This introduces another call to addfd, in which the move flag is set. It may make sense to setup a cgroup v1 hierarchy, and check that the netprioidx is changed.
Signed-off-by: Sargun Dhillon <[email protected]> Cc: Matt Denton <[email protected]> Cc: Kees Cook <[email protected]>, Cc: Jann Horn <[email protected]>, Cc: Robert Sesek <[email protected]>, Cc: Chris Palmer <[email protected]> Cc: Christian Brauner <[email protected]> Cc: Tycho Andersen <[email protected]> --- tools/testing/selftests/seccomp/seccomp_bpf.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c index 1ec43fef2b93..f4b50cbbde42 100644 --- a/tools/testing/selftests/seccomp/seccomp_bpf.c +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c @@ -188,6 +188,8 @@ struct seccomp_metadata { /* valid flags for seccomp_notif_addfd */ #define SECCOMP_ADDFD_FLAG_SETFD (1UL << 0) /* Specify remote fd */ +#define SECCOMP_ADDFD_FLAG_MOVE (1UL << 1) + struct seccomp_notif { __u64 id; @@ -3756,6 +3758,12 @@ TEST(user_notification_sendfd) EXPECT_GE(ret, 0); EXPECT_EQ(filecmp(getpid(), pid, memfd, ret), 0); + /* Move the FD */ + addfd.flags = SECCOMP_ADDFD_FLAG_MOVE; + ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd); + EXPECT_GE(ret, 0); + EXPECT_EQ(filecmp(getpid(), pid, memfd, ret), 0); + /* Verify we can set a specific remote fd */ addfd.remote_fd = 42; addfd.flags = SECCOMP_ADDFD_FLAG_SETFD; -- 2.25.1
