Commit 267519c9 authored by Tycho Andersen's avatar Tycho Andersen Committed by Pavel Emelyanov

test: setuid in seccomp_filter test to have it fail

Signed-off-by: 's avatarTycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: 's avatarPavel Emelyanov <xemul@parallels.com>
parent 1da9760d
...@@ -100,16 +100,7 @@ int main(int argc, char ** argv) ...@@ -100,16 +100,7 @@ int main(int argc, char ** argv)
if (filter_syscall(__NR_getpid) < 0) if (filter_syscall(__NR_getpid) < 0)
_exit(1); _exit(1);
/* FIXME: seccomp requires a task to be root in its user ns in setuid(1000);
* order to install filters for security reasons, so that
* unprivileged parents cannot take over privileged childen.
* However, we restore euids before we restore seccomp filters,
* so if someone does a setuid(1000) here, the restore will
* fail. We need to reorder some things so that the other creds
* restore takes place after seccomp state is set; except that
* the tasks need to be ptraced so the seccomp filters
* potentially don't kill the task for calling setuid().
*/
zdtm_seccomp = 1; zdtm_seccomp = 1;
test_msg("SECCOMP_MODE_FILTER is enabled\n"); test_msg("SECCOMP_MODE_FILTER is enabled\n");
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment