mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
add test to secutil and fixed trace forked processes
This commit is contained in:
parent
bc680b67b5
commit
79d33bd16d
72
secutil/secutil_test.go
Normal file
72
secutil/secutil_test.go
Normal file
@ -0,0 +1,72 @@
|
|||||||
|
package secutil
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
libseccomp "github.com/seccomp/libseccomp-golang"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestBuildFilter(t *testing.T) {
|
||||||
|
defaultAction := libseccomp.ActKill
|
||||||
|
filter, err := buildFilterMock(defaultAction)
|
||||||
|
if err != nil {
|
||||||
|
t.Error("BuildFilter failed")
|
||||||
|
}
|
||||||
|
if d, e := filter.GetDefaultAction(); e != nil || d != defaultAction {
|
||||||
|
t.Error("DefaultAction does not match by BuildFilter")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestFilterToBPF(t *testing.T) {
|
||||||
|
defaultAction := libseccomp.ActKill
|
||||||
|
filter, err := buildFilterMock(defaultAction)
|
||||||
|
if err != nil {
|
||||||
|
t.Error("BuildFilter failed")
|
||||||
|
}
|
||||||
|
prog, err := FilterToBPF(filter)
|
||||||
|
if err != nil || prog == nil || prog.Filter == nil {
|
||||||
|
t.Error("BuildFilter failed")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestBuildFilterFail(t *testing.T) {
|
||||||
|
defaultAction := libseccomp.ActKill
|
||||||
|
defaultTrace := libseccomp.ActTrace
|
||||||
|
allow := []string{"fork"}
|
||||||
|
trace := []string{"execve"}
|
||||||
|
|
||||||
|
allowf := append(allow, "fail")
|
||||||
|
filter, err := BuildFilter(defaultAction, defaultTrace, allowf, trace)
|
||||||
|
if err == nil || filter != nil {
|
||||||
|
t.Error("BuildFilter did not detect failure")
|
||||||
|
}
|
||||||
|
|
||||||
|
tracef := append(trace, "fail")
|
||||||
|
filter, err = BuildFilter(defaultAction, defaultTrace, allow, tracef)
|
||||||
|
if err == nil || filter != nil {
|
||||||
|
t.Error("BuildFilter did not detect failure")
|
||||||
|
}
|
||||||
|
|
||||||
|
filter, err = BuildFilter(libseccomp.ActInvalid, defaultTrace, allow, trace)
|
||||||
|
if err == nil || filter != nil {
|
||||||
|
t.Error("BuildFilter did not detect failure")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAddActionFail(t *testing.T) {
|
||||||
|
defaultAction := libseccomp.ActKill
|
||||||
|
filter, _ := libseccomp.NewFilter(defaultAction)
|
||||||
|
arch, _ := libseccomp.GetNativeArch()
|
||||||
|
filter.RemoveArch(arch)
|
||||||
|
err := addFilterAction(filter, "fork", defaultAction)
|
||||||
|
if err == nil {
|
||||||
|
t.Error("addFilterAction did not detect failure")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func buildFilterMock(d libseccomp.ScmpAction) (*libseccomp.ScmpFilter, error) {
|
||||||
|
defaultTrace := libseccomp.ActTrace
|
||||||
|
allow := []string{"fork"}
|
||||||
|
trace := []string{"execve"}
|
||||||
|
return BuildFilter(d, defaultTrace, allow, trace)
|
||||||
|
}
|
||||||
@ -38,9 +38,8 @@ func Trace(handler Handler, runners []Runner, limits ResLimit, timeout int64) (r
|
|||||||
)
|
)
|
||||||
results = make([]TraceResult, len(runners))
|
results = make([]TraceResult, len(runners))
|
||||||
|
|
||||||
// Ptrace require running at the same OS thread
|
// make this thread exit after trace, ensure no process escaped
|
||||||
runtime.LockOSThread()
|
runtime.LockOSThread()
|
||||||
defer runtime.UnlockOSThread()
|
|
||||||
|
|
||||||
// Starts all runners
|
// Starts all runners
|
||||||
for i, r := range runners {
|
for i, r := range runners {
|
||||||
@ -124,7 +123,7 @@ func Trace(handler Handler, runners []Runner, limits ResLimit, timeout int64) (r
|
|||||||
case wstatus.Exited():
|
case wstatus.Exited():
|
||||||
delete(traced, pid)
|
delete(traced, pid)
|
||||||
println("process exited: ", pid, wstatus.ExitStatus())
|
println("process exited: ", pid, wstatus.ExitStatus())
|
||||||
if idx, inside := pidmap[pid]; inside {
|
if inside {
|
||||||
if execved[pid] {
|
if execved[pid] {
|
||||||
results[idx].ExitCode = wstatus.ExitStatus()
|
results[idx].ExitCode = wstatus.ExitStatus()
|
||||||
if running--; running == 0 {
|
if running--; running == 0 {
|
||||||
@ -139,7 +138,7 @@ func Trace(handler Handler, runners []Runner, limits ResLimit, timeout int64) (r
|
|||||||
case wstatus.Signaled():
|
case wstatus.Signaled():
|
||||||
sig := wstatus.Signal()
|
sig := wstatus.Signal()
|
||||||
println("ptrace signaled: ", sig)
|
println("ptrace signaled: ", sig)
|
||||||
if idx, inside := pidmap[pid]; inside {
|
if inside {
|
||||||
switch sig {
|
switch sig {
|
||||||
case unix.SIGXCPU:
|
case unix.SIGXCPU:
|
||||||
status = TraceCodeTLE
|
status = TraceCodeTLE
|
||||||
@ -159,11 +158,11 @@ func Trace(handler Handler, runners []Runner, limits ResLimit, timeout int64) (r
|
|||||||
if stopSig := wstatus.StopSignal(); stopSig == unix.SIGTRAP {
|
if stopSig := wstatus.StopSignal(); stopSig == unix.SIGTRAP {
|
||||||
switch trapCause := wstatus.TrapCause(); trapCause {
|
switch trapCause := wstatus.TrapCause(); trapCause {
|
||||||
case unix.PTRACE_EVENT_SECCOMP:
|
case unix.PTRACE_EVENT_SECCOMP:
|
||||||
if execved[pid] {
|
if !inside || execved[pid] {
|
||||||
// give the customized handle for syscall
|
// give the customized handle for syscall
|
||||||
err := handleTrap(handler, pid)
|
err := handleTrap(handler, pid)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
if idx, inside := pidmap[pid]; inside {
|
if inside {
|
||||||
results[idx].TraceStatus = TraceCodeBan
|
results[idx].TraceStatus = TraceCodeBan
|
||||||
}
|
}
|
||||||
return results, err
|
return results, err
|
||||||
@ -190,7 +189,7 @@ func Trace(handler Handler, runners []Runner, limits ResLimit, timeout int64) (r
|
|||||||
// Likely encountered SIGSEGV (segment violation)
|
// Likely encountered SIGSEGV (segment violation)
|
||||||
if stopSig != unix.SIGSTOP {
|
if stopSig != unix.SIGSTOP {
|
||||||
println("ptrace unexpected stop signal: ", stopSig)
|
println("ptrace unexpected stop signal: ", stopSig)
|
||||||
if idx, inside := pidmap[pid]; inside {
|
if inside {
|
||||||
results[idx].TraceStatus = TraceCodeRE
|
results[idx].TraceStatus = TraceCodeRE
|
||||||
}
|
}
|
||||||
return results, TraceCodeRE
|
return results, TraceCodeRE
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user