script_core 0.0.6 → 0.1.0

data/ext/enterprise_script_service/libseccomp/tests/miniseq.c

@@ -50,8 +50,9 @@ int main(int argc, char *argv[])
 	if (get_number(argv[1], &first) || get_number(argv[2], &last))
 		return 1;
 
-	for (cur = first; cur <= last; cur++)
-		printf("%" PRIu64 "\n", cur);
+	for (cur = first; cur != last; cur++)
+		printf("%" PRId64 "\n", cur);
+	printf("%" PRId64 "\n", cur);
 
 	return 0;
 }

data/ext/enterprise_script_service/libseccomp/tests/regression

@@ -28,12 +28,30 @@ GLBL_ARCH_LE_SUPPORT=" \
 	ppc64le"
 GLBL_ARCH_BE_SUPPORT=" \
 	mips mips64 mips64n32 \
+	parisc parisc64 \
 	ppc ppc64 \
 	s390 s390x"
 
+GLBL_ARCH_32B_SUPPORT=" \
+	x86 x32 \
+	arm \
+	mips mipsel mips64n32 mipsel64n32 \
+	parisc \
+	ppc \
+	s390"
+
+GLBL_ARCH_64B_SUPPORT=" \
+	x86_64 \
+	aarch64 \
+	mips64 \
+	parisc64 \
+	ppc64 \
+	s390x"
+
 GLBL_SYS_ARCH="../tools/scmp_arch_detect"
 GLBL_SYS_RESOLVER="../tools/scmp_sys_resolver"
 GLBL_SYS_SIM="../tools/scmp_bpf_sim"
+GLBL_SYS_API="../tools/scmp_api_level"
 
 ####
 # functions
@@ -82,6 +100,7 @@ optional arguments:
   -s SINGLE_TEST specifies individual test number to be run
   -t [TEMP_DIR]  specifies directory to create temporary files in
   -T [TEST_TYPE] only run tests matching the specified type
+                  can also be set via LIBSECCOMP_TSTCFG_TYPE env variable
   -v             specifies that verbose output be provided
 EOF
 }
@@ -213,7 +232,12 @@ function run_test_command() {
 	if [[ $mode == "python" ]]; then
 		cmd="PYTHONPATH=$PYTHONPATH"
 		cmd="$cmd:$(cd $(pwd)/../src/python/build/lib.*; pwd)"
-		cmd="$cmd /usr/bin/env python $2.py $3"
+		# check and adjust if we are doing a VPATH build
+		if [[ -e "./$2.py" ]]; then
+			cmd="$cmd /usr/bin/env python $2.py $3"
+		else
+			cmd="$cmd /usr/bin/env python ${srcdir}/$2.py $3"
+		fi
 	else
 		cmd="$2 $3"
 	fi
@@ -279,6 +303,10 @@ function run_test_bpf_sim_fuzz() {
 	local testname=${line[0]}
 	local stress_count=${line[1]}
 
+	# check for stress count configuration via environment variables
+	[[ -n $LIBSECCOMP_TSTCFG_STRESSCNT ]] && \
+		stress_count=$LIBSECCOMP_TSTCFG_STRESSCNT
+
 	for i in $(get_seq 1 $stress_count); do
 		local sys=$(generate_random_data)
 		local -a arg=($(generate_random_data) $(generate_random_data) \
@@ -407,6 +435,26 @@ function run_test_bpf_sim() {
 			# add all of the big endian architectures
 			simarch_tmp+=" $GLBL_ARCH_BE_SUPPORT"
 			;;
+		all_32)
+			# add the native arch only if it is 32-bit
+			if echo "$GLBL_ARCH_32B_SUPPORT" | grep -qw "$arch"; then
+				simarch_tmp+=" $arch"
+			fi
+			;;
+		+all_32)
+			# add all of the 32-bit architectures
+			simarch_tmp+=" $GLBL_ARCH_32B_SUPPORT"
+			;;
+		all_64)
+			# add the native arch only if it is 64-bit
+			if echo "$GLBL_ARCH_64B_SUPPORT" | grep -qw "$arch"; then
+				simarch_tmp+=" $arch"
+			fi
+			;;
+		+all_64)
+			# add all of the 64-bit architectures
+			simarch_tmp+=" $GLBL_ARCH_64B_SUPPORT"
+			;;
 		+*)
 			# add the architecture specified
 			simarch_tmp+=" ${arch_i:1}"
@@ -436,8 +484,8 @@ function run_test_bpf_sim() {
 
 	# do we have any architectures remaining in the list?
 	if [[ $simarch_list == "" ]]; then
-		print_result $(generate_test_num "$1" $2 1) "INFO" \
-			"Test skipped due to architecture difference"
+		print_result $(generate_test_num "$1" $2 1) "SKIPPED" \
+			"(architecture difference)"
 		stats_skipped=$(($stats_skipped+1))
 		return
 	fi
@@ -470,7 +518,7 @@ function run_test_bpf_sim() {
 
 		# get low and high syscall values and convert them to numbers
 		low_syscall=$(get_range $LOW "${line[2]}")
-		if [[ ! $low_syscall =~ ^[0-9]+$ ]]; then
+		if [[ ! $low_syscall =~ ^\-?[0-9]+$ ]]; then
 			low_syscall=$($GLBL_SYS_RESOLVER -a $simarch -t \
 				      $low_syscall)
 			if [[ $? -ne 0 ]]; then
@@ -481,7 +529,7 @@ function run_test_bpf_sim() {
 			fi
 		fi
 		high_syscall=$(get_range $HIGH "${line[2]}")
-		if [[ ! $high_syscall =~ ^[0-9]+$ ]]; then
+		if [[ ! $high_syscall =~ ^\-?[0-9]+$ ]]; then
 			high_syscall=$($GLBL_SYS_RESOLVER -a $simarch -t \
 				       $high_syscall)
 			if [[ $? -ne 0 ]]; then
@@ -599,12 +647,27 @@ function run_test_bpf_sim() {
 #
 function run_test_basic() {
 	local rc
+	local cmd
+
+	# if the test is a script, only run it in native/c mode
+	if [[ $mode != "c" && "$2" == *.sh ]]; then
+		print_result "$1" "SKIPPED" "(only valid in native/c mode)"
+		stats_skipped=$(($stats_skipped+1))
+		return
+	fi
 
 	# print out the input test data to the log file
 	print_data "$1" "$2"
 
+	# check and adjust if we are doing a VPATH build
+	if [[ -x "./$2" ]]; then
+		cmd="./$2"
+	else
+		cmd="${srcdir}/$2"
+	fi
+
 	# run the command
-	run_test_command "$1" "./$2" "" "" ""
+	run_test_command "$1" "$cmd" "" "" ""
 	rc=$?
 	if [[ $rc -ne 0 ]]; then
 		print_result $1 "FAILURE" "$2 rc=$rc"
@@ -631,6 +694,7 @@ function run_test_bpf_valgrind() {
 
 	# we only support the native/c test mode here
 	if [[ $mode != "c" ]]; then
+		print_result "$1" "SKIPPED" "(only valid in native/c mode)"
 		stats_skipped=$(($stats_skipped+1))
 		return
 	fi
@@ -682,12 +746,23 @@ function run_test_bpf_valgrind() {
 #
 function run_test_live() {
 	local rc
+	local api
 	local line=($2)
 
 	# parse the test line
 	line_cmd=${line[0]}
-	line_act=${line[1]}
-	line_test="$line_cmd $line_act"
+	line_api=${line[1]}
+	line_act=${line[2]}
+	line_test="$line_cmd $line_api $line_act"
+
+	# check the api level
+	api=$($GLBL_SYS_API)
+	if [[ $api -lt $line_api ]]; then
+		# runtime api level is too low
+		print_result "$1" "SKIPPED" "(api level)"
+		stats_skipped=$(($stats_skipped+1))
+		return
+	fi
 
 	# print out the input test data to the log file
 	print_data "$1" "$2"
@@ -701,19 +776,23 @@ function run_test_live() {
 
 	# setup the arch specific return values
 	case "$arch" in
-	x86|x86_64|x32|arm|aarch64|ppc|ppc64|ppc64le|ppc|s390|s390x)
+	x86|x86_64|x32|arm|aarch64|parisc|parisc64|ppc|ppc64|ppc64le|ppc|s390|s390x)
+		rc_kill_process=159
 		rc_kill=159
 		rc_allow=160
 		rc_trap=161
 		rc_trace=162
 		rc_errno=163
+		rc_log=164
 		;;
 	mips|mipsel|mips64|mips64n32|mipsel64|mipsel64n32)
+		rc_kill_process=140
 		rc_kill=140
 		rc_allow=160
 		rc_trap=161
 		rc_trace=162
 		rc_errno=163
+		rc_log=164
 		;;
 	*)
 		print_result $testnumstr "ERROR" "arch $arch not supported"
@@ -723,7 +802,10 @@ function run_test_live() {
 	esac
 
 	# verify the results
-	if [[ $line_act == "KILL" && $rc -eq $rc_kill ]]; then
+	if [[ $line_act == "KILL_PROCESS" && $rc -eq $rc_kill_process ]]; then
+		print_result $1 "SUCCESS" ""
+		stats_success=$(($stats_success+1))
+	elif [[ $line_act == "KILL" && $rc -eq $rc_kill ]]; then
 		print_result $1 "SUCCESS" ""
 		stats_success=$(($stats_success+1))
 	elif [[ $line_act == "ALLOW" && $rc -eq $rc_allow ]]; then
@@ -738,6 +820,9 @@ function run_test_live() {
 	elif [[ $line_act == "ERRNO" && $rc -eq $rc_errno ]]; then
 		print_result $1 "SUCCESS" ""
 		stats_success=$(($stats_success+1))
+	elif [[ $line_act == "LOG" && $rc -eq $rc_log ]]; then
+		print_result $1 "SUCCESS" ""
+		stats_success=$(($stats_success+1))
 	else
 		print_result $1 "FAILURE" "$line_test rc=$rc"
 		stats_failure=$(($stats_failure+1))
@@ -772,6 +857,8 @@ function run_test() {
 		if check_deps valgrind; then
 			run_test_bpf_valgrind "$testnumstr" "$3"
 		else
+			print_result $testnumstr "SKIPPED" \
+				"(valgrind not installed)"
 			stats_skipped=$(($stats_skipped+1))
 		fi
 	elif [[ "$4" == "live" ]]; then
@@ -779,6 +866,8 @@ function run_test() {
 		if [[ -n $type ]]; then
 			run_test_live "$testnumstr" "$3"
 		else
+			print_result $testnumstr "SKIPPED" \
+				"(must specify live tests)"
 			stats_skipped=$(($stats_skipped+1))
 		fi
 	else
@@ -961,6 +1050,9 @@ if [[ -n $runall ]]; then
 	single_list=()
 fi
 
+# check for configuration via environment variables
+[[ -z $type && -n $LIBSECCOMP_TSTCFG_TYPE ]] && type=$LIBSECCOMP_TSTCFG_TYPE
+
 # open log file for append (default to stdout)
 if [[ -n $logfile ]]; then
 	logfd=3

data/ext/enterprise_script_service/libseccomp/tests/util.c

@@ -168,6 +168,8 @@ int util_action_parse(const char *action)
 
 	if (strcasecmp(action, "KILL") == 0)
 		return SCMP_ACT_KILL;
+	if (strcasecmp(action, "KILL_PROCESS") == 0)
+		return SCMP_ACT_KILL_PROCESS;
 	else if (strcasecmp(action, "TRAP") == 0)
 		return SCMP_ACT_TRAP;
 	else if (strcasecmp(action, "ERRNO") == 0)
@@ -176,6 +178,8 @@ int util_action_parse(const char *action)
 		return -1; /* not yet supported */
 	else if (strcasecmp(action, "ALLOW") == 0)
 		return SCMP_ACT_ALLOW;
+	else if (strcasecmp(action, "LOG") == 0)
+		return SCMP_ACT_LOG;
 
 	return -1;
 }

data/ext/enterprise_script_service/libseccomp/tests/util.py

@@ -100,8 +100,8 @@ def write_file(path):
     Description:
     Open the specified file, write a string to the file, and close the file.
     """
-    fd = os.open(path, os.O_WRONLY|os.O_CREAT, 0600)
-    if not os.write(fd, "testing") == len("testing"):
+    fd = os.open(str(path), os.O_WRONLY|os.O_CREAT)
+    if not os.write(fd, b"testing") == len("testing"):
         raise IOError("failed to write the full test string in write_file()")
     os.close(fd)
 

data/ext/enterprise_script_service/libseccomp/tools/.gitignore

@@ -2,3 +2,4 @@ scmp_bpf_disasm
 scmp_bpf_sim
 scmp_sys_resolver
 scmp_arch_detect
+scmp_api_level

data/ext/enterprise_script_service/libseccomp/tools/Makefile.am

@@ -27,12 +27,14 @@ bin_PROGRAMS = \
 noinst_PROGRAMS = \
 	scmp_arch_detect \
 	scmp_bpf_disasm \
-	scmp_bpf_sim
+	scmp_bpf_sim \
+	scmp_api_level
 
 EXTRA_DIST = check-syntax scmp_app_inspector
 
 scmp_bpf_disasm_SOURCES = scmp_bpf_disasm.c bpf.h util.h
 scmp_bpf_sim_SOURCES = scmp_bpf_sim.c bpf.h util.h
+scmp_api_level_SOURCES = scmp_api_level.c
 
 scmp_sys_resolver_LDADD = ../src/libseccomp.la
 scmp_sys_resolver_LDFLAGS = -static
@@ -40,3 +42,5 @@ scmp_arch_detect_LDADD = ../src/libseccomp.la
 scmp_arch_detect_LDFLAGS = -static
 scmp_bpf_disasm_LDADD = util.la
 scmp_bpf_sim_LDADD = util.la
+scmp_api_level_LDADD = ../src/libseccomp.la
+scmp_api_level_LDFLAGS = -static

data/ext/enterprise_script_service/libseccomp/tools/bpf.h

@@ -56,14 +56,18 @@ struct sock_filter {
 typedef struct sock_filter bpf_instr_raw;
 
 /* seccomp return masks */
+#define SECCOMP_RET_ACTION_FULL 0xffff0000U
 #define SECCOMP_RET_ACTION	0x7fff0000U
 #define SECCOMP_RET_DATA	0x0000ffffU
 
 /* seccomp action values */
-#define SECCOMP_RET_KILL	0x00000000U
+#define SECCOMP_RET_KILL_PROCESS 0x80000000U
+#define SECCOMP_RET_KILL_THREAD 0x00000000U
+#define SECCOMP_RET_KILL	SECCOMP_RET_KILL_THREAD
 #define SECCOMP_RET_TRAP	0x00030000U
 #define SECCOMP_RET_ERRNO	0x00050000U
 #define SECCOMP_RET_TRACE	0x7ff00000U
+#define SECCOMP_RET_LOG		0x7ffc0000U
 #define SECCOMP_RET_ALLOW	0x7fff0000U
 
 /* bpf command classes */
@@ -101,6 +105,9 @@ typedef struct sock_filter bpf_instr_raw;
 #define BPF_LSH			0x60
 #define BPF_RSH			0x70
 #define BPF_NEG			0x80
+#define BPF_MOD			0x90
+#define BPF_XOR			0xa0
+
 /* BPF_JMP */
 #define BPF_JA			0x00
 #define BPF_JEQ			0x10

data/ext/enterprise_script_service/libseccomp/tools/scmp_api_level.c

@@ -0,0 +1,39 @@
+/**
+ * API Level Detector
+ *
+ * Copyright (c) 2018 Paul Moore <paul@paul-moore.com>
+ * Author: Paul Moore <paul@paul-moore.com>
+ */
+
+/*
+ * This library is free software; you can redistribute it and/or modify it
+ * under the terms of version 2.1 of the GNU Lesser General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this library; if not, see <http://www.gnu.org/licenses>.
+ */
+
+#include <errno.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#include <seccomp.h>
+
+/**
+ * main
+ */
+int main(int argc, char *argv[])
+{
+	unsigned int level;
+
+	level = seccomp_api_get();
+	printf("%d\n", level);
+
+	return 0;
+}

data/ext/enterprise_script_service/libseccomp/tools/scmp_arch_detect.c

@@ -99,6 +99,12 @@ int main(int argc, char *argv[])
 		case SCMP_ARCH_MIPSEL64N32:
 			printf("mipsel64n32\n");
 			break;
+		case SCMP_ARCH_PARISC:
+			printf("parisc\n");
+			break;
+		case SCMP_ARCH_PARISC64:
+			printf("parisc64\n");
+			break;
 		case SCMP_ARCH_PPC:
 			printf("ppc\n");
 			break;

data/ext/enterprise_script_service/libseccomp/tools/scmp_bpf_disasm.c

@@ -131,6 +131,12 @@ static const char *bpf_decode_op(const bpf_instr_raw *bpf)
 	case BPF_ALU+BPF_NEG+BPF_K:
 	case BPF_ALU+BPF_NEG+BPF_X:
 		return "neg";
+	case BPF_ALU+BPF_MOD+BPF_K:
+	case BPF_ALU+BPF_MOD+BPF_X:
+		return "mod";
+	case BPF_ALU+BPF_XOR+BPF_K:
+	case BPF_ALU+BPF_XOR+BPF_X:
+		return "xor";
 	case BPF_JMP+BPF_JA+BPF_K:
 	case BPF_JMP+BPF_JA+BPF_X:
 		return "jmp";
@@ -167,11 +173,14 @@ static const char *bpf_decode_op(const bpf_instr_raw *bpf)
  */
 static void bpf_decode_action(uint32_t k)
 {
-	uint32_t act = k & SECCOMP_RET_ACTION;
+	uint32_t act = k & SECCOMP_RET_ACTION_FULL;
 	uint32_t data = k & SECCOMP_RET_DATA;
 
 	switch (act) {
-	case SECCOMP_RET_KILL:
+	case SECCOMP_RET_KILL_PROCESS:
+		printf("KILL_PROCESS");
+		break;
+	case SECCOMP_RET_KILL_THREAD:
 		printf("KILL");
 		break;
 	case SECCOMP_RET_TRAP:
@@ -183,6 +192,9 @@ static void bpf_decode_action(uint32_t k)
 	case SECCOMP_RET_TRACE:
 		printf("TRACE(%u)", data);
 		break;
+	case SECCOMP_RET_LOG:
+		printf("LOG");
+		break;
 	case SECCOMP_RET_ALLOW:
 		printf("ALLOW");
 		break;

data/ext/enterprise_script_service/libseccomp/tools/scmp_bpf_sim.c

@@ -112,11 +112,14 @@ static void exit_error(unsigned int rc, unsigned int line)
  */
 static void end_action(uint32_t action, unsigned int line)
 {
-	uint32_t act = action & SECCOMP_RET_ACTION;
+	uint32_t act = action & SECCOMP_RET_ACTION_FULL;
 	uint32_t data = action & SECCOMP_RET_DATA;
 
 	switch (act) {
-	case SECCOMP_RET_KILL:
+	case SECCOMP_RET_KILL_PROCESS:
+		fprintf(stdout, "KILL_PROCESS\n");
+		break;
+	case SECCOMP_RET_KILL_THREAD:
 		fprintf(stdout, "KILL\n");
 		break;
 	case SECCOMP_RET_TRAP:
@@ -128,6 +131,9 @@ static void end_action(uint32_t action, unsigned int line)
 	case SECCOMP_RET_TRACE:
 		fprintf(stdout, "TRACE(%u)\n", data);
 		break;
+	case SECCOMP_RET_LOG:
+		fprintf(stdout, "LOG\n");
+		break;
 	case SECCOMP_RET_ALLOW:
 		fprintf(stdout, "ALLOW\n");
 		break;
@@ -265,6 +271,10 @@ int main(int argc, char *argv[])
 				arch = AUDIT_ARCH_MIPS64N32;
 			else if (strcmp(optarg, "mipsel64n32") == 0)
 				arch = AUDIT_ARCH_MIPSEL64N32;
+			else if (strcmp(optarg, "parisc") == 0)
+				arch = AUDIT_ARCH_PARISC;
+			else if (strcmp(optarg, "parisc64") == 0)
+				arch = AUDIT_ARCH_PARISC64;
 			else if (strcmp(optarg, "ppc") == 0)
 				arch = AUDIT_ARCH_PPC;
 			else if (strcmp(optarg, "ppc64") == 0)