filter_seccomp: fix jump offset overflow in binary match generator
binary_match_filter_generator() is missing a check for jump offset
overflows which might result in incorrect behavior if the binary match
strategy is selected and overflows.
I have only been able to reproduce the bug on mips after forcing strace to
use the binary match generator. Due to the large number of syscalls on
mips, the binary match algorithm is suboptimal and the linear one is
selected. This bug could however be triggered inadvertently if tracing a
very large set of syscalls not grouped together; in that case, the linear
strategy might have a jump offset overflow itself and strace would
fallback to the binary match one.
* filter_seccomp (binary_match_filter_generator): Check for jump offset
overflows.
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
tests: tolerate zero process group ID and session ID in strace-DDD.test
Paul Chaignon reported [1] that in some of Travis CI build environments
process group ID and session ID may be equal to zero.
Change the affected strace-DDD.test to tolerate these odd values as long
as they don't interfere with the purpose of the test.
[1] https://travis-ci.community/t/unexpected-zero-values-in-proc-pid-stat/5774
* tests/strace-DDD.test: Tolerate zero process group ID and session ID.
Reported-by: Paul Chaignon <paul.chaignon@gmail.com>
tests: robustify umount2.test against filtered umount2 syscall
Do not assume that umount2 syscall invoked with invalid arguments always
fail with EINVAL as in some environments it can be filtered out e.g.
using seccomp-bpf.
* tests/umount2.c (main): Use sprintrc() to prepare expected output.
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Co-authored-by: Dmitry V. Levin <ldv@altlinux.org>
tests: enhance termination signal forwarding check
Check that termination signal forwarding works properly when strace
is invoked with the corresponding termination signal blocked.
* tests/block_reset_run.c: New file.
* tests/Makefile.am (check_PROGRAMS): Add block_reset_run.
* tests/.gitignore: Likewise.
* tests/termsig.test: Extend the check to cover the case when
strace is invoked with the termination signal blocked.
Use __gcov_dump declaration from <gcov.h> if available
The function declaration provided by <gcov.h> is fine,
use it when <gcov.h> is available.
* configure.ac (AC_CHECK_HEADERS): Add gcov.h.
* defs.h [ENABLE_COVERAGE_GCOV && HAVE_GCOV_H]: Include <gcov.h>.
Use __gcov_dump instead of __gcov_flush to dump profile information
__gcov_flush is essentially __gcov_dump followed by __gcov_reset.
The way we use __gcov_flush so far does not need any __gcov_reset,
so use __gcov_dump instead.
* defs.h [ENABLE_COVERAGE_GCOV] (__gcov_flush): Replace with
__gcov_dump.
(GCOV_FLUSH): Replace with GCOV_DUMP.
* filter_seccomp.c (check_seccomp_order_do_child): Replace GCOV_FLUSH
with GCOV_DUMP.
* strace.c (terminate): Likewise.
Introduce a new macro GCOV_FLUSH and use it instead of __gcov_flush.
* defs.h (GCOV_FLUSH): New macro.
[ENABLE_COVERAGE_GCOV] (__gcov_flush): New prototype.
* filter_seccomp.c (__gcov_flush): Remove.
(check_seccomp_order_do_child): Call GCOV_FLUSH instead of __gcov_flush.
* strace.c (__gcov_flush): Remove.
(terminate): Call GCOV_FLUSH instead of __gcov_flush.
This commit introduces a new BPF program generation strategy. Traced
syscalls are encoded in 32-bit bit arrays in the BPF program. Syscalls
are then matched against bit arrays at runtime with two ALU operations:
a division to select the appropriate bit array to compare with,
and a shift to select the appropriate bit in the bit array.
Since there is no way to implement a jump table in BPF (jumps have fixed
offsets), we have to iterate over all bit arrays to select the appropriate
bit array. The division and modulo are also converted into a shift and
a bitwise AND, to improve performance and because seccomp-bpf disallows
modulos in BPF.
Compared to the linear generation strategy, this strategy generates
programs of near constant size. There is a single optimization that
depends on traced syscalls: if a bit array is all-0 or all-1, we don't
need to do a jset against it, we can simply jump to either RET_ALLOW
or RET_TRACE.
* filter_seccomp.c (JMP_PLACEHOLDER_ALLOW): New constant.
(binary_match_filter_generator): New prototype.
(filter_generators): Add binary_match_filter_generator.
(replace_jmp_placeholders): Handle JMP_PLACEHOLDER_ALLOW case.
(linear_filter_generator): New argument for replace_jmp_placeholders.
(bpf_syscalls_match, binary_match_filter_generator): New functions.
(dump_seccomp_bpf): Handle ldwimm, jset, rsh, lsh, and, tax, and txa
instructions.
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
filter_seccomp: list of seccomp filter generation strategies
Iterate over a list of BPF program generators, to select the shortest
program. This commit doesn't introduce new generation strategies.
* filter_seccomp.c (filter_generator_t): New typedef.
(linear_filter_generator): New prototype.
(filter_generators, filters): New variables.
(seccomp_filter): Remove.
(init_sock_filter): Rename to linear_filter_generator, signal overflow
via function argument instead of erroring out.
(check_seccomp_filter): Find the shortest program generated by all
generation strategies, error in case of overflow in all generated
programs.
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
tests: skip a few tests on systems with nproc == 1
Several tests require some concurrency between threads,
skip these tests if nproc reports 1.
* tests/init.sh (require_min_nproc): New function.
* tests/status-none-threads.test: Use it.
* tests/threads-execve.test: Likewise.
* xlat/v4l2_sliced_flags.in (V4L2_SLICED_TELETEXT_B, V4L2_SLICED_VPS,
V4L2_SLICED_CAPTION_525, V4L2_SLICED_WSS_625): Add fallback definitions.
(V4L2_SLICED_VBI_525): Comment out as it has the same value as
V4L2_SLICED_CAPTION_525.
(V4L2_SLICED_VBI_625): Add fallback definition, move up.
For some reason, it also used to include V4L2_VBI_ITU_[56]25_F[12]_START
constants that are definitely unrelated to V4L2_VBI_* flags.
* xlat/v4l2_vbi_flags.in (V4L2_VBI_UNSYNC, V4L2_VBI_INTERLACED): Add
fallback definitions.
(V4L2_VBI_ITU_525_F1_START, V4L2_VBI_ITU_525_F2_START,
V4L2_VBI_ITU_625_F1_START, V4L2_VBI_ITU_625_F2_START): Remove.
xlat: provide fallback definitions for V4L2_TUNER_* constants
Also, since V4L2_TUNER_*_SAP have the same values as V4L2_TUNER_*_LANG2,
comment out the former.
* xlat/v4l2_tuner_audmodes.in: Add fallback definitions for constants,
add #value_indexed.
(V4L2_TUNER_MODE_SAP): Comment out.
* xlat/v4l2_tuner_capabilities.in: Add fallback definitions for
constants.
(V4L2_TUNER_CAP_SAP): Comment out.
* xlat/v4l2_tuner_rxsubchanses.in: Add fallback definitions for
constants.
(V4L2_TUNER_SUB_SAP): Comment out.
When a structure is initialized using designated initializers,
clang >= 7, apparently, does not initialize trailing padding
of the structure.
* tests/bpf-obj_get_info_by_fd.c [CHECK_OBJ_PROG]
(bpf_prog_load_attr_sizes): Replace the size of struct
BPF_PROG_LOAD_struct with BPF_PROG_LOAD_struct_size.
filter_seccomp: use init_sock_filter to check the number of BPF instructions
With this commit, the number of instructions in the seccomp BPF program
is checked by directly constructing the program. The BPF program is
therefore created during the check for seccomp availability instead of
when seccomp filtering is initialized. The BPF program is saved
as a global variable between the two operations.
* filter_seccomp.c (seccomp_filter, bpf_prog): New variables.
(init_sock_filter): Disable seccomp-filter in case of overflow, move dump
of BPF program in debug mode...
(init_seccomp_filter): ...here.
(check_bpf_program_size): Remove.
(dump_seccomp_bpf): Remove arguments as they are now global variables.
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
tests/nsyscalls.c: remove redundant definition of SYSCALL_BIT
Starting with commit v5.3~111, tests/nsyscalls.c includes "scno.h"
which already defines SYSCALL_BIT where appropriate.
* tests/nsyscalls.c (SYSCALL_BIT): Remove.
xlat: add BPF_MAP_TYPE_DEVMAP_HASH to bpf_map_types
* xlat/bpf_map_types.in (BPF_MAP_TYPE_DEVMAP_HASH): New constant,
introduced by Linux commit v5.4-rc1~131^2~248^2~16^2~3.
* tests/bpf.c: Update expected output.
* xlat/bpf_prog_flags.in (BPF_F_TEST_STATE_FREQ): New constant,
introduced by Linux commit v5.4-rc1~131^2~62^2~17^2~3.
* tests/bpf.c: Update expected output.
* xlat/v4l2_format_description_flags.in (V4L2_FMT_FLAG_COMPRESSED,
V4L2_FMT_FLAG_EMULATED): Add fallback definitions.
(V4L2_FMT_FLAG_CONTINUOUS_BYTESTREAM): New constant, introduced by Linux
commit v5.4-rc1~145^2~69.
(V4L2_FMT_FLAG_DYN_RESOLUTION): New constant, introduced by Linux commit
v5.4-rc1~145^2~68.
* xlat/sock_sctp_options.in (SCTP_ASCONF_SUPPORTED): New constant,
introduced by Linux commit v5.4-rc1~131^2~204^2~4.
(SCTP_AUTH_SUPPORTED): New constant, introduced by Linux commit
v5.4-rc1~131^2~204^2~1.
(SCTP_ECN_SUPPORTED): New constant, introduced by Linux commit
v5.4-rc1~131^2~140^2.
rtnl_route: decode struct rta_mfc_stats and struct rtvia unconditionally
* rtnl_route.c (struct_rta_mfc_stats, struct_rtvia): New typedefs.
[HAVE_STRUCT_RTA_MFC_STATS]: Add a static_assert to check
that sizeof(struct rta_mfc_stats) has the expected value.
[HAVE_STRUCT_RTVIA]: Add a static_assert to check that sizeof(struct
rtvia) has the expected value.
(decode_rta_mfc_stats) [HAVE_STRUCT_RTA_MFC_STATS]: Remove guard.
(decode_rta_mfc_stats): Change the type of mfcs variable to
struct_rta_mfc_stats.
(decode_rtvia): Change the type of via variable to struct_rtvia.
References: https://bugzilla.redhat.com/show_bug.cgi?id=1758201
rtnl_neightbl: always decode struct ndt_config and struct ndt_stats
* rtnl_neightbl.c (struct_ndt_config, struct_ndt_stats): New typedefs.
[HAVE_STRUCT_NDT_CONFIG]: New static_assert to check
that sizeof(struct ndt_config) has the expected value.
[HAVE_STRUCT_NDT_STATS]: New static_assert to check
that sizeof(struct ndt_stats) has the expected value.
(decode_ndt_config) [HAVE_STRUCT_NDT_CONFIG]: Remove guard.
(decode_ndt_config): Change the type of ndtc variable
to struct_ndt_config.
(decode_ndt_stats) [HAVE_STRUCT_NDT_STATS]: Remove guard.
(decode_ndt_stats): Change the type of ndtst variable
to struct_ndt_stats.
References: https://bugzilla.redhat.com/show_bug.cgi?id=1758201
rtnl_link: print pad field in the struct ifla_port_vsi decoder
And steamline the flow a bit.
* rtnl_link.c (decode_ifla_port_vsi): Factor the printing code out of
the conditional statement, add pad field printing.
* tests/nlattr_ifla_port.c: Add check for the pad field printing.
rtnl_link: use internal rtnl_link_stats* and ifla_port_vsi definitions
Define substitutes for struct rtnl_link_stats, struct
rtnl_link_stats64, and struct ifla_port_vsi internally.
Add a static_assert that informs about future growth of the structures
provided by the kernel headers.
* rtnl_link.c (struct_rtnl_link_stats, struct_rtnl_link_stats64,
struct_ifla_port_vsi): New typedefs.
[HAVE_STRUCT_RTNL_LINK_STATS_RX_NOHANDLER]: Add a static_assert to check
that sizeof(struct rtnl_link_stats) has the expected value.
[HAVE_STRUCT_RTNL_LINK_STATS64_RX_NOHANDLER]: Add a static_assert
to check that sizeof(struct rtnl_link_stats) has the expected value.
[HAVE_STRUCT_IFLA_PORT_VSI]: Add a static_assert to check
that sizeof(struct ifla_port_vsi) has the expected value.
(decode_rtnl_link_stats) [HAVE_STRUCT_RTNL_LINK_STATS_RX_NOHANDLER]:
Remove guard.
(decode_rtnl_link_stats): Change the type of st variable to
struct_rtnl_link_stats; use struct_rtnl_link_stats in offsetofend
statement for min_size definition.
(decode_rtnl_link_stats64) [HAVE_STRUCT_RTNL_LINK_STATS64,
HAVE_STRUCT_RTNL_LINK_STATS64_RX_NOHANDLER]: Remove guards.
(decode_rtnl_link_stats64): Change the type of st variable
to struct_rtnl_link_stats64.
(decode_ifla_port_vsi) [HAVE_STRUCT_IFLA_PORT_VSI]: Remove guard.
(decode_ifla_port_vsi): Change the type of vsi variable
to struct_ifla_port_vsi.
References: https://bugzilla.redhat.com/show_bug.cgi?id=1758201
Enable building of netlink_crypto decoder without linux/cryptouser.h
* xlat/crypto_msgs.in: New file.
* configure.ac (AC_CHECK_TYPES): Check for struct crypto_user_alg.
* netlink.c: Include "xlat/crypto_msgs.h" with XLAT_MACROS_ONLY defined.
(netlink_decoders[]): Remove HAVE_LINUX_CRYPTOUSER_H guard around
[NETLINK_CRYPTO] item.
* netlink_crypto.c: Remove HAVE_LINUX_CRYPTOUSER_H guard; include
<linux/cryptouser.h> under HAVE_LINUX_CRYPTOUSER_H; include
"xlat/crypto_msgs.h" with XLAT_MACROS_ONLY defined.
[!CRYPTO_MAX_NAME] (CRYPTO_MAX_NAME): New macro.
(struct_crypto_user_alg, struct_crypto_report_hash,
struct_crypto_report_cipher, struct_crypto_report_blkcipher,
struct_crypto_report_aead, struct_crypto_report_rng): New typedefs.
[HAVE_STRUCT_CRYPTO_USER_ALG]: New static_assert to check
that sizeof(struct crypto_user_alg) has the expected value.
[HAVE_STRUCT_CRYPTO_REPORT_HASH]: New static_assert to check
that sizeof(struct crypto_report_hash) has the expected value.
[HAVE_STRUCT_CRYPTO_REPORT_CIPHER]: New static_assert to check
that sizeof(struct crypto_report_cipher) has the expected value.
[HAVE_STRUCT_CRYPTO_REPORT_BLKCIPHER]: New static_assert to check
that sizeof(struct crypto_report_blkcipher) has the expected value.
[HAVE_STRUCT_CRYPTO_REPORT_AEAD]: New static_assert to check
that sizeof(struct crypto_report_aead) has the expected value.
[HAVE_STRUCT_CRYPTO_REPORT_RNG]: New static_assert to check
that sizeof(struct crypto_report_rng) has the expected value.
(decode_crypto_report_hash) [!HAVE_STRUCT_CRYPTO_REPORT_HASH]: Remove.
(decode_crypto_report_hash): Change type of rhash to
struct_crypto_report_hash.
(decode_crypto_report_blkcipher) [!HAVE_STRUCT_CRYPTO_REPORT_BLKCIPHER]:
Remove.
(decode_crypto_report_blkcipher): Change type of rblkcipher to
struct_crypto_report_blkcipher.
(decode_crypto_report_aead) [!HAVE_STRUCT_CRYPTO_REPORT_AEAD]: Remove.
(decode_crypto_report_aead): Change type of raead to
struct_crypto_report_aead.
(decode_crypto_report_rng) [!HAVE_STRUCT_CRYPTO_REPORT_RNG]: Remove.
(decode_crypto_report_rng): Change type of rrng to
struct_crypto_report_rng.
(decode_crypto_report_cipher) [!HAVE_STRUCT_CRYPTO_REPORT_CIPHER]:
Remove.
(decode_crypto_report_cipher): Change type of rcipher to
struct_crypto_report_cipher.
(decode_crypto_user_alg): Change type of alg to struct_crypto_user_alg.
References: https://bugzilla.redhat.com/show_bug.cgi?id=1758201
evdev: remove additional indentation level for switch case labels
And while we are here, factor out evdev_write_ioctl_mpers call
out of the switch statement.
* evdev.c (bit_ioctl, evdev_read_ioctl, evdev_ioctl): Remove
one indentation level inside the switch statements.
(evedev_write_ioctl): Remove one indentation level inside the switch
statement; move default branch out of the switch statement.
It is useful in cases where a structure grows over time and we support
decoding of only part of it.
* tests/test_nlattr.h (TEST_NLATTR_OBJECT_EX_, TEST_NLATTR_OBJECT_EX):
Add minsz_ parameter, use it instead of sizeof(obj_).
(TEST_NLATTR_OBJECT): Pass sizeof(obj_) as minsz_.
(TEST_NLATTR_OBJECT_MINSZ): New macro.
* tests/nlattr_crypto_user_alg.c (main): Add proper minsz_ argument to
TEST_NLATTR_OBJECT_EX instances.
Paul Chaignon
Dmitry V. Levin
Eugene Syromyatnikov