script_core 0.2.6 → 0.2.7

data/ext/enterprise_script_service/libseccomp/tests/58-live-tsync_notify.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python
+
+#
+# Seccomp Library test program
+#
+# Copyright (c) 2019 Cisco Systems, Inc. <pmoore2@cisco.com>
+# Author: Paul Moore <paul@paul-moore.com>
+#
+
+#
+# This library is free software; you can redistribute it and/or modify it
+# under the terms of version 2.1 of the GNU Lesser General Public License as
+# published by the Free Software Foundation.
+#
+# This library is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
+# for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library; if not, see <http://www.gnu.org/licenses>.
+#
+
+import argparse
+import os
+import signal
+import sys
+
+import util
+
+from seccomp import *
+
+def test():
+    magic = os.getuid() + 1
+    f = SyscallFilter(ALLOW)
+    f.set_attr(Attr.CTL_TSYNC, 1)
+    f.add_rule(NOTIFY, "getuid")
+    f.load()
+    pid = os.fork()
+    if pid == 0:
+        val = os.getuid()
+        if val != magic:
+            raise RuntimeError("Response return value failed")
+            quit(1)
+        quit(0)
+    else:
+        notify = f.receive_notify()
+        if notify.syscall != resolve_syscall(Arch(), "getuid"):
+            raise RuntimeError("Notification failed")
+        f.respond_notify(NotificationResponse(notify, magic, 0, 0))
+        wpid, rc = os.waitpid(pid, 0)
+        if os.WIFEXITED(rc) == 0:
+            raise RuntimeError("Child process error")
+        if os.WEXITSTATUS(rc) != 0:
+            raise RuntimeError("Child process error")
+        quit(160)
+
+test()
+
+# kate: syntax python;
+# kate: indent-mode python; space-indent on; indent-width 4; mixedindent off;

data/ext/enterprise_script_service/libseccomp/tests/58-live-tsync_notify.tests

@@ -0,0 +1,11 @@
+#
+# libseccomp regression test automation data
+#
+# Copyright (c) 2019 Cisco Systems, Inc. <pmoore2@cisco.com>
+# Author: Paul Moore <paul@paul-moore.com>
+#
+
+test type: live
+
+# Testname		API	Result
+58-live-tsync_notify	6	ALLOW

data/ext/enterprise_script_service/libseccomp/tests/Makefile.am

@@ -57,7 +57,7 @@ check_PROGRAMS = \
 	15-basic-resolver \
 	16-sim-arch_basic \
 	17-sim-arch_merge \
-	18-sim-basic_whitelist \
+	18-sim-basic_allowlist \
 	19-sim-missing_syscalls \
 	20-live-basic_die \
 	21-live-basic_allow \
@@ -73,7 +73,7 @@ check_PROGRAMS = \
 	31-basic-version_check \
 	32-live-tsync_allow \
 	33-sim-socket_syscalls_be \
-	34-sim-basic_blacklist \
+	34-sim-basic_denylist \
 	35-sim-negative_one \
 	36-sim-ipc_syscalls \
 	37-sim-ipc_syscalls_be \
@@ -90,7 +90,14 @@ check_PROGRAMS = \
 	48-sim-32b_args \
 	49-sim-64b_comparisons \
 	50-sim-hash_collision \
-	52-basic-load
+	51-live-user_notification \
+	52-basic-load \
+	53-sim-binary_tree \
+	54-live-binary_tree \
+	55-basic-pfc_binary_tree \
+	56-basic-iterate_syscalls \
+	57-basic-rawsysrc \
+	58-live-tsync_notify
 
 EXTRA_DIST_TESTPYTHON = \
 	util.py \
@@ -111,7 +118,7 @@ EXTRA_DIST_TESTPYTHON = \
 	15-basic-resolver.py \
 	16-sim-arch_basic.py \
 	17-sim-arch_merge.py \
-	18-sim-basic_whitelist.py \
+	18-sim-basic_allowlist.py \
 	19-sim-missing_syscalls.py \
 	20-live-basic_die.py \
 	21-live-basic_allow.py \
@@ -127,7 +134,7 @@ EXTRA_DIST_TESTPYTHON = \
 	31-basic-version_check.py \
 	32-live-tsync_allow.py \
 	33-sim-socket_syscalls_be.py \
-	34-sim-basic_blacklist.py \
+	34-sim-basic_denylist.py \
 	35-sim-negative_one.py \
 	36-sim-ipc_syscalls.py \
 	37-sim-ipc_syscalls_be.py \
@@ -143,7 +150,13 @@ EXTRA_DIST_TESTPYTHON = \
 	48-sim-32b_args.py \
 	49-sim-64b_comparisons.py \
 	50-sim-hash_collision.py \
-	52-basic-load.py
+	51-live-user_notification.py \
+	52-basic-load.py \
+	53-sim-binary_tree.py \
+	54-live-binary_tree.py \
+	56-basic-iterate_syscalls.py \
+	57-basic-rawsysrc.py \
+	58-live-tsync_notify.py
 
 EXTRA_DIST_TESTCFGS = \
 	01-sim-allow.tests \
@@ -163,7 +176,7 @@ EXTRA_DIST_TESTCFGS = \
 	15-basic-resolver.tests \
 	16-sim-arch_basic.tests \
 	17-sim-arch_merge.tests \
-	18-sim-basic_whitelist.tests \
+	18-sim-basic_allowlist.tests \
 	19-sim-missing_syscalls.tests \
 	20-live-basic_die.tests \
 	21-live-basic_allow.tests \
@@ -179,7 +192,7 @@ EXTRA_DIST_TESTCFGS = \
 	31-basic-version_check.tests \
 	32-live-tsync_allow.tests \
 	33-sim-socket_syscalls_be.tests \
-	34-sim-basic_blacklist.tests \
+	34-sim-basic_denylist.tests \
 	35-sim-negative_one.tests \
 	36-sim-ipc_syscalls.tests \
 	37-sim-ipc_syscalls_be.tests \
@@ -196,10 +209,18 @@ EXTRA_DIST_TESTCFGS = \
 	48-sim-32b_args.tests \
 	49-sim-64b_comparisons.tests \
 	50-sim-hash_collision.tests \
-	52-basic-load.tests
+	51-live-user_notification.tests \
+	52-basic-load.tests \
+	53-sim-binary_tree.tests \
+	54-live-binary_tree.tests \
+	55-basic-pfc_binary_tree.tests \
+	56-basic-iterate_syscalls.tests \
+	57-basic-rawsysrc.tests \
+	58-live-tsync_notify.tests
 
 EXTRA_DIST_TESTSCRIPTS = \
-	38-basic-pfc_coverage.sh 38-basic-pfc_coverage.pfc
+	38-basic-pfc_coverage.sh 38-basic-pfc_coverage.pfc \
+	55-basic-pfc_binary_tree.sh 55-basic-pfc_binary_tree.pfc
 
 EXTRA_DIST_TESTTOOLS = regression testdiff testgen
 

data/ext/enterprise_script_service/libseccomp/tests/regression

@@ -25,7 +25,8 @@ GLBL_ARCH_LE_SUPPORT=" \
 	x86 x86_64 x32 \
 	arm aarch64 \
 	mipsel mipsel64 mipsel64n32 \
-	ppc64le"
+	ppc64le \
+	riscv64"
 GLBL_ARCH_BE_SUPPORT=" \
 	mips mips64 mips64n32 \
 	parisc parisc64 \
@@ -46,6 +47,7 @@ GLBL_ARCH_64B_SUPPORT=" \
 	mips64 \
 	parisc64 \
 	ppc64 \
+	riscv64 \
 	s390x"
 
 GLBL_SYS_ARCH="../tools/scmp_arch_detect"
@@ -270,7 +272,8 @@ function generate_random_data() {
 	else
 		rcount=$[ ($RANDOM % 8) + 1 ]
 	fi
-	rdata=$(echo $(</dev/urandom tr -dc A-Za-z0-9 | head -c"$rcount"))
+	rdata=$(dd if=/dev/urandom bs=64 count=1 status=none | \
+		md5sum | awk '{ print $1 }' | head -c"$rcount")
 	echo "$rdata"
 }
 
@@ -777,7 +780,7 @@ function run_test_live() {
 
 	# setup the arch specific return values
 	case "$arch" in
-	x86|x86_64|x32|arm|aarch64|parisc|parisc64|ppc|ppc64|ppc64le|ppc|s390|s390x)
+	x86|x86_64|x32|arm|aarch64|parisc|parisc64|ppc|ppc64|ppc64le|ppc|s390|s390x|riscv64)
 		rc_kill_process=159
 		rc_kill=159
 		rc_allow=160

data/ext/enterprise_script_service/libseccomp/tests/util.c

@@ -200,14 +200,14 @@ int util_file_write(const char *path)
 
 	fd = open(path, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
 	if (fd < 0)
-		return errno;
+		return -errno;
 	if (write(fd, buf, buf_len) < buf_len) {
-		int rc = errno;
+		int rc = -errno;
 		close(fd);
 		return rc;
 	}
 	if (close(fd) < 0)
-		return errno;
+		return -errno;
 
 	return 0;
 }

data/ext/enterprise_script_service/libseccomp/tools/check-syntax

@@ -26,7 +26,7 @@ CHK_C_LIST="include/seccomp.h.in \
 	    src/*.c src/*.h \
 	    tests/*.c tests/*.h \
 	    tools/*.c tools/*.h"
-CHK_C_EXCLUDE=""
+CHK_C_EXCLUDE="src/syscalls.perf.c"
 
 ####
 # functions

data/ext/enterprise_script_service/libseccomp/tools/scmp_arch_detect.c

@@ -120,6 +120,9 @@ int main(int argc, char *argv[])
 		case SCMP_ARCH_S390X:
 			printf("s390x\n");
 			break;
+		case SCMP_ARCH_RISCV64:
+			printf("riscv64\n");
+			break;
 		default:
 			printf("unknown\n");
 		}

data/ext/enterprise_script_service/libseccomp/tools/scmp_bpf_disasm.c

@@ -288,7 +288,7 @@ static void bpf_decode_args(const bpf_instr_raw *bpf, unsigned int line)
  * @param file the BPF program
  *
  * Read the BPF program and display the instructions.  Returns zero on success,
- * negative values on failure.
+ * non-zero values on failure.
  *
  */
 static int bpf_decode(FILE *file)
@@ -424,7 +424,7 @@ static void bpf_dot_decode_args(const bpf_instr_raw *bpf, unsigned int line)
  * @param file the BPF program
  *
  * Read the BPF program and display the instructions.  Returns zero on success,
- * negative values on failure.
+ * non-zero values on failure.
  *
  */
 static int bpf_dot_decode(FILE *file)
@@ -508,6 +508,8 @@ int main(int argc, char *argv[])
 				arch = AUDIT_ARCH_S390;
 			else if (strcmp(optarg, "s390x") == 0)
 				arch = AUDIT_ARCH_S390X;
+			else if (strcmp(optarg, "riscv64") == 0)
+				arch = AUDIT_ARCH_RISCV64;
 			else
 				exit_usage(argv[0]);
 			break;

data/ext/enterprise_script_service/libseccomp/tools/scmp_bpf_sim.c

@@ -285,6 +285,8 @@ int main(int argc, char *argv[])
 				arch = AUDIT_ARCH_S390;
 			else if (strcmp(optarg, "s390x") == 0)
 				arch = AUDIT_ARCH_S390X;
+			else if (strcmp(optarg, "riscv64") == 0)
+				arch = AUDIT_ARCH_RISCV64;
 			else
 				exit_fault(EINVAL);
 			break;

data/ext/enterprise_script_service/libseccomp/tools/util.c

@@ -78,6 +78,8 @@
 #define ARCH_NATIVE		AUDIT_ARCH_S390X
 #elif __s390__
 #define ARCH_NATIVE		AUDIT_ARCH_S390
+#elif __riscv && __riscv_xlen == 64
+#define ARCH_NATIVE		AUDIT_ARCH_RISCV64
 #else
 #error the simulator code needs to know about your machine type
 #endif
@@ -87,15 +89,15 @@ uint32_t arch = ARCH_NATIVE;
 
 /**
  * Convert a 16-bit target integer into the host's endianess
- * @param arch the architecture token
+ * @param arch_token the architecture token
  * @param val the 16-bit integer
  *
  * Convert the endianess of the supplied value and return it to the caller.
  *
  */
-uint16_t ttoh16(uint32_t arch, uint16_t val)
+uint16_t ttoh16(uint32_t arch_token, uint16_t val)
 {
-	if (arch & __AUDIT_ARCH_LE)
+	if (arch_token & __AUDIT_ARCH_LE)
 		return le16toh(val);
 	else
 		return be16toh(val);
@@ -103,15 +105,15 @@ uint16_t ttoh16(uint32_t arch, uint16_t val)
 
 /**
  * Convert a 32-bit target integer into the host's endianess
- * @param arch the architecture token
+ * @param arch_token the architecture token
  * @param val the 32-bit integer
  *
  * Convert the endianess of the supplied value and return it to the caller.
  *
  */
-uint32_t ttoh32(uint32_t arch, uint32_t val)
+uint32_t ttoh32(uint32_t arch_token, uint32_t val)
 {
-	if (arch & __AUDIT_ARCH_LE)
+	if (arch_token & __AUDIT_ARCH_LE)
 		return le32toh(val);
 	else
 		return be32toh(val);
@@ -119,15 +121,15 @@ uint32_t ttoh32(uint32_t arch, uint32_t val)
 
 /**
  * Convert a 32-bit host integer into the target's endianess
- * @param arch the architecture token
+ * @param arch_token the architecture token
  * @param val the 32-bit integer
  *
  * Convert the endianess of the supplied value and return it to the caller.
  *
  */
-uint32_t htot32(uint32_t arch, uint32_t val)
+uint32_t htot32(uint32_t arch_token, uint32_t val)
 {
-	if (arch & __AUDIT_ARCH_LE)
+	if (arch_token & __AUDIT_ARCH_LE)
 		return htole32(val);
 	else
 		return htobe32(val);
@@ -135,15 +137,15 @@ uint32_t htot32(uint32_t arch, uint32_t val)
 
 /**
  * Convert a 64-bit host integer into the target's endianess
- * @param arch the architecture token
+ * @param arch_token the architecture token
  * @param val the 64-bit integer
  *
  * Convert the endianess of the supplied value and return it to the caller.
  *
  */
-uint64_t htot64(uint32_t arch, uint64_t val)
+uint64_t htot64(uint32_t arch_token, uint64_t val)
 {
-	if (arch & __AUDIT_ARCH_LE)
+	if (arch_token & __AUDIT_ARCH_LE)
 		return htole64(val);
 	else
 		return htobe64(val);

data/ext/enterprise_script_service/libseccomp/tools/util.h

@@ -72,6 +72,13 @@
 #define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #endif
 
+#ifndef AUDIT_ARCH_RISCV64
+#ifndef EM_RISCV
+#define EM_RISCV		243
+#endif /* EM_RISCV */
+#define AUDIT_ARCH_RISCV64	(EM_RISCV|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#endif /* AUDIT_ARCH_RISCV64 */
+
 extern uint32_t arch;
 
 uint16_t ttoh16(uint32_t arch, uint16_t val);

data/ext/enterprise_script_service/mruby/.github/workflows/codeql-analysis.yml

@@ -0,0 +1,51 @@
+name: "Code scanning - action"
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '0 19 * * 4'
+
+jobs:
+  CodeQL-Build:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+      with:
+        # We must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head.
+        fetch-depth: 2
+
+    # If this run was triggered by a pull request event, then checkout
+    # the head of the pull request instead of the merge commit.
+    - run: git checkout HEAD^2
+      if: ${{ github.event_name == 'pull_request' }}
+      
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v1
+      # Override language selection by uncommenting this and choosing your languages
+      # with:
+      #   languages: go, javascript, csharp, python, cpp, java
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v1
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v1

data/ext/enterprise_script_service/mruby/Doxyfile

@@ -6,7 +6,7 @@
 
 DOXYFILE_ENCODING      = UTF-8
 PROJECT_NAME           = "mruby"
-PROJECT_NUMBER         = 2.1.1
+PROJECT_NUMBER         = 2.1.2
 
 PROJECT_BRIEF          = "mruby is the lightweight implementation of the Ruby language"