test/sandbox: check seccomp outcome

This is as ugly as it is because it has to have CAP_SYS_ADMIN and not be in seccomp mode.

Signed-off-by: Ophestra <cat@gensokyo.uk>

2 files changed, 62 insertions, 1 deletions

diff --git a/test/sandbox/assert.go b/test/sandbox/assert.go
index c4b59fd7..50d078e1 100644
--- a/test/sandbox/assert.go
+++ b/test/sandbox/assert.go
@@ -7,10 +7,14 @@ in the public sandbox/vfs package. Files in this package are excluded by the bui
 package sandbox
 
 import (
+	"crypto/sha512"
+	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"io/fs"
 	"log"
 	"os"
+	"syscall"
 )
 
 var (
@@ -124,6 +128,33 @@ func (t *T) MustCheck(want *TestCase) {
 	}
 }
 
+func MustCheckFilter(pid int, want string) {
+	if err := ptraceAttach(pid); err != nil {
+		fatalf("cannot attach to process %d: %v", pid, err)
+	}
+	buf, err := getFilter[[8]byte](pid, 0)
+	if err0 := ptraceDetach(pid); err0 != nil {
+		printf("cannot detach from process %d: %v", pid, err0)
+	}
+	if err != nil {
+		if errors.Is(err, syscall.ENOENT) {
+			fatalf("seccomp filter not installed for process %d", pid)
+		}
+		fatalf("cannot get filter: %v", err)
+	}
+
+	h := sha512.New()
+	for _, b := range buf {
+		h.Write(b[:])
+	}
+
+	if got := hex.EncodeToString(h.Sum(nil)); got != want {
+		fatalf("[FAIL] %s", got)
+	} else {
+		printf("[ OK ] %s", got)
+	}
+}
+
 func mustDecode(wantFilePath string, v any) {
 	if f, err := os.Open(wantFilePath); err != nil {
 		fatalf("cannot open %q: %v", wantFilePath, err)
diff --git a/test/sandbox/case/main.go b/test/sandbox/case/main.go
index 59c80efb..4c639b28 100644
--- a/test/sandbox/case/main.go
+++ b/test/sandbox/case/main.go
@@ -1,9 +1,39 @@
 package main
 
 import (
+	"log"
 	"os"
+	"strconv"
+	"strings"
 
 	"git.gensokyo.uk/security/fortify/test/sandbox"
 )
 
-func main() { (&sandbox.T{FS: os.DirFS("/")}).MustCheckFile(os.Args[1], "/tmp/sandbox-ok") }
+func main() {
+	log.SetFlags(0)
+	log.SetPrefix("test: ")
+
+	if len(os.Args) < 2 {
+		log.Fatal("invalid argument")
+	}
+
+	switch os.Args[1] {
+	case "filter":
+		if len(os.Args) != 4 {
+			log.Fatal("invalid argument")
+		}
+
+		if pid, err := strconv.Atoi(strings.TrimSpace(os.Args[2])); err != nil {
+			log.Fatalf("%s", err)
+		} else if pid < 1 {
+			log.Fatalf("%d out of range", pid)
+		} else {
+			sandbox.MustCheckFilter(pid, os.Args[3])
+			return
+		}
+
+	default:
+		(&sandbox.T{FS: os.DirFS("/")}).MustCheckFile(os.Args[1], "/tmp/sandbox-ok")
+		return
+	}
+}