diff --git a/tests/Makefile.am b/tests/Makefile.am index c7d6e3d8..7a39374d 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -8,6 +8,9 @@ EXTRA_DIST = ca-key.pem ca.pem common.sh server-cert.pem server-key.pem test1.co SUBDIRS = docker-ocserv +check_PROGRAMS = test-broken-seccomp +test_broken_seccomp_LDADD = $(LDADD) -lseccomp + dist_check_SCRIPTS = test-pass test-pass-cert test-cert test-iroute test-pass-script \ test-multi-cookie test-pam test-stress full-test test-group-pass test-pass-group-cert \ ocpasswd-test test-pass-group-cert-no-pass unix-test test-pass-opt-cert \ @@ -16,7 +19,7 @@ dist_check_SCRIPTS = test-pass test-pass-cert test-cert test-iroute test-pass-sc TESTS = test-pass test-pass-cert test-cert test-iroute test-pass-script \ test-multi-cookie full-test test-group-pass test-pass-group-cert \ ocpasswd-test test-pass-group-cert-no-pass unix-test test-pass-opt-cert \ - test-cookie-timeout test-cookie-timeout-2 + test-cookie-timeout test-cookie-timeout-2 test-broken-seccomp TESTS_ENVIRONMENT = srcdir="$(srcdir)" \ top_builddir="$(top_builddir)" diff --git a/tests/test-broken-seccomp.c b/tests/test-broken-seccomp.c new file mode 100644 index 00000000..81bcfb28 --- /dev/null +++ b/tests/test-broken-seccomp.c @@ -0,0 +1,39 @@ +#include +#include +#include +#include +#include +#include +#include +#include + +int main() +{ + scmp_filter_ctx ctx; + fd_set rfds; + int fd = open("/dev/null", O_RDONLY), ret; + + ctx = seccomp_init(SCMP_ACT_ERRNO(EPERM)); + assert(ctx != 0); + + assert(seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(select), 0) == 0); + + /* to allow printing and exiting */ + assert(seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(writev), 0) == 0); + assert(seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0) == 0); + assert(seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit), 0) == 0); + assert(seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0) == 0); + + assert (seccomp_load(ctx) == 0); + + FD_ZERO(&rfds); + FD_SET(fd, &rfds); + + ret = select(fd+1, &rfds, NULL, NULL, NULL); + if (ret < 0) { + fprintf(stderr, "select is blocked!\n"); + exit(1); + } + fprintf(stderr, "all ok\n"); + exit(0); +}