def test_syscall_priority() -> None:
filt = pyseccomp.SyscallFilter(pyseccomp.KILL)
filt.syscall_priority(
pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "write"), 100)
filt.syscall_priority("write", 100)
for syscall in [
pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "NOEXIST"),
"NOEXIST"
]:
with pytest.raises(OSError, match=r"Invalid argument"):
filt.syscall_priority(cast(Union[int, str], syscall), 100)
def test_nice_eperm_exactly() -> None:
filt = pyseccomp.SyscallFilter(pyseccomp.ALLOW)
for name in ["nice", "setpriority"]:
sys_nr = pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, name)
if sys_nr >= 0:
filt.add_rule_exactly(pyseccomp.ERRNO(errno.EPERM), sys_nr)
pid = os.fork()
if pid == 0:
try:
os.nice(0)
filt.load()
with pytest.raises(PermissionError):
os.nice(0)
except Exception: # pylint: disable=broad-except
traceback.print_exc()
os._exit(1) # pylint: disable=protected-access
finally:
os._exit(0) # pylint: disable=protected-access
_, wstatus = os.waitpid(pid, 0)
assert os.WIFEXITED(wstatus)
assert os.WEXITSTATUS(wstatus) == 0
def test_resolve_syscall() -> None:
write_nr = pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "write")
assert pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, write_nr) == b"write"
with pytest.raises(ValueError, match="Unknown syscall"):
pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, -1)
with pytest.raises(ValueError, match="Unknown syscall"):
pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, -2)
assert pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "NO_SYSCALL") == -1
def test_notification_resp_success() -> None:
filt = pyseccomp.SyscallFilter(pyseccomp.ALLOW)
filt.add_rule(pyseccomp.NOTIFY, "setpriority")
pid = os.fork()
if pid == 0:
try:
if cov_init is not None:
cov_init()
filt.load()
pid = os.fork()
if pid == 0:
try:
os.setpriority(os.PRIO_PROCESS, 0, os.getpriority(os.PRIO_PROCESS, 0))
except BaseException: # pylint: disable=broad-except
traceback.print_exc()
os._exit(1) # pylint: disable=protected-access
finally:
os._exit(0) # pylint: disable=protected-access
notif = filt.receive_notify()
assert notif.syscall == pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "setpriority")
assert notif.syscall_arch == pyseccomp.system_arch()
assert notif.syscall_args[:3] == [
os.PRIO_PROCESS,
0,
os.getpriority(os.PRIO_PROCESS, 0),
]
filt.respond_notify(pyseccomp.NotificationResponse(0, 0, notif.id, 1))
_, wstatus = os.waitpid(pid, 0)
assert os.WIFEXITED(wstatus)
assert os.WEXITSTATUS(wstatus) == 0
if cov_cleanup is not None:
cov_cleanup()
except BaseException: # pylint: disable=broad-except
traceback.print_exc()
os._exit(1) # pylint: disable=protected-access
finally:
os._exit(0) # pylint: disable=protected-access
_, wstatus = os.waitpid(pid, 0)
assert os.WIFEXITED(wstatus)
assert os.WEXITSTATUS(wstatus) == 0
def test_nice_kill() -> None:
filt = pyseccomp.SyscallFilter(pyseccomp.ALLOW)
filt.add_rule(pyseccomp.KILL,
pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "nice"))
filt.add_rule(
pyseccomp.KILL,
pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "setpriority"))
pid = os.fork()
if pid == 0:
try:
os.nice(0)
filt.load()
os.nice(0)
finally:
os._exit(0) # pylint: disable=protected-access
_, wstatus = os.waitpid(pid, 0)
assert os.WIFSIGNALED(wstatus)
assert os.WTERMSIG(wstatus) == signal.SIGSYS