1// SPDX-License-Identifier: GPL-2.0
  2
  3/*
  4 * Copyright (C) 2020 Google LLC.
  5 */
  6
  7#include <test_progs.h>
  8#include <sys/mman.h>
  9#include <sys/wait.h>
 10#include <unistd.h>
 11#include <malloc.h>
 12#include <stdlib.h>
 13
 14#include "lsm.skel.h"
 15#include "lsm_tailcall.skel.h"
 16
 17char *CMD_ARGS[] = {"true", NULL};
 18
 19#define GET_PAGE_ADDR(ADDR, PAGE_SIZE)					\
 20	(char *)(((unsigned long) (ADDR + PAGE_SIZE)) & ~(PAGE_SIZE-1))
 21
 22int stack_mprotect(void)
 23{
 24	void *buf;
 25	long sz;
 26	int ret;
 27
 28	sz = sysconf(_SC_PAGESIZE);
 29	if (sz < 0)
 30		return sz;
 31
 32	buf = alloca(sz * 3);
 33	ret = mprotect(GET_PAGE_ADDR(buf, sz), sz,
 34		       PROT_READ | PROT_WRITE | PROT_EXEC);
 35	return ret;
 36}
 37
 38int exec_cmd(int *monitored_pid)
 39{
 40	int child_pid, child_status;
 41
 42	child_pid = fork();
 43	if (child_pid == 0) {
 44		*monitored_pid = getpid();
 45		execvp(CMD_ARGS[0], CMD_ARGS);
 46		return -EINVAL;
 47	} else if (child_pid > 0) {
 48		waitpid(child_pid, &child_status, 0);
 49		return child_status;
 50	}
 51
 52	return -EINVAL;
 53}
 54
 55static int test_lsm(struct lsm *skel)
 56{
 57	struct bpf_link *link;
 58	int buf = 1234;
 59	int err;
 60
 61	err = lsm__attach(skel);
 62	if (!ASSERT_OK(err, "attach"))
 63		return err;
 64
 65	/* Check that already linked program can't be attached again. */
 66	link = bpf_program__attach(skel->progs.test_int_hook);
 67	if (!ASSERT_ERR_PTR(link, "attach_link"))
 68		return -1;
 69
 70	err = exec_cmd(&skel->bss->monitored_pid);
 71	if (!ASSERT_OK(err, "exec_cmd"))
 72		return err;
 73
 74	ASSERT_EQ(skel->bss->bprm_count, 1, "bprm_count");
 75
 76	skel->bss->monitored_pid = getpid();
 77
 78	err = stack_mprotect();
 79	if (!ASSERT_EQ(err, -1, "stack_mprotect") ||
 80	    !ASSERT_EQ(errno, EPERM, "stack_mprotect"))
 81		return err;
 82
 83	ASSERT_EQ(skel->bss->mprotect_count, 1, "mprotect_count");
 84
 85	syscall(__NR_setdomainname, &buf, -2L);
 86	syscall(__NR_setdomainname, 0, -3L);
 87	syscall(__NR_setdomainname, ~0L, -4L);
 88
 89	ASSERT_EQ(skel->bss->copy_test, 3, "copy_test");
 90
 91	lsm__detach(skel);
 92
 93	skel->bss->copy_test = 0;
 94	skel->bss->bprm_count = 0;
 95	skel->bss->mprotect_count = 0;
 96	return 0;
 97}
 98
 99static void test_lsm_basic(void)
100{
101	struct lsm *skel = NULL;
102	int err;
103
104	skel = lsm__open_and_load();
105	if (!ASSERT_OK_PTR(skel, "lsm_skel_load"))
106		goto close_prog;
107
108	err = test_lsm(skel);
109	if (!ASSERT_OK(err, "test_lsm_first_attach"))
110		goto close_prog;
111
112	err = test_lsm(skel);
113	ASSERT_OK(err, "test_lsm_second_attach");
114
115close_prog:
116	lsm__destroy(skel);
117}
118
119static void test_lsm_tailcall(void)
120{
121	struct lsm_tailcall *skel = NULL;
122	int map_fd, prog_fd;
123	int err, key;
124
125	skel = lsm_tailcall__open_and_load();
126	if (!ASSERT_OK_PTR(skel, "lsm_tailcall__skel_load"))
127		goto close_prog;
128
129	map_fd = bpf_map__fd(skel->maps.jmp_table);
130	if (CHECK_FAIL(map_fd < 0))
131		goto close_prog;
132
133	prog_fd = bpf_program__fd(skel->progs.lsm_file_permission_prog);
134	if (CHECK_FAIL(prog_fd < 0))
135		goto close_prog;
136
137	key = 0;
138	err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY);
139	if (CHECK_FAIL(!err))
140		goto close_prog;
141
142	prog_fd = bpf_program__fd(skel->progs.lsm_file_alloc_security_prog);
143	if (CHECK_FAIL(prog_fd < 0))
 
144		goto close_prog;
145
146	err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY);
147	if (CHECK_FAIL(err))
148		goto close_prog;
149
150close_prog:
151	lsm_tailcall__destroy(skel);
152}
153
154void test_test_lsm(void)
155{
156	if (test__start_subtest("lsm_basic"))
157		test_lsm_basic();
158	if (test__start_subtest("lsm_tailcall"))
159		test_lsm_tailcall();
160}

 1// SPDX-License-Identifier: GPL-2.0
 2
 3/*
 4 * Copyright (C) 2020 Google LLC.
 5 */
 6
 7#include <test_progs.h>
 8#include <sys/mman.h>
 9#include <sys/wait.h>
10#include <unistd.h>
11#include <malloc.h>
12#include <stdlib.h>
13
14#include "lsm.skel.h"
 
15
16char *CMD_ARGS[] = {"true", NULL};
17
18#define GET_PAGE_ADDR(ADDR, PAGE_SIZE)					\
19	(char *)(((unsigned long) (ADDR + PAGE_SIZE)) & ~(PAGE_SIZE-1))
20
21int stack_mprotect(void)
22{
23	void *buf;
24	long sz;
25	int ret;
26
27	sz = sysconf(_SC_PAGESIZE);
28	if (sz < 0)
29		return sz;
30
31	buf = alloca(sz * 3);
32	ret = mprotect(GET_PAGE_ADDR(buf, sz), sz,
33		       PROT_READ | PROT_WRITE | PROT_EXEC);
34	return ret;
35}
36
37int exec_cmd(int *monitored_pid)
38{
39	int child_pid, child_status;
40
41	child_pid = fork();
42	if (child_pid == 0) {
43		*monitored_pid = getpid();
44		execvp(CMD_ARGS[0], CMD_ARGS);
45		return -EINVAL;
46	} else if (child_pid > 0) {
47		waitpid(child_pid, &child_status, 0);
48		return child_status;
49	}
50
51	return -EINVAL;
52}
53
54void test_test_lsm(void)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
55{
56	struct lsm *skel = NULL;
57	int err, duration = 0;
58
59	skel = lsm__open_and_load();
60	if (CHECK(!skel, "skel_load", "lsm skeleton failed\n"))
 
 
 
 
61		goto close_prog;
62
63	err = lsm__attach(skel);
64	if (CHECK(err, "attach", "lsm attach failed: %d\n", err))
 
 
 
 
 
 
 
 
 
 
 
 
 
65		goto close_prog;
66
67	err = exec_cmd(&skel->bss->monitored_pid);
68	if (CHECK(err < 0, "exec_cmd", "err %d errno %d\n", err, errno))
69		goto close_prog;
70
71	CHECK(skel->bss->bprm_count != 1, "bprm_count", "bprm_count = %d\n",
72	      skel->bss->bprm_count);
 
73
74	skel->bss->monitored_pid = getpid();
 
 
 
75
76	err = stack_mprotect();
77	if (CHECK(errno != EPERM, "stack_mprotect", "want err=EPERM, got %d\n",
78		  errno))
79		goto close_prog;
80
81	CHECK(skel->bss->mprotect_count != 1, "mprotect_count",
82	      "mprotect_count = %d\n", skel->bss->mprotect_count);
 
83
84close_prog:
85	lsm__destroy(skel);
 
 
 
 
 
 
 
 
86}