1 /*
2 * Copyright (C) 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <jni.h>
18
19 #define LOG_TAG "SeccompTest"
20
21 #include <functional>
22 #include <android/log.h>
23 #include <unistd.h>
24 #include <sys/types.h>
25 #include <sys/wait.h>
26
27 #define ALOG(priority, tag, ...) ((void)__android_log_print(ANDROID_##priority, tag, __VA_ARGS__))
28
29 #define ALOGI(...) ALOG(LOG_INFO, LOG_TAG, __VA_ARGS__)
30 #define ALOGE(...) ALOG(LOG_ERROR, LOG_TAG, __VA_ARGS__)
31
32 #define PER_USER_RANGE 100000
33
34 /*
35 * Function: testSyscallBlocked
36 * Purpose: test that the syscall listed is blocked by seccomp
37 * Parameters:
38 * nr: syscall number
39 * Returns:
40 * 1 if blocked, else 0
41 * Exceptions: None
42 */
doTestSyscallBlocked(std::function<void ()> execSyscall)43 static jboolean doTestSyscallBlocked(std::function<void()> execSyscall) {
44 int pid = fork();
45 if (pid == 0) {
46 execSyscall();
47 exit(0);
48 } else {
49 int status;
50 int ret = waitpid(pid, &status, 0);
51 if (ret != pid) {
52 ALOGE("Unexpected return result from waitpid");
53 return false;
54 }
55
56 if (WIFEXITED(status)) {
57 ALOGE("syscall was not blocked");
58 return false;
59 }
60
61 if (WIFSIGNALED(status)) {
62 int signal = WTERMSIG(status);
63 if (signal == 31) {
64 ALOGI("syscall caused process termination");
65 return true;
66 }
67
68 ALOGE("Unexpected signal");
69 return false;
70 }
71
72 ALOGE("Unexpected status from syscall_exists");
73 return false;
74 }
75 }
76
testSyscallBlocked(JNIEnv *,jobject,jint nr)77 static jboolean testSyscallBlocked(JNIEnv *, jobject, jint nr) {
78 return doTestSyscallBlocked([&](){ ALOGI("Calling syscall %d", nr); syscall(nr); });
79 }
80
testSetresuidBlocked(JNIEnv *,jobject,jint ruid,jint euid,jint suid)81 static jboolean testSetresuidBlocked(JNIEnv *, jobject, jint ruid, jint euid, jint suid) {
82 jint userId = getuid() / PER_USER_RANGE;
83 jint userRuid = userId * PER_USER_RANGE + ruid;
84 jint userEuid = userId * PER_USER_RANGE + euid;
85 jint userSuid = userId * PER_USER_RANGE + suid;
86
87 return doTestSyscallBlocked([&] {ALOGE("Calling setresuid\n"); setresuid(userRuid, userEuid, userSuid);});
88 }
89
testSetresgidBlocked(JNIEnv *,jobject,jint rgid,jint egid,jint sgid)90 static jboolean testSetresgidBlocked(JNIEnv *, jobject, jint rgid, jint egid, jint sgid) {
91 jint userId = getuid() / PER_USER_RANGE;
92 jint userRgid = userId * PER_USER_RANGE + rgid;
93 jint userEgid = userId * PER_USER_RANGE + egid;
94 jint userSgid = userId * PER_USER_RANGE + sgid;
95
96 return doTestSyscallBlocked([&] {ALOGE("Calling setresgid\n"); setresgid(userRgid, userEgid, userSgid);});
97 }
98
99 static JNINativeMethod gMethods[] = {
100 { "testSyscallBlocked", "(I)Z",
101 (void*) testSyscallBlocked },
102 { "testSetresuidBlocked", "(III)Z",
103 (void*) testSetresuidBlocked },
104 { "testSetresgidBlocked", "(III)Z",
105 (void*) testSetresgidBlocked },
106 };
107
register_android_seccomp_cts_app_SeccompTest(JNIEnv * env)108 int register_android_seccomp_cts_app_SeccompTest(JNIEnv* env)
109 {
110 jclass clazz = env->FindClass("android/seccomp/cts/app/SeccompDeviceTest");
111
112 return env->RegisterNatives(clazz, gMethods,
113 sizeof(gMethods) / sizeof(JNINativeMethod));
114 }
115