chore(test): send an unexistent SYS_ code too.

Signed-off-by: Federico Di Pierro <[email protected]>
falcosecurity · Oct 5, 2023 · 0a3f56d · 0a3f56d
1 parent fb3fe12
commit 0a3f56d
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/test/drivers/helpers/ia32.c b/test/drivers/helpers/ia32.c
@@ -16,5 +16,6 @@ int main() {
 	syscall(__NR_socketcall, SYS_ACCEPT4, args);
 	syscall(__NR_socketcall, SYS_SEND, args);
 	syscall(__NR_socketcall, SYS_ACCEPT, args);
+	syscall(__NR_socketcall, -1, args);
 	return 0;
 }
diff --git a/test/drivers/test_suites/actions_suite/ia32.cpp.in b/test/drivers/test_suites/actions_suite/ia32.cpp.in
@@ -66,6 +66,13 @@ TEST(Actions, ia32)
     	 */
     	evt_test->assert_event_absence(ret_pid, PPME_SOCKET_ACCEPT4_6_E);
     	evt_test->assert_event_absence(ret_pid, PPME_SOCKET_ACCEPT4_6_X);
+
+      /*
+       * Last event sent by the script is a socketcall with non existing SYS_ code.
+       * We don't expect any event generated.
+       */
+      evt_test->assert_event_absence(ret_pid, PPME_GENERIC_E);
+      evt_test->assert_event_absence(ret_pid, PPME_GENERIC_X);
 	}
 	else
 	{
@@ -76,8 +83,18 @@ TEST(Actions, ia32)
     evt_test->assert_event_presence(ret_pid, PPME_SOCKET_SEND_E);
     evt_test->assert_event_presence(ret_pid, PPME_SOCKET_SEND_X);
 
+    /*
+     * Same as above
+     */
     evt_test->assert_event_presence(ret_pid, PPME_SOCKET_ACCEPT_5_E);
     evt_test->assert_event_presence(ret_pid, PPME_SOCKET_ACCEPT_5_X);
+
+    /*
+     * Last event sent by the script is a socketcall with non existing SYS_ code.
+     * We expect generic events to be pushed.
+     */
+    evt_test->assert_event_presence(ret_pid, PPME_GENERIC_E);
+    evt_test->assert_event_presence(ret_pid, PPME_GENERIC_X);
 	}
 }
 #endif