tools/testing/selftests/bpf/prog_tests/test_lsm.c

   1 // SPDX-License-Identifier: GPL-2.0
   2
   3 /*
   4  * Copyright (C) 2020 Google LLC.
   5  */
   6
   7 #include <test_progs.h>
   8 #include <sys/mman.h>
   9 #include <sys/wait.h>
  10 #include <unistd.h>
  11 #include <malloc.h>
  12 #include <stdlib.h>
  13
  14 #include "lsm.skel.h"
  15 #include "lsm_tailcall.skel.h"
  16
  17 char *CMD_ARGS[] = {"true", NULL};
  18
  19 #define GET_PAGE_ADDR(ADDR, PAGE_SIZE)                                  \
  20         (char *)(((unsigned long) (ADDR + PAGE_SIZE)) & ~(PAGE_SIZE-1))
  21
  22 int stack_mprotect(void)
  23 {
  24         void *buf;
  25         long sz;
  26         int ret;
  27
  28         sz = sysconf(_SC_PAGESIZE);
  29         if (sz < 0)
  30                 return sz;
  31
  32         buf = alloca(sz * 3);
  33         ret = mprotect(GET_PAGE_ADDR(buf, sz), sz,
  34                        PROT_READ | PROT_WRITE | PROT_EXEC);
  35         return ret;
  36 }
  37
  38 int exec_cmd(int *monitored_pid)
  39 {
  40         int child_pid, child_status;
  41
  42         child_pid = fork();
  43         if (child_pid == 0) {
  44                 *monitored_pid = getpid();
  45                 execvp(CMD_ARGS[0], CMD_ARGS);
  46                 return -EINVAL;
  47         } else if (child_pid > 0) {
  48                 waitpid(child_pid, &child_status, 0);
  49                 return child_status;
  50         }
  51
  52         return -EINVAL;
  53 }
  54
  55 static int test_lsm(struct lsm *skel)
  56 {
  57         struct bpf_link *link;
  58         int buf = 1234;
  59         int err;
  60
  61         err = lsm__attach(skel);
  62         if (!ASSERT_OK(err, "attach"))
  63                 return err;
  64
  65         /* Check that already linked program can't be attached again. */
  66         link = bpf_program__attach(skel->progs.test_int_hook);
  67         if (!ASSERT_ERR_PTR(link, "attach_link"))
  68                 return -1;
  69
  70         err = exec_cmd(&skel->bss->monitored_pid);
  71         if (!ASSERT_OK(err, "exec_cmd"))
  72                 return err;
  73
  74         ASSERT_EQ(skel->bss->bprm_count, 1, "bprm_count");
  75
  76         skel->bss->monitored_pid = getpid();
  77
  78         err = stack_mprotect();
  79         if (!ASSERT_EQ(err, -1, "stack_mprotect") ||
  80             !ASSERT_EQ(errno, EPERM, "stack_mprotect"))
  81                 return err;
  82
  83         ASSERT_EQ(skel->bss->mprotect_count, 1, "mprotect_count");
  84
  85         syscall(__NR_setdomainname, &buf, -2L);
  86         syscall(__NR_setdomainname, 0, -3L);
  87         syscall(__NR_setdomainname, ~0L, -4L);
  88
  89         ASSERT_EQ(skel->bss->copy_test, 3, "copy_test");
  90
  91         lsm__detach(skel);
  92
  93         skel->bss->copy_test = 0;
  94         skel->bss->bprm_count = 0;
  95         skel->bss->mprotect_count = 0;
  96         return 0;
  97 }
  98
  99 static void test_lsm_basic(void)
 100 {
 101         struct lsm *skel = NULL;
 102         int err;
 103
 104         skel = lsm__open_and_load();
 105         if (!ASSERT_OK_PTR(skel, "lsm_skel_load"))
 106                 goto close_prog;
 107
 108         err = test_lsm(skel);
 109         if (!ASSERT_OK(err, "test_lsm_first_attach"))
 110                 goto close_prog;
 111
 112         err = test_lsm(skel);
 113         ASSERT_OK(err, "test_lsm_second_attach");
 114
 115 close_prog:
 116         lsm__destroy(skel);
 117 }
 118
 119 static void test_lsm_tailcall(void)
 120 {
 121         struct lsm_tailcall *skel = NULL;
 122         int map_fd, prog_fd;
 123         int err, key;
 124
 125         skel = lsm_tailcall__open_and_load();
 126         if (!ASSERT_OK_PTR(skel, "lsm_tailcall__skel_load"))
 127                 goto close_prog;
 128
 129         map_fd = bpf_map__fd(skel->maps.jmp_table);
 130         if (CHECK_FAIL(map_fd < 0))
 131                 goto close_prog;
 132
 133         prog_fd = bpf_program__fd(skel->progs.lsm_file_permission_prog);
 134         if (CHECK_FAIL(prog_fd < 0))
 135                 goto close_prog;
 136
 137         key = 0;
 138         err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY);
 139         if (CHECK_FAIL(!err))
 140                 goto close_prog;
 141
 142         prog_fd = bpf_program__fd(skel->progs.lsm_file_alloc_security_prog);
 143         if (CHECK_FAIL(prog_fd < 0))
 144                 goto close_prog;
 145
 146         err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY);
 147         if (CHECK_FAIL(err))
 148                 goto close_prog;
 149
 150 close_prog:
 151         lsm_tailcall__destroy(skel);
 152 }
 153
 154 void test_test_lsm(void)
 155 {
 156         if (test__start_subtest("lsm_basic"))
 157                 test_lsm_basic();
 158         if (test__start_subtest("lsm_tailcall"))
 159                 test_lsm_tailcall();
 160 }