baseline_policy_unittest.cc 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500
  1. // Copyright 2014 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
  5. #include <errno.h>
  6. #include <fcntl.h>
  7. #include <netinet/in.h>
  8. #include <sched.h>
  9. #include <signal.h>
  10. #include <stddef.h>
  11. #include <stdlib.h>
  12. #include <string.h>
  13. #include <sys/mman.h>
  14. #include <sys/prctl.h>
  15. #include <sys/resource.h>
  16. #include <sys/socket.h>
  17. #include <sys/stat.h>
  18. #include <sys/syscall.h>
  19. #include <sys/time.h>
  20. #include <sys/types.h>
  21. #include <sys/wait.h>
  22. #include <time.h>
  23. #include <unistd.h>
  24. #include <tuple>
  25. #include "base/clang_profiling_buildflags.h"
  26. #include "base/files/scoped_file.h"
  27. #include "base/posix/eintr_wrapper.h"
  28. #include "base/threading/thread.h"
  29. #include "build/build_config.h"
  30. #include "build/chromeos_buildflags.h"
  31. #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
  32. #include "sandbox/linux/seccomp-bpf/bpf_tests.h"
  33. #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
  34. #include "sandbox/linux/seccomp-bpf/syscall.h"
  35. #include "sandbox/linux/services/syscall_wrappers.h"
  36. #include "sandbox/linux/services/thread_helpers.h"
  37. #include "sandbox/linux/system_headers/linux_futex.h"
  38. #include "sandbox/linux/system_headers/linux_syscalls.h"
  39. #include "sandbox/linux/system_headers/linux_time.h"
  40. #include "sandbox/linux/tests/test_utils.h"
  41. #include "sandbox/linux/tests/unit_tests.h"
  42. #if !defined(SO_PEEK_OFF)
  43. #define SO_PEEK_OFF 42
  44. #endif
  45. namespace sandbox {
  46. namespace {
  47. // This also tests that read(), write(), fstat(), and fstatat(.., "", ..,
  48. // AT_EMPTY_PATH) are allowed.
  49. void TestPipeOrSocketPair(base::ScopedFD read_end, base::ScopedFD write_end) {
  50. BPF_ASSERT_LE(0, read_end.get());
  51. BPF_ASSERT_LE(0, write_end.get());
  52. struct stat stat_buf;
  53. int sys_ret = fstat(read_end.get(), &stat_buf);
  54. BPF_ASSERT_EQ(0, sys_ret);
  55. BPF_ASSERT(S_ISFIFO(stat_buf.st_mode) || S_ISSOCK(stat_buf.st_mode));
  56. sys_ret = fstatat(read_end.get(), "", &stat_buf, AT_EMPTY_PATH);
  57. BPF_ASSERT_EQ(0, sys_ret);
  58. BPF_ASSERT(S_ISFIFO(stat_buf.st_mode) || S_ISSOCK(stat_buf.st_mode));
  59. // Make sure fstatat with anything other than an empty string is denied.
  60. sys_ret = fstatat(read_end.get(), "/", &stat_buf, AT_EMPTY_PATH);
  61. BPF_ASSERT_EQ(sys_ret, -1);
  62. BPF_ASSERT_EQ(EPERM, errno);
  63. // Make sure fstatat without AT_EMPTY_PATH is denied.
  64. sys_ret = fstatat(read_end.get(), "", &stat_buf, 0);
  65. BPF_ASSERT_EQ(sys_ret, -1);
  66. BPF_ASSERT_EQ(EPERM, errno);
  67. const ssize_t kTestTransferSize = 4;
  68. static const char kTestString[kTestTransferSize] = {'T', 'E', 'S', 'T'};
  69. ssize_t transfered = 0;
  70. transfered =
  71. HANDLE_EINTR(write(write_end.get(), kTestString, kTestTransferSize));
  72. BPF_ASSERT_EQ(kTestTransferSize, transfered);
  73. char read_buf[kTestTransferSize + 1] = {0};
  74. transfered = HANDLE_EINTR(read(read_end.get(), read_buf, sizeof(read_buf)));
  75. BPF_ASSERT_EQ(kTestTransferSize, transfered);
  76. BPF_ASSERT_EQ(0, memcmp(kTestString, read_buf, kTestTransferSize));
  77. }
  78. // Test that a few easy-to-test system calls are allowed.
  79. BPF_TEST_C(BaselinePolicy, BaselinePolicyBasicAllowed, BaselinePolicy) {
  80. BPF_ASSERT_EQ(0, sched_yield());
  81. int pipefd[2];
  82. int sys_ret = pipe(pipefd);
  83. BPF_ASSERT_EQ(0, sys_ret);
  84. TestPipeOrSocketPair(base::ScopedFD(pipefd[0]), base::ScopedFD(pipefd[1]));
  85. BPF_ASSERT_LE(1, getpid());
  86. BPF_ASSERT_LE(0, getuid());
  87. }
  88. BPF_TEST_C(BaselinePolicy, FchmodErrno, BaselinePolicy) {
  89. int ret = fchmod(-1, 07777);
  90. BPF_ASSERT_EQ(-1, ret);
  91. // Without the sandbox, this would EBADF instead.
  92. BPF_ASSERT_EQ(EPERM, errno);
  93. }
  94. BPF_TEST_C(BaselinePolicy, ForkErrno, BaselinePolicy) {
  95. errno = 0;
  96. pid_t pid = fork();
  97. const int fork_errno = errno;
  98. TestUtils::HandlePostForkReturn(pid);
  99. BPF_ASSERT_EQ(-1, pid);
  100. BPF_ASSERT_EQ(EPERM, fork_errno);
  101. }
  102. pid_t ForkX86Glibc() {
  103. static pid_t ptid;
  104. return sys_clone(CLONE_PARENT_SETTID | SIGCHLD, nullptr, &ptid, nullptr,
  105. nullptr);
  106. }
  107. BPF_TEST_C(BaselinePolicy, ForkX86Eperm, BaselinePolicy) {
  108. errno = 0;
  109. pid_t pid = ForkX86Glibc();
  110. const int fork_errno = errno;
  111. TestUtils::HandlePostForkReturn(pid);
  112. BPF_ASSERT_EQ(-1, pid);
  113. BPF_ASSERT_EQ(EPERM, fork_errno);
  114. }
  115. pid_t ForkARMGlibc() {
  116. static pid_t ctid;
  117. return sys_clone(CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID | SIGCHLD, nullptr,
  118. nullptr, &ctid, nullptr);
  119. }
  120. BPF_TEST_C(BaselinePolicy, ForkArmEperm, BaselinePolicy) {
  121. errno = 0;
  122. pid_t pid = ForkARMGlibc();
  123. const int fork_errno = errno;
  124. TestUtils::HandlePostForkReturn(pid);
  125. BPF_ASSERT_EQ(-1, pid);
  126. BPF_ASSERT_EQ(EPERM, fork_errno);
  127. }
  128. BPF_TEST_C(BaselinePolicy, SystemEperm, BaselinePolicy) {
  129. errno = 0;
  130. int ret_val = system("echo SHOULD NEVER RUN");
  131. // glibc >= 2.33 changed the ret code: 127 is now expected on bits 15-8
  132. // previously it was simply -1, so check for not zero
  133. BPF_ASSERT_NE(0, ret_val);
  134. BPF_ASSERT_EQ(EPERM, errno);
  135. }
  136. BPF_TEST_C(BaselinePolicy, CloneVforkEperm, BaselinePolicy) {
  137. errno = 0;
  138. // Allocate a couple pages for the child's stack even though the child should
  139. // never start.
  140. constexpr size_t kStackSize = 4096 * 4;
  141. void* child_stack = mmap(nullptr, kStackSize, PROT_READ | PROT_WRITE,
  142. MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0);
  143. BPF_ASSERT_NE(child_stack, nullptr);
  144. pid_t pid = syscall(__NR_clone, CLONE_VM | CLONE_VFORK | SIGCHLD,
  145. static_cast<char*>(child_stack) + kStackSize, nullptr,
  146. nullptr, nullptr);
  147. const int clone_errno = errno;
  148. TestUtils::HandlePostForkReturn(pid);
  149. munmap(child_stack, kStackSize);
  150. BPF_ASSERT_EQ(-1, pid);
  151. BPF_ASSERT_EQ(EPERM, clone_errno);
  152. }
  153. BPF_TEST_C(BaselinePolicy, CreateThread, BaselinePolicy) {
  154. base::Thread thread("sandbox_tests");
  155. BPF_ASSERT(thread.Start());
  156. }
  157. // Rseq should be enabled if it exists (i.e. shouldn't receive EPERM).
  158. #if !BUILDFLAG(IS_ANDROID)
  159. BPF_TEST_C(BaselinePolicy, RseqEnabled, BaselinePolicy) {
  160. errno = 0;
  161. int res = syscall(__NR_rseq, 0, 0, 0, 0);
  162. BPF_ASSERT_EQ(-1, res);
  163. // The parameters above are invalid so the system call should fail with
  164. // EINVAL, or ENOSYS if the kernel is too old to recognize the system call.
  165. BPF_ASSERT(EINVAL == errno || ENOSYS == errno);
  166. }
  167. #endif // !BUILDFLAG(IS_ANDROID)
  168. BPF_DEATH_TEST_C(BaselinePolicy,
  169. DisallowedCloneFlagCrashes,
  170. DEATH_SEGV_MESSAGE(GetCloneErrorMessageContentForTests()),
  171. BaselinePolicy) {
  172. pid_t pid = sys_clone(CLONE_THREAD | SIGCHLD);
  173. TestUtils::HandlePostForkReturn(pid);
  174. }
  175. BPF_DEATH_TEST_C(BaselinePolicy,
  176. DisallowedKillCrashes,
  177. DEATH_SEGV_MESSAGE(GetKillErrorMessageContentForTests()),
  178. BaselinePolicy) {
  179. BPF_ASSERT_NE(1, getpid());
  180. kill(1, 0);
  181. _exit(0);
  182. }
  183. BPF_TEST_C(BaselinePolicy, CanKillSelf, BaselinePolicy) {
  184. int sys_ret = kill(getpid(), 0);
  185. BPF_ASSERT_EQ(0, sys_ret);
  186. }
  187. BPF_TEST_C(BaselinePolicy, Socketpair, BaselinePolicy) {
  188. int sv[2];
  189. int sys_ret = socketpair(AF_UNIX, SOCK_DGRAM, 0, sv);
  190. BPF_ASSERT_EQ(0, sys_ret);
  191. TestPipeOrSocketPair(base::ScopedFD(sv[0]), base::ScopedFD(sv[1]));
  192. sys_ret = socketpair(AF_UNIX, SOCK_SEQPACKET, 0, sv);
  193. BPF_ASSERT_EQ(0, sys_ret);
  194. TestPipeOrSocketPair(base::ScopedFD(sv[0]), base::ScopedFD(sv[1]));
  195. }
  196. #if !defined(GRND_NONBLOCK)
  197. #define GRND_NONBLOCK 1
  198. #endif
  199. BPF_TEST_C(BaselinePolicy, GetRandom, BaselinePolicy) {
  200. char buf[1];
  201. // Many systems do not yet support getrandom(2) so ENOSYS is a valid result
  202. // here.
  203. int ret = HANDLE_EINTR(syscall(__NR_getrandom, buf, sizeof(buf), 0));
  204. BPF_ASSERT((ret == -1 && errno == ENOSYS) || ret == 1);
  205. ret = HANDLE_EINTR(syscall(__NR_getrandom, buf, sizeof(buf), GRND_NONBLOCK));
  206. BPF_ASSERT((ret == -1 && (errno == ENOSYS || errno == EAGAIN)) || ret == 1);
  207. }
  208. // Not all architectures can restrict the domain for socketpair().
  209. #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__)
  210. BPF_DEATH_TEST_C(BaselinePolicy,
  211. SocketpairWrongDomain,
  212. DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()),
  213. BaselinePolicy) {
  214. int sv[2];
  215. std::ignore = socketpair(AF_INET, SOCK_STREAM, 0, sv);
  216. _exit(1);
  217. }
  218. #endif // defined(__x86_64__) || defined(__arm__) || defined(__aarch64__)
  219. BPF_TEST_C(BaselinePolicy, EPERM_open, BaselinePolicy) {
  220. errno = 0;
  221. int sys_ret = open("/proc/cpuinfo", O_RDONLY);
  222. BPF_ASSERT_EQ(-1, sys_ret);
  223. BPF_ASSERT_EQ(EPERM, errno);
  224. }
  225. BPF_TEST_C(BaselinePolicy, EPERM_access, BaselinePolicy) {
  226. errno = 0;
  227. int sys_ret = access("/proc/cpuinfo", R_OK);
  228. BPF_ASSERT_EQ(-1, sys_ret);
  229. BPF_ASSERT_EQ(EPERM, errno);
  230. }
  231. BPF_TEST_C(BaselinePolicy, EPERM_getcwd, BaselinePolicy) {
  232. errno = 0;
  233. char buf[1024];
  234. char* cwd = getcwd(buf, sizeof(buf));
  235. BPF_ASSERT_EQ(nullptr, cwd);
  236. BPF_ASSERT_EQ(EPERM, errno);
  237. }
  238. BPF_DEATH_TEST_C(BaselinePolicy,
  239. SIGSYS_InvalidSyscall,
  240. DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()),
  241. BaselinePolicy) {
  242. Syscall::InvalidCall();
  243. }
  244. // A failing test using this macro could be problematic since we perform
  245. // system calls by passing "0" as every argument.
  246. // The kernel could SIGSEGV the process or the system call itself could reboot
  247. // the machine. Some thoughts have been given when hand-picking the system
  248. // calls below to limit any potential side effects outside of the current
  249. // process.
  250. #define TEST_BASELINE_SIGSYS(sysno) \
  251. BPF_DEATH_TEST_C(BaselinePolicy, \
  252. SIGSYS_##sysno, \
  253. DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()), \
  254. BaselinePolicy) { \
  255. syscall(sysno, 0, 0, 0, 0, 0, 0); \
  256. _exit(1); \
  257. }
  258. TEST_BASELINE_SIGSYS(__NR_acct)
  259. TEST_BASELINE_SIGSYS(__NR_chroot)
  260. TEST_BASELINE_SIGSYS(__NR_fanotify_init)
  261. TEST_BASELINE_SIGSYS(__NR_fgetxattr)
  262. TEST_BASELINE_SIGSYS(__NR_getcpu)
  263. TEST_BASELINE_SIGSYS(__NR_getitimer)
  264. TEST_BASELINE_SIGSYS(__NR_init_module)
  265. TEST_BASELINE_SIGSYS(__NR_io_cancel)
  266. TEST_BASELINE_SIGSYS(__NR_keyctl)
  267. TEST_BASELINE_SIGSYS(__NR_mq_open)
  268. TEST_BASELINE_SIGSYS(__NR_ptrace)
  269. TEST_BASELINE_SIGSYS(__NR_sched_setaffinity)
  270. TEST_BASELINE_SIGSYS(__NR_setpgid)
  271. TEST_BASELINE_SIGSYS(__NR_swapon)
  272. TEST_BASELINE_SIGSYS(__NR_sysinfo)
  273. TEST_BASELINE_SIGSYS(__NR_syslog)
  274. TEST_BASELINE_SIGSYS(__NR_timer_create)
  275. #if !defined(__aarch64__)
  276. TEST_BASELINE_SIGSYS(__NR_inotify_init)
  277. TEST_BASELINE_SIGSYS(__NR_vserver)
  278. #endif
  279. #if defined(LIBC_GLIBC) && !BUILDFLAG(IS_CHROMEOS_ASH)
  280. BPF_TEST_C(BaselinePolicy, FutexEINVAL, BaselinePolicy) {
  281. int ops[] = {
  282. FUTEX_CMP_REQUEUE_PI, FUTEX_CMP_REQUEUE_PI_PRIVATE,
  283. FUTEX_UNLOCK_PI_PRIVATE,
  284. };
  285. for (int op : ops) {
  286. BPF_ASSERT_EQ(-1, syscall(__NR_futex, nullptr, op, 0, nullptr, nullptr, 0));
  287. BPF_ASSERT_EQ(EINVAL, errno);
  288. }
  289. }
  290. #else
  291. BPF_DEATH_TEST_C(BaselinePolicy,
  292. FutexWithRequeuePriorityInheritence,
  293. DEATH_SEGV_MESSAGE(GetFutexErrorMessageContentForTests()),
  294. BaselinePolicy) {
  295. syscall(__NR_futex, nullptr, FUTEX_CMP_REQUEUE_PI, 0, nullptr, nullptr, 0);
  296. _exit(1);
  297. }
  298. BPF_DEATH_TEST_C(BaselinePolicy,
  299. FutexWithRequeuePriorityInheritencePrivate,
  300. DEATH_SEGV_MESSAGE(GetFutexErrorMessageContentForTests()),
  301. BaselinePolicy) {
  302. syscall(__NR_futex, nullptr, FUTEX_CMP_REQUEUE_PI_PRIVATE, 0, nullptr,
  303. nullptr, 0);
  304. _exit(1);
  305. }
  306. BPF_DEATH_TEST_C(BaselinePolicy,
  307. FutexWithUnlockPIPrivate,
  308. DEATH_SEGV_MESSAGE(GetFutexErrorMessageContentForTests()),
  309. BaselinePolicy) {
  310. syscall(__NR_futex, nullptr, FUTEX_UNLOCK_PI_PRIVATE, 0, nullptr, nullptr, 0);
  311. _exit(1);
  312. }
  313. #endif // defined(LIBC_GLIBC) && !BUILDFLAG(IS_CHROMEOS_ASH)
  314. BPF_TEST_C(BaselinePolicy, PrctlDumpable, BaselinePolicy) {
  315. const int is_dumpable = prctl(PR_GET_DUMPABLE, 0, 0, 0, 0);
  316. BPF_ASSERT(is_dumpable == 1 || is_dumpable == 0);
  317. const int prctl_ret = prctl(PR_SET_DUMPABLE, is_dumpable, 0, 0, 0, 0);
  318. BPF_ASSERT_EQ(0, prctl_ret);
  319. }
  320. // Workaround incomplete Android headers.
  321. #if !defined(PR_CAPBSET_READ)
  322. #define PR_CAPBSET_READ 23
  323. #endif
  324. #if !BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
  325. BPF_DEATH_TEST_C(BaselinePolicy,
  326. PrctlSigsys,
  327. DEATH_SEGV_MESSAGE(GetPrctlErrorMessageContentForTests()),
  328. BaselinePolicy) {
  329. prctl(PR_CAPBSET_READ, 0, 0, 0, 0);
  330. _exit(1);
  331. }
  332. #endif
  333. BPF_TEST_C(BaselinePolicy, GetOrSetPriority, BaselinePolicy) {
  334. errno = 0;
  335. const int original_prio = getpriority(PRIO_PROCESS, 0);
  336. // Check errno instead of the return value since this system call can return
  337. // -1 as a valid value.
  338. BPF_ASSERT_EQ(0, errno);
  339. errno = 0;
  340. int rc = getpriority(PRIO_PROCESS, getpid());
  341. BPF_ASSERT_EQ(0, errno);
  342. rc = getpriority(PRIO_PROCESS, getpid() + 1);
  343. BPF_ASSERT_EQ(-1, rc);
  344. BPF_ASSERT_EQ(EPERM, errno);
  345. rc = setpriority(PRIO_PROCESS, 0, original_prio);
  346. BPF_ASSERT_EQ(0, rc);
  347. rc = setpriority(PRIO_PROCESS, getpid(), original_prio);
  348. BPF_ASSERT_EQ(0, rc);
  349. errno = 0;
  350. rc = setpriority(PRIO_PROCESS, getpid() + 1, original_prio);
  351. BPF_ASSERT_EQ(-1, rc);
  352. BPF_ASSERT_EQ(EPERM, errno);
  353. }
  354. BPF_DEATH_TEST_C(BaselinePolicy,
  355. GetPrioritySigsys,
  356. DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()),
  357. BaselinePolicy) {
  358. getpriority(PRIO_USER, 0);
  359. _exit(1);
  360. }
  361. BPF_DEATH_TEST_C(BaselinePolicy,
  362. ClockGettimeWithDisallowedClockCrashes,
  363. DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()),
  364. BaselinePolicy) {
  365. struct timespec ts;
  366. syscall(SYS_clock_gettime, (~0) | CLOCKFD, &ts);
  367. }
  368. BPF_DEATH_TEST_C(BaselinePolicy,
  369. ClockNanosleepWithDisallowedClockCrashes,
  370. DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()),
  371. BaselinePolicy) {
  372. struct timespec ts;
  373. struct timespec out_ts;
  374. ts.tv_sec = 0;
  375. ts.tv_nsec = 0;
  376. syscall(SYS_clock_nanosleep, (~0) | CLOCKFD, 0, &ts, &out_ts);
  377. }
  378. #if !defined(GRND_RANDOM)
  379. #define GRND_RANDOM 2
  380. #endif
  381. BPF_DEATH_TEST_C(BaselinePolicy,
  382. GetRandomOfDevRandomCrashes,
  383. DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()),
  384. BaselinePolicy) {
  385. syscall(__NR_getrandom, nullptr, 0, GRND_RANDOM);
  386. }
  387. #if !defined(__i386__)
  388. BPF_DEATH_TEST_C(BaselinePolicy,
  389. GetSockOptWrongLevelSigsys,
  390. DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()),
  391. BaselinePolicy) {
  392. int fds[2];
  393. PCHECK(socketpair(AF_UNIX, SOCK_STREAM, 0, fds) == 0);
  394. int id;
  395. socklen_t peek_off_size = sizeof(id);
  396. getsockopt(fds[0], IPPROTO_TCP, SO_PEEK_OFF, &id, &peek_off_size);
  397. }
  398. BPF_DEATH_TEST_C(BaselinePolicy,
  399. GetSockOptWrongOptionSigsys,
  400. DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()),
  401. BaselinePolicy) {
  402. int fds[2];
  403. PCHECK(socketpair(AF_UNIX, SOCK_STREAM, 0, fds) == 0);
  404. int id;
  405. socklen_t peek_off_size = sizeof(id);
  406. getsockopt(fds[0], SOL_SOCKET, SO_DEBUG, &id, &peek_off_size);
  407. }
  408. BPF_DEATH_TEST_C(BaselinePolicy,
  409. SetSockOptWrongLevelSigsys,
  410. DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()),
  411. BaselinePolicy) {
  412. int fds[2];
  413. PCHECK(socketpair(AF_UNIX, SOCK_STREAM, 0, fds) == 0);
  414. int id;
  415. setsockopt(fds[0], IPPROTO_TCP, SO_PEEK_OFF, &id, sizeof(id));
  416. }
  417. BPF_DEATH_TEST_C(BaselinePolicy,
  418. SetSockOptWrongOptionSigsys,
  419. DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()),
  420. BaselinePolicy) {
  421. int fds[2];
  422. PCHECK(socketpair(AF_UNIX, SOCK_STREAM, 0, fds) == 0);
  423. int id;
  424. setsockopt(fds[0], SOL_SOCKET, SO_DEBUG, &id, sizeof(id));
  425. }
  426. #endif
  427. } // namespace
  428. } // namespace sandbox