[gentoo-commits] proj/sandbox:master commit in: tests/, libsandbox/

[Mike Gilbert]

commit:     986ca640c66862e55a9c54779c2723c0b64373f6
Author:     Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 22 03:32:48 2024 +0000
Commit:     Mike Gilbert <floppym <AT> gentoo <DOT> org>
CommitDate: Sun Dec 22 03:32:48 2024 +0000
URL:        https://gitweb.gentoo.org/proj/sandbox.git/commit/?id=986ca640

trace: wire up faccessat2

Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>

 libsandbox/symbols.h.in     |  1 +
 libsandbox/trace.c          | 16 +++++++++++++---
 tests/faccessat_static-0.c  |  1 +
 tests/faccessat_static-1.sh |  8 ++++++++
 tests/faccessat_static.at   |  1 +
 tests/local.mk              |  1 +
 6 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/libsandbox/symbols.h.in b/libsandbox/symbols.h.in
index 5805592..1232874 100644
--- a/libsandbox/symbols.h.in
+++ b/libsandbox/symbols.h.in
@@ -33,6 +33,7 @@ mkfifo
 mkfifoat
 access
 faccessat
+faccessat2
 remove
 rename
 renameat

diff --git a/libsandbox/trace.c b/libsandbox/trace.c
index e570207..1b874d0 100644
--- a/libsandbox/trace.c
+++ b/libsandbox/trace.c
@@ -385,9 +385,9 @@ static bool trace_check_syscall(const struct syscall_entry 
*se, void *regs)
 
        else if (nr == SB_NR_ACCESS) {
                char *path = do_peekstr(trace_arg(regs, 1));
-               int flags = trace_arg(regs, 2);
-               __sb_debug("(\"%s\", %x)", path, flags);
-               ret = _SB_SAFE_ACCESS(nr, name, path, flags);
+               int mode = trace_arg(regs, 2);
+               __sb_debug("(\"%s\", %x)", path, mode);
+               ret = _SB_SAFE_ACCESS(nr, name, path, mode);
                free(path);
                return ret;
 
@@ -400,6 +400,16 @@ static bool trace_check_syscall(const struct syscall_entry 
*se, void *regs)
                free(path);
                return ret;
 
+       } else if (nr == SB_NR_FACCESSAT2) {
+               int dirfd = trace_arg(regs, 1);
+               char *path = do_peekstr(trace_arg(regs, 2));
+               int mode = trace_arg(regs, 3);
+               int flags = trace_arg(regs, 4);
+               __sb_debug("(%i, \"%s\", %x, %x)", dirfd, path, mode, flags);
+               ret = _SB_SAFE_ACCESS_AT(nr, name, dirfd, path, mode, flags);
+               free(path);
+               return ret;
+
        } else if (nr == SB_NR_OPEN) {
                char *path = do_peekstr(trace_arg(regs, 1));
                int flags = trace_arg(regs, 2);

diff --git a/tests/faccessat_static-0.c b/tests/faccessat_static-0.c
new file mode 100644
index 0000000..8e3bdd9
--- /dev/null
+++ b/tests/faccessat_static-0.c
@@ -0,0 +1 @@
+#include "faccessat-0.c"

diff --git a/tests/faccessat_static-1.sh b/tests/faccessat_static-1.sh
new file mode 100644
index 0000000..4bf209d
--- /dev/null
+++ b/tests/faccessat_static-1.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+[ "${at_xfail}" = "yes" ] && exit 77 # see trace-0
+set -e
+addwrite "$PWD/file"
+faccessat_static-0 0 'file:O_RDWR|O_CREAT:0666' '' rw AT_EMPTY_PATH
+exec 9<file
+adddeny "$PWD/file"
+faccessat_static-0 -1,EPERM 9 '' rw AT_EMPTY_PATH

diff --git a/tests/faccessat_static.at b/tests/faccessat_static.at
new file mode 100644
index 0000000..081d7d2
--- /dev/null
+++ b/tests/faccessat_static.at
@@ -0,0 +1 @@
+SB_CHECK(1)

diff --git a/tests/local.mk b/tests/local.mk
index f1f4ac0..5a32207 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -29,6 +29,7 @@ check_PROGRAMS += \
        %D%/execv-0 \
        %D%/execvp-0 \
        %D%/faccessat-0 \
+       %D%/faccessat_static-0 \
        %D%/fchmod-0 \
        %D%/fchmodat-0 \
        %D%/fchown-0 \