On Tue, Jul 28, 2026 at 10:11:21AM +0800, Jinjie Ruan wrote: > As Kees suggested, add a test that verifies that seccomp observes the > correct first argument after a ptracer modifies x0 at a syscall-enter-stop > on arm64.
This change is now in -next and is breaking the build on Arm's internal
KernelCI instance, the same thing can also be seen on at least upstream
KernelCI mixed in with extra issues due to what looks like a
missing/failed headers_install - I'll report the infra aspects of that
separately:
CC seccomp_ptrace_x0_bypass
seccomp_ptrace_x0_bypass.c: In function ‘do_child’:
seccomp_ptrace_x0_bypass.c:67:28: error: array type has incomplete element type
‘struct sock_filter’
67 | struct sock_filter filter[] = {
| ^~~~~~
seccomp_ptrace_x0_bypass.c:68:17: warning: implicit declaration of function
‘BPF_STMT’; did you mean ‘BPF_STX’? [-Wimplicit-function-declaration]
68 | BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct
seccomp_data, nr)), /* nr */
| ^~~~~~~~
| BPF_STX
seccomp_ptrace_x0_bypass.c:69:17: warning: implicit declaration of function
‘BPF_JUMP’; did you mean ‘BPF_JMP’? [-Wimplicit-function-declaration]
69 | BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_write, 0, 3),
| ^~~~~~~~
| BPF_JMP
seccomp_ptrace_x0_bypass.c:75:16: error: variable ‘prog’ has initializer but
incomplete type
75 | struct sock_fprog prog = {
| ^~~~~~~~~~
seccomp_ptrace_x0_bypass.c:76:18: error: ‘struct sock_fprog’ has no member
named ‘len’
76 | .len = ARRAY_SIZE(filter),
| ^~~
In file included from seccomp_ptrace_x0_bypass.c:38:
/tmp/kci/linux/tools/testing/selftests/kselftest.h:64:25: warning: excess
elements in struct initializer
64 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
| ^
seccomp_ptrace_x0_bypass.c:76:24: note: in expansion of macro ‘ARRAY_SIZE’
76 | .len = ARRAY_SIZE(filter),
| ^~~~~~~~~~
/tmp/kci/linux/tools/testing/selftests/kselftest.h:64:25: note: (near
initialization for ‘prog’)
64 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
| ^
seccomp_ptrace_x0_bypass.c:76:24: note: in expansion of macro ‘ARRAY_SIZE’
76 | .len = ARRAY_SIZE(filter),
| ^~~~~~~~~~
seccomp_ptrace_x0_bypass.c:77:18: error: ‘struct sock_fprog’ has no member
named ‘filter’
77 | .filter = filter,
| ^~~~~~
seccomp_ptrace_x0_bypass.c:77:27: warning: excess elements in struct initializer
77 | .filter = filter,
| ^~~~~~
seccomp_ptrace_x0_bypass.c:77:27: note: (near initialization for ‘prog’)
seccomp_ptrace_x0_bypass.c:75:27: error: storage size of ‘prog’ isn’t known
75 | struct sock_fprog prog = {
| ^~~~
seccomp_ptrace_x0_bypass.c:75:27: warning: unused variable ‘prog’
[-Wunused-variable]
seccomp_ptrace_x0_bypass.c:67:28: warning: unused variable ‘filter’
[-Wunused-variable]
67 | struct sock_filter filter[] = {
> --- /dev/null
> +++ b/tools/testing/selftests/arm64/abi/seccomp_ptrace_x0_bypass.c
> @@ -0,0 +1,195 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * Test that seccomp, tracepoints and audit observe the correct syscall
> + * arguments after a ptracer has modified them at syscall-enter-stop.
> +#include <linux/filter.h>
The relevant definitions ought to be being picked up from here, there's
a copy of a current version in tools/include and has been for a while
(since at least v6.18) but there's no Makefile update to ensure that
gets picked up.
> +#ifndef __NR_write
> +#define __NR_write 64
> +#endif
That's... interesting.
signature.asc
Description: PGP signature
