1 /*
2 * Copyright (C) 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <jni.h>
18
19 #define LOG_TAG "SeccompTest"
20
21 #include <functional>
22 #include <android/log.h>
23 #include <unistd.h>
24 #include <sys/types.h>
25 #include <sys/wait.h>
26
27 #define ALOG(priority, tag, ...) ((void)__android_log_print(ANDROID_##priority, tag, __VA_ARGS__))
28
29 #define ALOGI(...) ALOG(LOG_INFO, LOG_TAG, __VA_ARGS__)
30 #define ALOGE(...) ALOG(LOG_ERROR, LOG_TAG, __VA_ARGS__)
31
32 /*
33 * Function: testSyscallBlocked
34 * Purpose: test that the syscall listed is blocked by seccomp
35 * Parameters:
36 * nr: syscall number
37 * Returns:
38 * 1 if blocked, else 0
39 * Exceptions: None
40 */
doTestSyscallBlocked(std::function<void ()> execSyscall)41 static jboolean doTestSyscallBlocked(std::function<void()> execSyscall) {
42 int pid = fork();
43 if (pid == 0) {
44 execSyscall();
45 exit(0);
46 } else {
47 int status;
48 int ret = waitpid(pid, &status, 0);
49 if (ret != pid) {
50 ALOGE("Unexpected return result from waitpid");
51 return false;
52 }
53
54 if (WIFEXITED(status)) {
55 ALOGE("syscall was not blocked");
56 return false;
57 }
58
59 if (WIFSIGNALED(status)) {
60 int signal = WTERMSIG(status);
61 if (signal == 31) {
62 ALOGI("syscall caused process termination");
63 return true;
64 }
65
66 ALOGE("Unexpected signal");
67 return false;
68 }
69
70 ALOGE("Unexpected status from syscall_exists");
71 return false;
72 }
73 }
74
testSyscallBlocked(JNIEnv *,jobject,jint nr)75 static jboolean testSyscallBlocked(JNIEnv *, jobject, jint nr) {
76 return doTestSyscallBlocked([&](){ ALOGI("Calling syscall %d", nr); syscall(nr); });
77 }
78
testSetresuidBlocked(JNIEnv *,jobject,jint ruid,jint euid,jint suid)79 static jboolean testSetresuidBlocked(JNIEnv *, jobject, jint ruid, jint euid, jint suid) {
80 return doTestSyscallBlocked([&] {
81 ALOGE("Calling setresuid\n");
82 setresuid(ruid, euid, suid);
83 });
84 }
85
testSetresgidBlocked(JNIEnv *,jobject,jint rgid,jint egid,jint sgid)86 static jboolean testSetresgidBlocked(JNIEnv *, jobject, jint rgid, jint egid, jint sgid) {
87 return doTestSyscallBlocked([&] {
88 ALOGE("Calling setresgid\n");
89 setresgid(rgid, egid, sgid);
90 });
91 }
92
93 static JNINativeMethod gMethods[] = {
94 { "testSyscallBlocked", "(I)Z",
95 (void*) testSyscallBlocked },
96 { "testSetresuidBlocked", "(III)Z",
97 (void*) testSetresuidBlocked },
98 { "testSetresgidBlocked", "(III)Z",
99 (void*) testSetresgidBlocked },
100 };
101
register_android_seccomp_cts_app_SeccompTest(JNIEnv * env)102 int register_android_seccomp_cts_app_SeccompTest(JNIEnv* env)
103 {
104 jclass clazz = env->FindClass("android/seccomp/cts/app/SeccompDeviceTest");
105
106 return env->RegisterNatives(clazz, gMethods,
107 sizeof(gMethods) / sizeof(JNINativeMethod));
108 }
109