Re: [PATCH v3 1/2] kselftest/arm64: Add seccomp ptrace x0 bypass test

Mark Brown <[email protected]> Wed, 5 Aug 2026 16:04:36 +0100
Newsgroups	org.kernel.vger.linux-kselftest,org.infradead.lists.linux-arm-kernel,org.kernel.vger.linux-kernel
Message-ID	<[email protected]>
On Tue, Jul 28, 2026 at 10:11:21AM +0800, Jinjie Ruan wrote:
> As Kees suggested, add a test that verifies that seccomp observes the
> correct first argument after a ptracer modifies x0 at a syscall-enter-stop
> on arm64.

This change is now in -next and is breaking the build on Arm's internal
KernelCI instance, the same thing can also be seen on at least upstream
KernelCI mixed in with extra issues due to what looks like a
missing/failed headers_install - I'll report the infra aspects of that
separately:

  CC       seccomp_ptrace_x0_bypass
seccomp_ptrace_x0_bypass.c: In function ‘do_child’:
seccomp_ptrace_x0_bypass.c:67:28: error: array type has incomplete element type ‘struct sock_filter’
   67 |         struct sock_filter filter[] = {
      |                            ^~~~~~
seccomp_ptrace_x0_bypass.c:68:17: warning: implicit declaration of function ‘BPF_STMT’; did you mean ‘BPF_STX’? [-Wimplicit-function-declaration]
   68 |                 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),  /* nr */
      |                 ^~~~~~~~
      |                 BPF_STX
seccomp_ptrace_x0_bypass.c:69:17: warning: implicit declaration of function ‘BPF_JUMP’; did you mean ‘BPF_JMP’? [-Wimplicit-function-declaration]
   69 |                 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_write, 0, 3),
      |                 ^~~~~~~~
      |                 BPF_JMP
seccomp_ptrace_x0_bypass.c:75:16: error: variable ‘prog’ has initializer but incomplete type
   75 |         struct sock_fprog prog = {
      |                ^~~~~~~~~~
seccomp_ptrace_x0_bypass.c:76:18: error: ‘struct sock_fprog’ has no member named ‘len’
   76 |                 .len = ARRAY_SIZE(filter),
      |                  ^~~
In file included from seccomp_ptrace_x0_bypass.c:38:
/tmp/kci/linux/tools/testing/selftests/kselftest.h:64:25: warning: excess elements in struct initializer
   64 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
      |                         ^
seccomp_ptrace_x0_bypass.c:76:24: note: in expansion of macro ‘ARRAY_SIZE’
   76 |                 .len = ARRAY_SIZE(filter),
      |                        ^~~~~~~~~~
/tmp/kci/linux/tools/testing/selftests/kselftest.h:64:25: note: (near initialization for ‘prog’)
   64 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
      |                         ^
seccomp_ptrace_x0_bypass.c:76:24: note: in expansion of macro ‘ARRAY_SIZE’
   76 |                 .len = ARRAY_SIZE(filter),
      |                        ^~~~~~~~~~
seccomp_ptrace_x0_bypass.c:77:18: error: ‘struct sock_fprog’ has no member named ‘filter’
   77 |                 .filter = filter,
      |                  ^~~~~~
seccomp_ptrace_x0_bypass.c:77:27: warning: excess elements in struct initializer
   77 |                 .filter = filter,
      |                           ^~~~~~
seccomp_ptrace_x0_bypass.c:77:27: note: (near initialization for ‘prog’)
seccomp_ptrace_x0_bypass.c:75:27: error: storage size of ‘prog’ isn’t known
   75 |         struct sock_fprog prog = {
      |                           ^~~~
seccomp_ptrace_x0_bypass.c:75:27: warning: unused variable ‘prog’ [-Wunused-variable]
seccomp_ptrace_x0_bypass.c:67:28: warning: unused variable ‘filter’ [-Wunused-variable]
   67 |         struct sock_filter filter[] = {


> --- /dev/null
> +++ b/tools/testing/selftests/arm64/abi/seccomp_ptrace_x0_bypass.c
> @@ -0,0 +1,195 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * Test that seccomp, tracepoints and audit observe the correct syscall
> + * arguments after a ptracer has modified them at syscall-enter-stop.

> +#include <linux/filter.h>

The relevant definitions ought to be being picked up from here, there's
a copy of a current version in tools/include and has been for a while
(since at least v6.18) but there's no Makefile update to ensure that
gets picked up.

> +#ifndef __NR_write
> +#define __NR_write 64
> +#endif

That's...  interesting.
signature.asc (application/pgp-signature, 488 B)