Commit d7d2e5bb authored by Kees Cook's avatar Kees Cook

selftests/seccomp: Add SKIPs for failed unshare()

Running the seccomp tests as a regular user shouldn't just fail tests
that require CAP_SYS_ADMIN (for getting a PID namespace). Instead,
detect those cases and SKIP them. Additionally, gracefully SKIP missing
CONFIG_USER_NS (and add to "config" since we'd prefer to actually test
this case).
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 8b1bc88c
CONFIG_SECCOMP=y CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y CONFIG_SECCOMP_FILTER=y
CONFIG_USER_NS=y
...@@ -3444,7 +3444,10 @@ TEST(user_notification_child_pid_ns) ...@@ -3444,7 +3444,10 @@ TEST(user_notification_child_pid_ns)
struct seccomp_notif req = {}; struct seccomp_notif req = {};
struct seccomp_notif_resp resp = {}; struct seccomp_notif_resp resp = {};
ASSERT_EQ(unshare(CLONE_NEWUSER | CLONE_NEWPID), 0); ASSERT_EQ(unshare(CLONE_NEWUSER | CLONE_NEWPID), 0) {
if (errno == EINVAL)
SKIP(return, "kernel missing CLONE_NEWUSER support");
};
listener = user_trap_syscall(__NR_getppid, listener = user_trap_syscall(__NR_getppid,
SECCOMP_FILTER_FLAG_NEW_LISTENER); SECCOMP_FILTER_FLAG_NEW_LISTENER);
...@@ -3509,7 +3512,10 @@ TEST(user_notification_sibling_pid_ns) ...@@ -3509,7 +3512,10 @@ TEST(user_notification_sibling_pid_ns)
} }
/* Create the sibling ns, and sibling in it. */ /* Create the sibling ns, and sibling in it. */
ASSERT_EQ(unshare(CLONE_NEWPID), 0); ASSERT_EQ(unshare(CLONE_NEWPID), 0) {
if (errno == EPERM)
SKIP(return, "CLONE_NEWPID requires CAP_SYS_ADMIN");
}
ASSERT_EQ(errno, 0); ASSERT_EQ(errno, 0);
pid2 = fork(); pid2 = fork();
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment