sigsegv: add a forced sigsegv example

This example shows a means to trigger a SIGSEGV after processing a system call
in SIGSYS while keeping all register intact.  It does so by mapping the
enclosing page PROT_NONE such that the sigreturn will fault.

This means it is unsafe to use code that may be adjacent to the original call
when performing the mprotect.  If not, the SIGSEGV will be triggered early.
Additionally, any SIGSEGV handlers may result in a double fault if they rely
on now inaccessible code.

This is useful for certain debugging and crash dumping frameworks which have
trouble unrolling stack frames, e.g., through a SIGSYS.  There are some other
potential uses, but that is the most obvious.
drop need for __NR_time

Also cleans up tests and other logic.

Signed-off-by: Kees Cook <keescook@chromium.org>
do not change SECCOMP_RET defines if they're known

Signed-off-by: Kees Cook <keescook@chromium.org>
Makefile: clean up targets add "clean"

Signed-off-by: Kees Cook <keescook@chromium.org>
avoid gcc warning about type changes

Signed-off-by: Kees Cook <keescook@chromium.org>
Merge pull request #1 from kees/master

Pull in fixed from Kees, incl. nuking some of the vdso hack testing.
seccomp_bpf_tests: add support for proposed TSYNC behavior

Add support for the proposed cross-thread synchronization
functionality.  If implemented as proposed, it will provide
a means for a thread group to synchronize on a given seccomp
filter after thread creation as long as only the caller has
attached new filters (and any eligible threads are under seccomp
mode=2)
Merge pull request #2 from redpig/threads

seccomp_bpf_tests: add support for proposed TSYNC behavior
tsync: only one of the two siblings should fail

In two_siblings_not_under_filter, only 1 sibling should fail since the other
will be pulled into seccomp mode.

Signed-off-by: Kees Cook <keescook@chromium.org>
Merge pull request #4 from kees/tsync

tsync: only one of the two siblings should fail
tsync: unlock mutex on failure

Testing the there-is-no-seccomp case showed the children need to
unlock on fatal errors.

Signed-off-by: Kees Cook <keescook@chromium.org>
Merge pull request #5 from kees/tsync

tsync: unlock mutex on failure
tsync: fix cond_broadcast/wait race

It is possible for the second sibling to lose the race for the mutex
and miss one of the two cond_broadcast events. Detect this, and lower
the num_waits manually when shutting down the sibling.

Signed-off-by: Kees Cook <keescook@chromium.org>
Merge pull request #6 from kees/tsync

tsync: fix cond_broadcast/wait race
tests: check that fixture can detect prctl errors

This tests that prctl errors in threads will be reported correctly,
as fixed in "tsync: unlock mutex on failure".

Signed-off-by: Kees Cook <keescook@chromium.org>
tests: make sure spawned process can report status

If the spawned tracer fails and tests, communicate that back to the
spawner so the test will be reported as failing at the top-level.

Signed-off-by: Kees Cook <keescook@chromium.org>
tests: make sure events are from SECCOMP

Makes sure that the PTRACE_EVENT_SECCOMP value is correct and that is
is being passed by the kernel on ptrace events.

https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1326905

Signed-off-by: Kees Cook <keescook@chromium.org>
tests: run tests in source declaration order

Since the constructor was calling registration, the test list needed to be
explicitly built in reverse.

Signed-off-by: Kees Cook <keescook@chromium.org>
tests: convert from ACT_EXT_TSYNC to syscall

Converts tests to use new seccomp syscall instead of prctl. Also removes
logic expecing side-effects from TSYNC failure.

Signed-off-by: Kees Cook <keescook@chromium.org>
tests: add test for mode locking

Make sure the seccomp mode can't change.

Signed-off-by: Kees Cook <keescook@chromium.org>