| // Licensed to the Apache Software Foundation (ASF) under one |
| // or more contributor license agreements. See the NOTICE file |
| // distributed with this work for additional information |
| // regarding copyright ownership. The ASF licenses this file |
| // to you under the Apache License, Version 2.0 (the |
| // "License"); you may not use this file except in compliance |
| // with the License. You may obtain a copy of the License at |
| // |
| // http://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| |
| #include <gtest/gtest.h> |
| |
| #include <stout/gtest.hpp> |
| #include <stout/try.hpp> |
| |
| #include "linux/capabilities.hpp" |
| #include "linux/seccomp/seccomp_parser.hpp" |
| |
| using mesos::seccomp::ContainerSeccompProfile; |
| |
| using std::multiset; |
| using std::string; |
| |
| namespace mesos { |
| namespace internal { |
| namespace tests { |
| |
| class SeccompParserTest : public ::testing::Test {}; |
| |
| |
| // This test verifies that the Seccomp parser can parse a valid Seccomp profile. |
| TEST_F(SeccompParserTest, SECCOMP_ParseSeccompProfile) |
| { |
| const string config = |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [ |
| { |
| "architecture": "SCMP_ARCH_X86_64", |
| "subArchitectures": [ |
| "SCMP_ARCH_X86", |
| "SCMP_ARCH_X32" |
| ] |
| }, |
| { |
| "architecture": "SCMP_ARCH_AARCH64", |
| "subArchitectures": [ |
| "SCMP_ARCH_ARM" |
| ] |
| } |
| ], |
| "syscalls": [ |
| { |
| "names": [ |
| "accept", |
| "writev" |
| ], |
| "action": "SCMP_ACT_ALLOW", |
| "args": [], |
| "comment": "", |
| "includes": {}, |
| "excludes": {} |
| }, |
| { |
| "names": [ |
| "clone" |
| ], |
| "action": "SCMP_ACT_ALLOW", |
| "args": [ |
| { |
| "index": 0, |
| "value": 2080505856, |
| "valueTwo": 0, |
| "op": "SCMP_CMP_MASKED_EQ" |
| } |
| ], |
| "comment": "", |
| "includes": {}, |
| "excludes": { |
| "caps": [ |
| "CAP_SYS_ADMIN" |
| ], |
| "arches": [ |
| "s390", |
| "s390x" |
| ] |
| } |
| } |
| ] |
| })~"; |
| |
| Try<ContainerSeccompProfile> profile = |
| mesos::internal::seccomp::parseProfileData(config); |
| |
| ASSERT_SOME(profile); |
| |
| EXPECT_EQ(profile->default_action(), |
| ContainerSeccompProfile::Syscall::ACT_ERRNO); |
| |
| // Note that the Seccomp parser doesn't add an architecture with all its |
| // subarchitectures when the architecture is not native. |
| const auto& architectures = profile->architectures(); |
| EXPECT_EQ(multiset<int>(architectures.begin(), architectures.end()), |
| multiset<int>({ContainerSeccompProfile::ARCH_X86_64, |
| ContainerSeccompProfile::ARCH_X86, |
| ContainerSeccompProfile::ARCH_X32})); |
| |
| EXPECT_EQ(profile->syscalls_size(), 2); |
| |
| { |
| const auto& rule = profile->syscalls().Get(0); |
| |
| const auto& names = rule.names(); |
| EXPECT_EQ(multiset<string>(names.begin(), names.end()), |
| multiset<string>({"accept", "writev"})); |
| |
| EXPECT_EQ(rule.action(), ContainerSeccompProfile::Syscall::ACT_ALLOW); |
| EXPECT_EQ(rule.args_size(), 0); |
| EXPECT_FALSE(rule.has_includes()); |
| EXPECT_FALSE(rule.has_excludes()); |
| } |
| |
| { |
| const auto& rule = profile->syscalls().Get(1); |
| |
| const auto& names = rule.names(); |
| EXPECT_EQ(multiset<string>(names.begin(), names.end()), |
| multiset<string>({"clone"})); |
| |
| EXPECT_EQ(rule.action(), ContainerSeccompProfile::Syscall::ACT_ALLOW); |
| |
| EXPECT_EQ(rule.args_size(), 1); |
| |
| const auto& arg = rule.args().Get(0); |
| EXPECT_EQ(arg.index(), 0u); |
| EXPECT_EQ(arg.value(), 2080505856u); |
| EXPECT_EQ(arg.value_two(), 0u); |
| EXPECT_EQ(arg.op(), ContainerSeccompProfile::Syscall::Arg::CMP_MASKED_EQ); |
| |
| EXPECT_FALSE(rule.has_includes()); |
| |
| EXPECT_TRUE(rule.has_excludes()); |
| EXPECT_EQ(rule.excludes().capabilities_size(), 1); |
| EXPECT_EQ(rule.excludes().capabilities().Get(0), CapabilityInfo::SYS_ADMIN); |
| } |
| } |
| |
| |
| // This test verifies handling of errors caused by an invalid Seccomp profile. |
| TEST_F(SeccompParserTest, SECCOMP_ParseInvalidSeccompProfile) |
| { |
| auto check = [](const string& config, const string& failureMessage) { |
| CHECK(!failureMessage.empty()); |
| |
| Try<ContainerSeccompProfile> profile = |
| mesos::internal::seccomp::parseProfileData(config); |
| |
| ASSERT_ERROR(profile); |
| EXPECT_TRUE(strings::contains(profile.error(), failureMessage)); |
| }; |
| |
| // Check for the existence of the top-most objects. |
| check( |
| R"~( |
| { |
| "defaultAction!!BUG": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [] |
| })~", |
| "Cannot determine 'defaultAction'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap!!BUG": [], |
| "syscalls": [] |
| })~", |
| "Cannot determine 'archMap'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls!!BUG": [] |
| })~", |
| "Cannot determine 'syscalls'"); |
| |
| // Check `defaultAction` object. |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_!!BUG", |
| "archMap": [], |
| "syscalls": [] |
| })~", |
| "Unknown syscall action: 'SCMP_ACT_!!BUG'"); |
| |
| // Check `archMap` object. |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [ |
| { |
| "architecture": "SCMP_ARCH_!!BUG", |
| "subArchitectures": [] |
| } |
| ], |
| "syscalls": [] |
| })~", |
| "Unknown architecture: 'SCMP_ARCH_!!BUG'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [ |
| { |
| "architecture": "SCMP_ARCH_X86_64", |
| "subArchitectures": [ |
| "SCMP_ARCH_X86", |
| "SCMP_ARCH_!!BUG" |
| ] |
| } |
| ], |
| "syscalls": [] |
| })~", |
| "Unknown architecture: 'SCMP_ARCH_!!BUG'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [ |
| { |
| "architecture": "SCMP_ARCH_X86_64", |
| "subArchitectures!!BUG": [] |
| } |
| ], |
| "syscalls": [] |
| })~", |
| "Cannot determine 'subArchitectures'"); |
| |
| // Check `syscalls` section. |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names!!BUG": ["accept"], |
| "action": "SCMP_ACT_ALLOW", |
| "args": [], |
| "includes": {}, |
| "excludes": {} |
| } |
| ] |
| })~", |
| "Cannot determine 'names'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names": ["accept"], |
| "action!!BUG": "SCMP_ACT_ALLOW", |
| "args": [], |
| "includes": {}, |
| "excludes": {} |
| } |
| ] |
| })~", |
| "Cannot determine 'action'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names": ["accept"], |
| "action": "SCMP_ACT_ALLOW", |
| "args!!BUG": [], |
| "includes": {}, |
| "excludes": {} |
| } |
| ] |
| })~", |
| "Cannot determine 'args'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names": ["accept"], |
| "action": "SCMP_ACT_ALLOW", |
| "args": [], |
| "includes!!BUG": {}, |
| "excludes": {} |
| } |
| ] |
| })~", |
| "Cannot determine 'includes'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names": ["accept"], |
| "action": "SCMP_ACT_ALLOW", |
| "args": [], |
| "includes": {}, |
| "excludes!!BUG": {} |
| } |
| ] |
| })~", |
| "Cannot determine 'excludes'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names": [ |
| "accept", |
| "writev!!BUG" |
| ], |
| "action": "SCMP_ACT_ALLOW", |
| "args": [], |
| "includes": {}, |
| "excludes": {} |
| } |
| ] |
| })~", |
| "Unrecognized syscall 'writev!!BUG'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names": ["accept"], |
| "action": "SCMP_ACT_!!BUG", |
| "args": [], |
| "includes": {}, |
| "excludes": {} |
| } |
| ] |
| })~", |
| "Unknown syscall action: 'SCMP_ACT_!!BUG'"); |
| |
| // Check `args` object which belongs to the `syscalls` object. |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names": ["accept"], |
| "action": "SCMP_ACT_ALLOW", |
| "args": [ |
| { |
| "index!!BUG": 0, |
| "value": 2080505856, |
| "valueTwo": 0, |
| "op": "SCMP_CMP_MASKED_EQ" |
| } |
| ], |
| "includes": {}, |
| "excludes": {} |
| } |
| ] |
| })~", |
| "Cannot determine 'index'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names": ["accept"], |
| "action": "SCMP_ACT_ALLOW", |
| "args": [ |
| { |
| "index": 0, |
| "value!!BUG": 2080505856, |
| "valueTwo": 0, |
| "op": "SCMP_CMP_MASKED_EQ" |
| } |
| ], |
| "includes": {}, |
| "excludes": {} |
| } |
| ] |
| })~", |
| "Cannot determine 'value'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names": ["accept"], |
| "action": "SCMP_ACT_ALLOW", |
| "args": [ |
| { |
| "index": 0, |
| "value": 2080505856, |
| "valueTwo!!BUG": 0, |
| "op": "SCMP_CMP_MASKED_EQ" |
| } |
| ], |
| "includes": {}, |
| "excludes": {} |
| } |
| ] |
| })~", |
| "Cannot determine 'valueTwo'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names": ["accept"], |
| "action": "SCMP_ACT_ALLOW", |
| "args": [ |
| { |
| "index": 0, |
| "value": 2080505856, |
| "valueTwo": 0, |
| "op!!BUG": "SCMP_CMP_MASKED_EQ" |
| } |
| ], |
| "includes": {}, |
| "excludes": {} |
| } |
| ] |
| })~", |
| "Cannot determine 'op'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names": ["accept"], |
| "action": "SCMP_ACT_ALLOW", |
| "args": [ |
| { |
| "index": 0, |
| "value": 2080505856, |
| "valueTwo": 0, |
| "op": "SCMP_CMP_MASKED_EQ!!BUG" |
| } |
| ], |
| "includes": {}, |
| "excludes": {} |
| } |
| ] |
| })~", |
| "Unknown operator: 'SCMP_CMP_MASKED_EQ!!BUG'"); |
| |
| // Check `excludes` object which belongs to the `syscalls` object. |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names": ["accept"], |
| "action": "SCMP_ACT_ALLOW", |
| "args": [], |
| "includes": {}, |
| "excludes": { |
| "arches": [ |
| "amd64!!SPECTRE" |
| ] |
| } |
| } |
| ] |
| })~", |
| "Unknown architecture: 'amd64!!SPECTRE'"); |
| |
| check( |
| R"~( |
| { |
| "defaultAction": "SCMP_ACT_ERRNO", |
| "archMap": [], |
| "syscalls": [ |
| { |
| "names": ["accept"], |
| "action": "SCMP_ACT_ALLOW", |
| "args": [], |
| "includes": {}, |
| "excludes": { |
| "caps": [ |
| "CAP_SYS_ADMIN!!BUG" |
| ] |
| } |
| } |
| ] |
| })~", |
| "Unknown capability: 'CAP_SYS_ADMIN!!BUG'"); |
| } |
| |
| } // namespace tests { |
| } // namespace internal { |
| } // namespace mesos { |
