def test_syscall_priority() -> None: filt = pyseccomp.SyscallFilter(pyseccomp.KILL) filt.syscall_priority( pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "write"), 100) filt.syscall_priority("write", 100) for syscall in [ pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "NOEXIST"), "NOEXIST" ]: with pytest.raises(OSError, match=r"Invalid argument"): filt.syscall_priority(cast(Union[int, str], syscall), 100)
def test_nice_eperm_exactly() -> None: filt = pyseccomp.SyscallFilter(pyseccomp.ALLOW) for name in ["nice", "setpriority"]: sys_nr = pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, name) if sys_nr >= 0: filt.add_rule_exactly(pyseccomp.ERRNO(errno.EPERM), sys_nr) pid = os.fork() if pid == 0: try: os.nice(0) filt.load() with pytest.raises(PermissionError): os.nice(0) except Exception: # pylint: disable=broad-except traceback.print_exc() os._exit(1) # pylint: disable=protected-access finally: os._exit(0) # pylint: disable=protected-access _, wstatus = os.waitpid(pid, 0) assert os.WIFEXITED(wstatus) assert os.WEXITSTATUS(wstatus) == 0
def test_resolve_syscall() -> None: write_nr = pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "write") assert pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, write_nr) == b"write" with pytest.raises(ValueError, match="Unknown syscall"): pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, -1) with pytest.raises(ValueError, match="Unknown syscall"): pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, -2) assert pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "NO_SYSCALL") == -1
def test_notification_resp_success() -> None: filt = pyseccomp.SyscallFilter(pyseccomp.ALLOW) filt.add_rule(pyseccomp.NOTIFY, "setpriority") pid = os.fork() if pid == 0: try: if cov_init is not None: cov_init() filt.load() pid = os.fork() if pid == 0: try: os.setpriority(os.PRIO_PROCESS, 0, os.getpriority(os.PRIO_PROCESS, 0)) except BaseException: # pylint: disable=broad-except traceback.print_exc() os._exit(1) # pylint: disable=protected-access finally: os._exit(0) # pylint: disable=protected-access notif = filt.receive_notify() assert notif.syscall == pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "setpriority") assert notif.syscall_arch == pyseccomp.system_arch() assert notif.syscall_args[:3] == [ os.PRIO_PROCESS, 0, os.getpriority(os.PRIO_PROCESS, 0), ] filt.respond_notify(pyseccomp.NotificationResponse(0, 0, notif.id, 1)) _, wstatus = os.waitpid(pid, 0) assert os.WIFEXITED(wstatus) assert os.WEXITSTATUS(wstatus) == 0 if cov_cleanup is not None: cov_cleanup() except BaseException: # pylint: disable=broad-except traceback.print_exc() os._exit(1) # pylint: disable=protected-access finally: os._exit(0) # pylint: disable=protected-access _, wstatus = os.waitpid(pid, 0) assert os.WIFEXITED(wstatus) assert os.WEXITSTATUS(wstatus) == 0
def test_nice_kill() -> None: filt = pyseccomp.SyscallFilter(pyseccomp.ALLOW) filt.add_rule(pyseccomp.KILL, pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "nice")) filt.add_rule( pyseccomp.KILL, pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "setpriority")) pid = os.fork() if pid == 0: try: os.nice(0) filt.load() os.nice(0) finally: os._exit(0) # pylint: disable=protected-access _, wstatus = os.waitpid(pid, 0) assert os.WIFSIGNALED(wstatus) assert os.WTERMSIG(wstatus) == signal.SIGSYS