From ff3cfbb437795c7fee547b8340014071625a61a8 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Fri, 28 Mar 2025 02:24:27 +0900 Subject: test/sandbox: check seccomp outcome This is as ugly as it is because it has to have CAP_SYS_ADMIN and not be in seccomp mode. Signed-off-by: Ophestra --- test/sandbox/case/main.go | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) (limited to 'test/sandbox/case') diff --git a/test/sandbox/case/main.go b/test/sandbox/case/main.go index 59c80efb..4c639b28 100644 --- a/test/sandbox/case/main.go +++ b/test/sandbox/case/main.go @@ -1,9 +1,39 @@ package main import ( + "log" "os" + "strconv" + "strings" "git.gensokyo.uk/security/fortify/test/sandbox" ) -func main() { (&sandbox.T{FS: os.DirFS("/")}).MustCheckFile(os.Args[1], "/tmp/sandbox-ok") } +func main() { + log.SetFlags(0) + log.SetPrefix("test: ") + + if len(os.Args) < 2 { + log.Fatal("invalid argument") + } + + switch os.Args[1] { + case "filter": + if len(os.Args) != 4 { + log.Fatal("invalid argument") + } + + if pid, err := strconv.Atoi(strings.TrimSpace(os.Args[2])); err != nil { + log.Fatalf("%s", err) + } else if pid < 1 { + log.Fatalf("%d out of range", pid) + } else { + sandbox.MustCheckFilter(pid, os.Args[3]) + return + } + + default: + (&sandbox.T{FS: os.DirFS("/")}).MustCheckFile(os.Args[1], "/tmp/sandbox-ok") + return + } +} -- cgit v1.3.1