go-sandbox/seccomp/seccomp_test.go
2019-07-08 23:31:05 -07:00

73 lines
1.9 KiB
Go

package seccomp
import (
"testing"
libseccomp "github.com/seccomp/libseccomp-golang"
)
func TestBuildFilter(t *testing.T) {
defaultAction := libseccomp.ActKill
filter, err := buildFilterMock(defaultAction)
if err != nil {
t.Error("BuildFilter failed")
}
if d, e := filter.GetDefaultAction(); e != nil || d != defaultAction {
t.Error("DefaultAction does not match by BuildFilter")
}
}
func TestFilterToBPF(t *testing.T) {
defaultAction := libseccomp.ActKill
filter, err := buildFilterMock(defaultAction)
if err != nil {
t.Error("BuildFilter failed")
}
prog, err := FilterToBPF(filter)
if err != nil || prog == nil || prog.Filter == nil {
t.Error("BuildFilter failed")
}
}
func TestBuildFilterFail(t *testing.T) {
defaultAction := libseccomp.ActKill
defaultTrace := libseccomp.ActTrace
allow := []string{"fork"}
trace := []string{"execve"}
allowf := append(allow, "fail")
filter, err := BuildFilter(defaultAction, defaultTrace, allowf, trace)
if err == nil || filter != nil {
t.Error("BuildFilter did not detect failure")
}
tracef := append(trace, "fail")
filter, err = BuildFilter(defaultAction, defaultTrace, allow, tracef)
if err == nil || filter != nil {
t.Error("BuildFilter did not detect failure")
}
filter, err = BuildFilter(libseccomp.ActInvalid, defaultTrace, allow, trace)
if err == nil || filter != nil {
t.Error("BuildFilter did not detect failure")
}
}
func TestAddActionFail(t *testing.T) {
defaultAction := libseccomp.ActKill
filter, _ := libseccomp.NewFilter(defaultAction)
arch, _ := libseccomp.GetNativeArch()
filter.RemoveArch(arch)
err := addFilterAction(filter, "fork", defaultAction)
if err == nil {
t.Error("addFilterAction did not detect failure")
}
}
func buildFilterMock(d libseccomp.ScmpAction) (*libseccomp.ScmpFilter, error) {
defaultTrace := libseccomp.ActTrace
allow := []string{"fork"}
trace := []string{"execve"}
return BuildFilter(d, defaultTrace, allow, trace)
}