Loading...
Note: File does not exist in v3.5.6.
1// SPDX-License-Identifier: GPL-2.0
2
3#include <sys/types.h>
4#include <sys/socket.h>
5#include <test_progs.h>
6#include <bpf/btf.h>
7
8#include "lsm_cgroup.skel.h"
9#include "lsm_cgroup_nonvoid.skel.h"
10#include "cgroup_helpers.h"
11#include "network_helpers.h"
12
13#ifndef ENOTSUPP
14#define ENOTSUPP 524
15#endif
16
17static struct btf *btf;
18
19static __u32 query_prog_cnt(int cgroup_fd, const char *attach_func)
20{
21 LIBBPF_OPTS(bpf_prog_query_opts, p);
22 int cnt = 0;
23 int i;
24
25 ASSERT_OK(bpf_prog_query_opts(cgroup_fd, BPF_LSM_CGROUP, &p), "prog_query");
26
27 if (!attach_func)
28 return p.prog_cnt;
29
30 /* When attach_func is provided, count the number of progs that
31 * attach to the given symbol.
32 */
33
34 if (!btf)
35 btf = btf__load_vmlinux_btf();
36 if (!ASSERT_OK(libbpf_get_error(btf), "btf_vmlinux"))
37 return -1;
38
39 p.prog_ids = malloc(sizeof(u32) * p.prog_cnt);
40 p.prog_attach_flags = malloc(sizeof(u32) * p.prog_cnt);
41 ASSERT_OK(bpf_prog_query_opts(cgroup_fd, BPF_LSM_CGROUP, &p), "prog_query");
42
43 for (i = 0; i < p.prog_cnt; i++) {
44 struct bpf_prog_info info = {};
45 __u32 info_len = sizeof(info);
46 int fd;
47
48 fd = bpf_prog_get_fd_by_id(p.prog_ids[i]);
49 ASSERT_GE(fd, 0, "prog_get_fd_by_id");
50 ASSERT_OK(bpf_obj_get_info_by_fd(fd, &info, &info_len), "prog_info_by_fd");
51 close(fd);
52
53 if (info.attach_btf_id ==
54 btf__find_by_name_kind(btf, attach_func, BTF_KIND_FUNC))
55 cnt++;
56 }
57
58 free(p.prog_ids);
59 free(p.prog_attach_flags);
60
61 return cnt;
62}
63
64static void test_lsm_cgroup_functional(void)
65{
66 DECLARE_LIBBPF_OPTS(bpf_prog_attach_opts, attach_opts);
67 DECLARE_LIBBPF_OPTS(bpf_link_update_opts, update_opts);
68 int cgroup_fd = -1, cgroup_fd2 = -1, cgroup_fd3 = -1;
69 int listen_fd, client_fd, accepted_fd;
70 struct lsm_cgroup *skel = NULL;
71 int post_create_prog_fd2 = -1;
72 int post_create_prog_fd = -1;
73 int bind_link_fd2 = -1;
74 int bind_prog_fd2 = -1;
75 int alloc_prog_fd = -1;
76 int bind_prog_fd = -1;
77 int bind_link_fd = -1;
78 int clone_prog_fd = -1;
79 int err, fd, prio;
80 socklen_t socklen;
81
82 cgroup_fd3 = test__join_cgroup("/sock_policy_empty");
83 if (!ASSERT_GE(cgroup_fd3, 0, "create empty cgroup"))
84 goto close_cgroup;
85
86 cgroup_fd2 = test__join_cgroup("/sock_policy_reuse");
87 if (!ASSERT_GE(cgroup_fd2, 0, "create cgroup for reuse"))
88 goto close_cgroup;
89
90 cgroup_fd = test__join_cgroup("/sock_policy");
91 if (!ASSERT_GE(cgroup_fd, 0, "join_cgroup"))
92 goto close_cgroup;
93
94 skel = lsm_cgroup__open_and_load();
95 if (!ASSERT_OK_PTR(skel, "open_and_load"))
96 goto close_cgroup;
97
98 post_create_prog_fd = bpf_program__fd(skel->progs.socket_post_create);
99 post_create_prog_fd2 = bpf_program__fd(skel->progs.socket_post_create2);
100 bind_prog_fd = bpf_program__fd(skel->progs.socket_bind);
101 bind_prog_fd2 = bpf_program__fd(skel->progs.socket_bind2);
102 alloc_prog_fd = bpf_program__fd(skel->progs.socket_alloc);
103 clone_prog_fd = bpf_program__fd(skel->progs.socket_clone);
104
105 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_sk_alloc_security"), 0, "prog count");
106 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 0, "total prog count");
107 err = bpf_prog_attach(alloc_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0);
108 if (err == -ENOTSUPP) {
109 test__skip();
110 goto close_cgroup;
111 }
112 if (!ASSERT_OK(err, "attach alloc_prog_fd"))
113 goto detach_cgroup;
114 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_sk_alloc_security"), 1, "prog count");
115 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 1, "total prog count");
116
117 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_inet_csk_clone"), 0, "prog count");
118 err = bpf_prog_attach(clone_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0);
119 if (!ASSERT_OK(err, "attach clone_prog_fd"))
120 goto detach_cgroup;
121 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_inet_csk_clone"), 1, "prog count");
122 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 2, "total prog count");
123
124 /* Make sure replacing works. */
125
126 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 0, "prog count");
127 err = bpf_prog_attach(post_create_prog_fd, cgroup_fd,
128 BPF_LSM_CGROUP, 0);
129 if (!ASSERT_OK(err, "attach post_create_prog_fd"))
130 goto detach_cgroup;
131 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 1, "prog count");
132 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 3, "total prog count");
133
134 attach_opts.replace_prog_fd = post_create_prog_fd;
135 err = bpf_prog_attach_opts(post_create_prog_fd2, cgroup_fd,
136 BPF_LSM_CGROUP, &attach_opts);
137 if (!ASSERT_OK(err, "prog replace post_create_prog_fd"))
138 goto detach_cgroup;
139 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 1, "prog count");
140 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 3, "total prog count");
141
142 /* Try the same attach/replace via link API. */
143
144 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 0, "prog count");
145 bind_link_fd = bpf_link_create(bind_prog_fd, cgroup_fd,
146 BPF_LSM_CGROUP, NULL);
147 if (!ASSERT_GE(bind_link_fd, 0, "link create bind_prog_fd"))
148 goto detach_cgroup;
149 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count");
150 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
151
152 update_opts.old_prog_fd = bind_prog_fd;
153 update_opts.flags = BPF_F_REPLACE;
154
155 err = bpf_link_update(bind_link_fd, bind_prog_fd2, &update_opts);
156 if (!ASSERT_OK(err, "link update bind_prog_fd"))
157 goto detach_cgroup;
158 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count");
159 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
160
161 /* Attach another instance of bind program to another cgroup.
162 * This should trigger the reuse of the trampoline shim (two
163 * programs attaching to the same btf_id).
164 */
165
166 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count");
167 ASSERT_EQ(query_prog_cnt(cgroup_fd2, "bpf_lsm_socket_bind"), 0, "prog count");
168 bind_link_fd2 = bpf_link_create(bind_prog_fd2, cgroup_fd2,
169 BPF_LSM_CGROUP, NULL);
170 if (!ASSERT_GE(bind_link_fd2, 0, "link create bind_prog_fd2"))
171 goto detach_cgroup;
172 ASSERT_EQ(query_prog_cnt(cgroup_fd2, "bpf_lsm_socket_bind"), 1, "prog count");
173 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
174 ASSERT_EQ(query_prog_cnt(cgroup_fd2, NULL), 1, "total prog count");
175
176 fd = socket(AF_UNIX, SOCK_STREAM, 0);
177 if (!(skel->kconfig->CONFIG_SECURITY_APPARMOR
178 || skel->kconfig->CONFIG_SECURITY_SELINUX
179 || skel->kconfig->CONFIG_SECURITY_SMACK))
180 /* AF_UNIX is prohibited. */
181 ASSERT_LT(fd, 0, "socket(AF_UNIX)");
182 close(fd);
183
184 /* AF_INET6 gets default policy (sk_priority). */
185
186 fd = socket(AF_INET6, SOCK_STREAM, 0);
187 if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)"))
188 goto detach_cgroup;
189
190 prio = 0;
191 socklen = sizeof(prio);
192 ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
193 "getsockopt");
194 ASSERT_EQ(prio, 123, "sk_priority");
195
196 close(fd);
197
198 /* TX-only AF_PACKET is allowed. */
199
200 ASSERT_LT(socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)), 0,
201 "socket(AF_PACKET, ..., ETH_P_ALL)");
202
203 fd = socket(AF_PACKET, SOCK_RAW, 0);
204 ASSERT_GE(fd, 0, "socket(AF_PACKET, ..., 0)");
205
206 /* TX-only AF_PACKET can not be rebound. */
207
208 struct sockaddr_ll sa = {
209 .sll_family = AF_PACKET,
210 .sll_protocol = htons(ETH_P_ALL),
211 };
212 ASSERT_LT(bind(fd, (struct sockaddr *)&sa, sizeof(sa)), 0,
213 "bind(ETH_P_ALL)");
214
215 close(fd);
216
217 /* Trigger passive open. */
218
219 listen_fd = start_server(AF_INET6, SOCK_STREAM, "::1", 0, 0);
220 ASSERT_GE(listen_fd, 0, "start_server");
221 client_fd = connect_to_fd(listen_fd, 0);
222 ASSERT_GE(client_fd, 0, "connect_to_fd");
223 accepted_fd = accept(listen_fd, NULL, NULL);
224 ASSERT_GE(accepted_fd, 0, "accept");
225
226 prio = 0;
227 socklen = sizeof(prio);
228 ASSERT_GE(getsockopt(accepted_fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
229 "getsockopt");
230 ASSERT_EQ(prio, 234, "sk_priority");
231
232 /* These are replaced and never called. */
233 ASSERT_EQ(skel->bss->called_socket_post_create, 0, "called_create");
234 ASSERT_EQ(skel->bss->called_socket_bind, 0, "called_bind");
235
236 /* AF_INET6+SOCK_STREAM
237 * AF_PACKET+SOCK_RAW
238 * AF_UNIX+SOCK_RAW if already have non-bpf lsms installed
239 * listen_fd
240 * client_fd
241 * accepted_fd
242 */
243 if (skel->kconfig->CONFIG_SECURITY_APPARMOR
244 || skel->kconfig->CONFIG_SECURITY_SELINUX
245 || skel->kconfig->CONFIG_SECURITY_SMACK)
246 /* AF_UNIX+SOCK_RAW if already have non-bpf lsms installed */
247 ASSERT_EQ(skel->bss->called_socket_post_create2, 6, "called_create2");
248 else
249 ASSERT_EQ(skel->bss->called_socket_post_create2, 5, "called_create2");
250
251 /* start_server
252 * bind(ETH_P_ALL)
253 */
254 ASSERT_EQ(skel->bss->called_socket_bind2, 2, "called_bind2");
255 /* Single accept(). */
256 ASSERT_EQ(skel->bss->called_socket_clone, 1, "called_clone");
257
258 /* AF_UNIX+SOCK_STREAM (failed)
259 * AF_INET6+SOCK_STREAM
260 * AF_PACKET+SOCK_RAW (failed)
261 * AF_PACKET+SOCK_RAW
262 * listen_fd
263 * client_fd
264 * accepted_fd
265 */
266 ASSERT_EQ(skel->bss->called_socket_alloc, 7, "called_alloc");
267
268 close(listen_fd);
269 close(client_fd);
270 close(accepted_fd);
271
272 /* Make sure other cgroup doesn't trigger the programs. */
273
274 if (!ASSERT_OK(join_cgroup("/sock_policy_empty"), "join root cgroup"))
275 goto detach_cgroup;
276
277 fd = socket(AF_INET6, SOCK_STREAM, 0);
278 if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)"))
279 goto detach_cgroup;
280
281 prio = 0;
282 socklen = sizeof(prio);
283 ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
284 "getsockopt");
285 ASSERT_EQ(prio, 0, "sk_priority");
286
287 close(fd);
288
289detach_cgroup:
290 ASSERT_GE(bpf_prog_detach2(post_create_prog_fd2, cgroup_fd,
291 BPF_LSM_CGROUP), 0, "detach_create");
292 close(bind_link_fd);
293 /* Don't close bind_link_fd2, exercise cgroup release cleanup. */
294 ASSERT_GE(bpf_prog_detach2(alloc_prog_fd, cgroup_fd,
295 BPF_LSM_CGROUP), 0, "detach_alloc");
296 ASSERT_GE(bpf_prog_detach2(clone_prog_fd, cgroup_fd,
297 BPF_LSM_CGROUP), 0, "detach_clone");
298
299close_cgroup:
300 close(cgroup_fd);
301 close(cgroup_fd2);
302 close(cgroup_fd3);
303 lsm_cgroup__destroy(skel);
304}
305
306static void test_lsm_cgroup_nonvoid(void)
307{
308 struct lsm_cgroup_nonvoid *skel = NULL;
309
310 skel = lsm_cgroup_nonvoid__open_and_load();
311 ASSERT_NULL(skel, "open succeeds");
312 lsm_cgroup_nonvoid__destroy(skel);
313}
314
315void test_lsm_cgroup(void)
316{
317 if (test__start_subtest("functional"))
318 test_lsm_cgroup_functional();
319 if (test__start_subtest("nonvoid"))
320 test_lsm_cgroup_nonvoid();
321 btf__free(btf);
322}