161 lines · c
1// SPDX-License-Identifier: GPL-2.02 3/*4 * Copyright (C) 2020 Google LLC.5 */6 7#include <test_progs.h>8#include <sys/mman.h>9#include <sys/wait.h>10#include <unistd.h>11#include <malloc.h>12#include <stdlib.h>13 14#include "lsm.skel.h"15#include "lsm_tailcall.skel.h"16 17char *CMD_ARGS[] = {"true", NULL};18 19#define GET_PAGE_ADDR(ADDR, PAGE_SIZE) \20 (char *)(((unsigned long) (ADDR + PAGE_SIZE)) & ~(PAGE_SIZE-1))21 22int stack_mprotect(void)23{24 void *buf;25 long sz;26 int ret;27 28 sz = sysconf(_SC_PAGESIZE);29 if (sz < 0)30 return sz;31 32 buf = alloca(sz * 3);33 ret = mprotect(GET_PAGE_ADDR(buf, sz), sz,34 PROT_READ | PROT_WRITE | PROT_EXEC);35 return ret;36}37 38int exec_cmd(int *monitored_pid)39{40 int child_pid, child_status;41 42 child_pid = fork();43 if (child_pid == 0) {44 *monitored_pid = getpid();45 execvp(CMD_ARGS[0], CMD_ARGS);46 return -EINVAL;47 } else if (child_pid > 0) {48 waitpid(child_pid, &child_status, 0);49 return child_status;50 }51 52 return -EINVAL;53}54 55static int test_lsm(struct lsm *skel)56{57 struct bpf_link *link;58 int buf = 1234;59 int err;60 61 err = lsm__attach(skel);62 if (!ASSERT_OK(err, "attach"))63 return err;64 65 /* Check that already linked program can't be attached again. */66 link = bpf_program__attach(skel->progs.test_int_hook);67 if (!ASSERT_ERR_PTR(link, "attach_link"))68 return -1;69 70 err = exec_cmd(&skel->bss->monitored_pid);71 if (!ASSERT_OK(err, "exec_cmd"))72 return err;73 74 ASSERT_EQ(skel->bss->bprm_count, 1, "bprm_count");75 76 skel->bss->monitored_pid = getpid();77 78 err = stack_mprotect();79 if (!ASSERT_EQ(err, -1, "stack_mprotect") ||80 !ASSERT_EQ(errno, EPERM, "stack_mprotect"))81 return err;82 83 ASSERT_EQ(skel->bss->mprotect_count, 1, "mprotect_count");84 85 syscall(__NR_setdomainname, &buf, -2L);86 syscall(__NR_setdomainname, 0, -3L);87 syscall(__NR_setdomainname, ~0L, -4L);88 89 ASSERT_EQ(skel->bss->copy_test, 3, "copy_test");90 91 lsm__detach(skel);92 93 skel->bss->copy_test = 0;94 skel->bss->bprm_count = 0;95 skel->bss->mprotect_count = 0;96 return 0;97}98 99static void test_lsm_basic(void)100{101 struct lsm *skel = NULL;102 int err;103 104 skel = lsm__open_and_load();105 if (!ASSERT_OK_PTR(skel, "lsm_skel_load"))106 goto close_prog;107 108 err = test_lsm(skel);109 if (!ASSERT_OK(err, "test_lsm_first_attach"))110 goto close_prog;111 112 err = test_lsm(skel);113 ASSERT_OK(err, "test_lsm_second_attach");114 115close_prog:116 lsm__destroy(skel);117}118 119static void test_lsm_tailcall(void)120{121 struct lsm_tailcall *skel = NULL;122 int map_fd, prog_fd;123 int err, key;124 125 skel = lsm_tailcall__open_and_load();126 if (!ASSERT_OK_PTR(skel, "lsm_tailcall__skel_load"))127 goto close_prog;128 129 map_fd = bpf_map__fd(skel->maps.jmp_table);130 if (CHECK_FAIL(map_fd < 0))131 goto close_prog;132 133 prog_fd = bpf_program__fd(skel->progs.lsm_file_permission_prog);134 if (CHECK_FAIL(prog_fd < 0))135 goto close_prog;136 137 key = 0;138 err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY);139 if (CHECK_FAIL(!err))140 goto close_prog;141 142 prog_fd = bpf_program__fd(skel->progs.lsm_file_alloc_security_prog);143 if (CHECK_FAIL(prog_fd < 0))144 goto close_prog;145 146 err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY);147 if (CHECK_FAIL(err))148 goto close_prog;149 150close_prog:151 lsm_tailcall__destroy(skel);152}153 154void test_test_lsm(void)155{156 if (test__start_subtest("lsm_basic"))157 test_lsm_basic();158 if (test__start_subtest("lsm_tailcall"))159 test_lsm_tailcall();160}161