fix(test/drivers): correct socketcall SYS_ACCEPT failures on s390x

The modern BPF driver maps the SYS_ACCEPT to SYS_ACCEPT4 which is being tested in the socketcall SYS_ACCEPT tests. The kmod and bpf drivers do not switch directly but rather ensure to use the PPM event instead of syscall. The socketcall SYS_ACCEPT tests contain a specific handling for kmod. Enable this handling to also for the bpf driver. Signed-off-by: Hendrik Brueckner <[email protected]>
falcosecurity · Dec 5, 2023 · 98410bc · 98410bc
1 parent 1aad982
commit 98410bc
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 12 deletions.
diff --git a/test/drivers/test_suites/syscall_enter_suite/socketcall_e.cpp b/test/drivers/test_suites/syscall_enter_suite/socketcall_e.cpp
@@ -327,8 +327,8 @@ TEST(SyscallEnter, socketcall_acceptE)
 {
 #ifdef __s390x__
 	auto evt_test = get_syscall_event_test(__NR_accept4, ENTER_EVENT);
-	/* The kmod can correctly handle accept also on s390x */
-	if(evt_test->is_kmod_engine())
+	/* The kmod/bpf can correctly handle accept also on s390x */
+	if(evt_test->is_kmod_engine() || evt_test->is_bpf_engine())
 	{
 		/* we cannot set `__NR_accept` explicitly since it is not defined on s390x
 		 * we activate all syscalls.
@@ -370,9 +370,9 @@ TEST(SyscallEnter, socketcall_acceptE)
 	evt_test->assert_header();
 
 #ifdef __s390x__
-	if(!evt_test->is_kmod_engine())
+	if(evt_test->is_modern_bpf_engine())
 	{
-		/* socketcall uses accept4 event for SYS_ACCEPT */
+		/* socketcall uses accept4 event for SYS_ACCEPT for modern BPF */
 
 		/*=============================== ASSERT PARAMETERS  ===========================*/
 

diff --git a/test/drivers/test_suites/syscall_exit_suite/socketcall_x.cpp b/test/drivers/test_suites/syscall_exit_suite/socketcall_x.cpp
@@ -346,8 +346,8 @@ TEST(SyscallExit, socketcall_acceptX_INET)
 {
 #ifdef __s390x__
 	auto evt_test = get_syscall_event_test(__NR_accept4, EXIT_EVENT);
-	/* The kmod can correctly handle accept also on s390x */
-	if(evt_test->is_kmod_engine())
+	/* The kmod/bpf can correctly handle accept also on s390x */
+	if(evt_test->is_kmod_engine() || evt_test->is_bpf_engine())
 	{
 		/* we cannot set `__NR_accept` explicitly since it is not defined on s390x
 		 * we activate all syscalls.
@@ -429,8 +429,8 @@ TEST(SyscallExit, socketcall_acceptX_INET6)
 {
 #ifdef __s390x__
 	auto evt_test = get_syscall_event_test(__NR_accept4, EXIT_EVENT);
-	/* The kmod can correctly handle accept also on s390x */
-	if(evt_test->is_kmod_engine())
+	/* The kmod/bpf can correctly handle accept also on s390x */
+	if(evt_test->is_kmod_engine() || evt_test->is_bpf_engine())
 	{
 		/* we cannot set `__NR_accept` explicitly since it is not defined on s390x
 		 * we activate all syscalls.
@@ -513,8 +513,8 @@ TEST(SyscallExit, socketcall_acceptX_UNIX)
 {
 #ifdef __s390x__
 	auto evt_test = get_syscall_event_test(__NR_accept4, EXIT_EVENT);
-	/* The kmod can correctly handle accept also on s390x */
-	if(evt_test->is_kmod_engine())
+	/* The kmod/bpf can correctly handle accept also on s390x */
+	if(evt_test->is_kmod_engine() || evt_test->is_bpf_engine())
 	{
 		/* we cannot set `__NR_accept` explicitly since it is not defined on s390x
 		 * we activate all syscalls.
@@ -599,8 +599,8 @@ TEST(SyscallExit, socketcall_acceptX_failure)
 {
 #ifdef __s390x__
 	auto evt_test = get_syscall_event_test(__NR_accept4, EXIT_EVENT);
-	/* The kmod can correctly handle accept also on s390x */
-	if(evt_test->is_kmod_engine())
+	/* The kmod/bpf can correctly handle accept also on s390x */
+	if(evt_test->is_kmod_engine() || evt_test->is_bpf_engine())
 	{
 		/* we cannot set `__NR_accept` explicitly since it is not defined on s390x
 		 * we activate all syscalls.