def test_remove_arch_sys() -> None:
filt = pyseccomp.SyscallFilter(defaction=pyseccomp.KILL)
filt.remove_arch(pyseccomp.system_arch())
with pytest.raises(FileExistsError):
filt.remove_arch(pyseccomp.system_arch())
with pytest.raises(FileExistsError):
filt.remove_arch(pyseccomp.Arch.NATIVE)
with pytest.raises(FileExistsError):
filt.remove_arch(nonsystem_arch())
def test_merge() -> None:
sys_arch = pyseccomp.system_arch()
nonsys_arch = nonsystem_arch()
filt_a = pyseccomp.SyscallFilter(pyseccomp.KILL)
assert filt_a.exist_arch(sys_arch)
assert not filt_a.exist_arch(nonsys_arch)
filt_b = pyseccomp.SyscallFilter(pyseccomp.KILL)
filt_b.add_arch(nonsys_arch)
filt_b.remove_arch(sys_arch)
assert not filt_b.exist_arch(sys_arch)
assert filt_b.exist_arch(nonsys_arch)
filt_a.merge(filt_b)
# Filter A has both
assert filt_a.exist_arch(sys_arch)
assert filt_a.exist_arch(nonsys_arch)
# Filter B was reset
assert filt_b.exist_arch(sys_arch)
assert not filt_b.exist_arch(nonsys_arch)
def test_notification_resp_success() -> None:
filt = pyseccomp.SyscallFilter(pyseccomp.ALLOW)
filt.add_rule(pyseccomp.NOTIFY, "setpriority")
pid = os.fork()
if pid == 0:
try:
if cov_init is not None:
cov_init()
filt.load()
pid = os.fork()
if pid == 0:
try:
os.setpriority(os.PRIO_PROCESS, 0, os.getpriority(os.PRIO_PROCESS, 0))
except BaseException: # pylint: disable=broad-except
traceback.print_exc()
os._exit(1) # pylint: disable=protected-access
finally:
os._exit(0) # pylint: disable=protected-access
notif = filt.receive_notify()
assert notif.syscall == pyseccomp.resolve_syscall(pyseccomp.Arch.NATIVE, "setpriority")
assert notif.syscall_arch == pyseccomp.system_arch()
assert notif.syscall_args[:3] == [
os.PRIO_PROCESS,
0,
os.getpriority(os.PRIO_PROCESS, 0),
]
filt.respond_notify(pyseccomp.NotificationResponse(0, 0, notif.id, 1))
_, wstatus = os.waitpid(pid, 0)
assert os.WIFEXITED(wstatus)
assert os.WEXITSTATUS(wstatus) == 0
if cov_cleanup is not None:
cov_cleanup()
except BaseException: # pylint: disable=broad-except
traceback.print_exc()
os._exit(1) # pylint: disable=protected-access
finally:
os._exit(0) # pylint: disable=protected-access
_, wstatus = os.waitpid(pid, 0)
assert os.WIFEXITED(wstatus)
assert os.WEXITSTATUS(wstatus) == 0
def nonsystem_arch() -> int:
sys_arch = pyseccomp.system_arch()
return next(arch for arch in [pyseccomp.Arch.X86_64, pyseccomp.Arch.ARM]
if arch != sys_arch)
def test_has_arch() -> None:
filt = pyseccomp.SyscallFilter(defaction=pyseccomp.KILL)
assert filt.exist_arch(pyseccomp.Arch.NATIVE)
assert filt.exist_arch(pyseccomp.system_arch())
assert not filt.exist_arch(nonsystem_arch())