mir/criu
2
0
Fork 0
mirror of https://github.com/checkpoint-restore/criu synced 2025-09-03 07:45:17 +00:00
Code Issues Releases Wiki Activity

test: setuid in seccomp_filter test to have it fail

Browse Source 
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This commit is contained in:
Tycho Andersen
2015-12-16 09:15:08 -07:00
committed by Pavel Emelyanov
parent 1da9760dfe
commit 267519c9fb
1 changed files with 1 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
test/zdtm/live/static/seccomp_filter.c
View File

@@ -100,16 +100,7 @@ int main(int argc, char ** argv)
if (filter_syscall(__NR_getpid) < 0) if (filter_syscall(__NR_getpid) < 0)
_exit(1); _exit(1);
/* FIXME: seccomp requires a task to be root in its user ns in setuid(1000);
* order to install filters for security reasons, so that
* unprivileged parents cannot take over privileged childen.
* However, we restore euids before we restore seccomp filters,
* so if someone does a setuid(1000) here, the restore will
* fail. We need to reorder some things so that the other creds
* restore takes place after seccomp state is set; except that
* the tasks need to be ptraced so the seccomp filters
* potentially don't kill the task for calling setuid().
*/
zdtm_seccomp = 1; zdtm_seccomp = 1;
test_msg("SECCOMP_MODE_FILTER is enabled\n"); test_msg("SECCOMP_MODE_FILTER is enabled\n");