From 053f6a0dca214138ba5e14f5a73a038809d86d20 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Fri, 15 Dec 2023 11:23:01 +0900 Subject: [PATCH] seccomp_syscall_test1: use ftruncate instead of kcmp kcmp is often missing: https://man7.org/linux/man-pages/man2/kcmp.2.html > Before Linux 5.12, this system call is available only if the > kernel is configured with CONFIG_CHECKPOINT_RESTORE, since the > original purpose of the system call was for the > checkpoint/restore in user space (CRIU) feature. (The > alternative to this system call would have been to expose > suitable process information via the proc(5) filesystem; this was > deemed to be unsuitable for security reasons.) Since Linux 5.12, > this system call is also available if the kernel is configured > with CONFIG_KCMP. Signed-off-by: Akihiro Suda --- tests/integration/testdata/seccomp_syscall_test1.c | 8 ++++---- tests/integration/testdata/seccomp_syscall_test1.json | 7 +++---- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/tests/integration/testdata/seccomp_syscall_test1.c b/tests/integration/testdata/seccomp_syscall_test1.c index d62598a20..856dc25b8 100644 --- a/tests/integration/testdata/seccomp_syscall_test1.c +++ b/tests/integration/testdata/seccomp_syscall_test1.c @@ -57,10 +57,10 @@ int main(void) syscall_assert(raw(process_vm_writev, 0, NULL, 0, NULL, 0, ~0), -EPERM); // Multiple arguments with AND rules. - syscall_assert(raw(kcmp, 0, 1337, 0, 0, 0), -ESRCH); - syscall_assert(raw(kcmp, 0, 0, 0, 0, 0), -EPERM); - syscall_assert(raw(kcmp, 500, 1337, 0, 0, 0), -EPERM); - syscall_assert(raw(kcmp, 500, 500, 0, 0, 0), -EPERM); + syscall_assert(raw(ftruncate, 123456789, 1337), -EBADF); + syscall_assert(raw(ftruncate, 123456789, 0), -EPERM); + syscall_assert(raw(ftruncate, 500, 1337), -EPERM); + syscall_assert(raw(ftruncate, 500, 500), -EPERM); // Multiple rules for the same syscall. syscall_assert(raw(dup3, 0, -100, 0xFFFF), -EPERM); diff --git a/tests/integration/testdata/seccomp_syscall_test1.json b/tests/integration/testdata/seccomp_syscall_test1.json index c48ceae7e..9e8e8aec4 100644 --- a/tests/integration/testdata/seccomp_syscall_test1.json +++ b/tests/integration/testdata/seccomp_syscall_test1.json @@ -79,8 +79,6 @@ "fstatfs", "fstatfs64", "fsync", - "ftruncate", - "ftruncate64", "futex", "futex_time64", "futimesat", @@ -380,12 +378,13 @@ { "action": "SCMP_ACT_ALLOW", "names": [ - "kcmp" + "ftruncate", + "ftruncate64" ], "args": [ { "index": 0, - "value": 0, + "value": 123456789, "op": "SCMP_CMP_EQ" }, {