forked from falcosecurity/libs
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathsetresgid_x.cpp
More file actions
53 lines (36 loc) · 1.44 KB
/
setresgid_x.cpp
File metadata and controls
53 lines (36 loc) · 1.44 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
#include "../../event_class/event_class.h"
#ifdef __NR_setresgid
TEST(SyscallExit, setresgidX) {
auto evt_test = get_syscall_event_test(__NR_setresgid, EXIT_EVENT);
evt_test->enable_capture();
/*=============================== TRIGGER SYSCALL ===========================*/
gid_t rgid = (uint32_t)-1;
gid_t egid = (uint32_t)-1;
gid_t sgid = (uint32_t)-1;
/* If one of the arguments equals -1, the corresponding value is not changed. */
assert_syscall_state(SYSCALL_SUCCESS,
"setresgid",
syscall(__NR_setresgid, rgid, egid, sgid),
NOT_EQUAL,
-1);
/*=============================== TRIGGER SYSCALL ===========================*/
evt_test->disable_capture();
evt_test->assert_event_presence();
if(HasFatalFailure()) {
return;
}
evt_test->parse_event();
evt_test->assert_header();
/*=============================== ASSERT PARAMETERS ===========================*/
/* Parameter 1: res (type: PT_ERRNO) */
evt_test->assert_numeric_param(1, (int64_t)0);
/* Parameter 2: rgid (type: PT_GID) */
evt_test->assert_numeric_param(2, (uint32_t)rgid);
/* Parameter 3: egid (type: PT_GID) */
evt_test->assert_numeric_param(3, (uint32_t)egid);
/* Parameter 4: sgid (type: PT_GID) */
evt_test->assert_numeric_param(4, (uint32_t)sgid);
/*=============================== ASSERT PARAMETERS ===========================*/
evt_test->assert_num_params_pushed(4);
}
#endif