examples: Containment tests for a protected build and a kernel build

[casaroli]

Summary

Two test programs for a protected build and a kernel build.

examples/pffault touches one kernel address from a user process. It is small and direct, and it shows the fault and the signal.

examples/sandbox is the general test. Every target carries the outcome it expects, so the test fails a build that refuses everything as well as one that permits everything.

target	address	expected
self	its own data	must succeed
kernel	kernel memory	must fault
periph	a peripheral register	must fault
unmapped	an address with no mapping	must fault

The self target is the control. Without it a build that refuses every access passes every other check.

The offending process allocates memory, writes to all of it, and opens a file before it makes the access. It still holds both when it dies. The test reads /proc/meminfo before, while the offender lives, and after it is reaped, and it reads /proc/<pid>/group/fd while the offender lives. A count that never rises is reported as a failure, because "the same before and after" says nothing if the memory was never seen.

The offender is a process and not a task. A kernel build does not give task_create() to user code, so posix_spawn() is used.

Impact

Two new example programs, pffault and sandbox. No existing configuration in this repository selects them. The separate fork() and vfork() tests this branch used to carry are upstream already, through #3685.

Testing

Board: ESP32-S3-DevKitC with an ESP32-S3-WROOM-2 N32R8V, 32 MB octal flash and 8 MB PSRAM.

Configuration: esp32s3-devkit:kernel_oct, a BUILD_KERNEL image.

sandbox: /proc/meminfo reads
      total       used       free    maxused    maxfree  nused  nfree name
     378616      28336     350280      28704     345576    105      4 Kmem
    4194304    1441792    2752512               2752512               Page

sandbox: target self -- this process's own data, expecting success
sandbox: PASS - the allowed access completed
sandbox: memory 1441792 -> 2162688 -> 1441792
sandbox: PASS - 3 descriptor(s) open, none after

sandbox: target kernel -- kernel memory at 0x3fc98000, expecting a fault
pms_violation_isr: SIGSEGV (PMS) task /system/bin/sandbox
sandbox: PASS - the offending process was terminated

sandbox: target periph -- a peripheral register at 0x600c5000, expecting a fault
pms_violation_isr: SIGSEGV (PMS) task /system/bin/sandbox
sandbox: PASS - the offending process was terminated

sandbox: target unmapped -- an address with no mapping at 0x3d800000, expecting a fault
pms_violation_isr: SIGSEGV (MMU entry) task /system/bin/sandbox
sandbox: PASS - the offending process was terminated

sandbox: CONTAINED - 4 target(s), every check passed

The run above was made three times, which is twelve process deaths. The memory returns to the same value each time, and the descriptors are closed each time.

ostest runs to the end on the same image.

vfork_test: Child 41 ran and exited before the parent resumed
fork_test: Child running independently (child)
fork_test: Parent and child had independent memory
ostest_main: Exiting with status 0

tools/checkpatch.sh -c -u -m -g reports no errors.

[xiaoxiang781216]

let's merge the last two patch into one

[casaroli]

Done