Loading...
1// SPDX-License-Identifier: GPL-2.0
2
3#include <sys/types.h>
4#include <sys/socket.h>
5#include <test_progs.h>
6#include <bpf/btf.h>
7
8#include "lsm_cgroup.skel.h"
9#include "lsm_cgroup_nonvoid.skel.h"
10#include "cgroup_helpers.h"
11#include "network_helpers.h"
12
13static struct btf *btf;
14
15static __u32 query_prog_cnt(int cgroup_fd, const char *attach_func)
16{
17 LIBBPF_OPTS(bpf_prog_query_opts, p);
18 int cnt = 0;
19 int i;
20
21 ASSERT_OK(bpf_prog_query_opts(cgroup_fd, BPF_LSM_CGROUP, &p), "prog_query");
22
23 if (!attach_func)
24 return p.prog_cnt;
25
26 /* When attach_func is provided, count the number of progs that
27 * attach to the given symbol.
28 */
29
30 if (!btf)
31 btf = btf__load_vmlinux_btf();
32 if (!ASSERT_OK(libbpf_get_error(btf), "btf_vmlinux"))
33 return -1;
34
35 p.prog_ids = malloc(sizeof(u32) * p.prog_cnt);
36 p.prog_attach_flags = malloc(sizeof(u32) * p.prog_cnt);
37 ASSERT_OK(bpf_prog_query_opts(cgroup_fd, BPF_LSM_CGROUP, &p), "prog_query");
38
39 for (i = 0; i < p.prog_cnt; i++) {
40 struct bpf_prog_info info = {};
41 __u32 info_len = sizeof(info);
42 int fd;
43
44 fd = bpf_prog_get_fd_by_id(p.prog_ids[i]);
45 ASSERT_GE(fd, 0, "prog_get_fd_by_id");
46 ASSERT_OK(bpf_prog_get_info_by_fd(fd, &info, &info_len),
47 "prog_info_by_fd");
48 close(fd);
49
50 if (info.attach_btf_id ==
51 btf__find_by_name_kind(btf, attach_func, BTF_KIND_FUNC))
52 cnt++;
53 }
54
55 free(p.prog_ids);
56 free(p.prog_attach_flags);
57
58 return cnt;
59}
60
61static void test_lsm_cgroup_functional(void)
62{
63 DECLARE_LIBBPF_OPTS(bpf_prog_attach_opts, attach_opts);
64 DECLARE_LIBBPF_OPTS(bpf_link_update_opts, update_opts);
65 int cgroup_fd = -1, cgroup_fd2 = -1, cgroup_fd3 = -1;
66 int listen_fd, client_fd, accepted_fd;
67 struct lsm_cgroup *skel = NULL;
68 int post_create_prog_fd2 = -1;
69 int post_create_prog_fd = -1;
70 int bind_link_fd2 = -1;
71 int bind_prog_fd2 = -1;
72 int alloc_prog_fd = -1;
73 int bind_prog_fd = -1;
74 int bind_link_fd = -1;
75 int clone_prog_fd = -1;
76 int err, fd, prio;
77 socklen_t socklen;
78
79 cgroup_fd3 = test__join_cgroup("/sock_policy_empty");
80 if (!ASSERT_GE(cgroup_fd3, 0, "create empty cgroup"))
81 goto close_cgroup;
82
83 cgroup_fd2 = test__join_cgroup("/sock_policy_reuse");
84 if (!ASSERT_GE(cgroup_fd2, 0, "create cgroup for reuse"))
85 goto close_cgroup;
86
87 cgroup_fd = test__join_cgroup("/sock_policy");
88 if (!ASSERT_GE(cgroup_fd, 0, "join_cgroup"))
89 goto close_cgroup;
90
91 skel = lsm_cgroup__open_and_load();
92 if (!ASSERT_OK_PTR(skel, "open_and_load"))
93 goto close_cgroup;
94
95 post_create_prog_fd = bpf_program__fd(skel->progs.socket_post_create);
96 post_create_prog_fd2 = bpf_program__fd(skel->progs.socket_post_create2);
97 bind_prog_fd = bpf_program__fd(skel->progs.socket_bind);
98 bind_prog_fd2 = bpf_program__fd(skel->progs.socket_bind2);
99 alloc_prog_fd = bpf_program__fd(skel->progs.socket_alloc);
100 clone_prog_fd = bpf_program__fd(skel->progs.socket_clone);
101
102 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_sk_alloc_security"), 0, "prog count");
103 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 0, "total prog count");
104 err = bpf_prog_attach(alloc_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0);
105 if (err == -ENOTSUPP) {
106 test__skip();
107 goto close_cgroup;
108 }
109 if (!ASSERT_OK(err, "attach alloc_prog_fd"))
110 goto detach_cgroup;
111 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_sk_alloc_security"), 1, "prog count");
112 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 1, "total prog count");
113
114 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_inet_csk_clone"), 0, "prog count");
115 err = bpf_prog_attach(clone_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0);
116 if (!ASSERT_OK(err, "attach clone_prog_fd"))
117 goto detach_cgroup;
118 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_inet_csk_clone"), 1, "prog count");
119 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 2, "total prog count");
120
121 /* Make sure replacing works. */
122
123 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 0, "prog count");
124 err = bpf_prog_attach(post_create_prog_fd, cgroup_fd,
125 BPF_LSM_CGROUP, 0);
126 if (!ASSERT_OK(err, "attach post_create_prog_fd"))
127 goto detach_cgroup;
128 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 1, "prog count");
129 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 3, "total prog count");
130
131 attach_opts.replace_prog_fd = post_create_prog_fd;
132 err = bpf_prog_attach_opts(post_create_prog_fd2, cgroup_fd,
133 BPF_LSM_CGROUP, &attach_opts);
134 if (!ASSERT_OK(err, "prog replace post_create_prog_fd"))
135 goto detach_cgroup;
136 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 1, "prog count");
137 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 3, "total prog count");
138
139 /* Try the same attach/replace via link API. */
140
141 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 0, "prog count");
142 bind_link_fd = bpf_link_create(bind_prog_fd, cgroup_fd,
143 BPF_LSM_CGROUP, NULL);
144 if (!ASSERT_GE(bind_link_fd, 0, "link create bind_prog_fd"))
145 goto detach_cgroup;
146 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count");
147 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
148
149 update_opts.old_prog_fd = bind_prog_fd;
150 update_opts.flags = BPF_F_REPLACE;
151
152 err = bpf_link_update(bind_link_fd, bind_prog_fd2, &update_opts);
153 if (!ASSERT_OK(err, "link update bind_prog_fd"))
154 goto detach_cgroup;
155 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count");
156 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
157
158 /* Attach another instance of bind program to another cgroup.
159 * This should trigger the reuse of the trampoline shim (two
160 * programs attaching to the same btf_id).
161 */
162
163 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count");
164 ASSERT_EQ(query_prog_cnt(cgroup_fd2, "bpf_lsm_socket_bind"), 0, "prog count");
165 bind_link_fd2 = bpf_link_create(bind_prog_fd2, cgroup_fd2,
166 BPF_LSM_CGROUP, NULL);
167 if (!ASSERT_GE(bind_link_fd2, 0, "link create bind_prog_fd2"))
168 goto detach_cgroup;
169 ASSERT_EQ(query_prog_cnt(cgroup_fd2, "bpf_lsm_socket_bind"), 1, "prog count");
170 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
171 ASSERT_EQ(query_prog_cnt(cgroup_fd2, NULL), 1, "total prog count");
172
173 fd = socket(AF_UNIX, SOCK_STREAM, 0);
174 if (!(skel->kconfig->CONFIG_SECURITY_APPARMOR
175 || skel->kconfig->CONFIG_SECURITY_SELINUX
176 || skel->kconfig->CONFIG_SECURITY_SMACK))
177 /* AF_UNIX is prohibited. */
178 ASSERT_LT(fd, 0, "socket(AF_UNIX)");
179 close(fd);
180
181 /* AF_INET6 gets default policy (sk_priority). */
182
183 fd = socket(AF_INET6, SOCK_STREAM, 0);
184 if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)"))
185 goto detach_cgroup;
186
187 prio = 0;
188 socklen = sizeof(prio);
189 ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
190 "getsockopt");
191 ASSERT_EQ(prio, 123, "sk_priority");
192
193 close(fd);
194
195 /* TX-only AF_PACKET is allowed. */
196
197 ASSERT_LT(socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)), 0,
198 "socket(AF_PACKET, ..., ETH_P_ALL)");
199
200 fd = socket(AF_PACKET, SOCK_RAW, 0);
201 ASSERT_GE(fd, 0, "socket(AF_PACKET, ..., 0)");
202
203 /* TX-only AF_PACKET can not be rebound. */
204
205 struct sockaddr_ll sa = {
206 .sll_family = AF_PACKET,
207 .sll_protocol = htons(ETH_P_ALL),
208 };
209 ASSERT_LT(bind(fd, (struct sockaddr *)&sa, sizeof(sa)), 0,
210 "bind(ETH_P_ALL)");
211
212 close(fd);
213
214 /* Trigger passive open. */
215
216 listen_fd = start_server(AF_INET6, SOCK_STREAM, "::1", 0, 0);
217 ASSERT_GE(listen_fd, 0, "start_server");
218 client_fd = connect_to_fd(listen_fd, 0);
219 ASSERT_GE(client_fd, 0, "connect_to_fd");
220 accepted_fd = accept(listen_fd, NULL, NULL);
221 ASSERT_GE(accepted_fd, 0, "accept");
222
223 prio = 0;
224 socklen = sizeof(prio);
225 ASSERT_GE(getsockopt(accepted_fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
226 "getsockopt");
227 ASSERT_EQ(prio, 234, "sk_priority");
228
229 /* These are replaced and never called. */
230 ASSERT_EQ(skel->bss->called_socket_post_create, 0, "called_create");
231 ASSERT_EQ(skel->bss->called_socket_bind, 0, "called_bind");
232
233 /* AF_INET6+SOCK_STREAM
234 * AF_PACKET+SOCK_RAW
235 * AF_UNIX+SOCK_RAW if already have non-bpf lsms installed
236 * listen_fd
237 * client_fd
238 * accepted_fd
239 */
240 if (skel->kconfig->CONFIG_SECURITY_APPARMOR
241 || skel->kconfig->CONFIG_SECURITY_SELINUX
242 || skel->kconfig->CONFIG_SECURITY_SMACK)
243 /* AF_UNIX+SOCK_RAW if already have non-bpf lsms installed */
244 ASSERT_EQ(skel->bss->called_socket_post_create2, 6, "called_create2");
245 else
246 ASSERT_EQ(skel->bss->called_socket_post_create2, 5, "called_create2");
247
248 /* start_server
249 * bind(ETH_P_ALL)
250 */
251 ASSERT_EQ(skel->bss->called_socket_bind2, 2, "called_bind2");
252 /* Single accept(). */
253 ASSERT_EQ(skel->bss->called_socket_clone, 1, "called_clone");
254
255 /* AF_UNIX+SOCK_STREAM (failed)
256 * AF_INET6+SOCK_STREAM
257 * AF_PACKET+SOCK_RAW (failed)
258 * AF_PACKET+SOCK_RAW
259 * listen_fd
260 * client_fd
261 * accepted_fd
262 */
263 ASSERT_EQ(skel->bss->called_socket_alloc, 7, "called_alloc");
264
265 close(listen_fd);
266 close(client_fd);
267 close(accepted_fd);
268
269 /* Make sure other cgroup doesn't trigger the programs. */
270
271 if (!ASSERT_OK(join_cgroup("/sock_policy_empty"), "join root cgroup"))
272 goto detach_cgroup;
273
274 fd = socket(AF_INET6, SOCK_STREAM, 0);
275 if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)"))
276 goto detach_cgroup;
277
278 prio = 0;
279 socklen = sizeof(prio);
280 ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
281 "getsockopt");
282 ASSERT_EQ(prio, 0, "sk_priority");
283
284 close(fd);
285
286detach_cgroup:
287 ASSERT_GE(bpf_prog_detach2(post_create_prog_fd2, cgroup_fd,
288 BPF_LSM_CGROUP), 0, "detach_create");
289 close(bind_link_fd);
290 /* Don't close bind_link_fd2, exercise cgroup release cleanup. */
291 ASSERT_GE(bpf_prog_detach2(alloc_prog_fd, cgroup_fd,
292 BPF_LSM_CGROUP), 0, "detach_alloc");
293 ASSERT_GE(bpf_prog_detach2(clone_prog_fd, cgroup_fd,
294 BPF_LSM_CGROUP), 0, "detach_clone");
295
296close_cgroup:
297 close(cgroup_fd);
298 close(cgroup_fd2);
299 close(cgroup_fd3);
300 lsm_cgroup__destroy(skel);
301}
302
303static void test_lsm_cgroup_nonvoid(void)
304{
305 struct lsm_cgroup_nonvoid *skel = NULL;
306
307 skel = lsm_cgroup_nonvoid__open_and_load();
308 ASSERT_NULL(skel, "open succeeds");
309 lsm_cgroup_nonvoid__destroy(skel);
310}
311
312void test_lsm_cgroup(void)
313{
314 if (test__start_subtest("functional"))
315 test_lsm_cgroup_functional();
316 if (test__start_subtest("nonvoid"))
317 test_lsm_cgroup_nonvoid();
318 btf__free(btf);
319}
1// SPDX-License-Identifier: GPL-2.0
2
3#include <sys/types.h>
4#include <sys/socket.h>
5#include <test_progs.h>
6#include <bpf/btf.h>
7
8#include "lsm_cgroup.skel.h"
9#include "lsm_cgroup_nonvoid.skel.h"
10#include "cgroup_helpers.h"
11#include "network_helpers.h"
12
13#ifndef ENOTSUPP
14#define ENOTSUPP 524
15#endif
16
17static struct btf *btf;
18
19static __u32 query_prog_cnt(int cgroup_fd, const char *attach_func)
20{
21 LIBBPF_OPTS(bpf_prog_query_opts, p);
22 int cnt = 0;
23 int i;
24
25 ASSERT_OK(bpf_prog_query_opts(cgroup_fd, BPF_LSM_CGROUP, &p), "prog_query");
26
27 if (!attach_func)
28 return p.prog_cnt;
29
30 /* When attach_func is provided, count the number of progs that
31 * attach to the given symbol.
32 */
33
34 if (!btf)
35 btf = btf__load_vmlinux_btf();
36 if (!ASSERT_OK(libbpf_get_error(btf), "btf_vmlinux"))
37 return -1;
38
39 p.prog_ids = malloc(sizeof(u32) * p.prog_cnt);
40 p.prog_attach_flags = malloc(sizeof(u32) * p.prog_cnt);
41 ASSERT_OK(bpf_prog_query_opts(cgroup_fd, BPF_LSM_CGROUP, &p), "prog_query");
42
43 for (i = 0; i < p.prog_cnt; i++) {
44 struct bpf_prog_info info = {};
45 __u32 info_len = sizeof(info);
46 int fd;
47
48 fd = bpf_prog_get_fd_by_id(p.prog_ids[i]);
49 ASSERT_GE(fd, 0, "prog_get_fd_by_id");
50 ASSERT_OK(bpf_prog_get_info_by_fd(fd, &info, &info_len),
51 "prog_info_by_fd");
52 close(fd);
53
54 if (info.attach_btf_id ==
55 btf__find_by_name_kind(btf, attach_func, BTF_KIND_FUNC))
56 cnt++;
57 }
58
59 free(p.prog_ids);
60 free(p.prog_attach_flags);
61
62 return cnt;
63}
64
65static void test_lsm_cgroup_functional(void)
66{
67 DECLARE_LIBBPF_OPTS(bpf_prog_attach_opts, attach_opts);
68 DECLARE_LIBBPF_OPTS(bpf_link_update_opts, update_opts);
69 int cgroup_fd = -1, cgroup_fd2 = -1, cgroup_fd3 = -1;
70 int listen_fd, client_fd, accepted_fd;
71 struct lsm_cgroup *skel = NULL;
72 int post_create_prog_fd2 = -1;
73 int post_create_prog_fd = -1;
74 int bind_link_fd2 = -1;
75 int bind_prog_fd2 = -1;
76 int alloc_prog_fd = -1;
77 int bind_prog_fd = -1;
78 int bind_link_fd = -1;
79 int clone_prog_fd = -1;
80 int err, fd, prio;
81 socklen_t socklen;
82
83 cgroup_fd3 = test__join_cgroup("/sock_policy_empty");
84 if (!ASSERT_GE(cgroup_fd3, 0, "create empty cgroup"))
85 goto close_cgroup;
86
87 cgroup_fd2 = test__join_cgroup("/sock_policy_reuse");
88 if (!ASSERT_GE(cgroup_fd2, 0, "create cgroup for reuse"))
89 goto close_cgroup;
90
91 cgroup_fd = test__join_cgroup("/sock_policy");
92 if (!ASSERT_GE(cgroup_fd, 0, "join_cgroup"))
93 goto close_cgroup;
94
95 skel = lsm_cgroup__open_and_load();
96 if (!ASSERT_OK_PTR(skel, "open_and_load"))
97 goto close_cgroup;
98
99 post_create_prog_fd = bpf_program__fd(skel->progs.socket_post_create);
100 post_create_prog_fd2 = bpf_program__fd(skel->progs.socket_post_create2);
101 bind_prog_fd = bpf_program__fd(skel->progs.socket_bind);
102 bind_prog_fd2 = bpf_program__fd(skel->progs.socket_bind2);
103 alloc_prog_fd = bpf_program__fd(skel->progs.socket_alloc);
104 clone_prog_fd = bpf_program__fd(skel->progs.socket_clone);
105
106 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_sk_alloc_security"), 0, "prog count");
107 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 0, "total prog count");
108 err = bpf_prog_attach(alloc_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0);
109 if (err == -ENOTSUPP) {
110 test__skip();
111 goto close_cgroup;
112 }
113 if (!ASSERT_OK(err, "attach alloc_prog_fd"))
114 goto detach_cgroup;
115 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_sk_alloc_security"), 1, "prog count");
116 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 1, "total prog count");
117
118 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_inet_csk_clone"), 0, "prog count");
119 err = bpf_prog_attach(clone_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0);
120 if (!ASSERT_OK(err, "attach clone_prog_fd"))
121 goto detach_cgroup;
122 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_inet_csk_clone"), 1, "prog count");
123 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 2, "total prog count");
124
125 /* Make sure replacing works. */
126
127 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 0, "prog count");
128 err = bpf_prog_attach(post_create_prog_fd, cgroup_fd,
129 BPF_LSM_CGROUP, 0);
130 if (!ASSERT_OK(err, "attach post_create_prog_fd"))
131 goto detach_cgroup;
132 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 1, "prog count");
133 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 3, "total prog count");
134
135 attach_opts.replace_prog_fd = post_create_prog_fd;
136 err = bpf_prog_attach_opts(post_create_prog_fd2, cgroup_fd,
137 BPF_LSM_CGROUP, &attach_opts);
138 if (!ASSERT_OK(err, "prog replace post_create_prog_fd"))
139 goto detach_cgroup;
140 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 1, "prog count");
141 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 3, "total prog count");
142
143 /* Try the same attach/replace via link API. */
144
145 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 0, "prog count");
146 bind_link_fd = bpf_link_create(bind_prog_fd, cgroup_fd,
147 BPF_LSM_CGROUP, NULL);
148 if (!ASSERT_GE(bind_link_fd, 0, "link create bind_prog_fd"))
149 goto detach_cgroup;
150 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count");
151 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
152
153 update_opts.old_prog_fd = bind_prog_fd;
154 update_opts.flags = BPF_F_REPLACE;
155
156 err = bpf_link_update(bind_link_fd, bind_prog_fd2, &update_opts);
157 if (!ASSERT_OK(err, "link update bind_prog_fd"))
158 goto detach_cgroup;
159 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count");
160 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
161
162 /* Attach another instance of bind program to another cgroup.
163 * This should trigger the reuse of the trampoline shim (two
164 * programs attaching to the same btf_id).
165 */
166
167 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count");
168 ASSERT_EQ(query_prog_cnt(cgroup_fd2, "bpf_lsm_socket_bind"), 0, "prog count");
169 bind_link_fd2 = bpf_link_create(bind_prog_fd2, cgroup_fd2,
170 BPF_LSM_CGROUP, NULL);
171 if (!ASSERT_GE(bind_link_fd2, 0, "link create bind_prog_fd2"))
172 goto detach_cgroup;
173 ASSERT_EQ(query_prog_cnt(cgroup_fd2, "bpf_lsm_socket_bind"), 1, "prog count");
174 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
175 ASSERT_EQ(query_prog_cnt(cgroup_fd2, NULL), 1, "total prog count");
176
177 fd = socket(AF_UNIX, SOCK_STREAM, 0);
178 if (!(skel->kconfig->CONFIG_SECURITY_APPARMOR
179 || skel->kconfig->CONFIG_SECURITY_SELINUX
180 || skel->kconfig->CONFIG_SECURITY_SMACK))
181 /* AF_UNIX is prohibited. */
182 ASSERT_LT(fd, 0, "socket(AF_UNIX)");
183 close(fd);
184
185 /* AF_INET6 gets default policy (sk_priority). */
186
187 fd = socket(AF_INET6, SOCK_STREAM, 0);
188 if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)"))
189 goto detach_cgroup;
190
191 prio = 0;
192 socklen = sizeof(prio);
193 ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
194 "getsockopt");
195 ASSERT_EQ(prio, 123, "sk_priority");
196
197 close(fd);
198
199 /* TX-only AF_PACKET is allowed. */
200
201 ASSERT_LT(socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)), 0,
202 "socket(AF_PACKET, ..., ETH_P_ALL)");
203
204 fd = socket(AF_PACKET, SOCK_RAW, 0);
205 ASSERT_GE(fd, 0, "socket(AF_PACKET, ..., 0)");
206
207 /* TX-only AF_PACKET can not be rebound. */
208
209 struct sockaddr_ll sa = {
210 .sll_family = AF_PACKET,
211 .sll_protocol = htons(ETH_P_ALL),
212 };
213 ASSERT_LT(bind(fd, (struct sockaddr *)&sa, sizeof(sa)), 0,
214 "bind(ETH_P_ALL)");
215
216 close(fd);
217
218 /* Trigger passive open. */
219
220 listen_fd = start_server(AF_INET6, SOCK_STREAM, "::1", 0, 0);
221 ASSERT_GE(listen_fd, 0, "start_server");
222 client_fd = connect_to_fd(listen_fd, 0);
223 ASSERT_GE(client_fd, 0, "connect_to_fd");
224 accepted_fd = accept(listen_fd, NULL, NULL);
225 ASSERT_GE(accepted_fd, 0, "accept");
226
227 prio = 0;
228 socklen = sizeof(prio);
229 ASSERT_GE(getsockopt(accepted_fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
230 "getsockopt");
231 ASSERT_EQ(prio, 234, "sk_priority");
232
233 /* These are replaced and never called. */
234 ASSERT_EQ(skel->bss->called_socket_post_create, 0, "called_create");
235 ASSERT_EQ(skel->bss->called_socket_bind, 0, "called_bind");
236
237 /* AF_INET6+SOCK_STREAM
238 * AF_PACKET+SOCK_RAW
239 * AF_UNIX+SOCK_RAW if already have non-bpf lsms installed
240 * listen_fd
241 * client_fd
242 * accepted_fd
243 */
244 if (skel->kconfig->CONFIG_SECURITY_APPARMOR
245 || skel->kconfig->CONFIG_SECURITY_SELINUX
246 || skel->kconfig->CONFIG_SECURITY_SMACK)
247 /* AF_UNIX+SOCK_RAW if already have non-bpf lsms installed */
248 ASSERT_EQ(skel->bss->called_socket_post_create2, 6, "called_create2");
249 else
250 ASSERT_EQ(skel->bss->called_socket_post_create2, 5, "called_create2");
251
252 /* start_server
253 * bind(ETH_P_ALL)
254 */
255 ASSERT_EQ(skel->bss->called_socket_bind2, 2, "called_bind2");
256 /* Single accept(). */
257 ASSERT_EQ(skel->bss->called_socket_clone, 1, "called_clone");
258
259 /* AF_UNIX+SOCK_STREAM (failed)
260 * AF_INET6+SOCK_STREAM
261 * AF_PACKET+SOCK_RAW (failed)
262 * AF_PACKET+SOCK_RAW
263 * listen_fd
264 * client_fd
265 * accepted_fd
266 */
267 ASSERT_EQ(skel->bss->called_socket_alloc, 7, "called_alloc");
268
269 close(listen_fd);
270 close(client_fd);
271 close(accepted_fd);
272
273 /* Make sure other cgroup doesn't trigger the programs. */
274
275 if (!ASSERT_OK(join_cgroup("/sock_policy_empty"), "join root cgroup"))
276 goto detach_cgroup;
277
278 fd = socket(AF_INET6, SOCK_STREAM, 0);
279 if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)"))
280 goto detach_cgroup;
281
282 prio = 0;
283 socklen = sizeof(prio);
284 ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
285 "getsockopt");
286 ASSERT_EQ(prio, 0, "sk_priority");
287
288 close(fd);
289
290detach_cgroup:
291 ASSERT_GE(bpf_prog_detach2(post_create_prog_fd2, cgroup_fd,
292 BPF_LSM_CGROUP), 0, "detach_create");
293 close(bind_link_fd);
294 /* Don't close bind_link_fd2, exercise cgroup release cleanup. */
295 ASSERT_GE(bpf_prog_detach2(alloc_prog_fd, cgroup_fd,
296 BPF_LSM_CGROUP), 0, "detach_alloc");
297 ASSERT_GE(bpf_prog_detach2(clone_prog_fd, cgroup_fd,
298 BPF_LSM_CGROUP), 0, "detach_clone");
299
300close_cgroup:
301 close(cgroup_fd);
302 close(cgroup_fd2);
303 close(cgroup_fd3);
304 lsm_cgroup__destroy(skel);
305}
306
307static void test_lsm_cgroup_nonvoid(void)
308{
309 struct lsm_cgroup_nonvoid *skel = NULL;
310
311 skel = lsm_cgroup_nonvoid__open_and_load();
312 ASSERT_NULL(skel, "open succeeds");
313 lsm_cgroup_nonvoid__destroy(skel);
314}
315
316void test_lsm_cgroup(void)
317{
318 if (test__start_subtest("functional"))
319 test_lsm_cgroup_functional();
320 if (test__start_subtest("nonvoid"))
321 test_lsm_cgroup_nonvoid();
322 btf__free(btf);
323}