nordisk/heimdall

scripts/seccomp-tests.sh

#!/bin/sh
# SPDX-License-Identifier: AGPL-3.0-only
# Kernel tests of heimdall-seccomp and heimdall-probe: real seccomp filters,
# USER_NOTIF listeners and probe runs. Heimdall is a defensive sandbox; every
# worker in these tests attacks only its own filter.
#
# They need seccomp USER_NOTIF (kernel >= 5.14 for ADDFD_SEND) and a
# container whose own seccomp profile does not stand in the way, so the
# script runs them in a privileged toolchain container (rootless podman is
# enough), with HEIMDALL_KERNEL_TESTS=1:
#   cargo test -p nordisk-heimdall-seccomp --test kernel
#   cargo test -p nordisk-heimdall-probe --test kernel
# then the drift check of every checked-in profile of this arch (release
# builds, glibc and musl): heimdall profile check <workload> --libc <libc>.
# HEIMDALL_SKIP_DRIFT=1 skips that part.
#
# Usage, from the repo root on a Linux host with podman:
#   scripts/seccomp-tests.sh [test name filter]
# Environment:
#   HEIMDALL_TEST_IMAGE  toolchain image (default localhost/nordisk-cargo-toolchain:heim-ci)
#   CARGO_TARGET_DIR     host target dir to mount (default ./target)
#   CARGO_HOME           host cargo home to mount (optional)
set -eu
cd "$(dirname "$0")/.."

if [ "${HEIMDALL_SECCOMP_INNER:-}" != 1 ]; then
  img=${HEIMDALL_TEST_IMAGE:-localhost/nordisk-cargo-toolchain:heim-ci}
  tgt=${CARGO_TARGET_DIR:-$PWD/target}
  mkdir -p "$tgt"
  extra=""
  if [ -n "${CARGO_HOME:-}" ]; then extra="-v $CARGO_HOME:/ch -e CARGO_HOME=/ch"; fi
  # shellcheck disable=SC2086
  exec podman run --rm --privileged \
    -v "$PWD":/src -v "$tgt":/tgt -e CARGO_TARGET_DIR=/tgt $extra \
    -e HEIMDALL_SECCOMP_INNER=1 -e CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-8}" \
    -w /src "$img" scripts/seccomp-tests.sh "$@"
fi

echo "kernel $(uname -r), seccomp actions: $(cat /proc/sys/kernel/seccomp/actions_avail 2>/dev/null)"
export HEIMDALL_KERNEL_TESTS=1
cargo test -p nordisk-heimdall-seccomp --test kernel -- "$@"
cargo test -p nordisk-heimdall-probe --test kernel -- "$@"

[ "${HEIMDALL_SKIP_DRIFT:-}" = 1 ] && exit 0
arch=$(uname -m)
cargo build --release -p nordisk-heimdall-cli
if rustup target list --installed 2>/dev/null | grep -q "^$arch-unknown-linux-musl$"; then
  cargo build --release -p nordisk-heimdall-cli --target "$arch-unknown-linux-musl"
fi
# Every checked-in profile enforced on its binary over its corpus.
cargo test -p nordisk-heimdall-profiles --test enforce
heimdall=$CARGO_TARGET_DIR/release/heimdall
fail=0
for j in profiles/*/"$arch"-*.json; do
  case $j in *.oci.json|*.probe.json) continue ;; esac
  [ -f "$j" ] || continue
  w=$(basename "$(dirname "$j")")
  libc=$(basename "$j" .json); libc=${libc#"$arch"-}
  echo "== drift check: $w $arch $libc"
  "$heimdall" profile check "$w" --libc "$libc" || fail=1
done
exit $fail