1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */ 3 #define _GNU_SOURCE 4 #include <test_progs.h> 5 #include <bpf/btf.h> 6 #include "cap_helpers.h" 7 #include <fcntl.h> 8 #include <sched.h> 9 #include <signal.h> 10 #include <unistd.h> 11 #include <linux/filter.h> 12 #include <linux/unistd.h> 13 #include <linux/mount.h> 14 #include <sys/socket.h> 15 #include <sys/stat.h> 16 #include <sys/syscall.h> 17 #include <sys/un.h> 18 #include "priv_map.skel.h" 19 #include "priv_prog.skel.h" 20 #include "dummy_st_ops_success.skel.h" 21 #include "token_lsm.skel.h" 22 #include "priv_freplace_prog.skel.h" 23 24 static inline int sys_mount(const char *dev_name, const char *dir_name, 25 const char *type, unsigned long flags, 26 const void *data) 27 { 28 return syscall(__NR_mount, dev_name, dir_name, type, flags, data); 29 } 30 31 static inline int sys_fsopen(const char *fsname, unsigned flags) 32 { 33 return syscall(__NR_fsopen, fsname, flags); 34 } 35 36 static inline int sys_fspick(int dfd, const char *path, unsigned flags) 37 { 38 return syscall(__NR_fspick, dfd, path, flags); 39 } 40 41 static inline int sys_fsconfig(int fs_fd, unsigned cmd, const char *key, const void *val, int aux) 42 { 43 return syscall(__NR_fsconfig, fs_fd, cmd, key, val, aux); 44 } 45 46 static inline int sys_fsmount(int fs_fd, unsigned flags, unsigned ms_flags) 47 { 48 return syscall(__NR_fsmount, fs_fd, flags, ms_flags); 49 } 50 51 static inline int sys_move_mount(int from_dfd, const char *from_path, 52 int to_dfd, const char *to_path, 53 unsigned flags) 54 { 55 return syscall(__NR_move_mount, from_dfd, from_path, to_dfd, to_path, flags); 56 } 57 58 static int drop_priv_caps(__u64 *old_caps) 59 { 60 return cap_disable_effective((1ULL << CAP_BPF) | 61 (1ULL << CAP_PERFMON) | 62 (1ULL << CAP_NET_ADMIN) | 63 (1ULL << CAP_SYS_ADMIN), old_caps); 64 } 65 66 static int restore_priv_caps(__u64 old_caps) 67 { 68 return cap_enable_effective(old_caps, NULL); 69 } 70 71 static int set_delegate_mask(int fs_fd, const char *key, __u64 mask, const char *mask_str) 72 { 73 char buf[32]; 74 int err; 75 76 if (!mask_str) { 77 if (mask == ~0ULL) { 78 mask_str = "any"; 79 } else { 80 snprintf(buf, sizeof(buf), "0x%llx", (unsigned long long)mask); 81 mask_str = buf; 82 } 83 } 84 85 err = sys_fsconfig(fs_fd, FSCONFIG_SET_STRING, key, 86 mask_str, 0); 87 if (err < 0) 88 err = -errno; 89 return err; 90 } 91 92 #define zclose(fd) do { if (fd >= 0) close(fd); fd = -1; } while (0) 93 94 struct bpffs_opts { 95 __u64 cmds; 96 __u64 maps; 97 __u64 progs; 98 __u64 attachs; 99 const char *cmds_str; 100 const char *maps_str; 101 const char *progs_str; 102 const char *attachs_str; 103 }; 104 105 static int create_bpffs_fd(void) 106 { 107 int fs_fd; 108 109 /* create VFS context */ 110 fs_fd = sys_fsopen("bpf", 0); 111 ASSERT_GE(fs_fd, 0, "fs_fd"); 112 113 return fs_fd; 114 } 115 116 static int materialize_bpffs_fd(int fs_fd, struct bpffs_opts *opts) 117 { 118 int mnt_fd, err; 119 120 /* set up token delegation mount options */ 121 err = set_delegate_mask(fs_fd, "delegate_cmds", opts->cmds, opts->cmds_str); 122 if (!ASSERT_OK(err, "fs_cfg_cmds")) 123 return err; 124 err = set_delegate_mask(fs_fd, "delegate_maps", opts->maps, opts->maps_str); 125 if (!ASSERT_OK(err, "fs_cfg_maps")) 126 return err; 127 err = set_delegate_mask(fs_fd, "delegate_progs", opts->progs, opts->progs_str); 128 if (!ASSERT_OK(err, "fs_cfg_progs")) 129 return err; 130 err = set_delegate_mask(fs_fd, "delegate_attachs", opts->attachs, opts->attachs_str); 131 if (!ASSERT_OK(err, "fs_cfg_attachs")) 132 return err; 133 134 /* instantiate FS object */ 135 err = sys_fsconfig(fs_fd, FSCONFIG_CMD_CREATE, NULL, NULL, 0); 136 if (err < 0) 137 return -errno; 138 139 /* create O_PATH fd for detached mount */ 140 mnt_fd = sys_fsmount(fs_fd, 0, 0); 141 if (err < 0) 142 return -errno; 143 144 return mnt_fd; 145 } 146 147 /* send FD over Unix domain (AF_UNIX) socket */ 148 static int sendfd(int sockfd, int fd) 149 { 150 struct msghdr msg = {}; 151 struct cmsghdr *cmsg; 152 int fds[1] = { fd }, err; 153 char iobuf[1]; 154 struct iovec io = { 155 .iov_base = iobuf, 156 .iov_len = sizeof(iobuf), 157 }; 158 union { 159 char buf[CMSG_SPACE(sizeof(fds))]; 160 struct cmsghdr align; 161 } u; 162 163 msg.msg_iov = &io; 164 msg.msg_iovlen = 1; 165 msg.msg_control = u.buf; 166 msg.msg_controllen = sizeof(u.buf); 167 cmsg = CMSG_FIRSTHDR(&msg); 168 cmsg->cmsg_level = SOL_SOCKET; 169 cmsg->cmsg_type = SCM_RIGHTS; 170 cmsg->cmsg_len = CMSG_LEN(sizeof(fds)); 171 memcpy(CMSG_DATA(cmsg), fds, sizeof(fds)); 172 173 err = sendmsg(sockfd, &msg, 0); 174 if (err < 0) 175 err = -errno; 176 if (!ASSERT_EQ(err, 1, "sendmsg")) 177 return -EINVAL; 178 179 return 0; 180 } 181 182 /* receive FD over Unix domain (AF_UNIX) socket */ 183 static int recvfd(int sockfd, int *fd) 184 { 185 struct msghdr msg = {}; 186 struct cmsghdr *cmsg; 187 int fds[1], err; 188 char iobuf[1]; 189 struct iovec io = { 190 .iov_base = iobuf, 191 .iov_len = sizeof(iobuf), 192 }; 193 union { 194 char buf[CMSG_SPACE(sizeof(fds))]; 195 struct cmsghdr align; 196 } u; 197 198 msg.msg_iov = &io; 199 msg.msg_iovlen = 1; 200 msg.msg_control = u.buf; 201 msg.msg_controllen = sizeof(u.buf); 202 203 err = recvmsg(sockfd, &msg, 0); 204 if (err < 0) 205 err = -errno; 206 if (!ASSERT_EQ(err, 1, "recvmsg")) 207 return -EINVAL; 208 209 cmsg = CMSG_FIRSTHDR(&msg); 210 if (!ASSERT_OK_PTR(cmsg, "cmsg_null") || 211 !ASSERT_EQ(cmsg->cmsg_len, CMSG_LEN(sizeof(fds)), "cmsg_len") || 212 !ASSERT_EQ(cmsg->cmsg_level, SOL_SOCKET, "cmsg_level") || 213 !ASSERT_EQ(cmsg->cmsg_type, SCM_RIGHTS, "cmsg_type")) 214 return -EINVAL; 215 216 memcpy(fds, CMSG_DATA(cmsg), sizeof(fds)); 217 *fd = fds[0]; 218 219 return 0; 220 } 221 222 static ssize_t write_nointr(int fd, const void *buf, size_t count) 223 { 224 ssize_t ret; 225 226 do { 227 ret = write(fd, buf, count); 228 } while (ret < 0 && errno == EINTR); 229 230 return ret; 231 } 232 233 static int write_file(const char *path, const void *buf, size_t count) 234 { 235 int fd; 236 ssize_t ret; 237 238 fd = open(path, O_WRONLY | O_CLOEXEC | O_NOCTTY | O_NOFOLLOW); 239 if (fd < 0) 240 return -1; 241 242 ret = write_nointr(fd, buf, count); 243 close(fd); 244 if (ret < 0 || (size_t)ret != count) 245 return -1; 246 247 return 0; 248 } 249 250 static int create_and_enter_userns(void) 251 { 252 uid_t uid; 253 gid_t gid; 254 char map[100]; 255 256 uid = getuid(); 257 gid = getgid(); 258 259 if (unshare(CLONE_NEWUSER)) 260 return -1; 261 262 if (write_file("/proc/self/setgroups", "deny", sizeof("deny") - 1) && 263 errno != ENOENT) 264 return -1; 265 266 snprintf(map, sizeof(map), "0 %d 1", uid); 267 if (write_file("/proc/self/uid_map", map, strlen(map))) 268 return -1; 269 270 271 snprintf(map, sizeof(map), "0 %d 1", gid); 272 if (write_file("/proc/self/gid_map", map, strlen(map))) 273 return -1; 274 275 if (setgid(0)) 276 return -1; 277 278 if (setuid(0)) 279 return -1; 280 281 return 0; 282 } 283 284 typedef int (*child_callback_fn)(int bpffs_fd, struct token_lsm *lsm_skel); 285 286 static void child(int sock_fd, struct bpffs_opts *opts, child_callback_fn callback) 287 { 288 int mnt_fd = -1, fs_fd = -1, err = 0, bpffs_fd = -1, token_fd = -1; 289 struct token_lsm *lsm_skel = NULL; 290 291 /* load and attach LSM "policy" before we go into unpriv userns */ 292 lsm_skel = token_lsm__open_and_load(); 293 if (!ASSERT_OK_PTR(lsm_skel, "lsm_skel_load")) { 294 err = -EINVAL; 295 goto cleanup; 296 } 297 lsm_skel->bss->my_pid = getpid(); 298 err = token_lsm__attach(lsm_skel); 299 if (!ASSERT_OK(err, "lsm_skel_attach")) 300 goto cleanup; 301 302 /* setup userns with root mappings */ 303 err = create_and_enter_userns(); 304 if (!ASSERT_OK(err, "create_and_enter_userns")) 305 goto cleanup; 306 307 /* setup mountns to allow creating BPF FS (fsopen("bpf")) from unpriv process */ 308 err = unshare(CLONE_NEWNS); 309 if (!ASSERT_OK(err, "create_mountns")) 310 goto cleanup; 311 312 err = sys_mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, 0); 313 if (!ASSERT_OK(err, "remount_root")) 314 goto cleanup; 315 316 fs_fd = create_bpffs_fd(); 317 if (!ASSERT_GE(fs_fd, 0, "create_bpffs_fd")) { 318 err = -EINVAL; 319 goto cleanup; 320 } 321 322 /* ensure unprivileged child cannot set delegation options */ 323 err = set_delegate_mask(fs_fd, "delegate_cmds", 0x1, NULL); 324 ASSERT_EQ(err, -EPERM, "delegate_cmd_eperm"); 325 err = set_delegate_mask(fs_fd, "delegate_maps", 0x1, NULL); 326 ASSERT_EQ(err, -EPERM, "delegate_maps_eperm"); 327 err = set_delegate_mask(fs_fd, "delegate_progs", 0x1, NULL); 328 ASSERT_EQ(err, -EPERM, "delegate_progs_eperm"); 329 err = set_delegate_mask(fs_fd, "delegate_attachs", 0x1, NULL); 330 ASSERT_EQ(err, -EPERM, "delegate_attachs_eperm"); 331 332 /* pass BPF FS context object to parent */ 333 err = sendfd(sock_fd, fs_fd); 334 if (!ASSERT_OK(err, "send_fs_fd")) 335 goto cleanup; 336 zclose(fs_fd); 337 338 /* avoid mucking around with mount namespaces and mounting at 339 * well-known path, just get detach-mounted BPF FS fd back from parent 340 */ 341 err = recvfd(sock_fd, &mnt_fd); 342 if (!ASSERT_OK(err, "recv_mnt_fd")) 343 goto cleanup; 344 345 /* try to fspick() BPF FS and try to add some delegation options */ 346 fs_fd = sys_fspick(mnt_fd, "", FSPICK_EMPTY_PATH); 347 if (!ASSERT_GE(fs_fd, 0, "bpffs_fspick")) { 348 err = -EINVAL; 349 goto cleanup; 350 } 351 352 /* ensure unprivileged child cannot reconfigure to set delegation options */ 353 err = set_delegate_mask(fs_fd, "delegate_cmds", 0, "any"); 354 if (!ASSERT_EQ(err, -EPERM, "delegate_cmd_eperm_reconfig")) { 355 err = -EINVAL; 356 goto cleanup; 357 } 358 err = set_delegate_mask(fs_fd, "delegate_maps", 0, "any"); 359 if (!ASSERT_EQ(err, -EPERM, "delegate_maps_eperm_reconfig")) { 360 err = -EINVAL; 361 goto cleanup; 362 } 363 err = set_delegate_mask(fs_fd, "delegate_progs", 0, "any"); 364 if (!ASSERT_EQ(err, -EPERM, "delegate_progs_eperm_reconfig")) { 365 err = -EINVAL; 366 goto cleanup; 367 } 368 err = set_delegate_mask(fs_fd, "delegate_attachs", 0, "any"); 369 if (!ASSERT_EQ(err, -EPERM, "delegate_attachs_eperm_reconfig")) { 370 err = -EINVAL; 371 goto cleanup; 372 } 373 zclose(fs_fd); 374 375 bpffs_fd = openat(mnt_fd, ".", 0, O_RDWR); 376 if (!ASSERT_GE(bpffs_fd, 0, "bpffs_open")) { 377 err = -EINVAL; 378 goto cleanup; 379 } 380 381 /* create BPF token FD and pass it to parent for some extra checks */ 382 token_fd = bpf_token_create(bpffs_fd, NULL); 383 if (!ASSERT_GT(token_fd, 0, "child_token_create")) { 384 err = -EINVAL; 385 goto cleanup; 386 } 387 err = sendfd(sock_fd, token_fd); 388 if (!ASSERT_OK(err, "send_token_fd")) 389 goto cleanup; 390 zclose(token_fd); 391 392 /* do custom test logic with customly set up BPF FS instance */ 393 err = callback(bpffs_fd, lsm_skel); 394 if (!ASSERT_OK(err, "test_callback")) 395 goto cleanup; 396 397 err = 0; 398 cleanup: 399 zclose(sock_fd); 400 zclose(mnt_fd); 401 zclose(fs_fd); 402 zclose(bpffs_fd); 403 zclose(token_fd); 404 405 lsm_skel->bss->my_pid = 0; 406 token_lsm__destroy(lsm_skel); 407 408 exit(-err); 409 } 410 411 static int wait_for_pid(pid_t pid) 412 { 413 int status, ret; 414 415 again: 416 ret = waitpid(pid, &status, 0); 417 if (ret == -1) { 418 if (errno == EINTR) 419 goto again; 420 421 return -1; 422 } 423 424 if (!WIFEXITED(status)) 425 return -1; 426 427 return WEXITSTATUS(status); 428 } 429 430 static void parent(int child_pid, struct bpffs_opts *bpffs_opts, int sock_fd) 431 { 432 int fs_fd = -1, mnt_fd = -1, token_fd = -1, err; 433 434 err = recvfd(sock_fd, &fs_fd); 435 if (!ASSERT_OK(err, "recv_bpffs_fd")) 436 goto cleanup; 437 438 mnt_fd = materialize_bpffs_fd(fs_fd, bpffs_opts); 439 if (!ASSERT_GE(mnt_fd, 0, "materialize_bpffs_fd")) { 440 err = -EINVAL; 441 goto cleanup; 442 } 443 zclose(fs_fd); 444 445 /* pass BPF FS context object to parent */ 446 err = sendfd(sock_fd, mnt_fd); 447 if (!ASSERT_OK(err, "send_mnt_fd")) 448 goto cleanup; 449 zclose(mnt_fd); 450 451 /* receive BPF token FD back from child for some extra tests */ 452 err = recvfd(sock_fd, &token_fd); 453 if (!ASSERT_OK(err, "recv_token_fd")) 454 goto cleanup; 455 456 err = wait_for_pid(child_pid); 457 ASSERT_OK(err, "waitpid_child"); 458 459 cleanup: 460 zclose(sock_fd); 461 zclose(fs_fd); 462 zclose(mnt_fd); 463 zclose(token_fd); 464 465 if (child_pid > 0) 466 (void)kill(child_pid, SIGKILL); 467 } 468 469 static void subtest_userns(struct bpffs_opts *bpffs_opts, 470 child_callback_fn child_cb) 471 { 472 int sock_fds[2] = { -1, -1 }; 473 int child_pid = 0, err; 474 475 err = socketpair(AF_UNIX, SOCK_STREAM, 0, sock_fds); 476 if (!ASSERT_OK(err, "socketpair")) 477 goto cleanup; 478 479 child_pid = fork(); 480 if (!ASSERT_GE(child_pid, 0, "fork")) 481 goto cleanup; 482 483 if (child_pid == 0) { 484 zclose(sock_fds[0]); 485 return child(sock_fds[1], bpffs_opts, child_cb); 486 487 } else { 488 zclose(sock_fds[1]); 489 return parent(child_pid, bpffs_opts, sock_fds[0]); 490 } 491 492 cleanup: 493 zclose(sock_fds[0]); 494 zclose(sock_fds[1]); 495 if (child_pid > 0) 496 (void)kill(child_pid, SIGKILL); 497 } 498 499 static int userns_map_create(int mnt_fd, struct token_lsm *lsm_skel) 500 { 501 LIBBPF_OPTS(bpf_map_create_opts, map_opts); 502 int err, token_fd = -1, map_fd = -1; 503 __u64 old_caps = 0; 504 505 /* create BPF token from BPF FS mount */ 506 token_fd = bpf_token_create(mnt_fd, NULL); 507 if (!ASSERT_GT(token_fd, 0, "token_create")) { 508 err = -EINVAL; 509 goto cleanup; 510 } 511 512 /* while inside non-init userns, we need both a BPF token *and* 513 * CAP_BPF inside current userns to create privileged map; let's test 514 * that neither BPF token alone nor namespaced CAP_BPF is sufficient 515 */ 516 err = drop_priv_caps(&old_caps); 517 if (!ASSERT_OK(err, "drop_caps")) 518 goto cleanup; 519 520 /* no token, no CAP_BPF -> fail */ 521 map_opts.map_flags = 0; 522 map_opts.token_fd = 0; 523 map_fd = bpf_map_create(BPF_MAP_TYPE_STACK, "wo_token_wo_bpf", 0, 8, 1, &map_opts); 524 if (!ASSERT_LT(map_fd, 0, "stack_map_wo_token_wo_cap_bpf_should_fail")) { 525 err = -EINVAL; 526 goto cleanup; 527 } 528 529 /* token without CAP_BPF -> fail */ 530 map_opts.map_flags = BPF_F_TOKEN_FD; 531 map_opts.token_fd = token_fd; 532 map_fd = bpf_map_create(BPF_MAP_TYPE_STACK, "w_token_wo_bpf", 0, 8, 1, &map_opts); 533 if (!ASSERT_LT(map_fd, 0, "stack_map_w_token_wo_cap_bpf_should_fail")) { 534 err = -EINVAL; 535 goto cleanup; 536 } 537 538 /* get back effective local CAP_BPF (and CAP_SYS_ADMIN) */ 539 err = restore_priv_caps(old_caps); 540 if (!ASSERT_OK(err, "restore_caps")) 541 goto cleanup; 542 543 /* CAP_BPF without token -> fail */ 544 map_opts.map_flags = 0; 545 map_opts.token_fd = 0; 546 map_fd = bpf_map_create(BPF_MAP_TYPE_STACK, "wo_token_w_bpf", 0, 8, 1, &map_opts); 547 if (!ASSERT_LT(map_fd, 0, "stack_map_wo_token_w_cap_bpf_should_fail")) { 548 err = -EINVAL; 549 goto cleanup; 550 } 551 552 /* finally, namespaced CAP_BPF + token -> success */ 553 map_opts.map_flags = BPF_F_TOKEN_FD; 554 map_opts.token_fd = token_fd; 555 map_fd = bpf_map_create(BPF_MAP_TYPE_STACK, "w_token_w_bpf", 0, 8, 1, &map_opts); 556 if (!ASSERT_GT(map_fd, 0, "stack_map_w_token_w_cap_bpf")) { 557 err = -EINVAL; 558 goto cleanup; 559 } 560 561 cleanup: 562 zclose(token_fd); 563 zclose(map_fd); 564 return err; 565 } 566 567 static int userns_btf_load(int mnt_fd, struct token_lsm *lsm_skel) 568 { 569 LIBBPF_OPTS(bpf_btf_load_opts, btf_opts); 570 int err, token_fd = -1, btf_fd = -1; 571 const void *raw_btf_data; 572 struct btf *btf = NULL; 573 __u32 raw_btf_size; 574 __u64 old_caps = 0; 575 576 /* create BPF token from BPF FS mount */ 577 token_fd = bpf_token_create(mnt_fd, NULL); 578 if (!ASSERT_GT(token_fd, 0, "token_create")) { 579 err = -EINVAL; 580 goto cleanup; 581 } 582 583 /* while inside non-init userns, we need both a BPF token *and* 584 * CAP_BPF inside current userns to create privileged map; let's test 585 * that neither BPF token alone nor namespaced CAP_BPF is sufficient 586 */ 587 err = drop_priv_caps(&old_caps); 588 if (!ASSERT_OK(err, "drop_caps")) 589 goto cleanup; 590 591 /* setup a trivial BTF data to load to the kernel */ 592 btf = btf__new_empty(); 593 if (!ASSERT_OK_PTR(btf, "empty_btf")) 594 goto cleanup; 595 596 ASSERT_GT(btf__add_int(btf, "int", 4, 0), 0, "int_type"); 597 598 raw_btf_data = btf__raw_data(btf, &raw_btf_size); 599 if (!ASSERT_OK_PTR(raw_btf_data, "raw_btf_data")) 600 goto cleanup; 601 602 /* no token + no CAP_BPF -> failure */ 603 btf_opts.btf_flags = 0; 604 btf_opts.token_fd = 0; 605 btf_fd = bpf_btf_load(raw_btf_data, raw_btf_size, &btf_opts); 606 if (!ASSERT_LT(btf_fd, 0, "no_token_no_cap_should_fail")) 607 goto cleanup; 608 609 /* token + no CAP_BPF -> failure */ 610 btf_opts.btf_flags = BPF_F_TOKEN_FD; 611 btf_opts.token_fd = token_fd; 612 btf_fd = bpf_btf_load(raw_btf_data, raw_btf_size, &btf_opts); 613 if (!ASSERT_LT(btf_fd, 0, "token_no_cap_should_fail")) 614 goto cleanup; 615 616 /* get back effective local CAP_BPF (and CAP_SYS_ADMIN) */ 617 err = restore_priv_caps(old_caps); 618 if (!ASSERT_OK(err, "restore_caps")) 619 goto cleanup; 620 621 /* token + CAP_BPF -> success */ 622 btf_opts.btf_flags = BPF_F_TOKEN_FD; 623 btf_opts.token_fd = token_fd; 624 btf_fd = bpf_btf_load(raw_btf_data, raw_btf_size, &btf_opts); 625 if (!ASSERT_GT(btf_fd, 0, "token_and_cap_success")) 626 goto cleanup; 627 628 err = 0; 629 cleanup: 630 btf__free(btf); 631 zclose(btf_fd); 632 zclose(token_fd); 633 return err; 634 } 635 636 static int userns_prog_load(int mnt_fd, struct token_lsm *lsm_skel) 637 { 638 LIBBPF_OPTS(bpf_prog_load_opts, prog_opts); 639 int err, token_fd = -1, prog_fd = -1; 640 struct bpf_insn insns[] = { 641 /* bpf_jiffies64() requires CAP_BPF */ 642 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_jiffies64), 643 /* bpf_get_current_task() requires CAP_PERFMON */ 644 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_current_task), 645 /* r0 = 0; exit; */ 646 BPF_MOV64_IMM(BPF_REG_0, 0), 647 BPF_EXIT_INSN(), 648 }; 649 size_t insn_cnt = ARRAY_SIZE(insns); 650 __u64 old_caps = 0; 651 652 /* create BPF token from BPF FS mount */ 653 token_fd = bpf_token_create(mnt_fd, NULL); 654 if (!ASSERT_GT(token_fd, 0, "token_create")) { 655 err = -EINVAL; 656 goto cleanup; 657 } 658 659 /* validate we can successfully load BPF program with token; this 660 * being XDP program (CAP_NET_ADMIN) using bpf_jiffies64() (CAP_BPF) 661 * and bpf_get_current_task() (CAP_PERFMON) helpers validates we have 662 * BPF token wired properly in a bunch of places in the kernel 663 */ 664 prog_opts.prog_flags = BPF_F_TOKEN_FD; 665 prog_opts.token_fd = token_fd; 666 prog_opts.expected_attach_type = BPF_XDP; 667 prog_fd = bpf_prog_load(BPF_PROG_TYPE_XDP, "token_prog", "GPL", 668 insns, insn_cnt, &prog_opts); 669 if (!ASSERT_GT(prog_fd, 0, "prog_fd")) { 670 err = -EPERM; 671 goto cleanup; 672 } 673 674 /* no token + caps -> failure */ 675 prog_opts.prog_flags = 0; 676 prog_opts.token_fd = 0; 677 prog_fd = bpf_prog_load(BPF_PROG_TYPE_XDP, "token_prog", "GPL", 678 insns, insn_cnt, &prog_opts); 679 if (!ASSERT_EQ(prog_fd, -EPERM, "prog_fd_eperm")) { 680 err = -EPERM; 681 goto cleanup; 682 } 683 684 err = drop_priv_caps(&old_caps); 685 if (!ASSERT_OK(err, "drop_caps")) 686 goto cleanup; 687 688 /* no caps + token -> failure */ 689 prog_opts.prog_flags = BPF_F_TOKEN_FD; 690 prog_opts.token_fd = token_fd; 691 prog_fd = bpf_prog_load(BPF_PROG_TYPE_XDP, "token_prog", "GPL", 692 insns, insn_cnt, &prog_opts); 693 if (!ASSERT_EQ(prog_fd, -EPERM, "prog_fd_eperm")) { 694 err = -EPERM; 695 goto cleanup; 696 } 697 698 /* no caps + no token -> definitely a failure */ 699 prog_opts.prog_flags = 0; 700 prog_opts.token_fd = 0; 701 prog_fd = bpf_prog_load(BPF_PROG_TYPE_XDP, "token_prog", "GPL", 702 insns, insn_cnt, &prog_opts); 703 if (!ASSERT_EQ(prog_fd, -EPERM, "prog_fd_eperm")) { 704 err = -EPERM; 705 goto cleanup; 706 } 707 708 err = 0; 709 cleanup: 710 zclose(prog_fd); 711 zclose(token_fd); 712 return err; 713 } 714 715 static int userns_obj_priv_map(int mnt_fd, struct token_lsm *lsm_skel) 716 { 717 LIBBPF_OPTS(bpf_object_open_opts, opts); 718 char buf[256]; 719 struct priv_map *skel; 720 int err; 721 722 skel = priv_map__open_and_load(); 723 if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load")) { 724 priv_map__destroy(skel); 725 return -EINVAL; 726 } 727 728 /* use bpf_token_path to provide BPF FS path */ 729 snprintf(buf, sizeof(buf), "/proc/self/fd/%d", mnt_fd); 730 opts.bpf_token_path = buf; 731 skel = priv_map__open_opts(&opts); 732 if (!ASSERT_OK_PTR(skel, "obj_token_path_open")) 733 return -EINVAL; 734 735 err = priv_map__load(skel); 736 priv_map__destroy(skel); 737 if (!ASSERT_OK(err, "obj_token_path_load")) 738 return -EINVAL; 739 740 return 0; 741 } 742 743 static int userns_obj_priv_prog(int mnt_fd, struct token_lsm *lsm_skel) 744 { 745 LIBBPF_OPTS(bpf_object_open_opts, opts); 746 char buf[256]; 747 struct priv_prog *skel; 748 int err; 749 750 skel = priv_prog__open_and_load(); 751 if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load")) { 752 priv_prog__destroy(skel); 753 return -EINVAL; 754 } 755 756 /* use bpf_token_path to provide BPF FS path */ 757 snprintf(buf, sizeof(buf), "/proc/self/fd/%d", mnt_fd); 758 opts.bpf_token_path = buf; 759 skel = priv_prog__open_opts(&opts); 760 if (!ASSERT_OK_PTR(skel, "obj_token_path_open")) 761 return -EINVAL; 762 err = priv_prog__load(skel); 763 priv_prog__destroy(skel); 764 if (!ASSERT_OK(err, "obj_token_path_load")) 765 return -EINVAL; 766 767 /* provide BPF token, but reject bpf_token_capable() with LSM */ 768 lsm_skel->bss->reject_capable = true; 769 lsm_skel->bss->reject_cmd = false; 770 skel = priv_prog__open_opts(&opts); 771 if (!ASSERT_OK_PTR(skel, "obj_token_lsm_reject_cap_open")) 772 return -EINVAL; 773 err = priv_prog__load(skel); 774 priv_prog__destroy(skel); 775 if (!ASSERT_ERR(err, "obj_token_lsm_reject_cap_load")) 776 return -EINVAL; 777 778 /* provide BPF token, but reject bpf_token_cmd() with LSM */ 779 lsm_skel->bss->reject_capable = false; 780 lsm_skel->bss->reject_cmd = true; 781 skel = priv_prog__open_opts(&opts); 782 if (!ASSERT_OK_PTR(skel, "obj_token_lsm_reject_cmd_open")) 783 return -EINVAL; 784 err = priv_prog__load(skel); 785 priv_prog__destroy(skel); 786 if (!ASSERT_ERR(err, "obj_token_lsm_reject_cmd_load")) 787 return -EINVAL; 788 789 return 0; 790 } 791 792 static int userns_obj_priv_freplace_setup(int mnt_fd, struct priv_freplace_prog **fr_skel, 793 struct priv_prog **skel, int *tgt_fd) 794 { 795 LIBBPF_OPTS(bpf_object_open_opts, opts); 796 int err; 797 char buf[256]; 798 799 /* use bpf_token_path to provide BPF FS path */ 800 snprintf(buf, sizeof(buf), "/proc/self/fd/%d", mnt_fd); 801 opts.bpf_token_path = buf; 802 *skel = priv_prog__open_opts(&opts); 803 if (!ASSERT_OK_PTR(*skel, "priv_prog__open_opts")) 804 return -EINVAL; 805 err = priv_prog__load(*skel); 806 if (!ASSERT_OK(err, "priv_prog__load")) 807 return -EINVAL; 808 809 *fr_skel = priv_freplace_prog__open_opts(&opts); 810 if (!ASSERT_OK_PTR(*skel, "priv_freplace_prog__open_opts")) 811 return -EINVAL; 812 813 *tgt_fd = bpf_program__fd((*skel)->progs.xdp_prog1); 814 return 0; 815 } 816 817 /* Verify that freplace works from user namespace, because bpf token is loaded 818 * in bpf_object__prepare 819 */ 820 static int userns_obj_priv_freplace_prog(int mnt_fd, struct token_lsm *lsm_skel) 821 { 822 struct priv_freplace_prog *fr_skel = NULL; 823 struct priv_prog *skel = NULL; 824 int err, tgt_fd; 825 826 err = userns_obj_priv_freplace_setup(mnt_fd, &fr_skel, &skel, &tgt_fd); 827 if (!ASSERT_OK(err, "setup")) 828 goto out; 829 830 err = bpf_object__prepare(fr_skel->obj); 831 if (!ASSERT_OK(err, "freplace__prepare")) 832 goto out; 833 834 err = bpf_program__set_attach_target(fr_skel->progs.new_xdp_prog2, tgt_fd, "xdp_prog1"); 835 if (!ASSERT_OK(err, "set_attach_target")) 836 goto out; 837 838 err = priv_freplace_prog__load(fr_skel); 839 ASSERT_OK(err, "priv_freplace_prog__load"); 840 841 out: 842 priv_freplace_prog__destroy(fr_skel); 843 priv_prog__destroy(skel); 844 return err; 845 } 846 847 /* Verify that replace fails to set attach target from user namespace without bpf token */ 848 static int userns_obj_priv_freplace_prog_fail(int mnt_fd, struct token_lsm *lsm_skel) 849 { 850 struct priv_freplace_prog *fr_skel = NULL; 851 struct priv_prog *skel = NULL; 852 int err, tgt_fd; 853 854 err = userns_obj_priv_freplace_setup(mnt_fd, &fr_skel, &skel, &tgt_fd); 855 if (!ASSERT_OK(err, "setup")) 856 goto out; 857 858 err = bpf_program__set_attach_target(fr_skel->progs.new_xdp_prog2, tgt_fd, "xdp_prog1"); 859 if (ASSERT_ERR(err, "attach fails")) 860 err = 0; 861 else 862 err = -EINVAL; 863 864 out: 865 priv_freplace_prog__destroy(fr_skel); 866 priv_prog__destroy(skel); 867 return err; 868 } 869 870 /* this test is called with BPF FS that doesn't delegate BPF_BTF_LOAD command, 871 * which should cause struct_ops application to fail, as BTF won't be uploaded 872 * into the kernel, even if STRUCT_OPS programs themselves are allowed 873 */ 874 static int validate_struct_ops_load(int mnt_fd, bool expect_success) 875 { 876 LIBBPF_OPTS(bpf_object_open_opts, opts); 877 char buf[256]; 878 struct dummy_st_ops_success *skel; 879 int err; 880 881 snprintf(buf, sizeof(buf), "/proc/self/fd/%d", mnt_fd); 882 opts.bpf_token_path = buf; 883 skel = dummy_st_ops_success__open_opts(&opts); 884 if (!ASSERT_OK_PTR(skel, "obj_token_path_open")) 885 return -EINVAL; 886 887 err = dummy_st_ops_success__load(skel); 888 dummy_st_ops_success__destroy(skel); 889 if (expect_success) { 890 if (!ASSERT_OK(err, "obj_token_path_load")) 891 return -EINVAL; 892 } else /* expect failure */ { 893 if (!ASSERT_ERR(err, "obj_token_path_load")) 894 return -EINVAL; 895 } 896 897 return 0; 898 } 899 900 static int userns_obj_priv_btf_fail(int mnt_fd, struct token_lsm *lsm_skel) 901 { 902 return validate_struct_ops_load(mnt_fd, false /* should fail */); 903 } 904 905 static int userns_obj_priv_btf_success(int mnt_fd, struct token_lsm *lsm_skel) 906 { 907 return validate_struct_ops_load(mnt_fd, true /* should succeed */); 908 } 909 910 static const char *token_bpffs_custom_dir() 911 { 912 return getenv("BPF_SELFTESTS_BPF_TOKEN_DIR") ?: "/tmp/bpf-token-fs"; 913 } 914 915 #define TOKEN_ENVVAR "LIBBPF_BPF_TOKEN_PATH" 916 917 static int userns_obj_priv_implicit_token(int mnt_fd, struct token_lsm *lsm_skel) 918 { 919 LIBBPF_OPTS(bpf_object_open_opts, opts); 920 struct dummy_st_ops_success *skel; 921 int err; 922 923 /* before we mount BPF FS with token delegation, struct_ops skeleton 924 * should fail to load 925 */ 926 skel = dummy_st_ops_success__open_and_load(); 927 if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load")) { 928 dummy_st_ops_success__destroy(skel); 929 return -EINVAL; 930 } 931 932 /* mount custom BPF FS over /sys/fs/bpf so that libbpf can create BPF 933 * token automatically and implicitly 934 */ 935 err = sys_move_mount(mnt_fd, "", AT_FDCWD, "/sys/fs/bpf", MOVE_MOUNT_F_EMPTY_PATH); 936 if (!ASSERT_OK(err, "move_mount_bpffs")) 937 return -EINVAL; 938 939 /* disable implicit BPF token creation by setting 940 * LIBBPF_BPF_TOKEN_PATH envvar to empty value, load should fail 941 */ 942 err = setenv(TOKEN_ENVVAR, "", 1 /*overwrite*/); 943 if (!ASSERT_OK(err, "setenv_token_path")) 944 return -EINVAL; 945 skel = dummy_st_ops_success__open_and_load(); 946 if (!ASSERT_ERR_PTR(skel, "obj_token_envvar_disabled_load")) { 947 unsetenv(TOKEN_ENVVAR); 948 dummy_st_ops_success__destroy(skel); 949 return -EINVAL; 950 } 951 unsetenv(TOKEN_ENVVAR); 952 953 /* now the same struct_ops skeleton should succeed thanks to libbpf 954 * creating BPF token from /sys/fs/bpf mount point 955 */ 956 skel = dummy_st_ops_success__open_and_load(); 957 if (!ASSERT_OK_PTR(skel, "obj_implicit_token_load")) 958 return -EINVAL; 959 960 dummy_st_ops_success__destroy(skel); 961 962 /* now disable implicit token through empty bpf_token_path, should fail */ 963 opts.bpf_token_path = ""; 964 skel = dummy_st_ops_success__open_opts(&opts); 965 if (!ASSERT_OK_PTR(skel, "obj_empty_token_path_open")) 966 return -EINVAL; 967 968 err = dummy_st_ops_success__load(skel); 969 dummy_st_ops_success__destroy(skel); 970 if (!ASSERT_ERR(err, "obj_empty_token_path_load")) 971 return -EINVAL; 972 973 return 0; 974 } 975 976 static int userns_obj_priv_implicit_token_envvar(int mnt_fd, struct token_lsm *lsm_skel) 977 { 978 const char *custom_dir = token_bpffs_custom_dir(); 979 LIBBPF_OPTS(bpf_object_open_opts, opts); 980 struct dummy_st_ops_success *skel; 981 int err; 982 983 /* before we mount BPF FS with token delegation, struct_ops skeleton 984 * should fail to load 985 */ 986 skel = dummy_st_ops_success__open_and_load(); 987 if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load")) { 988 dummy_st_ops_success__destroy(skel); 989 return -EINVAL; 990 } 991 992 /* mount custom BPF FS over custom location, so libbpf can't create 993 * BPF token implicitly, unless pointed to it through 994 * LIBBPF_BPF_TOKEN_PATH envvar 995 */ 996 rmdir(custom_dir); 997 if (!ASSERT_OK(mkdir(custom_dir, 0777), "mkdir_bpffs_custom")) 998 goto err_out; 999 err = sys_move_mount(mnt_fd, "", AT_FDCWD, custom_dir, MOVE_MOUNT_F_EMPTY_PATH); 1000 if (!ASSERT_OK(err, "move_mount_bpffs")) 1001 goto err_out; 1002 1003 /* even though we have BPF FS with delegation, it's not at default 1004 * /sys/fs/bpf location, so we still fail to load until envvar is set up 1005 */ 1006 skel = dummy_st_ops_success__open_and_load(); 1007 if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load2")) { 1008 dummy_st_ops_success__destroy(skel); 1009 goto err_out; 1010 } 1011 1012 err = setenv(TOKEN_ENVVAR, custom_dir, 1 /*overwrite*/); 1013 if (!ASSERT_OK(err, "setenv_token_path")) 1014 goto err_out; 1015 1016 /* now the same struct_ops skeleton should succeed thanks to libbpf 1017 * creating BPF token from custom mount point 1018 */ 1019 skel = dummy_st_ops_success__open_and_load(); 1020 if (!ASSERT_OK_PTR(skel, "obj_implicit_token_load")) 1021 goto err_out; 1022 1023 dummy_st_ops_success__destroy(skel); 1024 1025 /* now disable implicit token through empty bpf_token_path, envvar 1026 * will be ignored, should fail 1027 */ 1028 opts.bpf_token_path = ""; 1029 skel = dummy_st_ops_success__open_opts(&opts); 1030 if (!ASSERT_OK_PTR(skel, "obj_empty_token_path_open")) 1031 goto err_out; 1032 1033 err = dummy_st_ops_success__load(skel); 1034 dummy_st_ops_success__destroy(skel); 1035 if (!ASSERT_ERR(err, "obj_empty_token_path_load")) 1036 goto err_out; 1037 1038 rmdir(custom_dir); 1039 unsetenv(TOKEN_ENVVAR); 1040 return 0; 1041 err_out: 1042 rmdir(custom_dir); 1043 unsetenv(TOKEN_ENVVAR); 1044 return -EINVAL; 1045 } 1046 1047 #define bit(n) (1ULL << (n)) 1048 1049 void test_token(void) 1050 { 1051 if (test__start_subtest("map_token")) { 1052 struct bpffs_opts opts = { 1053 .cmds_str = "map_create", 1054 .maps_str = "stack", 1055 }; 1056 1057 subtest_userns(&opts, userns_map_create); 1058 } 1059 if (test__start_subtest("btf_token")) { 1060 struct bpffs_opts opts = { 1061 .cmds = 1ULL << BPF_BTF_LOAD, 1062 }; 1063 1064 subtest_userns(&opts, userns_btf_load); 1065 } 1066 if (test__start_subtest("prog_token")) { 1067 struct bpffs_opts opts = { 1068 .cmds_str = "PROG_LOAD", 1069 .progs_str = "XDP", 1070 .attachs_str = "xdp", 1071 }; 1072 1073 subtest_userns(&opts, userns_prog_load); 1074 } 1075 if (test__start_subtest("obj_priv_map")) { 1076 struct bpffs_opts opts = { 1077 .cmds = bit(BPF_MAP_CREATE), 1078 .maps = bit(BPF_MAP_TYPE_QUEUE), 1079 }; 1080 1081 subtest_userns(&opts, userns_obj_priv_map); 1082 } 1083 if (test__start_subtest("obj_priv_prog")) { 1084 struct bpffs_opts opts = { 1085 .cmds = bit(BPF_PROG_LOAD), 1086 .progs = bit(BPF_PROG_TYPE_XDP), 1087 .attachs = ~0ULL, 1088 }; 1089 1090 subtest_userns(&opts, userns_obj_priv_prog); 1091 } 1092 if (test__start_subtest("obj_priv_freplace_prog")) { 1093 struct bpffs_opts opts = { 1094 .cmds = bit(BPF_BTF_LOAD) | bit(BPF_PROG_LOAD) | bit(BPF_BTF_GET_FD_BY_ID), 1095 .progs = bit(BPF_PROG_TYPE_EXT) | bit(BPF_PROG_TYPE_XDP), 1096 .attachs = ~0ULL, 1097 }; 1098 subtest_userns(&opts, userns_obj_priv_freplace_prog); 1099 } 1100 if (test__start_subtest("obj_priv_freplace_prog_fail")) { 1101 struct bpffs_opts opts = { 1102 .cmds = bit(BPF_BTF_LOAD) | bit(BPF_PROG_LOAD) | bit(BPF_BTF_GET_FD_BY_ID), 1103 .progs = bit(BPF_PROG_TYPE_EXT) | bit(BPF_PROG_TYPE_XDP), 1104 .attachs = ~0ULL, 1105 }; 1106 subtest_userns(&opts, userns_obj_priv_freplace_prog_fail); 1107 } 1108 if (test__start_subtest("obj_priv_btf_fail")) { 1109 struct bpffs_opts opts = { 1110 /* disallow BTF loading */ 1111 .cmds = bit(BPF_MAP_CREATE) | bit(BPF_PROG_LOAD), 1112 .maps = bit(BPF_MAP_TYPE_STRUCT_OPS), 1113 .progs = bit(BPF_PROG_TYPE_STRUCT_OPS), 1114 .attachs = ~0ULL, 1115 }; 1116 1117 subtest_userns(&opts, userns_obj_priv_btf_fail); 1118 } 1119 if (test__start_subtest("obj_priv_btf_success")) { 1120 struct bpffs_opts opts = { 1121 /* allow BTF loading */ 1122 .cmds = bit(BPF_BTF_LOAD) | bit(BPF_MAP_CREATE) | bit(BPF_PROG_LOAD), 1123 .maps = bit(BPF_MAP_TYPE_STRUCT_OPS), 1124 .progs = bit(BPF_PROG_TYPE_STRUCT_OPS), 1125 .attachs = ~0ULL, 1126 }; 1127 1128 subtest_userns(&opts, userns_obj_priv_btf_success); 1129 } 1130 if (test__start_subtest("obj_priv_implicit_token")) { 1131 struct bpffs_opts opts = { 1132 /* allow BTF loading */ 1133 .cmds = bit(BPF_BTF_LOAD) | bit(BPF_MAP_CREATE) | bit(BPF_PROG_LOAD), 1134 .maps = bit(BPF_MAP_TYPE_STRUCT_OPS), 1135 .progs = bit(BPF_PROG_TYPE_STRUCT_OPS), 1136 .attachs = ~0ULL, 1137 }; 1138 1139 subtest_userns(&opts, userns_obj_priv_implicit_token); 1140 } 1141 if (test__start_subtest("obj_priv_implicit_token_envvar")) { 1142 struct bpffs_opts opts = { 1143 /* allow BTF loading */ 1144 .cmds = bit(BPF_BTF_LOAD) | bit(BPF_MAP_CREATE) | bit(BPF_PROG_LOAD), 1145 .maps = bit(BPF_MAP_TYPE_STRUCT_OPS), 1146 .progs = bit(BPF_PROG_TYPE_STRUCT_OPS), 1147 .attachs = ~0ULL, 1148 }; 1149 1150 subtest_userns(&opts, userns_obj_priv_implicit_token_envvar); 1151 } 1152 } 1153