Signed-off-by: Paul Moore <[email protected]> --- tests/.gitignore | 2 + tests/20-live-basic_die.c | 69 +++++++++++++++++++++++++++++++++++ tests/20-live-basic_die.py | 48 +++++++++++++++++++++++++ tests/20-live-basic_die.tests | 13 +++++++ tests/21-live-basic_allow.c | 76 +++++++++++++++++++++++++++++++++++++++ tests/21-live-basic_allow.py | 59 ++++++++++++++++++++++++++++++ tests/21-live-basic_allow.tests | 11 ++++++ tests/Makefile | 4 ++ 8 files changed, 281 insertions(+), 1 deletion(-) create mode 100644 tests/20-live-basic_die.c create mode 100644 tests/20-live-basic_die.py create mode 100644 tests/20-live-basic_die.tests create mode 100644 tests/21-live-basic_allow.c create mode 100644 tests/21-live-basic_allow.py create mode 100644 tests/21-live-basic_allow.tests
diff --git a/tests/.gitignore b/tests/.gitignore index da6eee6..8bbb158 100644 --- a/tests/.gitignore +++ b/tests/.gitignore @@ -20,3 +20,5 @@ util.pyc 17-sim-arch_merge 18-sim-basic_whitelist 19-sim-missing_syscalls +20-live-basic_die +21-live-basic_allow diff --git a/tests/20-live-basic_die.c b/tests/20-live-basic_die.c new file mode 100644 index 0000000..b71e0f5 --- /dev/null +++ b/tests/20-live-basic_die.c @@ -0,0 +1,69 @@ +/** + * Seccomp Library test program + * + * Copyright (c) 2013 Red Hat <[email protected]> + * Author: Paul Moore <[email protected]> + */ + +/* + * This library is free software; you can redistribute it and/or modify it + * under the terms of version 2.1 of the GNU Lesser General Public License as + * published by the Free Software Foundation. + * + * This library is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License + * for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this library; if not, see <http://www.gnu.org/licenses>. + */ + +#include <unistd.h> + +#include <seccomp.h> + +#include "util.h" + +int main(int argc, char *argv[]) +{ + int rc; + int action; + scmp_filter_ctx ctx; + + rc = util_action_parse(argv[1]); + if (rc == -1) + goto out; + action = rc; + + if (action == SCMP_ACT_TRAP) { + rc = util_trap_install(); + if (rc != 0) + goto out; + } + + ctx = seccomp_init(action); + if (ctx == NULL) + goto out; + rc = seccomp_rule_add_exact(ctx, + SCMP_ACT_ALLOW, SCMP_SYS(rt_sigreturn), 0); + if (rc != 0) + goto out; + rc = seccomp_rule_add_exact(ctx, + SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0); + if (rc != 0) + goto out; + rc = seccomp_load(ctx); + if (rc != 0) + goto out; + + rc = util_file_write("/dev/null"); + if (rc != 0) + goto out; + + rc = 160; + +out: + seccomp_release(ctx); + return (rc < 0 ? -rc : rc); +} diff --git a/tests/20-live-basic_die.py b/tests/20-live-basic_die.py new file mode 100644 index 0000000..2b07776 --- /dev/null +++ b/tests/20-live-basic_die.py @@ -0,0 +1,48 @@ +#!/usr/bin/env python + +# +# Seccomp Library test program +# +# Copyright (c) 2013 Red Hat <[email protected]> +# Author: Paul Moore <[email protected]> +# + +# +# This library is free software; you can redistribute it and/or modify it +# under the terms of version 2.1 of the GNU Lesser General Public License as +# published by the Free Software Foundation. +# +# This library is distributed in the hope that it will be useful, but WITHOUT +# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +# FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License +# for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this library; if not, see <http://www.gnu.org/licenses>. +# + +import argparse +import sys + +import util + +from seccomp import * + +def test(): + action = util.parse_action(sys.argv[1]) + if action == TRAP: + util.install_trap() + f = SyscallFilter(action) + f.add_rule_exactly(ALLOW, "rt_sigreturn") + f.add_rule_exactly(ALLOW, "exit_group") + f.load() + try: + util.write_file("/dev/null") + except OSError as ex: + quit(ex.errno) + quit(160) + +test() + +# kate: syntax python; +# kate: indent-mode python; space-indent on; indent-width 4; mixedindent off; diff --git a/tests/20-live-basic_die.tests b/tests/20-live-basic_die.tests new file mode 100644 index 0000000..ac30ae1 --- /dev/null +++ b/tests/20-live-basic_die.tests @@ -0,0 +1,13 @@ +# +# libseccomp regression test automation data +# +# Copyright (c) 2013 Red Hat <[email protected]> +# Author: Paul Moore <[email protected] +# + +test type: live + +# Testname Result +20-live-basic_die KILL +20-live-basic_die TRAP +20-live-basic_die ERRNO diff --git a/tests/21-live-basic_allow.c b/tests/21-live-basic_allow.c new file mode 100644 index 0000000..1496cef --- /dev/null +++ b/tests/21-live-basic_allow.c @@ -0,0 +1,76 @@ +/** + * Seccomp Library test program + * + * Copyright (c) 2013 Red Hat <[email protected]> + * Author: Paul Moore <[email protected]> + */ + +/* + * This library is free software; you can redistribute it and/or modify it + * under the terms of version 2.1 of the GNU Lesser General Public License as + * published by the Free Software Foundation. + * + * This library is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License + * for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this library; if not, see <http://www.gnu.org/licenses>. + */ + +#include <unistd.h> + +#include <seccomp.h> + +#include "util.h" + +int main(int argc, char *argv[]) +{ + int rc; + scmp_filter_ctx ctx; + + rc = util_action_parse(argv[1]); + if (rc != SCMP_ACT_ALLOW) { + rc = 1; + goto out; + } + + rc = util_trap_install(); + if (rc != 0) + goto out; + + ctx = seccomp_init(SCMP_ACT_TRAP); + if (ctx == NULL) + goto out; + rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 0); + if (rc != 0) + goto out; + rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0); + if (rc != 0) + goto out; + rc = seccomp_rule_add_exact(ctx, SCMP_ACT_ALLOW, SCMP_SYS(close), 0); + if (rc != 0) + goto out; + rc = seccomp_rule_add_exact(ctx, + SCMP_ACT_ALLOW, SCMP_SYS(rt_sigreturn), 0); + if (rc != 0) + goto out; + rc = seccomp_rule_add_exact(ctx, + SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0); + if (rc != 0) + goto out; + rc = seccomp_load(ctx); + if (rc != 0) + goto out; + + rc = util_file_write("/dev/null"); + if (rc != 0) + goto out; + + rc = 160; + +out: + seccomp_release(ctx); + return (rc < 0 ? -rc : rc); +} diff --git a/tests/21-live-basic_allow.py b/tests/21-live-basic_allow.py new file mode 100644 index 0000000..1332f2e --- /dev/null +++ b/tests/21-live-basic_allow.py @@ -0,0 +1,59 @@ +#!/usr/bin/env python + +# +# Seccomp Library test program +# +# Copyright (c) 2013 Red Hat <[email protected]> +# Author: Paul Moore <[email protected]> +# + +# +# This library is free software; you can redistribute it and/or modify it +# under the terms of version 2.1 of the GNU Lesser General Public License as +# published by the Free Software Foundation. +# +# This library is distributed in the hope that it will be useful, but WITHOUT +# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +# FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License +# for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this library; if not, see <http://www.gnu.org/licenses>. +# + +import argparse +import sys + +import util + +from seccomp import * + +def test(): + action = util.parse_action(sys.argv[1]) + if not action == ALLOW: + quit(1) + util.install_trap() + f = SyscallFilter(TRAP) + # NOTE: additional syscalls required for python + f.add_rule_exactly(ALLOW, "stat") + f.add_rule_exactly(ALLOW, "fstat") + f.add_rule_exactly(ALLOW, "open") + f.add_rule_exactly(ALLOW, "mmap") + f.add_rule_exactly(ALLOW, "munmap") + f.add_rule_exactly(ALLOW, "read") + f.add_rule_exactly(ALLOW, "write") + f.add_rule_exactly(ALLOW, "close") + f.add_rule_exactly(ALLOW, "rt_sigaction") + f.add_rule_exactly(ALLOW, "rt_sigreturn") + f.add_rule_exactly(ALLOW, "exit_group") + f.load() + try: + util.write_file("/dev/null") + except OSError as ex: + quit(ex.errno) + quit(160) + +test() + +# kate: syntax python; +# kate: indent-mode python; space-indent on; indent-width 4; mixedindent off; diff --git a/tests/21-live-basic_allow.tests b/tests/21-live-basic_allow.tests new file mode 100644 index 0000000..e41e4ef --- /dev/null +++ b/tests/21-live-basic_allow.tests @@ -0,0 +1,11 @@ +# +# libseccomp regression test automation data +# +# Copyright (c) 2013 Red Hat <[email protected]> +# Author: Paul Moore <[email protected] +# + +test type: live + +# Testname Result +21-live-basic_allow ALLOW diff --git a/tests/Makefile b/tests/Makefile index d3f76f6..5d0a16f 100644 --- a/tests/Makefile +++ b/tests/Makefile @@ -54,7 +54,9 @@ TESTS = 01-sim-allow \ 16-sim-arch_basic \ 17-sim-arch_merge \ 18-sim-basic_whitelist \ - 19-sim-missing_syscalls + 19-sim-missing_syscalls \ + 20-live-basic_die \ + 21-live-basic_allow DEPS_OBJS = $(OBJS:%.o=%.d) DEPS_TESTS = $(TESTS:%=%.d) ------------------------------------------------------------------------------ Free Next-Gen Firewall Hardware Offer Buy your Sophos next-gen firewall before the end March 2013 and get the hardware for free! Learn more. http://p.sf.net/sfu/sophos-d2d-feb _______________________________________________ libseccomp-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/libseccomp-discuss
