在 2026/8/5 23:04, Mark Brown 写道:
> On Tue, Jul 28, 2026 at 10:11:21AM +0800, Jinjie Ruan wrote:
>> As Kees suggested, add a test that verifies that seccomp observes the
>> correct first argument after a ptracer modifies x0 at a syscall-enter-stop
>> on arm64.
>
> This change is now in -next and is breaking the build on Arm's internal
> KernelCI instance, the same thing can also be seen on at least upstream
> KernelCI mixed in with extra issues due to what looks like a
> missing/failed headers_install - I'll report the infra aspects of that
> separately:
Thank you for the report.
>
> CC seccomp_ptrace_x0_bypass
> seccomp_ptrace_x0_bypass.c: In function ‘do_child’:
> seccomp_ptrace_x0_bypass.c:67:28: error: array type has incomplete element
> type ‘struct sock_filter’
> 67 | struct sock_filter filter[] = {
> | ^~~~~~
> seccomp_ptrace_x0_bypass.c:68:17: warning: implicit declaration of function
> ‘BPF_STMT’; did you mean ‘BPF_STX’? [-Wimplicit-function-declaration]
> 68 | BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct
> seccomp_data, nr)), /* nr */
> | ^~~~~~~~
> | BPF_STX
> seccomp_ptrace_x0_bypass.c:69:17: warning: implicit declaration of function
> ‘BPF_JUMP’; did you mean ‘BPF_JMP’? [-Wimplicit-function-declaration]
> 69 | BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_write, 0, 3),
> | ^~~~~~~~
> | BPF_JMP
> seccomp_ptrace_x0_bypass.c:75:16: error: variable ‘prog’ has initializer but
> incomplete type
> 75 | struct sock_fprog prog = {
> | ^~~~~~~~~~
> seccomp_ptrace_x0_bypass.c:76:18: error: ‘struct sock_fprog’ has no member
> named ‘len’
> 76 | .len = ARRAY_SIZE(filter),
> | ^~~
> In file included from seccomp_ptrace_x0_bypass.c:38:
> /tmp/kci/linux/tools/testing/selftests/kselftest.h:64:25: warning: excess
> elements in struct initializer
> 64 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
> | ^
> seccomp_ptrace_x0_bypass.c:76:24: note: in expansion of macro ‘ARRAY_SIZE’
> 76 | .len = ARRAY_SIZE(filter),
> | ^~~~~~~~~~
> /tmp/kci/linux/tools/testing/selftests/kselftest.h:64:25: note: (near
> initialization for ‘prog’)
> 64 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
> | ^
> seccomp_ptrace_x0_bypass.c:76:24: note: in expansion of macro ‘ARRAY_SIZE’
> 76 | .len = ARRAY_SIZE(filter),
> | ^~~~~~~~~~
> seccomp_ptrace_x0_bypass.c:77:18: error: ‘struct sock_fprog’ has no member
> named ‘filter’
> 77 | .filter = filter,
> | ^~~~~~
> seccomp_ptrace_x0_bypass.c:77:27: warning: excess elements in struct
> initializer
> 77 | .filter = filter,
> | ^~~~~~
> seccomp_ptrace_x0_bypass.c:77:27: note: (near initialization for ‘prog’)
> seccomp_ptrace_x0_bypass.c:75:27: error: storage size of ‘prog’ isn’t known
> 75 | struct sock_fprog prog = {
> | ^~~~
> seccomp_ptrace_x0_bypass.c:75:27: warning: unused variable ‘prog’
> [-Wunused-variable]
> seccomp_ptrace_x0_bypass.c:67:28: warning: unused variable ‘filter’
> [-Wunused-variable]
> 67 | struct sock_filter filter[] = {
>
>
>> --- /dev/null
>> +++ b/tools/testing/selftests/arm64/abi/seccomp_ptrace_x0_bypass.c
>> @@ -0,0 +1,195 @@
>> +// SPDX-License-Identifier: GPL-2.0
>> +/*
>> + * Test that seccomp, tracepoints and audit observe the correct syscall
>> + * arguments after a ptracer has modified them at syscall-enter-stop.
>
>> +#include <linux/filter.h>
>
> The relevant definitions ought to be being picked up from here, there's
> a copy of a current version in tools/include and has been for a while
> (since at least v6.18) but there's no Makefile update to ensure that
> gets picked up.
Will add -I$(top_srcdir)/tools/include to CFLAGS for this test.
>
>> +#ifndef __NR_write
>> +#define __NR_write 64
>> +#endif
>
> That's... interesting.
I'll remove the hardcoded __NR_write.
