From: Shuah Khan <shuahkh@osg.samsung.com>
To: Kees Cook <keescook@chromium.org>, Michael Ellerman <mpe@ellerman.id.au>
Cc: LKML <linux-kernel@vger.kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andy Lutomirski <luto@amacapital.net>,
Will Drewry <wad@chromium.org>,
Andrew Morton <akpm@linux-foundation.org>,
Greg KH <gregkh@linuxfoundation.org>,
Mauro Carvalho Chehab <mchehab@osg.samsung.com>,
"David S. Miller" <davem@davemloft.net>,
Arnd Bergmann <arnd@arndb.de>, Joe Perches <joe@perches.com>,
Jingoo Han <jingoohan1@gmail.com>,
Linux API <linux-api@vger.kernel.org>,
Shuah Khan <shuahkh@osg.samsung.com>
Subject: Re: [PATCH] selftests: add seccomp suite
Date: Wed, 17 Jun 2015 17:25:59 -0600 [thread overview]
Message-ID: <55820207.1070101@osg.samsung.com> (raw)
In-Reply-To: <CAGXu5jK3xuCqJoE9W+b_5yH+TffDDaL5tDFyZhKRx_K-Qqqk2g@mail.gmail.com>
On 06/17/2015 12:12 PM, Kees Cook wrote:
> On Wed, Jun 17, 2015 at 12:31 AM, Michael Ellerman <mpe@ellerman.id.au> wrote:
>> On Tue, 2015-06-16 at 10:54 -0700, Kees Cook wrote:
>>> This imports the existing seccomp test suite into the kernel's selftests
>>> tree. It contains extensive testing of seccomp features and corner cases.
>>> There remain additional tests to move into the kernel tree, but they have
>>> not yet been ported to all the architectures seccomp supports:
>>> https://github.com/redpig/seccomp/tree/master/tests
>>>
>>> Signed-off-by: Kees Cook <keescook@chromium.org>
>>> ---
>>> MAINTAINERS | 1 +
>>> tools/testing/selftests/Makefile | 1 +
>>> tools/testing/selftests/seccomp/.gitignore | 1 +
>>> tools/testing/selftests/seccomp/Makefile | 10 +
>>> tools/testing/selftests/seccomp/seccomp_bpf.c | 2109 ++++++++++++++++++++++++
>>> tools/testing/selftests/seccomp/test_harness.h | 537 ++++++
>>
>>
>> Thanks very much for adding this, it would have been very helpful recently when
>> I was trying to get seccomp filter working on powerpc :)
>>
>> I get one failure in TRACE_syscall.syscall_dropped:
>>
>> seccomp_bpf.c:1394:TRACE_syscall.syscall_dropped:Expected 1 (1) == syscall(207) (18446744073709551615)
>>
>>
>> So it looks like we're returning -1 instead of 1.
>>
>> That's probably a bug in our handling of the return value, or maybe an
>> inconsistency across the arches. I'll try and find time to dig into it.
>
> Ah-ha! Excellent. Did you add an implementation for change_syscall()
> in seccomp_bpf.c? I don't have a powerpc method in there. I would have
> expected both TRACE_syscall.syscall_redirected and .syscall_dropped to
> fail without that.
>
> If you did, maybe something isn't right with regs.SYSCALL_RET ? That's
> where the return value being tested on a skipped syscall is stored.
>
> Thanks for testing!
>
Thanks for the test. Fantastic to see so many positive responses
to this addition. Thanks Michael for testing it. It is now queued
for 4.2 in linux-kselftest next
thanks,
-- Shuah
--
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America (Silicon Valley)
shuahkh@osg.samsung.com | (970) 217-8978
next prev parent reply other threads:[~2015-06-17 23:26 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-06-16 17:54 [PATCH] selftests: add seccomp suite Kees Cook
2015-06-16 19:52 ` Andy Lutomirski
2015-06-16 19:52 ` Andy Lutomirski
2015-06-16 20:54 ` Daniel Borkmann
2015-06-16 20:54 ` Daniel Borkmann
2015-06-17 6:12 ` Michael Ellerman
2015-06-17 6:12 ` Michael Ellerman
2015-06-17 7:31 ` Michael Ellerman
2015-06-17 7:31 ` Michael Ellerman
2015-06-17 18:12 ` Kees Cook
2015-06-17 18:12 ` Kees Cook
2015-06-17 23:25 ` Shuah Khan [this message]
2015-06-18 6:41 ` Michael Ellerman
2015-06-18 6:41 ` Michael Ellerman
2015-06-18 18:00 ` Kees Cook
2015-06-18 18:00 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55820207.1070101@osg.samsung.com \
--to=shuahkh@osg.samsung.com \
--cc=akpm@linux-foundation.org \
--cc=arnd@arndb.de \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=gregkh@linuxfoundation.org \
--cc=jingoohan1@gmail.com \
--cc=joe@perches.com \
--cc=keescook@chromium.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=mchehab@osg.samsung.com \
--cc=mpe@ellerman.id.au \
--cc=wad@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.