summaryrefslogtreecommitdiff
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
...
* tests: change test 55 to use syscall names rather than numbersTom Hromatka2020-03-102-1182/+233
| | | | | | | | | | | | Previously test 55, basic-pfc_binary_tree, used syscall numbers to build a large binary tree. This is problematic on architectures that have sparsely populated syscall numbers. This commit modifies the test to use syscall names to build up a realistic binary tree that should work on all architectures. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: change test 53 to use syscall names rather than numbersTom Hromatka2020-03-103-366/+176
| | | | | | | | | | | | Previously test 53, sim-binary_tree, used syscall numbers to build a large binary tree. This is problematic on architectures that have sparsely populated syscall numbers. This commit modifies the test to use syscall names to build up a realistic binary tree that should work on all architectures. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add tests for the binary treeTom Hromatka2020-02-2813-4/+2067
| | | | | | | | This commit adds tests to ensure the validity of the binary tree and the resultant pfc and bpf output. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: Add RISC-V 64-bit supportAndreas Schwab2020-02-236-2/+16
| | | | | | Signed-off-by: Andreas Schwab <schwab@suse.de> [PM: minor macro shuffling in seccomp.h.in] Signed-off-by: Paul Moore <paul@paul-moore.com>
* travis: avoid running live python tests in TravisCIChris Waldon2020-01-201-0/+4
| | | | | Signed-off-by: Chris Waldon <chris.waldon@ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: rely on __SNR_xxx instead of __NR_xxx for syscallsPaul Moore2019-11-201-3/+3
| | | | | | | | We recently changed how libseccomp handles syscall numbers that are not defined natively, but we missed test #15. Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: introduce a simple seccomp_load() test as part of the non-live testsPaul Moore2019-11-135-3/+105
| | | | | | | | | | | | | | This is a bit controversial as historically we've refrained from doing any tests that rely on the host kernel in the non-live tests, but I think enough time has past that we can do a simple seccomp_load() and not break the world's build/test platforms. The obvious big advantage is we are now testing the basic prctl()/seccomp() filter load infrastructure as part of the main regression test run. Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add some additional test code to boost our code coveragePaul Moore2019-11-133-4/+34
| | | | | Acked-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add notification testsPaul Moore2019-05-037-4/+190
| | | | | | | Some of this was taken from Tycho's original patch. Signed-off-by: Tycho Andersen <tycho@tycho.ws> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: fix a error message typo in 13-basic-attrs.pyPaul Moore2019-04-301-1/+1
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* api: rename SCMP_FLTATR_SPEC_ALLOW to SCMP_FLTATR_CTL_SSBPaul Moore2019-04-292-7/+5
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* api: add support for the SPEC_ALLOW flagTycho Andersen2019-04-292-2/+19
| | | | | Signed-off-by: Tycho Andersen <tycho@tycho.ws> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: only run test 50 on x86_64Paul Moore2019-04-171-8/+8
| | | | | | | | | | Because of the way libseccomp handles non-native arch translations we can't use arbitrary syscalls, e.g. 1000; we need to use syscalls that are defined in the libseccomp syscall tables. Unfortunately, changing the syscalls from 1000/1001 to a defined syscall appears to break the test so let's just limit it to x86_64 for now. Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: Add 50-sim-hash_collision testTom Hromatka2019-04-165-3/+184
| | | | | | | | | | | | libseccomp utilizes a hash table to manage BPF blocks. It currently employs MurmurHash3 where the key is the hashed values of the BPF instruction blocks, the accumulator start, and the accumulator end. This test was added because of a mishandled hash collision reported by Tor in GitHub issue #148. * https://github.com/seccomp/libseccomp/issues/148 Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add LT tests to 43-sim-a2_orderPaul Moore2019-03-143-5/+74
| | | | | | | We want to be able to test proper ordering for both LT and GT comparisons. Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add 48-sim-64b_comparisonsPaul Moore2019-03-145-3/+133
| | | | | | Based on some initial tests from Jann Horn. Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: update 38-basic-pfc_coveragePaul Moore2019-03-141-30/+59
| | | | | | | | | | Based on the recent 64-bit argument comparison fixes, we need to update test 38-basic-pfc_coverage. A special thanks to Jann Horn for bringing this problem to our attention. Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: fix some issues found by coverityPaul Moore2019-03-122-11/+8
| | | | | | | None of these are major, and they are all part of the tests, but we should fix them regardless. Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: make use of the new 32-bit test filtersPaul Moore2019-03-041-18/+18
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add support for 32-bit and 64-bit test filteringPaul Moore2019-03-041-0/+36
| | | | | | | Add "[+]all_32" and "[+]all_64" which work the same as the little and big endian test filters. Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: disable a number of tests on the x32 archroot2019-03-0411-145/+145
| | | | | | | Unfortunately a number of our automated tests fail because of the x32 syscall bit, making low numbered syscalls invalid. Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add 48-sim-32b_args to the .gitignore filePaul Moore2019-03-041-0/+1
| | | | | | We forgot to do this earlier, fix it. Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: fix a number of problems with the tests on a 32-bit x86 systemroot2019-03-014-19/+25
| | | | | | Verified on a 32-bit x86 Ubuntu 16.04.6 system. Signed-off-by: Paul Moore <paul@paul-moore.com>
* api: provide 32-bit friendly argument comparison macrosPaul Moore2019-02-214-3/+178
| | | | | | | | | | | | | | | | | We have a longstanding issue with 32-bit to 64-bit sign extension inadvertently resulting in bogus syscall argument extensions. This patch introduces a new set of argument comparison macros which limit the argument values to 32-bit values so that we don't run into problems with sign extension. We use the macro overloading proposed by Roman at https://kecher.net/overloading-macros/ to retain the feature of these macros being usable as static initializers. Thanks to @jdstrand on GitHub for reporting the problem. Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
* tests: add an API level check to the live testsPaul Moore2018-09-227-16/+28
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add openat() to the syscall whitelist in test 44Paul Moore2018-09-192-0/+4
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: Add tests for SECCOMP_RET_KILL_PROCESSTom Hromatka2018-09-1915-6/+360
| | | | | | | | This addresses GitHub Issue #96 - RFE: add support for SECCOMP_RET_KILL_PROCESS Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* pfc: fix PFC export hang on prioritized syscall with no rules (GH issue #117)Tom Hromatka2018-09-191-0/+5
| | | | | | | | | | | | github user @varqox reported that generating PFC will hang if the libseccomp filter contains a syscalle with a priority but no rule set. The root cause is the while() loop in gen_pfc.c that walks through the filter's syscalls. It wasn't properly advancing through the list when p_iter was invalid. Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> [PM: fix a comment in the test] Signed-off-by: Paul Moore <paul@paul-moore.com>
* build: enable distcheck'ing for the python codePaul Moore2018-05-102-1/+7
| | | | | | | | I'm not particularly proud of the seccomp.pyx hack, but it works, and enabling the python bindings during the distcheck is definitely the "Greater Good". Signed-off-by: Paul Moore <paul@paul-moore.com>
* all: fixup all the file permissionsPaul Moore2018-05-104-0/+0
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add tests for db_chain_lt()Tom Hromatka2018-04-055-3/+179
| | | | | | | Add a test to improve the test coverage for db_chain_lt(). Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> [PM: stripped the conversion from a macro to function, kept the test] Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: added tests for the A2 ordering bug (GH issue #112)Tom Hromatka2018-04-058-3/+483
| | | | | | Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com> [PM: subject line tweaks] Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: update the python testsPaul Moore2018-01-171-2/+2
| | | | | | | Commit ce3dda9a1747 ("all: massive src/db.c rework") failed to update the python tests to match the native/C tests; this patch fixes that oversight. Signed-off-by: Paul Moore <paul@paul-moore.com>
* all: massive src/db.c reworkPaul Moore2018-01-173-4/+6
| | | | | | | | | | | | | | | | | | | First, and most importantly, let me state that this is perhaps the worst possible example of a patch I can think of, and if anyone tries to submit a PR/patch like this one I will reject it almost immediately. I'm only merging this because 1) this patch escalated quickly, 2) splitting it would require a disproportionate amount of time, and 3) this effort had blocked other work for too long ... and, well, I'm the maintainer. Consider this a bit of "maintainer privilege" if you will. This patch started simply enough: the goal was to add/augment some tests to help increase the libseccomp test coverage. Unfortunately, this particular test improvement uncovered a rather tricky bug which escalated quite quickly and soon involved a major rework of how we build the filter tree in src/db.c. This rework brought about changes throughout the repository, including the transaction and ABI specific code. Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add some advanced syscall argument chain tests via 40-sim-adv_chainsPaul Moore2018-01-175-3/+385
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add a test to check for syscall priority function on non-native ABIsPaul Moore2018-01-175-3/+133
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: exercise removing multiple ABIs from a filterPaul Moore2018-01-171-0/+29
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: test for invalid filter attributesPaul Moore2018-01-171-0/+12
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: fix the live Python testsPaul Moore2018-01-103-0/+3
| | | | | | | Add the sigaltstack(2) syscall to the list of allowed syscalls; tested against Python v3.6.4. Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add test for SCMP_ACT_LOG of all syscallsTyler Hicks2017-11-015-3/+134
| | | | | | | Test SCMP_ACT_LOG as the default action which all syscalls trigger. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: add SCMP_ACT_LOG test to 06-sim-actionsTyler Hicks2017-11-013-8/+22
| | | | | | | | | | Extend the 06-sim-actions set of tests to include tests for SCMP_ACT_LOG. The CTL_KCHECKACTS global attribute must be set to prevent test errors when running under an old kernel that doesn't support SECCOMP_RET_LOG. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: test suite infrastructure changes for SCMP_ACT_LOGTyler Hicks2017-11-012-0/+7
| | | | | | | | The basics needed to handle tests that use the new SCMP_ACT_LOG action. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* all: add support for new log filter flagTyler Hicks2017-11-014-4/+36
| | | | | | | | | | Extend libseccomp to support SECCOMP_FILTER_FLAG_LOG, which is intended to cause log events for all actions taken by a filter except for SCMP_ACT_ALLOW actions. This is done via a new filter attribute called SCMP_FLTATR_CTL_LOG that is off by default. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* python: Expose API level functionalityTyler Hicks2017-10-191-3/+31
| | | | | | | | Allow Python applications to get and set the API level using global functions. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: Improve seccomp_api_set() test coverageTyler Hicks2017-10-191-0/+16
| | | | | | | | Test setting all of the valid API levels and then test an invalid API level to ensure that seccomp_api_set() fails. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: Add new API level test binary to gitignoreTyler Hicks2017-10-171-0/+1
| | | | | Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* api: create an API level construct as part of the supported APIPaul Moore2017-09-214-2/+94
| | | | | | | | | | | | | | | | | | | This patch adds the concept of "API levels" which are a way of indicating what functionality is supported at runtime. There are two new API functions added, as explained by the manpage: "The seccomp_api_get() function returns an integer representing the functionality ("API level") provided by the current running kernel. It is important to note that while seccomp_api_get() can be called multiple times, the kernel is only probed the first time to see what functionality is supported, all following calls to seccomp_api_get() return a cached value. The seccomp_api_set() function allows callers to force the API level to the provided value; however, this is almost always a bad idea and use of this function is strongly discouraged." Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: fix conditional that was skipping all basic python testsTyler Hicks2017-09-121-1/+1
| | | | | | | | | | | A conditional added in ec6f45ab was incorrectly comparing the (empty) stdout of grep -q against 0, which always evaluated to be true and skipped the basic python tests. Fix it by using bash's pattern matching. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: we can't run fuzz tests on non-native filtersPaul Moore2017-02-271-5/+0
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
* tests: cleanup some comments in 15-sim-negative_onePaul Moore2017-02-271-5/+0
| | | | Signed-off-by: Paul Moore <paul@paul-moore.com>
View Lorry Controller Status