tests: add tests for filtering the syscalls

4 files changed, 122 insertions, 3 deletions

diff --git a/tests/unit/Makefile b/tests/unit/Makefile
index 1c3a413..aeaf6ae 100644
--- a/tests/unit/Makefile
+++ b/tests/unit/Makefile
@@ -7,8 +7,13 @@ OP_DIR := ../../
 COOKER_DIR := ../../cooker
 DBG_DIR := ../../debug
 
-SRCS_FILTER := $(COOKER_DIR)/filter.c $(DBG_DIR)/disasm.c $(COMMON_DIR)/common.c
-HEADERS_FILTER := $(COOKER_DIR)/filter.h $(DBG_DIR)/disasm.h $(COMMON_DIR)/common.h
+SRCS_FILTER_BUILD := $(COOKER_DIR)/filter.c $(DBG_DIR)/disasm.c $(COMMON_DIR)/common.c
+HEADERS_FILTER_BUILD := $(COOKER_DIR)/filter.h $(DBG_DIR)/disasm.h $(COMMON_DIR)/common.h
+
+SRCS_FILTER := $(COOKER_DIR)/filter.c $(COMMON_DIR)/common.c util.c \
+	       $(DBG_DIR)/disasm.c
+HEADERS_FILTER := $(COOKER_DIR)/filter.h $(COMMON_DIR)/common.h \
+		  $(DBG_DIR)/disasm.h testutil.h
 
 HEADERS_OP_CALL := $(COMMON_DIR)/gluten.h  $(OP_DIR)/operations.h
 SRCS_OP_CALL := $(OP_DIR)/operations.c
@@ -33,11 +38,16 @@ CFLAGS += -DSEITAN_AUDIT_ARCH=AUDIT_ARCH_$(AUDIT_ARCH) -DTMP_DATA_SIZE=1000
 
 test: test-filter test-operations test-op-call
 
-test-filter-build: test_filter_build.c $(SRCS_FILTER) $(HEADERS_FILTER)
+test-filter-build: test_filter_build.c $(SRCS_FILTER_BUILD) $(HEADERS_FILTER_BUILD)
 	$(CC) $(CFLAGS) -o test-filter-build $(SRCS_FILTER) \
 		test_filter_build.c
 		./test-filter-build
 
+test-filter: test_filter.c $(SRCS_FILTER) $(HEADERS_FILTER)
+	        $(CC) $(CFLAGS) -o test-filter $(SRCS_FILTER) \
+                test_filter.c
+		./test-filter
+
 test-op-call: test_op_call.c $(SRCS_OP_CALL) $(HEADERS_OP_CALL)
 	$(CC) $(CFLAGS) -o test-op-call $(SRCS_OP_CALL) \
 		test_op_call.c
diff --git a/tests/unit/test_filter.c b/tests/unit/test_filter.c
new file mode 100644
index 0000000..5ff9d65
--- /dev/null
+++ b/tests/unit/test_filter.c
@@ -0,0 +1,93 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright 2023 Red Hat GmbH
+ * Author: Alice Frosi <afrosi@redhat.com>
+ */
+
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sched.h>
+#include <unistd.h>
+#include <limits.h>
+#include <fcntl.h>
+#include <sys/prctl.h>
+#include <sys/syscall.h>
+#include <sys/ioctl.h>
+#include <sys/wait.h>
+#include <linux/audit.h>
+#include <linux/filter.h>
+#include <linux/seccomp.h>
+#include <sys/mman.h>
+#include <sys/un.h>
+#include <sys/socket.h>
+
+#include <check.h>
+
+#include "gluten.h"
+#include "common.h"
+#include "testutil.h"
+#include "filter.h"
+
+static int generate_install_filter(struct args_target *at)
+{
+	struct bpf_call calls[] = { {} };
+	struct syscall_entry table[] = {
+		{ .count = 1, .nr = at->nr, .entry = &calls[0] }
+	};
+	struct sock_filter filter[30];
+	unsigned int size;
+
+	size = create_bfp_program(table, filter, 1);
+	return install_filter(filter, size);
+}
+
+void setup_build_filter()
+{
+	at = mmap(NULL, sizeof(struct args_target), PROT_READ | PROT_WRITE,
+		  MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+	at->check_fd = false;
+	at->nr = __NR_getpid;
+	at->args[0] = NULL;
+	at->install_filter = generate_install_filter;
+	setup();
+}
+
+START_TEST(filter)
+{
+	continue_target();
+}
+END_TEST
+
+
+Suite *op_call_suite(void)
+{
+	Suite *s;
+	int timeout = 30;
+	TCase *simple;
+
+	s = suite_create("Test filter with target");
+
+	simple = tcase_create("simple");
+	tcase_add_checked_fixture(simple, setup_build_filter, teardown);
+	tcase_set_timeout(simple, timeout);
+	tcase_add_test(simple, filter);
+	suite_add_tcase(s, simple);
+
+	return s;
+}
+
+int main(void)
+{
+	int no_failed = 0;
+	Suite *s;
+	SRunner *runner;
+
+	s = op_call_suite();
+	runner = srunner_create(s);
+
+	srunner_run_all(runner, CK_VERBOSE);
+	no_failed = srunner_ntests_failed(runner);
+	srunner_free(runner);
+	return (no_failed == 0) ? EXIT_SUCCESS : EXIT_FAILURE;
+}
diff --git a/tests/unit/testutil.h b/tests/unit/testutil.h
index 896d690..d4f83af 100644
--- a/tests/unit/testutil.h
+++ b/tests/unit/testutil.h
@@ -41,5 +41,6 @@ void check_target_result(long ret, int err, bool ignore_ret);
 void setup();
 void teardown();
 int install_notification_filter(struct args_target *at);
+void continue_target();
 
 #endif /* TESTUTIL_H */
diff --git a/tests/unit/util.c b/tests/unit/util.c
index d4109b0..c6fc3fb 100644
--- a/tests/unit/util.c
+++ b/tests/unit/util.c
@@ -155,6 +155,21 @@ void check_target_result(long ret, int err, bool ignore_ret)
 	ck_assert_int_eq(close(pipefd[0]), 0);
 }
 
+void continue_target()
+{
+	struct seccomp_notif_resp resp;
+	int ret;
+
+	ret = ioctl(notifyfd, SECCOMP_IOCTL_NOTIF_ID_VALID, &req.id);
+	ck_assert_msg(ret == 0, strerror(errno));
+	resp.id = req.id;
+	resp.flags = SECCOMP_USER_NOTIF_FLAG_CONTINUE;
+	resp.error = 0;
+	resp.val = 0;
+	ret = ioctl(notifyfd, SECCOMP_IOCTL_NOTIF_SEND, &resp);
+	ck_assert_msg(ret == 0, strerror(errno));
+}
+
 void setup()
 {
 	int ret;