]> www.infradead.org Git - users/hch/misc.git/commit
selftests/seccomp: validate uretprobe syscall passes through seccomp
authorEyal Birger <eyal.birger@gmail.com>
Sun, 2 Feb 2025 16:29:21 +0000 (08:29 -0800)
committerKees Cook <kees@kernel.org>
Thu, 6 Feb 2025 21:19:14 +0000 (13:19 -0800)
commitc2debdb8544f415eaf9292a866d4073912eeb561
treef4b78b5fe7cf145fd1ff2357b65bd444f8520aac
parentcf6cb56ef24410fb5308f9655087f1eddf4452e6
selftests/seccomp: validate uretprobe syscall passes through seccomp

The uretprobe syscall is implemented as a performance enhancement on
x86_64 by having the kernel inject a call to it on function exit; User
programs cannot call this system call explicitly.

As such, this syscall is considered a kernel implementation detail and
should not be filtered by seccomp.

Enhance the seccomp bpf test suite to check that uretprobes can be
attached to processes without the killing the process regardless of
seccomp policy.

Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
Link: https://lore.kernel.org/r/20250202162921.335813-3-eyal.birger@gmail.com
[kees: Skip archs without __NR_uretprobe]
Signed-off-by: Kees Cook <kees@kernel.org>
tools/testing/selftests/seccomp/seccomp_bpf.c