test(drivers/syscall_exit/execveat_x): fix comm assertion#2702
test(drivers/syscall_exit/execveat_x): fix comm assertion#2702poiana merged 1 commit intofalcosecurity:masterfrom
comm assertion#2702Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2702 +/- ##
=======================================
Coverage 77.62% 77.62%
=======================================
Files 294 294
Lines 31951 31951
Branches 4716 4716
=======================================
Hits 24802 24802
Misses 7149 7149
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
/hold for further investigation. |
`SyscallExit.execveatX_execve_exit_comm_equal_to_fd` test asserts the `comm` parameter value among the others. For kernel versions lower than 6.14, if the `AT_EMPTY_PATH` flag is specified while invoking execveat, the comm value is expected to be set to the dirfd numeric value. Starting from 6.14 ( torvalds/linux@543841d ), this strange behaviour has been fixed, and the exact same execveat invocation results in the comm value to be correctly set to the dentry's filename value. For this reason, account for both scenarios while testing for the `comm` parameter to match the expectation. Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
645b916 to
3560b2a
Compare
|
Updated PR description with new findings |
irozzo-1A
left a comment
There was a problem hiding this comment.
/lgtm
Just a nit, but it's your call
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ekoops, irozzo-1A The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/hold cancel |
What type of PR is this?
/kind failing-test
Any specific area of the project related to this PR?
/area tests
Does this PR require a change in the driver versions?
What this PR does / why we need it:
SyscallExit.execveatX_execve_exit_comm_equal_to_fdtest asserts thecommparameter value among the others. For kernel versions lower than 6.14, if theAT_EMPTY_PATHflag is specified while invoking execveat, the comm value is expected to be set to the dirfd numeric value. Starting from 6.14 (torvalds/linux@543841d), this strange behaviour has been fixed, and the exact same execveatinvocation results in the comm value to be correctly set to the dentry's filename value. For this reason, this PR patches the test code to account for both scenarios while testing for the
commparameter to match the expectation.Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Does this PR introduce a user-facing change?: