add test to secutil and fixed trace forked processes

This commit is contained in:
criyle 2019-04-27 16:50:46 -04:00
parent bc680b67b5
commit 79d33bd16d
2 changed files with 78 additions and 7 deletions

72
secutil/secutil_test.go Normal file
View File

@ -0,0 +1,72 @@
package secutil
import (
"testing"
libseccomp "github.com/seccomp/libseccomp-golang"
)
func TestBuildFilter(t *testing.T) {
defaultAction := libseccomp.ActKill
filter, err := buildFilterMock(defaultAction)
if err != nil {
t.Error("BuildFilter failed")
}
if d, e := filter.GetDefaultAction(); e != nil || d != defaultAction {
t.Error("DefaultAction does not match by BuildFilter")
}
}
func TestFilterToBPF(t *testing.T) {
defaultAction := libseccomp.ActKill
filter, err := buildFilterMock(defaultAction)
if err != nil {
t.Error("BuildFilter failed")
}
prog, err := FilterToBPF(filter)
if err != nil || prog == nil || prog.Filter == nil {
t.Error("BuildFilter failed")
}
}
func TestBuildFilterFail(t *testing.T) {
defaultAction := libseccomp.ActKill
defaultTrace := libseccomp.ActTrace
allow := []string{"fork"}
trace := []string{"execve"}
allowf := append(allow, "fail")
filter, err := BuildFilter(defaultAction, defaultTrace, allowf, trace)
if err == nil || filter != nil {
t.Error("BuildFilter did not detect failure")
}
tracef := append(trace, "fail")
filter, err = BuildFilter(defaultAction, defaultTrace, allow, tracef)
if err == nil || filter != nil {
t.Error("BuildFilter did not detect failure")
}
filter, err = BuildFilter(libseccomp.ActInvalid, defaultTrace, allow, trace)
if err == nil || filter != nil {
t.Error("BuildFilter did not detect failure")
}
}
func TestAddActionFail(t *testing.T) {
defaultAction := libseccomp.ActKill
filter, _ := libseccomp.NewFilter(defaultAction)
arch, _ := libseccomp.GetNativeArch()
filter.RemoveArch(arch)
err := addFilterAction(filter, "fork", defaultAction)
if err == nil {
t.Error("addFilterAction did not detect failure")
}
}
func buildFilterMock(d libseccomp.ScmpAction) (*libseccomp.ScmpFilter, error) {
defaultTrace := libseccomp.ActTrace
allow := []string{"fork"}
trace := []string{"execve"}
return BuildFilter(d, defaultTrace, allow, trace)
}

View File

@ -38,9 +38,8 @@ func Trace(handler Handler, runners []Runner, limits ResLimit, timeout int64) (r
)
results = make([]TraceResult, len(runners))
// Ptrace require running at the same OS thread
// make this thread exit after trace, ensure no process escaped
runtime.LockOSThread()
defer runtime.UnlockOSThread()
// Starts all runners
for i, r := range runners {
@ -124,7 +123,7 @@ func Trace(handler Handler, runners []Runner, limits ResLimit, timeout int64) (r
case wstatus.Exited():
delete(traced, pid)
println("process exited: ", pid, wstatus.ExitStatus())
if idx, inside := pidmap[pid]; inside {
if inside {
if execved[pid] {
results[idx].ExitCode = wstatus.ExitStatus()
if running--; running == 0 {
@ -139,7 +138,7 @@ func Trace(handler Handler, runners []Runner, limits ResLimit, timeout int64) (r
case wstatus.Signaled():
sig := wstatus.Signal()
println("ptrace signaled: ", sig)
if idx, inside := pidmap[pid]; inside {
if inside {
switch sig {
case unix.SIGXCPU:
status = TraceCodeTLE
@ -159,11 +158,11 @@ func Trace(handler Handler, runners []Runner, limits ResLimit, timeout int64) (r
if stopSig := wstatus.StopSignal(); stopSig == unix.SIGTRAP {
switch trapCause := wstatus.TrapCause(); trapCause {
case unix.PTRACE_EVENT_SECCOMP:
if execved[pid] {
if !inside || execved[pid] {
// give the customized handle for syscall
err := handleTrap(handler, pid)
if err != nil {
if idx, inside := pidmap[pid]; inside {
if inside {
results[idx].TraceStatus = TraceCodeBan
}
return results, err
@ -190,7 +189,7 @@ func Trace(handler Handler, runners []Runner, limits ResLimit, timeout int64) (r
// Likely encountered SIGSEGV (segment violation)
if stopSig != unix.SIGSTOP {
println("ptrace unexpected stop signal: ", stopSig)
if idx, inside := pidmap[pid]; inside {
if inside {
results[idx].TraceStatus = TraceCodeRE
}
return results, TraceCodeRE