Loading...
1// SPDX-License-Identifier: GPL-2.0
2
3/*
4 * Copyright (C) 2020 Google LLC.
5 */
6
7#include <test_progs.h>
8#include <sys/mman.h>
9#include <sys/wait.h>
10#include <unistd.h>
11#include <malloc.h>
12#include <stdlib.h>
13
14#include "lsm.skel.h"
15#include "lsm_tailcall.skel.h"
16
17char *CMD_ARGS[] = {"true", NULL};
18
19#define GET_PAGE_ADDR(ADDR, PAGE_SIZE) \
20 (char *)(((unsigned long) (ADDR + PAGE_SIZE)) & ~(PAGE_SIZE-1))
21
22int stack_mprotect(void)
23{
24 void *buf;
25 long sz;
26 int ret;
27
28 sz = sysconf(_SC_PAGESIZE);
29 if (sz < 0)
30 return sz;
31
32 buf = alloca(sz * 3);
33 ret = mprotect(GET_PAGE_ADDR(buf, sz), sz,
34 PROT_READ | PROT_WRITE | PROT_EXEC);
35 return ret;
36}
37
38int exec_cmd(int *monitored_pid)
39{
40 int child_pid, child_status;
41
42 child_pid = fork();
43 if (child_pid == 0) {
44 *monitored_pid = getpid();
45 execvp(CMD_ARGS[0], CMD_ARGS);
46 return -EINVAL;
47 } else if (child_pid > 0) {
48 waitpid(child_pid, &child_status, 0);
49 return child_status;
50 }
51
52 return -EINVAL;
53}
54
55static int test_lsm(struct lsm *skel)
56{
57 struct bpf_link *link;
58 int buf = 1234;
59 int err;
60
61 err = lsm__attach(skel);
62 if (!ASSERT_OK(err, "attach"))
63 return err;
64
65 /* Check that already linked program can't be attached again. */
66 link = bpf_program__attach(skel->progs.test_int_hook);
67 if (!ASSERT_ERR_PTR(link, "attach_link"))
68 return -1;
69
70 err = exec_cmd(&skel->bss->monitored_pid);
71 if (!ASSERT_OK(err, "exec_cmd"))
72 return err;
73
74 ASSERT_EQ(skel->bss->bprm_count, 1, "bprm_count");
75
76 skel->bss->monitored_pid = getpid();
77
78 err = stack_mprotect();
79 if (!ASSERT_EQ(err, -1, "stack_mprotect") ||
80 !ASSERT_EQ(errno, EPERM, "stack_mprotect"))
81 return err;
82
83 ASSERT_EQ(skel->bss->mprotect_count, 1, "mprotect_count");
84
85 syscall(__NR_setdomainname, &buf, -2L);
86 syscall(__NR_setdomainname, 0, -3L);
87 syscall(__NR_setdomainname, ~0L, -4L);
88
89 ASSERT_EQ(skel->bss->copy_test, 3, "copy_test");
90
91 lsm__detach(skel);
92
93 skel->bss->copy_test = 0;
94 skel->bss->bprm_count = 0;
95 skel->bss->mprotect_count = 0;
96 return 0;
97}
98
99static void test_lsm_basic(void)
100{
101 struct lsm *skel = NULL;
102 int err;
103
104 skel = lsm__open_and_load();
105 if (!ASSERT_OK_PTR(skel, "lsm_skel_load"))
106 goto close_prog;
107
108 err = test_lsm(skel);
109 if (!ASSERT_OK(err, "test_lsm_first_attach"))
110 goto close_prog;
111
112 err = test_lsm(skel);
113 ASSERT_OK(err, "test_lsm_second_attach");
114
115close_prog:
116 lsm__destroy(skel);
117}
118
119static void test_lsm_tailcall(void)
120{
121 struct lsm_tailcall *skel = NULL;
122 int map_fd, prog_fd;
123 int err, key;
124
125 skel = lsm_tailcall__open_and_load();
126 if (!ASSERT_OK_PTR(skel, "lsm_tailcall__skel_load"))
127 goto close_prog;
128
129 map_fd = bpf_map__fd(skel->maps.jmp_table);
130 if (CHECK_FAIL(map_fd < 0))
131 goto close_prog;
132
133 prog_fd = bpf_program__fd(skel->progs.lsm_file_permission_prog);
134 if (CHECK_FAIL(prog_fd < 0))
135 goto close_prog;
136
137 key = 0;
138 err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY);
139 if (CHECK_FAIL(!err))
140 goto close_prog;
141
142 prog_fd = bpf_program__fd(skel->progs.lsm_file_alloc_security_prog);
143 if (CHECK_FAIL(prog_fd < 0))
144 goto close_prog;
145
146 err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY);
147 if (CHECK_FAIL(err))
148 goto close_prog;
149
150close_prog:
151 lsm_tailcall__destroy(skel);
152}
153
154void test_test_lsm(void)
155{
156 if (test__start_subtest("lsm_basic"))
157 test_lsm_basic();
158 if (test__start_subtest("lsm_tailcall"))
159 test_lsm_tailcall();
160}
1// SPDX-License-Identifier: GPL-2.0
2
3/*
4 * Copyright (C) 2020 Google LLC.
5 */
6
7#include <test_progs.h>
8#include <sys/mman.h>
9#include <sys/wait.h>
10#include <unistd.h>
11#include <malloc.h>
12#include <stdlib.h>
13
14#include "lsm.skel.h"
15
16char *CMD_ARGS[] = {"true", NULL};
17
18#define GET_PAGE_ADDR(ADDR, PAGE_SIZE) \
19 (char *)(((unsigned long) (ADDR + PAGE_SIZE)) & ~(PAGE_SIZE-1))
20
21int stack_mprotect(void)
22{
23 void *buf;
24 long sz;
25 int ret;
26
27 sz = sysconf(_SC_PAGESIZE);
28 if (sz < 0)
29 return sz;
30
31 buf = alloca(sz * 3);
32 ret = mprotect(GET_PAGE_ADDR(buf, sz), sz,
33 PROT_READ | PROT_WRITE | PROT_EXEC);
34 return ret;
35}
36
37int exec_cmd(int *monitored_pid)
38{
39 int child_pid, child_status;
40
41 child_pid = fork();
42 if (child_pid == 0) {
43 *monitored_pid = getpid();
44 execvp(CMD_ARGS[0], CMD_ARGS);
45 return -EINVAL;
46 } else if (child_pid > 0) {
47 waitpid(child_pid, &child_status, 0);
48 return child_status;
49 }
50
51 return -EINVAL;
52}
53
54static int test_lsm(struct lsm *skel)
55{
56 struct bpf_link *link;
57 int buf = 1234;
58 int err;
59
60 err = lsm__attach(skel);
61 if (!ASSERT_OK(err, "attach"))
62 return err;
63
64 /* Check that already linked program can't be attached again. */
65 link = bpf_program__attach(skel->progs.test_int_hook);
66 if (!ASSERT_ERR_PTR(link, "attach_link"))
67 return -1;
68
69 err = exec_cmd(&skel->bss->monitored_pid);
70 if (!ASSERT_OK(err, "exec_cmd"))
71 return err;
72
73 ASSERT_EQ(skel->bss->bprm_count, 1, "bprm_count");
74
75 skel->bss->monitored_pid = getpid();
76
77 err = stack_mprotect();
78 if (!ASSERT_EQ(err, -1, "stack_mprotect") ||
79 !ASSERT_EQ(errno, EPERM, "stack_mprotect"))
80 return err;
81
82 ASSERT_EQ(skel->bss->mprotect_count, 1, "mprotect_count");
83
84 syscall(__NR_setdomainname, &buf, -2L);
85 syscall(__NR_setdomainname, 0, -3L);
86 syscall(__NR_setdomainname, ~0L, -4L);
87
88 ASSERT_EQ(skel->bss->copy_test, 3, "copy_test");
89
90 lsm__detach(skel);
91
92 skel->bss->copy_test = 0;
93 skel->bss->bprm_count = 0;
94 skel->bss->mprotect_count = 0;
95 return 0;
96}
97
98void test_test_lsm(void)
99{
100 struct lsm *skel = NULL;
101 int err;
102
103 skel = lsm__open_and_load();
104 if (!ASSERT_OK_PTR(skel, "lsm_skel_load"))
105 goto close_prog;
106
107 err = test_lsm(skel);
108 if (!ASSERT_OK(err, "test_lsm_first_attach"))
109 goto close_prog;
110
111 err = test_lsm(skel);
112 ASSERT_OK(err, "test_lsm_second_attach");
113
114close_prog:
115 lsm__destroy(skel);
116}