rkt_seccomp_test: Fix arm64 stat tests #3804
Conversation
The -stat-file option of rkt's inspect program uses the standard go os.Stat() routine, which uses the syscall.Stat() routine for its operation. For amd64 syscall.Stat() uses the SYS_STAT system call, and so setting actool's --seccomp-set option to 'stat' works with inspect's -stat-file option. The arm64 linux kernel does not implement a SYS_STAT syscall, so for arm64 syscall.Stat() is implemented as a wrapper around the syscall.Fstatat() routine. Because of this actool's --seccomp-set option needs to be set to 'newfstatat' for the '-stat-file' option to work correctly on arm64 machines. Signed-off-by: Geoff Levand <geoff@infradead.org>
|
@glevand thanks for the detailed writeup! I like your PR, but I'm just wondering if we can make this architecture-independent by simply expanding the test-set to all stat-related syscalls (stat, fstatat64 and newfstatat)? I'm unsure if libseccomp/systemd rejects architecture-specific syscalls where they don't exist. |
|
@lucab I don't think it possible to test all stat related syscalls in a architecture-independent way since we either need to filter the tests to run (not include SYS_STAT tests on arm64), or vary the expected output (look for the error string on amd64 and success on arm64). I think the second better, but that seems like it will need |
|
@glevand no worries, mine was just a wish item. In order to keep the test simple, I'm fine with your PR as it currently is. I've just re-triggered semaphoreci. |
The -stat-file option of rkt's inspect program uses the standard go
os.Stat() routine, which uses the syscall.Stat() routine for its
operation. For amd64 syscall.Stat() uses the SYS_STAT system call,
and so setting actool's --seccomp-set option to 'stat' works with
inspect's -stat-file option.
The arm64 linux kernel does not implement a SYS_STAT syscall, so for
arm64 syscall.Stat() is implemented as a wrapper around the
syscall.Fstatat() routine. Because of this actool's --seccomp-set
option needs to be set to 'newfstatat' for the '-stat-file' option
to work correctly on arm64 machines.
I put a small program that tests for valid seccomp syscall names here:
https://gist.github.com/glevand/4625adcef2c5d25c457eb308f76e5148 (seccomp-name-test.c)
See:
https://github.com/rkt/rkt/blob/master/tests/inspect/inspect.go
https://golang.org/src/syscall/syscall_linux_arm64.go