Integ test for seccompiler --basic
Adds a test case for checking that the `basic`
flag is dropping the argument checks.
@@ -66,14 +66,15 @@ def _get_basic_syscall_list():
return json
-def _run_seccompiler(json_data):
+def _run_seccompiler(json_data, basic=False):
json_temp = tempfile.NamedTemporaryFile(delete=False)
json_temp.write(json_data.encode('utf-8'))
json_temp.flush()
bpf_temp = tempfile.NamedTemporaryFile(delete=False)
- run_seccompiler(bpf_path=bpf_temp.name, json_path=json_temp.name)
+ run_seccompiler(bpf_path=bpf_temp.name,
+ json_path=json_temp.name, basic=basic)
os.unlink(json_temp.name)
return bpf_temp.name
@@ -118,7 +119,7 @@ def test_seccomp_ls(bin_seccomp_paths):
def test_advanced_seccomp(bin_seccomp_paths):
"""
- Test `demo_harmless`.
+ Test seccompiler with `demo_jailer`.
Test that the demo jailer (with advanced seccomp) allows the harmless demo
binary and denies the malicious demo binary.
@@ -185,6 +186,20 @@ def test_advanced_seccomp(bin_seccomp_paths):
os.unlink(bpf_path)
+ # Run seccompiler with `--basic` flag.
+ bpf_path = _run_seccompiler(json_filter, basic=True)
+
+ # Run the mini jailer for malicious binary.
+ outcome = utils.run_cmd([demo_jailer, demo_malicious, bpf_path],
+ no_shell=True,
+ ignore_return_code=True)
+
+ # The malicious binary also terminates gracefully, since the --basic option
+ # disables all argument checks.
+ assert outcome.returncode == 0
+
+ os.unlink(bpf_path)
+
def test_seccomp_applies_to_all_threads(test_microvm_with_api):
"""Test all Firecracker threads get default seccomp level 2."""
