH v2] selftests/seccomp: Fix seccomp failure by adding missing headers

[Shuah Khan]

On 2/15/22 11:17 AM, Muhammad Usama Anjum wrote:
> 
> On 2/14/22 9:12 PM, Muhammad Usama Anjum wrote:
>>>> "../../../../usr/include/" directory doesn't have header files if
>>>> different output directory is used for kselftests build like "make -C
>>>> tools/tests/selftest O=build". Can you try adding recently added
>>>> variable, KHDR_INCLUDES here which makes this kind of headers inclusion
>>>> easy and correct for other build combinations as well?
>>>>
>>>>
>>>
>>> Hi Muhammad,
>>>
>>> I just pulled linux-next, and tried with KHDR_INCLUDES. It works. Very nice
>>> work! I really appreciate you made headers inclusion compatible. However,
>>> my case is a little more complicated. It will throw warnings with -I, using
>>> -isystem can suppress these warnings, more details please refer to
>>> https://lore.kernel.org/all/C340461A-6FD2-440A-8EFC-D7E85BF48DB5@oracle.com/
>>>
>>> According to this case, do you think will it be better to export header path
>>> (KHDR_INCLUDES) without “-I”?
>> Well said. I've thought about it and it seems like -isystem is better
>> than -I. I've sent a patch:
>> https://lore.kernel.org/linux-kselftest/20220214160756.3543590-1-usama.anjum@collabora.com/
>> I'm looking forward to discussion on it.
> The patch has been accepted. It should appear in linux-next soon. You
> should be able to use KHDR_INCLUDES easily now.
> 

Sherry,

I pulled in your patch as a fix as is for 5.17-rc5.

Using KHDR_INCLUDES can be separate patch for next release.
This way the fix is going to be pulled for this release
without dependencies on other patches.

thanks,
-- Shuah

Re: [PATCH v2] selftests/seccomp: Fix seccomp failure by adding missing headers

[Sherry Yang]

> On Feb 15, 2022, at 10:43 AM, Shuah Khan <skhan@linuxfoundation.org> wrote:
> 
> On 2/15/22 11:17 AM, Muhammad Usama Anjum wrote:
>> On 2/14/22 9:12 PM, Muhammad Usama Anjum wrote:
>>>>> "../../../../usr/include/" directory doesn't have header files if
>>>>> different output directory is used for kselftests build like "make -C
>>>>> tools/tests/selftest O=build". Can you try adding recently added
>>>>> variable, KHDR_INCLUDES here which makes this kind of headers inclusion
>>>>> easy and correct for other build combinations as well?
>>>>> 
>>>>> 
>>>> 
>>>> Hi Muhammad,
>>>> 
>>>> I just pulled linux-next, and tried with KHDR_INCLUDES. It works. Very nice
>>>> work! I really appreciate you made headers inclusion compatible. However,
>>>> my case is a little more complicated. It will throw warnings with -I, using
>>>> -isystem can suppress these warnings, more details please refer to
>>>> https://urldefense.com/v3/__https://lore.kernel.org/all/C340461A-6FD2-440A-8EFC-D7E85BF48DB5@oracle.com/__;!!ACWV5N9M2RV99hQ!e4ajMH2HRzLNZZDe3Z1iqAO7L8SVjqnvp-a5NfT6I-mKD59xjA-zHM8TAfkJM1Udcg$ 
>>>> According to this case, do you think will it be better to export header path
>>>> (KHDR_INCLUDES) without “-I”?
>>> Well said. I've thought about it and it seems like -isystem is better
>>> than -I. I've sent a patch:
>>> https://urldefense.com/v3/__https://lore.kernel.org/linux-kselftest/20220214160756.3543590-1-usama.anjum@collabora.com/__;!!ACWV5N9M2RV99hQ!e4ajMH2HRzLNZZDe3Z1iqAO7L8SVjqnvp-a5NfT6I-mKD59xjA-zHM8TAfk0AVSbFg$ I'm looking forward to discussion on it.
>> The patch has been accepted. It should appear in linux-next soon. You
>> should be able to use KHDR_INCLUDES easily now.
> 
> Sherry,
> 
> I pulled in your patch as a fix as is for 5.17-rc5.
> 
> Using KHDR_INCLUDES can be separate patch for next release.
> This way the fix is going to be pulled for this release
> without dependencies on other patches.
> 
> thanks,
> -- Shuah


Oh, I just sent out v3 patch before I received the updates. Okay, I will send
a separate patch with KHDR_INCLUDES later.

Thanks,
Sherry