libcontainer/seccomp/patchbpf/enosys_linux_test.go - third_party/runc - Git at Google

 //go:build cgo && seccomp

 package patchbpf

 import (
 	"bytes"
 	"encoding/binary"
 	"fmt"
 	"testing"

 	"github.com/opencontainers/runc/libcontainer/configs"

 	libseccomp "github.com/seccomp/libseccomp-golang"
 	"golang.org/x/net/bpf"
 )

 type seccompData struct {
 	Syscall uint32 // NOTE: We assume sizeof(int) == 4.
 	Arch    uint32
 	IP      uint64
 	Args    [6]uint64
 }

 // mockSyscallPayload creates a fake seccomp_data struct with the given data.
 func mockSyscallPayload(t *testing.T, sysno libseccomp.ScmpSyscall, arch linuxAuditArch, args ...uint64) []byte {
 	var buf bytes.Buffer

 	data := seccompData{
 		Syscall: uint32(sysno),
 		Arch:    uint32(arch),
 		IP:      0xDEADBEEFCAFE,
 	}

 	copy(data.Args[:], args)
 	if len(args) > 6 {
 		t.Fatalf("bad syscall payload: linux only supports 6-argument syscalls")
 	}

 	// NOTE: We use BigEndian here because golang.org/x/net/bpf assumes that
 	//       all payloads are big-endian while seccomp uses host endianness.
 	if err := binary.Write(&buf, binary.BigEndian, data); err != nil {
 		t.Fatalf("bad syscall payload: cannot write data: %v", err)
 	}
 	return buf.Bytes()
 }

 // retFallthrough is returned by the mockFilter. If a the mock filter returns
 // this value, it indicates "fallthrough to libseccomp-generated filter".
 const retFallthrough uint32 = 0xDEADBEEF

 // mockFilter returns a BPF VM that contains a mock filter with an -ENOSYS
 // stub. If the filter returns retFallthrough, the stub filter has permitted
 // the syscall to pass.
 func mockFilter(t *testing.T, config *configs.Seccomp) (*bpf.VM, []bpf.Instruction) {
 	patch, err := generatePatch(config)
 	if err != nil {
 		t.Fatalf("mock filter: generate enosys patch: %v", err)
 	}

 	program := append(patch, bpf.RetConstant{Val: retFallthrough})

 	vm, err := bpf.NewVM(program)
 	if err != nil {
 		t.Fatalf("mock filter: compile BPF VM: %v", err)
 	}
 	return vm, program
 }

 // fakeConfig generates a fake libcontainer seccomp configuration. The syscalls
 // are added with an action distinct from the default action.
 func fakeConfig(defaultAction configs.Action, explicitSyscalls []string, arches []string) *configs.Seccomp {
 	config := configs.Seccomp{
 		DefaultAction: defaultAction,
 		Architectures: arches,
 	}
 	syscallAction := configs.Allow
 	if syscallAction == defaultAction {
 		syscallAction = configs.Kill
 	}
 	for _, syscall := range explicitSyscalls {
 		config.Syscalls = append(config.Syscalls, &configs.Syscall{
 			Name:   syscall,
 			Action: syscallAction,
 		})
 	}
 	return &config
 }

 // List copied from <libcontainer/seccomp/config.go>.
 var testArches = []string{
 	"x86",
 	"amd64",
 	"x32",
 	"arm",
 	"arm64",
 	"mips",
 	"mips64",
 	"mips64n32",
 	"mipsel",
 	"mipsel64",
 	"mipsel64n32",
 	"ppc",
 	"ppc64",
 	"ppc64le",
 	"s390",
 	"s390x",
 	// Dummy value to indicate a configuration with no architecture specified.
 	"native",
 }

 // Used for the "native" architecture.
 var (
 	scmpNativeArch, _ = libseccomp.GetNativeArch()
 	nativeArch        = scmpNativeArch.String()
 )

 func testEnosysStub(t *testing.T, defaultAction configs.Action, arches []string) {
 	explicitSyscalls := []string{
 		"setns",
 		"kcmp",
 		"renameat2",
 		"copy_file_range",
 	}

 	implicitSyscalls := []string{
 		"clone",
 		"openat",
 		"read",
 		"write",
 	}

 	futureSyscalls := []libseccomp.ScmpSyscall{1000, 7331}

 	// Quick lookups for which arches are enabled.
 	archSet := map[string]bool{}
 	for _, arch := range arches {
 		archSet[arch] = true
 	}

 	for _, test := range []struct {
 		start, end int
 	}{
 		{0, 1}, // [setns]
 		{0, 2}, // [setns, process_vm_readv]
 		{1, 2}, // [process_vm_readv]
 		{1, 3}, // [process_vm_readv, renameat2, copy_file_range]
 		{1, 4}, // [process_vm_readv, renameat2, copy_file_range]
 		{3, 4}, // [copy_file_range]
 	} {
 		allowedSyscalls := explicitSyscalls[test.start:test.end]
 		config := fakeConfig(defaultAction, allowedSyscalls, arches)
 		filter, program := mockFilter(t, config)

 		// The syscalls are in increasing order of newness, so all syscalls
 		// after the last allowed syscall will give -ENOSYS.
 		enosysStart := test.end

 		for _, arch := range testArches {
 			type syscallTest struct {
 				sysno    libseccomp.ScmpSyscall
 				syscall  string
 				expected uint32
 			}

 			if arch == "native" {
 				arch = nativeArch
 			}
 			scmpArch, err := libseccomp.GetArchFromString(arch)
 			if err != nil {
 				t.Fatalf("unknown libseccomp architecture %q: %v", arch, err)
 			}

 			auditArch, err := scmpArchToAuditArch(scmpArch)
 			if err != nil {
 				t.Fatalf("unknown audit architecture %q: %v", arch, err)
 			}

 			var syscallTests []syscallTest

 			// Add explicit syscalls (whether they will return -ENOSYS
 			// depends on the filter rules).
 			for idx, syscall := range explicitSyscalls {
 				expected := retFallthrough
 				if idx >= enosysStart {
 					expected = retErrnoEnosys
 				}
 				sysno, err := libseccomp.GetSyscallFromNameByArch(syscall, scmpArch)
 				if err != nil {
 					t.Fatalf("unknown syscall %q on arch %q: %v", syscall, arch, err)
 				}
 				syscallTests = append(syscallTests, syscallTest{
 					sysno:    sysno,
 					syscall:  syscall,
 					expected: expected,
 				})
 			}

 			// Add implicit syscalls.
 			for _, syscall := range implicitSyscalls {
 				sysno, err := libseccomp.GetSyscallFromNameByArch(syscall, scmpArch)
 				if err != nil {
 					t.Fatalf("unknown syscall %q on arch %q: %v", syscall, arch, err)
 				}
 				syscallTests = append(syscallTests, syscallTest{
 					sysno:    sysno,
 					syscall:  syscall,
 					expected: retFallthrough,
 				})
 			}

 			// Add future syscalls.
 			for _, sysno := range futureSyscalls {
 				baseSysno, err := libseccomp.GetSyscallFromNameByArch("copy_file_range", scmpArch)
 				if err != nil {
 					t.Fatalf("unknown syscall 'copy_file_range' on arch %q: %v", arch, err)
 				}
 				sysno += baseSysno

 				syscallTests = append(syscallTests, syscallTest{
 					sysno:    sysno,
 					syscall:  fmt.Sprintf("syscall_%#x", sysno),
 					expected: retErrnoEnosys,
 				})
 			}

 			// If we're on s390(x) make sure you get -ENOSYS for the "setup"
 			// syscall (this is done to work around an issue with s390x's
 			// syscall multiplexing which results in unknown syscalls being a
 			// setup(2) invocation).
 			switch scmpArch {
 			case libseccomp.ArchS390, libseccomp.ArchS390X:
 				syscallTests = append(syscallTests, syscallTest{
 					sysno:    s390xMultiplexSyscall,
 					syscall:  "setup",
 					expected: retErrnoEnosys,
 				})
 			}

 			// Test syscalls in the explicit list.
 			for _, test := range syscallTests {
 				// Override the expected value in the two special cases:
 				//  1. If the default action is allow, the filter won't have
 				//     the stub prepended so we expect a fallthrough.
 				//  2. If the executing architecture is not in the architecture
 				//     set, then the architecture is not handled by the stub --
 				//     *except* in the case of the native architecture (which
 				//     is always included in the stub).
 				if isAllowAction(defaultAction) ||
 					(!archSet[arch] && arch != nativeArch) {
 					test.expected = retFallthrough
 				}

 				payload := mockSyscallPayload(t, test.sysno, auditArch, 0x1337, 0xF00BA5)
 				// NOTE: golang.org/x/net/bpf returns int here rather
 				// than uint32.
 				rawRet, err := filter.Run(payload)
 				if err != nil {
 					t.Fatalf("error running filter: %v", err)
 				}
 				ret := uint32(rawRet)
 				if ret != test.expected {
 					t.Logf("mock filter for %v %v:", arches, allowedSyscalls)
 					for idx, insn := range program {
 						t.Logf("  [%4.1d] %s", idx, insn)
 					}
 					t.Logf("payload: %#v", payload)
 					t.Errorf("filter %s(%d) %q(%d): got %#x, want %#x", arch, auditArch, test.syscall, test.sysno, ret, test.expected)
 				}
 			}
 		}
 	}
 }

 var testActions = map[string]configs.Action{
 	"allow": configs.Allow,
 	"log":   configs.Log,
 	"errno": configs.Errno,
 	"kill":  configs.Kill,
 }

 func TestEnosysStub_SingleArch(t *testing.T) {
 	for _, arch := range testArches {
 		var arches []string
 		// "native" indicates a blank architecture field for seccomp, to test
 		// the case where the running architecture was not included in the
 		// architecture. Docker doesn't always set the architecture for some
 		// reason (namely for ppc64le).
 		if arch != "native" {
 			arches = append(arches, arch)
 		}
 		t.Run("arch="+arch, func(t *testing.T) {
 			for name, action := range testActions {
 				t.Run("action="+name, func(t *testing.T) {
 					testEnosysStub(t, action, arches)
 				})
 			}
 		})
 	}
 }

 func TestEnosysStub_MultiArch(t *testing.T) {
 	for end := 0; end < len(testArches); end++ {
 		for start := 0; start < end; start++ {
 			var arches []string
 			for _, arch := range testArches[start:end] {
 				// "native" indicates a blank architecture field for seccomp, to test
 				// the case where the running architecture was not included in the
 				// architecture. Docker doesn't always set the architecture for some
 				// reason (namely for ppc64le).
 				if arch != "native" {
 					arches = append(arches, arch)
 				}
 			}
 			if len(arches) <= 1 {
 				continue
 			}
 			for _, action := range testActions {
 				testEnosysStub(t, action, arches)
 			}
 		}
 	}
 }

 func TestDisassembleHugeFilterDoesNotHang(t *testing.T) {
 	hugeFilter, err := libseccomp.NewFilter(libseccomp.ActAllow)
 	if err != nil {
 		t.Fatalf("failed to create seccomp filter: %v", err)
 	}

 	for i := 1; i < 10000; i++ {
 		if err := hugeFilter.AddRule(libseccomp.ScmpSyscall(i), libseccomp.ActKillThread); err != nil {
 			t.Fatalf("failed to add rule to filter %d: %v", i, err)
 		}
 	}

 	_, err = disassembleFilter(hugeFilter)
 	if err != nil {
 		t.Fatalf("failed to disassembleFilter: %v", err)
 	}

 	// if we exit, we did not hang
 }
	//go:build cgo && seccomp

	package patchbpf

	import (
	"bytes"
	"encoding/binary"
	"fmt"
	"testing"

	"github.com/opencontainers/runc/libcontainer/configs"

	libseccomp "github.com/seccomp/libseccomp-golang"
	"golang.org/x/net/bpf"
	)

	type seccompData struct {
	Syscall uint32 // NOTE: We assume sizeof(int) == 4.
	Arch uint32
	IP uint64
	Args [6]uint64
	}

	// mockSyscallPayload creates a fake seccomp_data struct with the given data.
	func mockSyscallPayload(t *testing.T, sysno libseccomp.ScmpSyscall, arch linuxAuditArch, args ...uint64) []byte {
	var buf bytes.Buffer

	data := seccompData{
	Syscall: uint32(sysno),
	Arch: uint32(arch),
	IP: 0xDEADBEEFCAFE,
	}

	copy(data.Args[:], args)
	if len(args) > 6 {
	t.Fatalf("bad syscall payload: linux only supports 6-argument syscalls")
	}

	// NOTE: We use BigEndian here because golang.org/x/net/bpf assumes that
	// all payloads are big-endian while seccomp uses host endianness.
	if err := binary.Write(&buf, binary.BigEndian, data); err != nil {
	t.Fatalf("bad syscall payload: cannot write data: %v", err)
	}
	return buf.Bytes()
	}

	// retFallthrough is returned by the mockFilter. If a the mock filter returns
	// this value, it indicates "fallthrough to libseccomp-generated filter".
	const retFallthrough uint32 = 0xDEADBEEF

	// mockFilter returns a BPF VM that contains a mock filter with an -ENOSYS
	// stub. If the filter returns retFallthrough, the stub filter has permitted
	// the syscall to pass.
	func mockFilter(t testing.T, config configs.Seccomp) (*bpf.VM, []bpf.Instruction) {
	patch, err := generatePatch(config)
	if err != nil {
	t.Fatalf("mock filter: generate enosys patch: %v", err)
	}

	program := append(patch, bpf.RetConstant{Val: retFallthrough})

	vm, err := bpf.NewVM(program)
	if err != nil {
	t.Fatalf("mock filter: compile BPF VM: %v", err)
	}
	return vm, program
	}

	// fakeConfig generates a fake libcontainer seccomp configuration. The syscalls
	// are added with an action distinct from the default action.
	func fakeConfig(defaultAction configs.Action, explicitSyscalls []string, arches []string) *configs.Seccomp {
	config := configs.Seccomp{
	DefaultAction: defaultAction,
	Architectures: arches,
	}
	syscallAction := configs.Allow
	if syscallAction == defaultAction {
	syscallAction = configs.Kill
	}
	for _, syscall := range explicitSyscalls {
	config.Syscalls = append(config.Syscalls, &configs.Syscall{
	Name: syscall,
	Action: syscallAction,
	})
	}
	return &config
	}

	// List copied from <libcontainer/seccomp/config.go>.
	var testArches = []string{
	"x86",
	"amd64",
	"x32",
	"arm",
	"arm64",
	"mips",
	"mips64",
	"mips64n32",
	"mipsel",
	"mipsel64",
	"mipsel64n32",
	"ppc",
	"ppc64",
	"ppc64le",
	"s390",
	"s390x",
	// Dummy value to indicate a configuration with no architecture specified.
	"native",
	}

	// Used for the "native" architecture.
	var (
	scmpNativeArch, _ = libseccomp.GetNativeArch()
	nativeArch = scmpNativeArch.String()
	)

	func testEnosysStub(t *testing.T, defaultAction configs.Action, arches []string) {
	explicitSyscalls := []string{
	"setns",
	"kcmp",
	"renameat2",
	"copy_file_range",
	}

	implicitSyscalls := []string{
	"clone",
	"openat",
	"read",
	"write",
	}

	futureSyscalls := []libseccomp.ScmpSyscall{1000, 7331}

	// Quick lookups for which arches are enabled.
	archSet := map[string]bool{}
	for _, arch := range arches {
	archSet[arch] = true
	}

	for _, test := range []struct {
	start, end int
	}{
	{0, 1}, // [setns]
	{0, 2}, // [setns, process_vm_readv]
	{1, 2}, // [process_vm_readv]
	{1, 3}, // [process_vm_readv, renameat2, copy_file_range]
	{1, 4}, // [process_vm_readv, renameat2, copy_file_range]
	{3, 4}, // [copy_file_range]
	} {
	allowedSyscalls := explicitSyscalls[test.start:test.end]
	config := fakeConfig(defaultAction, allowedSyscalls, arches)
	filter, program := mockFilter(t, config)

	// The syscalls are in increasing order of newness, so all syscalls
	// after the last allowed syscall will give -ENOSYS.
	enosysStart := test.end

	for _, arch := range testArches {
	type syscallTest struct {
	sysno libseccomp.ScmpSyscall
	syscall string
	expected uint32
	}

	if arch == "native" {
	arch = nativeArch
	}
	scmpArch, err := libseccomp.GetArchFromString(arch)
	if err != nil {
	t.Fatalf("unknown libseccomp architecture %q: %v", arch, err)
	}

	auditArch, err := scmpArchToAuditArch(scmpArch)
	if err != nil {
	t.Fatalf("unknown audit architecture %q: %v", arch, err)
	}

	var syscallTests []syscallTest

	// Add explicit syscalls (whether they will return -ENOSYS
	// depends on the filter rules).
	for idx, syscall := range explicitSyscalls {
	expected := retFallthrough
	if idx >= enosysStart {
	expected = retErrnoEnosys
	}
	sysno, err := libseccomp.GetSyscallFromNameByArch(syscall, scmpArch)
	if err != nil {
	t.Fatalf("unknown syscall %q on arch %q: %v", syscall, arch, err)
	}
	syscallTests = append(syscallTests, syscallTest{
	sysno: sysno,
	syscall: syscall,
	expected: expected,
	})
	}

	// Add implicit syscalls.
	for _, syscall := range implicitSyscalls {
	sysno, err := libseccomp.GetSyscallFromNameByArch(syscall, scmpArch)
	if err != nil {
	t.Fatalf("unknown syscall %q on arch %q: %v", syscall, arch, err)
	}
	syscallTests = append(syscallTests, syscallTest{
	sysno: sysno,
	syscall: syscall,
	expected: retFallthrough,
	})
	}

	// Add future syscalls.
	for _, sysno := range futureSyscalls {
	baseSysno, err := libseccomp.GetSyscallFromNameByArch("copy_file_range", scmpArch)
	if err != nil {
	t.Fatalf("unknown syscall 'copy_file_range' on arch %q: %v", arch, err)
	}
	sysno += baseSysno

	syscallTests = append(syscallTests, syscallTest{
	sysno: sysno,
	syscall: fmt.Sprintf("syscall_%#x", sysno),
	expected: retErrnoEnosys,
	})
	}

	// If we're on s390(x) make sure you get -ENOSYS for the "setup"
	// syscall (this is done to work around an issue with s390x's
	// syscall multiplexing which results in unknown syscalls being a
	// setup(2) invocation).
	switch scmpArch {
	case libseccomp.ArchS390, libseccomp.ArchS390X:
	syscallTests = append(syscallTests, syscallTest{
	sysno: s390xMultiplexSyscall,
	syscall: "setup",
	expected: retErrnoEnosys,
	})
	}

	// Test syscalls in the explicit list.
	for _, test := range syscallTests {
	// Override the expected value in the two special cases:
	// 1. If the default action is allow, the filter won't have
	// the stub prepended so we expect a fallthrough.
	// 2. If the executing architecture is not in the architecture
	// set, then the architecture is not handled by the stub --
	// except in the case of the native architecture (which
	// is always included in the stub).
	if isAllowAction(defaultAction) \|\|
	(!archSet[arch] && arch != nativeArch) {
	test.expected = retFallthrough
	}

	payload := mockSyscallPayload(t, test.sysno, auditArch, 0x1337, 0xF00BA5)
	// NOTE: golang.org/x/net/bpf returns int here rather
	// than uint32.
	rawRet, err := filter.Run(payload)
	if err != nil {
	t.Fatalf("error running filter: %v", err)
	}
	ret := uint32(rawRet)
	if ret != test.expected {
	t.Logf("mock filter for %v %v:", arches, allowedSyscalls)
	for idx, insn := range program {
	t.Logf(" [%4.1d] %s", idx, insn)
	}
	t.Logf("payload: %#v", payload)
	t.Errorf("filter %s(%d) %q(%d): got %#x, want %#x", arch, auditArch, test.syscall, test.sysno, ret, test.expected)
	}
	}
	}
	}
	}

	var testActions = map[string]configs.Action{
	"allow": configs.Allow,
	"log": configs.Log,
	"errno": configs.Errno,
	"kill": configs.Kill,
	}

	func TestEnosysStub_SingleArch(t *testing.T) {
	for _, arch := range testArches {
	var arches []string
	// "native" indicates a blank architecture field for seccomp, to test
	// the case where the running architecture was not included in the
	// architecture. Docker doesn't always set the architecture for some
	// reason (namely for ppc64le).
	if arch != "native" {
	arches = append(arches, arch)
	}
	t.Run("arch="+arch, func(t *testing.T) {
	for name, action := range testActions {
	t.Run("action="+name, func(t *testing.T) {
	testEnosysStub(t, action, arches)
	})
	}
	})
	}
	}

	func TestEnosysStub_MultiArch(t *testing.T) {
	for end := 0; end < len(testArches); end++ {
	for start := 0; start < end; start++ {
	var arches []string
	for _, arch := range testArches[start:end] {
	// "native" indicates a blank architecture field for seccomp, to test
	// the case where the running architecture was not included in the
	// architecture. Docker doesn't always set the architecture for some
	// reason (namely for ppc64le).
	if arch != "native" {
	arches = append(arches, arch)
	}
	}
	if len(arches) <= 1 {
	continue
	}
	for _, action := range testActions {
	testEnosysStub(t, action, arches)
	}
	}
	}
	}

	func TestDisassembleHugeFilterDoesNotHang(t *testing.T) {
	hugeFilter, err := libseccomp.NewFilter(libseccomp.ActAllow)
	if err != nil {
	t.Fatalf("failed to create seccomp filter: %v", err)
	}

	for i := 1; i < 10000; i++ {
	if err := hugeFilter.AddRule(libseccomp.ScmpSyscall(i), libseccomp.ActKillThread); err != nil {
	t.Fatalf("failed to add rule to filter %d: %v", i, err)
	}
	}

	_, err = disassembleFilter(hugeFilter)
	if err != nil {
	t.Fatalf("failed to disassembleFilter: %v", err)
	}

	// if we exit, we did not hang
	}