* [PATCH 2/4] seccomp: add two missing ptrace ifdefines [not found] <20190918084833.9369-1-christian.brauner@ubuntu.com> @ 2019-09-18 8:48 ` Christian Brauner 2019-09-18 9:15 ` Tyler Hicks 2019-09-18 8:48 ` [PATCH 3/4] seccomp: avoid overflow in implicit constant conversion Christian Brauner 2019-09-18 8:48 ` [PATCH 4/4] seccomp: test SECCOMP_RET_USER_NOTIF_ALLOW Christian Brauner 2 siblings, 1 reply; 10+ messages in thread From: Christian Brauner @ 2019-09-18 8:48 UTC (permalink / raw) To: keescook, luto Cc: jannh, wad, shuah, ast, daniel, kafai, songliubraving, yhs, linux-kernel, linux-kselftest, netdev, bpf, Christian Brauner, Tycho Andersen, Tyler Hicks, stable Add tw missing ptrace ifdefines to avoid compilation errors on systems that do not provide PTRACE_EVENTMSG_SYSCALL_ENTRY or PTRACE_EVENTMSG_SYSCALL_EXIT or: gcc -Wl,-no-as-needed -Wall seccomp_bpf.c -lpthread -o seccomp_bpf In file included from seccomp_bpf.c:52:0: seccomp_bpf.c: In function ‘tracer_ptrace’: seccomp_bpf.c:1792:20: error: ‘PTRACE_EVENTMSG_SYSCALL_ENTRY’ undeclared (first use in this function); did you mean ‘PTRACE_EVENT_CLONE’? EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY ^ ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ __typeof__(_expected) __exp = (_expected); \ ^~~~~~~~~ seccomp_bpf.c:1792:2: note: in expansion of macro ‘EXPECT_EQ’ EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY ^~~~~~~~~ seccomp_bpf.c:1792:20: note: each undeclared identifier is reported only once for each function it appears in EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY ^ ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ __typeof__(_expected) __exp = (_expected); \ ^~~~~~~~~ seccomp_bpf.c:1792:2: note: in expansion of macro ‘EXPECT_EQ’ EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY ^~~~~~~~~ seccomp_bpf.c:1793:6: error: ‘PTRACE_EVENTMSG_SYSCALL_EXIT’ undeclared (first use in this function); did you mean ‘PTRACE_EVENTMSG_SYSCALL_ENTRY’? : PTRACE_EVENTMSG_SYSCALL_EXIT, msg); ^ ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ __typeof__(_expected) __exp = (_expected); \ ^~~~~~~~~ seccomp_bpf.c:1792:2: note: in expansion of macro ‘EXPECT_EQ’ EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY ^~~~~~~~~ Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace") Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Cc: Kees Cook <keescook@chromium.org> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Will Drewry <wad@chromium.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Martin KaFai Lau <kafai@fb.com> Cc: Song Liu <songliubraving@fb.com> Cc: Yonghong Song <yhs@fb.com> Cc: Tycho Andersen <tycho@tycho.ws> CC: Tyler Hicks <tyhicks@canonical.com> Cc: Jann Horn <jannh@google.com> Cc: stable@vger.kernel.org Cc: linux-kselftest@vger.kernel.org Cc: netdev@vger.kernel.org Cc: bpf@vger.kernel.org --- tools/testing/selftests/seccomp/seccomp_bpf.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c index 6ef7f16c4cf5..ee52eab01800 100644 --- a/tools/testing/selftests/seccomp/seccomp_bpf.c +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c @@ -155,6 +155,14 @@ struct seccomp_data { #ifndef PTRACE_SECCOMP_GET_METADATA #define PTRACE_SECCOMP_GET_METADATA 0x420d +#ifndef PTRACE_EVENTMSG_SYSCALL_ENTRY +#define PTRACE_EVENTMSG_SYSCALL_ENTRY 1 +#endif + +#ifndef PTRACE_EVENTMSG_SYSCALL_EXIT +#define PTRACE_EVENTMSG_SYSCALL_EXIT 2 +#endif + struct seccomp_metadata { __u64 filter_off; /* Input: which filter */ __u64 flags; /* Output: filter's flags */ -- 2.23.0 ^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH 2/4] seccomp: add two missing ptrace ifdefines 2019-09-18 8:48 ` [PATCH 2/4] seccomp: add two missing ptrace ifdefines Christian Brauner @ 2019-09-18 9:15 ` Tyler Hicks 2019-09-18 17:33 ` Kees Cook 0 siblings, 1 reply; 10+ messages in thread From: Tyler Hicks @ 2019-09-18 9:15 UTC (permalink / raw) To: Christian Brauner Cc: keescook, luto, jannh, wad, shuah, ast, daniel, kafai, songliubraving, yhs, linux-kernel, linux-kselftest, netdev, bpf, Tycho Andersen, stable On 2019-09-18 10:48:31, Christian Brauner wrote: > Add tw missing ptrace ifdefines to avoid compilation errors on systems > that do not provide PTRACE_EVENTMSG_SYSCALL_ENTRY or > PTRACE_EVENTMSG_SYSCALL_EXIT or: > > gcc -Wl,-no-as-needed -Wall seccomp_bpf.c -lpthread -o seccomp_bpf > In file included from seccomp_bpf.c:52:0: > seccomp_bpf.c: In function ‘tracer_ptrace’: > seccomp_bpf.c:1792:20: error: ‘PTRACE_EVENTMSG_SYSCALL_ENTRY’ undeclared (first use in this function); did you mean ‘PTRACE_EVENT_CLONE’? > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > ^ > ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ > __typeof__(_expected) __exp = (_expected); \ > ^~~~~~~~~ > seccomp_bpf.c:1792:2: note: in expansion of macro ‘EXPECT_EQ’ > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > ^~~~~~~~~ > seccomp_bpf.c:1792:20: note: each undeclared identifier is reported only once for each function it appears in > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > ^ > ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ > __typeof__(_expected) __exp = (_expected); \ > ^~~~~~~~~ > seccomp_bpf.c:1792:2: note: in expansion of macro ‘EXPECT_EQ’ > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > ^~~~~~~~~ > seccomp_bpf.c:1793:6: error: ‘PTRACE_EVENTMSG_SYSCALL_EXIT’ undeclared (first use in this function); did you mean ‘PTRACE_EVENTMSG_SYSCALL_ENTRY’? > : PTRACE_EVENTMSG_SYSCALL_EXIT, msg); > ^ > ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ > __typeof__(_expected) __exp = (_expected); \ > ^~~~~~~~~ > seccomp_bpf.c:1792:2: note: in expansion of macro ‘EXPECT_EQ’ > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > ^~~~~~~~~ > > Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace") I think this Fixes line is incorrect and should be changed to: Fixes: 201766a20e30 ("ptrace: add PTRACE_GET_SYSCALL_INFO request") With that changed, Reviewed-by: Tyler Hicks <tyhicks@canonical.com> Tyler > Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> > Cc: Kees Cook <keescook@chromium.org> > Cc: Andy Lutomirski <luto@amacapital.net> > Cc: Will Drewry <wad@chromium.org> > Cc: Shuah Khan <shuah@kernel.org> > Cc: Alexei Starovoitov <ast@kernel.org> > Cc: Daniel Borkmann <daniel@iogearbox.net> > Cc: Martin KaFai Lau <kafai@fb.com> > Cc: Song Liu <songliubraving@fb.com> > Cc: Yonghong Song <yhs@fb.com> > Cc: Tycho Andersen <tycho@tycho.ws> > CC: Tyler Hicks <tyhicks@canonical.com> > Cc: Jann Horn <jannh@google.com> > Cc: stable@vger.kernel.org > Cc: linux-kselftest@vger.kernel.org > Cc: netdev@vger.kernel.org > Cc: bpf@vger.kernel.org > --- > tools/testing/selftests/seccomp/seccomp_bpf.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c > index 6ef7f16c4cf5..ee52eab01800 100644 > --- a/tools/testing/selftests/seccomp/seccomp_bpf.c > +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c > @@ -155,6 +155,14 @@ struct seccomp_data { > #ifndef PTRACE_SECCOMP_GET_METADATA > #define PTRACE_SECCOMP_GET_METADATA 0x420d > > +#ifndef PTRACE_EVENTMSG_SYSCALL_ENTRY > +#define PTRACE_EVENTMSG_SYSCALL_ENTRY 1 > +#endif > + > +#ifndef PTRACE_EVENTMSG_SYSCALL_EXIT > +#define PTRACE_EVENTMSG_SYSCALL_EXIT 2 > +#endif > + > struct seccomp_metadata { > __u64 filter_off; /* Input: which filter */ > __u64 flags; /* Output: filter's flags */ > -- > 2.23.0 > ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 2/4] seccomp: add two missing ptrace ifdefines 2019-09-18 9:15 ` Tyler Hicks @ 2019-09-18 17:33 ` Kees Cook 2019-09-19 10:42 ` Dmitry V. Levin 0 siblings, 1 reply; 10+ messages in thread From: Kees Cook @ 2019-09-18 17:33 UTC (permalink / raw) To: Tyler Hicks Cc: Christian Brauner, luto, jannh, wad, shuah, ast, daniel, kafai, songliubraving, yhs, linux-kernel, linux-kselftest, netdev, bpf, Tycho Andersen, stable On Wed, Sep 18, 2019 at 11:15:12AM +0200, Tyler Hicks wrote: > On 2019-09-18 10:48:31, Christian Brauner wrote: > > Add tw missing ptrace ifdefines to avoid compilation errors on systems > > that do not provide PTRACE_EVENTMSG_SYSCALL_ENTRY or > > PTRACE_EVENTMSG_SYSCALL_EXIT or: > > > > gcc -Wl,-no-as-needed -Wall seccomp_bpf.c -lpthread -o seccomp_bpf > > In file included from seccomp_bpf.c:52:0: > > seccomp_bpf.c: In function ‘tracer_ptrace’: > > seccomp_bpf.c:1792:20: error: ‘PTRACE_EVENTMSG_SYSCALL_ENTRY’ undeclared (first use in this function); did you mean ‘PTRACE_EVENT_CLONE’? > > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > > ^ > > ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ > > __typeof__(_expected) __exp = (_expected); \ > > ^~~~~~~~~ > > seccomp_bpf.c:1792:2: note: in expansion of macro ‘EXPECT_EQ’ > > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > > ^~~~~~~~~ > > seccomp_bpf.c:1792:20: note: each undeclared identifier is reported only once for each function it appears in > > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > > ^ > > ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ > > __typeof__(_expected) __exp = (_expected); \ > > ^~~~~~~~~ > > seccomp_bpf.c:1792:2: note: in expansion of macro ‘EXPECT_EQ’ > > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > > ^~~~~~~~~ > > seccomp_bpf.c:1793:6: error: ‘PTRACE_EVENTMSG_SYSCALL_EXIT’ undeclared (first use in this function); did you mean ‘PTRACE_EVENTMSG_SYSCALL_ENTRY’? > > : PTRACE_EVENTMSG_SYSCALL_EXIT, msg); > > ^ > > ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ > > __typeof__(_expected) __exp = (_expected); \ > > ^~~~~~~~~ > > seccomp_bpf.c:1792:2: note: in expansion of macro ‘EXPECT_EQ’ > > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > > ^~~~~~~~~ > > > > Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace") > > I think this Fixes line is incorrect and should be changed to: > > Fixes: 201766a20e30 ("ptrace: add PTRACE_GET_SYSCALL_INFO request") > > With that changed, > > Reviewed-by: Tyler Hicks <tyhicks@canonical.com> This is actually fixed in -next already (and, yes, with the Fixes line Tyler has mentioned): https://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest.git/commit/?h=next&id=69b2d3c5924273a0ae968d3818210fc57a1b9d07 -- Kees Cook ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 2/4] seccomp: add two missing ptrace ifdefines 2019-09-18 17:33 ` Kees Cook @ 2019-09-19 10:42 ` Dmitry V. Levin 2019-09-19 16:55 ` Kees Cook 0 siblings, 1 reply; 10+ messages in thread From: Dmitry V. Levin @ 2019-09-19 10:42 UTC (permalink / raw) To: Kees Cook Cc: Tyler Hicks, Christian Brauner, luto, jannh, wad, shuah, ast, daniel, kafai, songliubraving, yhs, linux-kernel, linux-kselftest, netdev, bpf, Tycho Andersen, stable On Wed, Sep 18, 2019 at 10:33:09AM -0700, Kees Cook wrote: > On Wed, Sep 18, 2019 at 11:15:12AM +0200, Tyler Hicks wrote: > > On 2019-09-18 10:48:31, Christian Brauner wrote: > > > Add tw missing ptrace ifdefines to avoid compilation errors on systems > > > that do not provide PTRACE_EVENTMSG_SYSCALL_ENTRY or > > > PTRACE_EVENTMSG_SYSCALL_EXIT or: > > > > > > gcc -Wl,-no-as-needed -Wall seccomp_bpf.c -lpthread -o seccomp_bpf > > > In file included from seccomp_bpf.c:52:0: > > > seccomp_bpf.c: In function ‘tracer_ptrace’: > > > seccomp_bpf.c:1792:20: error: ‘PTRACE_EVENTMSG_SYSCALL_ENTRY’ undeclared (first use in this function); did you mean ‘PTRACE_EVENT_CLONE’? > > > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > > > ^ > > > ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ > > > __typeof__(_expected) __exp = (_expected); \ > > > ^~~~~~~~~ > > > seccomp_bpf.c:1792:2: note: in expansion of macro ‘EXPECT_EQ’ > > > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > > > ^~~~~~~~~ > > > seccomp_bpf.c:1792:20: note: each undeclared identifier is reported only once for each function it appears in > > > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > > > ^ > > > ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ > > > __typeof__(_expected) __exp = (_expected); \ > > > ^~~~~~~~~ > > > seccomp_bpf.c:1792:2: note: in expansion of macro ‘EXPECT_EQ’ > > > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > > > ^~~~~~~~~ > > > seccomp_bpf.c:1793:6: error: ‘PTRACE_EVENTMSG_SYSCALL_EXIT’ undeclared (first use in this function); did you mean ‘PTRACE_EVENTMSG_SYSCALL_ENTRY’? > > > : PTRACE_EVENTMSG_SYSCALL_EXIT, msg); > > > ^ > > > ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ > > > __typeof__(_expected) __exp = (_expected); \ > > > ^~~~~~~~~ > > > seccomp_bpf.c:1792:2: note: in expansion of macro ‘EXPECT_EQ’ > > > EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY > > > ^~~~~~~~~ > > > > > > Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace") > > > > I think this Fixes line is incorrect and should be changed to: > > > > Fixes: 201766a20e30 ("ptrace: add PTRACE_GET_SYSCALL_INFO request") > > > > With that changed, > > > > Reviewed-by: Tyler Hicks <tyhicks@canonical.com> > > This is actually fixed in -next already (and, yes, with the Fixes line > Tyler has mentioned): > > https://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest.git/commit/?h=next&id=69b2d3c5924273a0ae968d3818210fc57a1b9d07 Excuse me, does it mean that you expect each selftest to be self-hosted? I was (and still is) under impression that selftests should be built with headers installed from the tree. Is it the case, or is it not? -- ldv ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 2/4] seccomp: add two missing ptrace ifdefines 2019-09-19 10:42 ` Dmitry V. Levin @ 2019-09-19 16:55 ` Kees Cook 2019-09-19 17:04 ` shuah 2019-09-19 18:30 ` Dmitry V. Levin 0 siblings, 2 replies; 10+ messages in thread From: Kees Cook @ 2019-09-19 16:55 UTC (permalink / raw) To: Dmitry V. Levin Cc: Tyler Hicks, Christian Brauner, luto, jannh, wad, shuah, ast, daniel, kafai, songliubraving, yhs, linux-kernel, linux-kselftest, netdev, bpf, Tycho Andersen, stable On Thu, Sep 19, 2019 at 01:42:51PM +0300, Dmitry V. Levin wrote: > On Wed, Sep 18, 2019 at 10:33:09AM -0700, Kees Cook wrote: > > This is actually fixed in -next already (and, yes, with the Fixes line > > Tyler has mentioned): > > > > https://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest.git/commit/?h=next&id=69b2d3c5924273a0ae968d3818210fc57a1b9d07 > > Excuse me, does it mean that you expect each selftest to be self-hosted? > I was (and still is) under impression that selftests should be built > with headers installed from the tree. Is it the case, or is it not? As you know (but to give others some context) there is a long-standing bug in the selftest build environment that causes these problems (it isn't including the uAPI headers) which you'd proposed to be fixed recently[1]. Did that ever get sent as a "real" patch? I don't see it in Shuah's tree; can you send it to Shuah? But even with that fixed, since the seccomp selftest has a history of being built stand-alone, I've continued to take these kinds of fixes. -Kees [1] https://lore.kernel.org/lkml/20190805094719.GA1693@altlinux.org/ -- Kees Cook ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 2/4] seccomp: add two missing ptrace ifdefines 2019-09-19 16:55 ` Kees Cook @ 2019-09-19 17:04 ` shuah 2019-09-19 18:30 ` Dmitry V. Levin 1 sibling, 0 replies; 10+ messages in thread From: shuah @ 2019-09-19 17:04 UTC (permalink / raw) To: Kees Cook, Dmitry V. Levin Cc: Tyler Hicks, Christian Brauner, luto, jannh, wad, ast, daniel, kafai, songliubraving, yhs, linux-kernel, linux-kselftest, netdev, bpf, Tycho Andersen, stable, shuah On 9/19/19 10:55 AM, Kees Cook wrote: > On Thu, Sep 19, 2019 at 01:42:51PM +0300, Dmitry V. Levin wrote: >> On Wed, Sep 18, 2019 at 10:33:09AM -0700, Kees Cook wrote: >>> This is actually fixed in -next already (and, yes, with the Fixes line >>> Tyler has mentioned): >>> >>> https://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest.git/commit/?h=next&id=69b2d3c5924273a0ae968d3818210fc57a1b9d07 >> >> Excuse me, does it mean that you expect each selftest to be self-hosted? >> I was (and still is) under impression that selftests should be built >> with headers installed from the tree. Is it the case, or is it not? > > As you know (but to give others some context) there is a long-standing > bug in the selftest build environment that causes these problems (it > isn't including the uAPI headers) which you'd proposed to be fixed > recently[1]. Did that ever get sent as a "real" patch? I don't see it > in Shuah's tree; can you send it to Shuah? > > But even with that fixed, since the seccomp selftest has a history of > being built stand-alone, I've continued to take these kinds of fixes. > > -Kees > > [1] https://lore.kernel.org/lkml/20190805094719.GA1693@altlinux.org/ > It has been sent to kselftest list yesterday. I will pull this in for my next update. thanks, -- Shuah ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 2/4] seccomp: add two missing ptrace ifdefines 2019-09-19 16:55 ` Kees Cook 2019-09-19 17:04 ` shuah @ 2019-09-19 18:30 ` Dmitry V. Levin 1 sibling, 0 replies; 10+ messages in thread From: Dmitry V. Levin @ 2019-09-19 18:30 UTC (permalink / raw) To: Kees Cook Cc: Tyler Hicks, Christian Brauner, luto, jannh, wad, shuah, ast, daniel, kafai, songliubraving, yhs, linux-kernel, linux-kselftest, netdev, bpf, Tycho Andersen, stable On Thu, Sep 19, 2019 at 09:55:30AM -0700, Kees Cook wrote: > On Thu, Sep 19, 2019 at 01:42:51PM +0300, Dmitry V. Levin wrote: > > On Wed, Sep 18, 2019 at 10:33:09AM -0700, Kees Cook wrote: > > > This is actually fixed in -next already (and, yes, with the Fixes line > > > Tyler has mentioned): > > > > > > https://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest.git/commit/?h=next&id=69b2d3c5924273a0ae968d3818210fc57a1b9d07 > > > > Excuse me, does it mean that you expect each selftest to be self-hosted? > > I was (and still is) under impression that selftests should be built > > with headers installed from the tree. Is it the case, or is it not? > > As you know (but to give others some context) there is a long-standing > bug in the selftest build environment that causes these problems (it > isn't including the uAPI headers) which you'd proposed to be fixed > recently[1]. Did that ever get sent as a "real" patch? I don't see it > in Shuah's tree; can you send it to Shuah? > > [1] https://lore.kernel.org/lkml/20190805094719.GA1693@altlinux.org/ The [1] was an idea rather than a patch, it didn't take arch uapi headers into account. OK, I'll try to come up with a proper fix then. -- ldv ^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH 3/4] seccomp: avoid overflow in implicit constant conversion [not found] <20190918084833.9369-1-christian.brauner@ubuntu.com> 2019-09-18 8:48 ` [PATCH 2/4] seccomp: add two missing ptrace ifdefines Christian Brauner @ 2019-09-18 8:48 ` Christian Brauner 2019-09-18 10:01 ` Tyler Hicks 2019-09-18 8:48 ` [PATCH 4/4] seccomp: test SECCOMP_RET_USER_NOTIF_ALLOW Christian Brauner 2 siblings, 1 reply; 10+ messages in thread From: Christian Brauner @ 2019-09-18 8:48 UTC (permalink / raw) To: keescook, luto Cc: jannh, wad, shuah, ast, daniel, kafai, songliubraving, yhs, linux-kernel, linux-kselftest, netdev, bpf, Christian Brauner, Tycho Andersen, Tyler Hicks, stable USER_NOTIF_MAGIC is assigned to int variables in this test so set it to INT_MAX to avoid warnings: seccomp_bpf.c: In function ‘user_notification_continue’: seccomp_bpf.c:3088:26: warning: overflow in implicit constant conversion [-Woverflow] #define USER_NOTIF_MAGIC 116983961184613L ^ seccomp_bpf.c:3572:15: note: in expansion of macro ‘USER_NOTIF_MAGIC’ resp.error = USER_NOTIF_MAGIC; ^~~~~~~~~~~~~~~~ Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace") Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Cc: Kees Cook <keescook@chromium.org> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Will Drewry <wad@chromium.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Martin KaFai Lau <kafai@fb.com> Cc: Song Liu <songliubraving@fb.com> Cc: Yonghong Song <yhs@fb.com> Cc: Tycho Andersen <tycho@tycho.ws> CC: Tyler Hicks <tyhicks@canonical.com> Cc: Jann Horn <jannh@google.com> Cc: stable@vger.kernel.org Cc: linux-kselftest@vger.kernel.org Cc: netdev@vger.kernel.org Cc: bpf@vger.kernel.org --- tools/testing/selftests/seccomp/seccomp_bpf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c index ee52eab01800..921f0e26f835 100644 --- a/tools/testing/selftests/seccomp/seccomp_bpf.c +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c @@ -35,6 +35,7 @@ #include <stdbool.h> #include <string.h> #include <time.h> +#include <limits.h> #include <linux/elf.h> #include <sys/uio.h> #include <sys/utsname.h> @@ -3080,7 +3081,7 @@ static int user_trap_syscall(int nr, unsigned int flags) return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog); } -#define USER_NOTIF_MAGIC 116983961184613L +#define USER_NOTIF_MAGIC INT_MAX TEST(user_notification_basic) { pid_t pid; -- 2.23.0 ^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH 3/4] seccomp: avoid overflow in implicit constant conversion 2019-09-18 8:48 ` [PATCH 3/4] seccomp: avoid overflow in implicit constant conversion Christian Brauner @ 2019-09-18 10:01 ` Tyler Hicks 0 siblings, 0 replies; 10+ messages in thread From: Tyler Hicks @ 2019-09-18 10:01 UTC (permalink / raw) To: Christian Brauner Cc: keescook, luto, jannh, wad, shuah, ast, daniel, kafai, songliubraving, yhs, linux-kernel, linux-kselftest, netdev, bpf, Tycho Andersen, stable On 2019-09-18 10:48:32, Christian Brauner wrote: > USER_NOTIF_MAGIC is assigned to int variables in this test so set it to INT_MAX > to avoid warnings: > > seccomp_bpf.c: In function ‘user_notification_continue’: > seccomp_bpf.c:3088:26: warning: overflow in implicit constant conversion [-Woverflow] > #define USER_NOTIF_MAGIC 116983961184613L > ^ > seccomp_bpf.c:3572:15: note: in expansion of macro ‘USER_NOTIF_MAGIC’ > resp.error = USER_NOTIF_MAGIC; > ^~~~~~~~~~~~~~~~ > > Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace") > Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> > Cc: Kees Cook <keescook@chromium.org> > Cc: Andy Lutomirski <luto@amacapital.net> > Cc: Will Drewry <wad@chromium.org> > Cc: Shuah Khan <shuah@kernel.org> > Cc: Alexei Starovoitov <ast@kernel.org> > Cc: Daniel Borkmann <daniel@iogearbox.net> > Cc: Martin KaFai Lau <kafai@fb.com> > Cc: Song Liu <songliubraving@fb.com> > Cc: Yonghong Song <yhs@fb.com> > Cc: Tycho Andersen <tycho@tycho.ws> > CC: Tyler Hicks <tyhicks@canonical.com> INT_MAX should be a safe value to use. Reviewed-by: Tyler Hicks <tyhicks@canonical.com> Tyler > Cc: Jann Horn <jannh@google.com> > Cc: stable@vger.kernel.org > Cc: linux-kselftest@vger.kernel.org > Cc: netdev@vger.kernel.org > Cc: bpf@vger.kernel.org > --- > tools/testing/selftests/seccomp/seccomp_bpf.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c > index ee52eab01800..921f0e26f835 100644 > --- a/tools/testing/selftests/seccomp/seccomp_bpf.c > +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c > @@ -35,6 +35,7 @@ > #include <stdbool.h> > #include <string.h> > #include <time.h> > +#include <limits.h> > #include <linux/elf.h> > #include <sys/uio.h> > #include <sys/utsname.h> > @@ -3080,7 +3081,7 @@ static int user_trap_syscall(int nr, unsigned int flags) > return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog); > } > > -#define USER_NOTIF_MAGIC 116983961184613L > +#define USER_NOTIF_MAGIC INT_MAX > TEST(user_notification_basic) > { > pid_t pid; > -- > 2.23.0 > ^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH 4/4] seccomp: test SECCOMP_RET_USER_NOTIF_ALLOW [not found] <20190918084833.9369-1-christian.brauner@ubuntu.com> 2019-09-18 8:48 ` [PATCH 2/4] seccomp: add two missing ptrace ifdefines Christian Brauner 2019-09-18 8:48 ` [PATCH 3/4] seccomp: avoid overflow in implicit constant conversion Christian Brauner @ 2019-09-18 8:48 ` Christian Brauner 2 siblings, 0 replies; 10+ messages in thread From: Christian Brauner @ 2019-09-18 8:48 UTC (permalink / raw) To: keescook, luto Cc: jannh, wad, shuah, ast, daniel, kafai, songliubraving, yhs, linux-kernel, linux-kselftest, netdev, bpf, Christian Brauner, Tycho Andersen, Tyler Hicks, stable Test whether a syscall can be performed after having been intercepted by the seccomp notifier. The test uses dup() and kcmp() since it allows us to nicely test whether the dup() syscall actually succeeded by comparing whether the fd refers to the same underlying struct file. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Cc: Kees Cook <keescook@chromium.org> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Will Drewry <wad@chromium.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Martin KaFai Lau <kafai@fb.com> Cc: Song Liu <songliubraving@fb.com> Cc: Yonghong Song <yhs@fb.com> Cc: Tycho Andersen <tycho@tycho.ws> CC: Tyler Hicks <tyhicks@canonical.com> Cc: Jann Horn <jannh@google.com> Cc: stable@vger.kernel.org Cc: linux-kselftest@vger.kernel.org Cc: netdev@vger.kernel.org Cc: bpf@vger.kernel.org --- tools/testing/selftests/seccomp/seccomp_bpf.c | 99 +++++++++++++++++++ 1 file changed, 99 insertions(+) diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c index 921f0e26f835..788d7e9007d5 100644 --- a/tools/testing/selftests/seccomp/seccomp_bpf.c +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c @@ -44,6 +44,7 @@ #include <sys/times.h> #include <sys/socket.h> #include <sys/ioctl.h> +#include <linux/kcmp.h> #include <unistd.h> #include <sys/syscall.h> @@ -175,6 +176,10 @@ struct seccomp_metadata { #define SECCOMP_RET_USER_NOTIF 0x7fc00000U +#ifndef SECCOMP_RET_USER_NOTIF_ALLOW +#define SECCOMP_RET_USER_NOTIF_ALLOW 0x00000001 +#endif + #define SECCOMP_IOC_MAGIC '!' #define SECCOMP_IO(nr) _IO(SECCOMP_IOC_MAGIC, nr) #define SECCOMP_IOR(nr, type) _IOR(SECCOMP_IOC_MAGIC, nr, type) @@ -3489,6 +3494,100 @@ TEST(seccomp_get_notif_sizes) EXPECT_EQ(sizes.seccomp_notif_resp, sizeof(struct seccomp_notif_resp)); } +static int filecmp(pid_t pid1, pid_t pid2, int fd1, int fd2) +{ +#ifdef __NR_kcmp + return syscall(__NR_kcmp, pid1, pid2, KCMP_FILE, fd1, fd2); +#else + errno = ENOSYS; + return -1; +#endif +} + +TEST(user_notification_continue) +{ + pid_t pid; + long ret; + int status, listener; + struct seccomp_notif req = {}; + struct seccomp_notif_resp resp = {}; + struct pollfd pollfd; + + ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); + ASSERT_EQ(0, ret) { + TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); + } + + listener = user_trap_syscall(__NR_dup, SECCOMP_FILTER_FLAG_NEW_LISTENER); + ASSERT_GE(listener, 0); + + pid = fork(); + ASSERT_GE(pid, 0); + + if (pid == 0) { + int dup_fd, pipe_fds[2]; + pid_t self; + + ret = pipe(pipe_fds); + if (ret < 0) + exit(EXIT_FAILURE); + + dup_fd = dup(pipe_fds[0]); + if (dup_fd < 0) + exit(EXIT_FAILURE); + + self = getpid(); + + ret = filecmp(self, self, pipe_fds[0], dup_fd); + if (ret) + exit(EXIT_FAILURE); + + exit(EXIT_SUCCESS); + } + + pollfd.fd = listener; + pollfd.events = POLLIN | POLLOUT; + + EXPECT_GT(poll(&pollfd, 1, -1), 0); + EXPECT_EQ(pollfd.revents, POLLIN); + + EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); + + pollfd.fd = listener; + pollfd.events = POLLIN | POLLOUT; + + EXPECT_GT(poll(&pollfd, 1, -1), 0); + EXPECT_EQ(pollfd.revents, POLLOUT); + + EXPECT_EQ(req.data.nr, __NR_dup); + + resp.id = req.id; + resp.flags = SECCOMP_RET_USER_NOTIF_ALLOW; + + /* check that if (flags & SECCOMP_RET_USER_NOTIF_ALLOW) the rest is 0 */ + resp.error = 0; + resp.val = USER_NOTIF_MAGIC; + EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1); + EXPECT_EQ(errno, EINVAL); + + resp.error = USER_NOTIF_MAGIC; + resp.val = 0; + EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), -1); + EXPECT_EQ(errno, EINVAL); + + resp.error = 0; + resp.val = 0; + EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0) { + if (errno == EINVAL) + XFAIL(goto skip, "Kernel does not support SECCOMP_RET_USER_NOTIF_ALLOW"); + } + +skip: + EXPECT_EQ(waitpid(pid, &status, 0), pid); + EXPECT_EQ(true, WIFEXITED(status)); + EXPECT_EQ(0, WEXITSTATUS(status)); +} + /* * TODO: * - add microbenchmarks -- 2.23.0 ^ permalink raw reply related [flat|nested] 10+ messages in thread
end of thread, other threads:[~2019-09-19 18:30 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20190918084833.9369-1-christian.brauner@ubuntu.com>
2019-09-18 8:48 ` [PATCH 2/4] seccomp: add two missing ptrace ifdefines Christian Brauner
2019-09-18 9:15 ` Tyler Hicks
2019-09-18 17:33 ` Kees Cook
2019-09-19 10:42 ` Dmitry V. Levin
2019-09-19 16:55 ` Kees Cook
2019-09-19 17:04 ` shuah
2019-09-19 18:30 ` Dmitry V. Levin
2019-09-18 8:48 ` [PATCH 3/4] seccomp: avoid overflow in implicit constant conversion Christian Brauner
2019-09-18 10:01 ` Tyler Hicks
2019-09-18 8:48 ` [PATCH 4/4] seccomp: test SECCOMP_RET_USER_NOTIF_ALLOW Christian Brauner
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).