[PATCH 0/2] kselftest/arm64: Add two arm64 kselftests for orig_x0 issue

[PATCH 0/2] kselftest/arm64: Add two arm64 kselftests for orig_x0 issue

[Jinjie Ruan]

Recently, a security issue related to orig_x0 was discovered and fixed
in arm64, but there are still no test cases covering it. Seccomp,
tracepoints, and audit can observe a stale value for x0 after a ptracer
or SECCOMP_RET_TRACE modifies x0.

As Kees suggested, this series adds two kselftests for arm64 that validate
the orig_x0 re-synchronisation fix in ptrace, the first one is for ptrace
update, the second one is for SECCOMP_RET_TRACE update.

Link: https://lore.kernel.org/all/20260716120640.6590-1-will@kernel.org/
Link: https://lore.kernel.org/all/202607152004.DEA95D63@keescook/

Jinjie Ruan (2):
  kselftest/arm64: Add seccomp ptrace x0 bypass test
  kselftest/arm64: Add SECCOMP_RET_TRACE x0 bypass test

 tools/testing/selftests/arm64/abi/.gitignore  |   2 +
 tools/testing/selftests/arm64/abi/Makefile    |   2 +-
 .../arm64/abi/seccomp_ptrace_x0_bypass.c      | 181 +++++++++++++
 .../arm64/abi/seccomp_ret_trace_x0_bypass.c   | 249 ++++++++++++++++++
 4 files changed, 433 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/arm64/abi/seccomp_ptrace_x0_bypass.c
 create mode 100644 tools/testing/selftests/arm64/abi/seccomp_ret_trace_x0_bypass.c

-- 
2.34.1

[PATCH 1/2] kselftest/arm64: Add seccomp ptrace x0 bypass test

[Jinjie Ruan]

As Kees suggested, add a test that verifies that seccomp observes the
correct first argument after a ptracer modifies x0 at a syscall-enter-stop
on arm64.

The first syscall argument and the return value share register x0.
The original value is saved in orig_x0 on entry and used by
syscall_get_arguments(), but ptrace changes to x0 were not
automatically reflected there.  This test checks the kernel re-syncs
orig_x0 after a ptrace stop so that seccomp sees the modified
argument.

A seccomp filter allows write(2,...) and kills the task for any other
fd.  The tracer changes fd from 2 to 1 at entry.  If orig_x0 remains
stale, the child exits normally (bypass, test fails).  If orig_x0 is
correctly updated, the child is killed by SIGSYS (test passes).

Before the fix:
	 ./seccomp_ptrace_x0_bypass
	TAP version 13
	1..1
	not ok 1 seccomp_ptrace_x0_bypass
	# Totals: pass:0 fail:1 xfail:0 xpass:0 skip:0 error:0

After the fix:
	# ./seccomp_ptrace_x0_bypass
	TAP version 13
	1..1
	[   19.475951] audit: type=1326 audit(1784254846.284:2): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=227 comm="seccomp_ptrace_" exe="/mnt/seccomp0
	[   19.477852] audit: type=1701 audit(1784254846.284:3): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=227 comm="seccomp_ptrace_" exe="/mnt/seccomp1
	ok 1 seccomp_ptrace_x0_bypass
	# Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0

Cc: Kees Cook <kees@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Link: https://lore.kernel.org/all/20260716120640.6590-1-will@kernel.org/
Link: https://lore.kernel.org/all/202607152004.DEA95D63@keescook/
Suggested-by: Kees Cook <kees@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
---
 tools/testing/selftests/arm64/abi/.gitignore  |   1 +
 tools/testing/selftests/arm64/abi/Makefile    |   2 +-
 .../arm64/abi/seccomp_ptrace_x0_bypass.c      | 181 ++++++++++++++++++
 3 files changed, 183 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/arm64/abi/seccomp_ptrace_x0_bypass.c

diff --git a/tools/testing/selftests/arm64/abi/.gitignore b/tools/testing/selftests/arm64/abi/.gitignore
index 44f8b80f37e3..39129a9907c7 100644
--- a/tools/testing/selftests/arm64/abi/.gitignore
+++ b/tools/testing/selftests/arm64/abi/.gitignore
@@ -1,4 +1,5 @@
 hwcap
 ptrace
+seccomp_ptrace_x0_bypass
 syscall-abi
 tpidr2
diff --git a/tools/testing/selftests/arm64/abi/Makefile b/tools/testing/selftests/arm64/abi/Makefile
index 483488f8c2ad..5a16db379bd4 100644
--- a/tools/testing/selftests/arm64/abi/Makefile
+++ b/tools/testing/selftests/arm64/abi/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 # Copyright (C) 2021 ARM Limited
 
-TEST_GEN_PROGS := hwcap ptrace syscall-abi tpidr2
+TEST_GEN_PROGS := hwcap ptrace syscall-abi tpidr2 seccomp_ptrace_x0_bypass
 
 include ../../lib.mk
 
diff --git a/tools/testing/selftests/arm64/abi/seccomp_ptrace_x0_bypass.c b/tools/testing/selftests/arm64/abi/seccomp_ptrace_x0_bypass.c
new file mode 100644
index 000000000000..718d3dcb3264
--- /dev/null
+++ b/tools/testing/selftests/arm64/abi/seccomp_ptrace_x0_bypass.c
@@ -0,0 +1,181 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Test that seccomp, tracepoints and audit observe the correct syscall
+ * arguments after a ptracer has modified them at syscall-enter-stop.
+ *
+ * On arm64, both the first argument and the return value of a syscall
+ * are passed in register x0.  The original x0 is saved in
+ * pt_regs::orig_x0 during syscall entry and returned as the first
+ * argument by syscall_get_arguments().  Because ptrace modifications
+ * to x0 are not automatically reflected in orig_x0, seccomp, tracepoints
+ * and audit may see a stale value unless orig_x0 is explicitly
+ * re-synchronised after a ptrace stop.
+ *
+ * This test sets up a seccomp filter that allows write(2, ...) but kills
+ * the task for any other fd.  A ptracer changes the fd argument from 2
+ * to 1 at the syscall-enter stop.  If the orig_x0 re-sync works, seccomp
+ * sees the modified argument (fd=1) and kills the child with SIGSYS
+ * (test passes).  If orig_x0 is not re-synced, seccomp sees the original
+ * fd=2, the write succeeds and the child exits normally (test fails,
+ * vulnerability present).
+ */
+#include <errno.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/prctl.h>
+#include <sys/ptrace.h>
+#include <sys/uio.h>
+#include <sys/wait.h>
+#include <asm/ptrace.h>
+#include <linux/elf.h>
+#include <linux/filter.h>
+#include <linux/seccomp.h>
+
+#include "kselftest.h"
+
+#ifndef __NR_write
+#define __NR_write 64
+#endif
+
+#define EXPECTED_TESTS 1
+
+static int do_child(void)
+{
+	if (ptrace(PTRACE_TRACEME, 0, NULL, NULL))
+		ksft_exit_fail_perror("PTRACE_TRACEME");
+
+	if (raise(SIGSTOP))
+		ksft_exit_fail_perror("raise(SIGSTOP)");
+
+	/*
+	 * Seccomp filter:
+	 *    If syscall is not write -> ALLOW
+	 *    If syscall is write:
+	 *	- If args[0] (fd) == 2 -> ALLOW
+	 *	- Otherwise -> KILL
+	 */
+	struct sock_filter filter[] = {
+		BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 0),			/* nr */
+		BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_write, 0, 3),
+		BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 16),			/* args[0] */
+		BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 2, 1, 0),
+		BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL),
+		BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
+	};
+	struct sock_fprog prog = {
+		.len = ARRAY_SIZE(filter),
+		.filter = filter,
+	};
+
+	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
+		ksft_exit_fail_perror("prctl NO_NEW_PRIVS");
+
+	if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog))
+		ksft_exit_fail_perror("prctl SECCOMP");
+
+	/*
+	 * Invoke write(2, ...) while the tracer will change the first
+	 * argument (fd) from 2 to 1 at syscall entry.
+	 */
+	syscall(__NR_write, 2, NULL, 0);
+	_exit(0);
+}
+
+static int do_parent(pid_t child)
+{
+	bool bypass = false;
+	int status;
+
+	/* Wait for the initial SIGSTOP */
+	if (waitpid(child, &status, 0) != child)
+		ksft_exit_fail_msg("waitpid failed");
+
+	if (!WIFSTOPPED(status) || WSTOPSIG(status) != SIGSTOP)
+		ksft_exit_fail_msg("unexpected stop status");
+
+	if (ptrace(PTRACE_SETOPTIONS, child, 0, PTRACE_O_TRACESYSGOOD))
+		ksft_exit_fail_perror("PTRACE_SETOPTIONS");
+
+	if (ptrace(PTRACE_SYSCALL, child, 0, 0))
+		ksft_exit_fail_perror("PTRACE_SYSCALL");
+
+	while (1) {
+		int sig;
+
+		if (waitpid(child, &status, 0) != child)
+			ksft_exit_fail_msg("waitpid lost child");
+
+		if (WIFEXITED(status)) {
+			/* Child exited normally – bypass succeeded */
+			bypass = true;
+			break;
+		}
+
+		if (WIFSIGNALED(status))
+			break;
+
+		if (!WIFSTOPPED(status))
+			ksft_exit_fail_msg("unexpected wait status");
+
+		sig = WSTOPSIG(status);
+
+		if (sig == (SIGTRAP | 0x80)) {
+			struct user_regs_struct regs;
+			struct iovec iov = {
+				.iov_base = &regs,
+				.iov_len = sizeof(regs),
+			};
+
+			if (ptrace(PTRACE_GETREGSET, child, NT_PRSTATUS, &iov))
+				ksft_exit_fail_perror("PTRACE_GETREGSET");
+
+			unsigned long syscall_nr = regs.regs[8];
+			unsigned long x0 = regs.regs[0];
+
+			/* Modify fd from 2 to 1 at write entry */
+			if (syscall_nr == __NR_write && x0 == 2) {
+				regs.regs[0] = 1;
+				if (ptrace(PTRACE_SETREGSET, child, NT_PRSTATUS, &iov))
+					ksft_exit_fail_perror("PTRACE_SETREGSET");
+			}
+
+			if (ptrace(PTRACE_SYSCALL, child, 0, 0))
+				ksft_exit_fail_perror("PTRACE_SYSCALL");
+		} else {
+			/* Forward other signals */
+			if (ptrace(PTRACE_SYSCALL, child, 0, sig))
+				ksft_exit_fail_perror("PTRACE_SYSCALL");
+		}
+	}
+
+	/* bypass == true means vulnerability exists -> test fails */
+	return bypass ? EXIT_FAILURE : EXIT_SUCCESS;
+}
+
+int main(void)
+{
+	pid_t child;
+
+	ksft_print_header();
+	ksft_set_plan(EXPECTED_TESTS);
+
+	child = fork();
+	if (!child)
+		return do_child();
+
+	/*
+	 * do_parent() returns EXIT_SUCCESS if the child was killed by
+	 * SIGSYS (i.e. seccomp correctly saw the modified argument),
+	 * and EXIT_FAILURE if the child exited normally (bypass).
+	 */
+	int result = do_parent(child);
+
+	ksft_test_result(result == EXIT_SUCCESS, "seccomp_ptrace_x0_bypass\n");
+
+	ksft_print_cnts();
+	return result;
+}
-- 
2.34.1

[PATCH 2/2] kselftest/arm64: Add SECCOMP_RET_TRACE x0 bypass test

[Jinjie Ruan]

Add a selftest that verifies the kernel re-synchronises orig_x0 after
a SECCOMP_RET_TRACE ptrace event, so that tracepoints (and audit) see
the modified argument rather than the original value.

The child installs a seccomp filter returning SECCOMP_RET_TRACE for
write().  The tracer changes the first argument (fd) from 2 to 1 at the
SECCOMP event, then the test checks that the sys_enter_write tracepoint
records fd=1.

The test requires root and tracefs (at /sys/kernel/debug/tracing);
it is skipped gracefully when these are unavailable.

Before the fix:
	# ./seccomp_ret_trace_x0_bypass
	TAP version 13
	1..1
	not ok 1 seccomp_ret_trace_x0_tracepoint
	# Totals: pass:0 fail:1 xfail:0 xpass:0 skip:0 error:0

After the fix:
	# ./seccomp_ret_trace_x0_bypass
	TAP version 13
	1..1
	ok 1 seccomp_ret_trace_x0_tracepoint
	# Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0

Cc: Kees Cook <kees@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Link: https://lore.kernel.org/all/20260716120640.6590-1-will@kernel.org/
Link: https://lore.kernel.org/all/202607152004.DEA95D63@keescook/
Suggested-by: Kees Cook <kees@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
---
 tools/testing/selftests/arm64/abi/.gitignore  |   1 +
 tools/testing/selftests/arm64/abi/Makefile    |   2 +-
 .../arm64/abi/seccomp_ret_trace_x0_bypass.c   | 249 ++++++++++++++++++
 3 files changed, 251 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/arm64/abi/seccomp_ret_trace_x0_bypass.c

diff --git a/tools/testing/selftests/arm64/abi/.gitignore b/tools/testing/selftests/arm64/abi/.gitignore
index 39129a9907c7..491a80db9dff 100644
--- a/tools/testing/selftests/arm64/abi/.gitignore
+++ b/tools/testing/selftests/arm64/abi/.gitignore
@@ -1,5 +1,6 @@
 hwcap
 ptrace
 seccomp_ptrace_x0_bypass
+seccomp_ret_trace_x0_bypass
 syscall-abi
 tpidr2
diff --git a/tools/testing/selftests/arm64/abi/Makefile b/tools/testing/selftests/arm64/abi/Makefile
index 5a16db379bd4..a01d3806eba8 100644
--- a/tools/testing/selftests/arm64/abi/Makefile
+++ b/tools/testing/selftests/arm64/abi/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 # Copyright (C) 2021 ARM Limited
 
-TEST_GEN_PROGS := hwcap ptrace syscall-abi tpidr2 seccomp_ptrace_x0_bypass
+TEST_GEN_PROGS := hwcap ptrace syscall-abi tpidr2 seccomp_ptrace_x0_bypass seccomp_ret_trace_x0_bypass
 
 include ../../lib.mk
 
diff --git a/tools/testing/selftests/arm64/abi/seccomp_ret_trace_x0_bypass.c b/tools/testing/selftests/arm64/abi/seccomp_ret_trace_x0_bypass.c
new file mode 100644
index 000000000000..a4e56a382fe2
--- /dev/null
+++ b/tools/testing/selftests/arm64/abi/seccomp_ret_trace_x0_bypass.c
@@ -0,0 +1,249 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Verify that after a SECCOMP_RET_TRACE stop, changes to x0 are visible
+ * to the syscall tracepoint (orig_x0 re-sync).
+ *
+ * The child installs a seccomp filter that returns SECCOMP_RET_TRACE for
+ * write().  The parent waits for PTRACE_EVENT_SECCOMP, changes the first
+ * argument (fd) from 2 to 1, then resumes the child.  By monitoring the
+ * sys_enter_write tracepoint, we check whether the kernel recorded fd=1
+ * (test passes) or fd=2 (test fails).
+ *
+ * Requires root and tracefs at /sys/kernel/debug/tracing.  If unavailable,
+ * the test is skipped.
+ */
+#include <errno.h>
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+#include <sys/prctl.h>
+#include <sys/ptrace.h>
+#include <sys/wait.h>
+#include <linux/elf.h>
+#include <linux/filter.h>
+#include <linux/seccomp.h>
+#include <linux/ptrace.h>
+
+#include "kselftest.h"
+
+#ifndef __NR_write
+#define __NR_write 64
+#endif
+
+#define PTRACE_EVENT_MASK(status) ((status) >> 16)
+
+#define TRACEFS_PATH "/sys/kernel/debug/tracing"
+#define TRACE_EVENT  "syscalls/sys_enter_write"   /* note '/' not ':' */
+#define TRACE_PIPE   TRACEFS_PATH "/trace_pipe"
+#define TRACE_ON     TRACEFS_PATH "/events/" TRACE_EVENT "/enable"
+#define TRACE_CLR    TRACEFS_PATH "/trace"
+
+static int do_child(void)
+{
+	int null_fd = open("/dev/null", O_WRONLY);
+
+	if (null_fd >= 0) {
+		dup2(null_fd, STDOUT_FILENO);
+		close(null_fd);
+	}
+
+	if (ptrace(PTRACE_TRACEME, 0, NULL, NULL))
+		_exit(1);
+	raise(SIGSTOP);	/* let parent configure ptrace options */
+
+	struct sock_filter filter[] = {
+		BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 0),			/* syscall nr */
+		BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_write, 0, 1),
+		BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRACE),		/* write -> trace */
+		BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
+	};
+	struct sock_fprog prog = {
+		.len = ARRAY_SIZE(filter),
+		.filter = filter,
+	};
+
+	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
+		_exit(2);
+
+	if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog))
+		_exit(3);
+
+	/* write(2, "", 0) – parent will change fd to 1 at SECCOMP stop */
+	syscall(__NR_write, 2, "", 0);
+	_exit(0);
+}
+
+static int trace_pipe_expect(const char *expect, int timeout_secs)
+{
+	FILE *fp = fopen(TRACE_PIPE, "r");
+	char buf[4096];
+	int found = 0;
+	time_t deadline = time(NULL) + timeout_secs;
+
+	if (!fp)
+		return 0;
+
+	fcntl(fileno(fp), F_SETFL, O_NONBLOCK);
+	while (time(NULL) < deadline) {
+		ssize_t n = fread(buf, 1, sizeof(buf) - 1, fp);
+
+		if (n <= 0) {
+			usleep(10000);
+			continue;
+		}
+		buf[n] = '\0';
+		if (strstr(buf, expect)) {
+			found = 1;
+			break;
+		}
+	}
+	fclose(fp);
+	return found;
+}
+
+static void enable_trace(bool on)
+{
+	int fd = open(TRACE_ON, O_WRONLY);
+	char c = on ? '1' : '0';
+
+	if (fd >= 0) {
+		write(fd, &c, 1);
+		close(fd);
+	}
+}
+
+static void clear_trace(void)
+{
+	int fd = open(TRACE_CLR, O_WRONLY);
+
+	if (fd >= 0) {
+		write(fd, "0", 1);
+		close(fd);
+	}
+}
+
+int main(void)
+{
+	/* Wait for SECCOMP event or child exit */
+	bool seccomp_event = false;
+	bool ok = false;
+	pid_t child;
+	int status;
+
+	ksft_print_header();
+	ksft_set_plan(1);
+
+	if (geteuid() != 0) {
+		ksft_test_result_skip("not root\n");
+		goto out;
+	}
+	if (access(TRACE_ON, W_OK) != 0) {
+		ksft_test_result_skip("tracefs unavailable\n");
+		goto out;
+	}
+
+	child = fork();
+	if (!child)
+		return do_child();
+
+	/* Wait for initial SIGSTOP */
+	if (waitpid(child, &status, 0) != child)
+		ksft_exit_fail_msg("waitpid initial");
+	if (!WIFSTOPPED(status) || WSTOPSIG(status) != SIGSTOP)
+		ksft_exit_fail_msg("unexpected initial stop");
+
+	if (ptrace(PTRACE_SETOPTIONS, child, 0, PTRACE_O_TRACESECCOMP)) {
+		ksft_test_result_fail("setoptions\n");
+		goto out;
+	}
+
+	if (ptrace(PTRACE_CONT, child, 0, 0)) {
+		ksft_test_result_fail("PTRACE_CONT\n");
+		goto out;
+	}
+
+	while (1) {
+		if (waitpid(child, &status, 0) != child)
+			ksft_exit_fail_msg("waitpid lost");
+
+		if (WIFEXITED(status)) {
+			int code = WEXITSTATUS(status);
+
+			ksft_test_result(code == 2 || code == 3,
+					 "seccomp filter not installed\n");
+			goto out;
+		}
+		if (WIFSIGNALED(status)) {
+			ksft_test_result_fail("killed\n");
+			goto out;
+		}
+		if (WIFSTOPPED(status)) {
+			if (WSTOPSIG(status) == SIGTRAP &&
+			    PTRACE_EVENT_MASK(status) == PTRACE_EVENT_SECCOMP) {
+				seccomp_event = true;
+				break;
+			}
+			ptrace(PTRACE_CONT, child, 0, WSTOPSIG(status));
+		}
+	}
+
+	if (!seccomp_event)
+		goto out;
+
+	/* At SECCOMP stop: modify x0 (fd) from 2 to 1 */
+	{
+		unsigned long long syscall_nr, x0;
+		struct user_pt_regs regs;
+		struct iovec iov = { .iov_base = &regs, .iov_len = sizeof(regs) };
+
+		if (ptrace(PTRACE_GETREGSET, child, NT_PRSTATUS, &iov))
+			ksft_exit_fail_perror("GETREGSET");
+
+		syscall_nr = regs.regs[8];
+		x0 = regs.regs[0];
+		if (syscall_nr != __NR_write || x0 != 2) {
+			ksft_test_result_fail("bad regs\n");
+			goto out;
+		}
+
+		regs.regs[0] = 1;
+		if (ptrace(PTRACE_SETREGSET, child, NT_PRSTATUS, &iov)) {
+			ksft_test_result_fail("SETREGSET\n");
+			goto out;
+		}
+	}
+
+	/* Enable tracepoint and clear buffer */
+	clear_trace();
+	enable_trace(true);
+
+	/* Continue child; it will execute write(1, ...) and hit tracepoint */
+	if (ptrace(PTRACE_CONT, child, 0, 0))
+		ksft_exit_fail_perror("PTRACE_CONT after SECCOMP");
+
+	/* Reap the child */
+	while (1) {
+		if (waitpid(child, &status, 0) != child)
+			break;
+		if (WIFEXITED(status) || WIFSIGNALED(status))
+			break;
+		ptrace(PTRACE_CONT, child, 0, WSTOPSIG(status));
+	}
+	enable_trace(false);
+
+	/* Check trace for the modified fd */
+	ok = trace_pipe_expect("fd: 1", 5);
+	ksft_test_result(ok, "seccomp_ret_trace_x0_tracepoint\n");
+
+out:
+	if (child > 0) {
+		kill(child, SIGKILL);
+		waitpid(child, NULL, 0);
+	}
+	ksft_print_cnts();
+	return ok ? EXIT_SUCCESS : EXIT_FAILURE;
+}
-- 
2.34.1