go-sandbox/seccomp/seccomp_test.go
2019-07-22 22:35:05 -07:00

96 lines
2.8 KiB
Go

package seccomp
import (
"testing"
libseccomp "github.com/seccomp/libseccomp-golang"
)
var (
defaultSyscallAllows = []string{
"read", "write", "readv", "writev", "close", "fstat", "lseek", "dup", "dup2", "dup3", "ioctl", "fcntl", "fadvise64",
"mmap", "mprotect", "munmap", "brk", "mremap", "msync", "mincore", "madvise",
"rt_sigaction", "rt_sigprocmask", "rt_sigreturn", "rt_sigpending", "sigaltstack",
"getcwd", "exit", "exit_group", "arch_prctl",
"gettimeofday", "getrlimit", "getrusage", "times", "time", "clock_gettime", "restart_syscall",
}
defaultSyscallTraces = []string{
"execve", "open", "openat", "unlink", "unlinkat", "readlink", "readlinkat", "lstat", "stat", "access", "faccessat",
}
)
func TestBuildFilter(t *testing.T) {
defaultAction := libseccomp.ActKill
filter, err := buildFilterMock(defaultAction)
if err != nil {
t.Error("BuildFilter failed")
}
if d, e := filter.GetDefaultAction(); e != nil || d != defaultAction {
t.Error("DefaultAction does not match by BuildFilter")
}
}
func TestFilterToBPF(t *testing.T) {
defaultAction := libseccomp.ActKill
filter, err := buildFilterMock(defaultAction)
if err != nil {
t.Error("BuildFilter failed")
}
prog, err := FilterToBPF(filter)
if err != nil || prog == nil || prog.Filter == nil {
t.Error("BuildFilter failed")
}
}
func TestBuildFilterFail(t *testing.T) {
defaultAction := libseccomp.ActKill
defaultTrace := libseccomp.ActTrace
allow := []string{"fork"}
trace := []string{"execve"}
allowf := append(allow, "fail")
filter, err := BuildFilter(defaultAction, defaultTrace, allowf, trace)
if err == nil || filter != nil {
t.Error("BuildFilter did not detect failure")
}
tracef := append(trace, "fail")
filter, err = BuildFilter(defaultAction, defaultTrace, allow, tracef)
if err == nil || filter != nil {
t.Error("BuildFilter did not detect failure")
}
filter, err = BuildFilter(libseccomp.ActInvalid, defaultTrace, allow, trace)
if err == nil || filter != nil {
t.Error("BuildFilter did not detect failure")
}
}
func TestAddActionFail(t *testing.T) {
defaultAction := libseccomp.ActKill
filter, _ := libseccomp.NewFilter(defaultAction)
arch, _ := libseccomp.GetNativeArch()
filter.RemoveArch(arch)
err := addFilterAction(filter, "fork", defaultAction)
if err == nil {
t.Error("addFilterAction did not detect failure")
}
}
// BenchmarkBuildDefaultFilter is about 0.2ms/op
func BenchmarkBuildDefaultFilter(b *testing.B) {
for i := 0; i < b.N; i++ {
filter, _ := BuildFilter(libseccomp.ActKill, libseccomp.ActTrace, defaultSyscallAllows, defaultSyscallTraces)
_, _ = FilterToBPF(filter)
filter.Release()
}
}
func buildFilterMock(d libseccomp.ScmpAction) (*libseccomp.ScmpFilter, error) {
defaultTrace := libseccomp.ActTrace
allow := []string{"fork"}
trace := []string{"execve"}
return BuildFilter(d, defaultTrace, allow, trace)
}