1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2026 Christian Brauner <brauner@kernel.org> */
3
4 /*
5 * Test BPF LSM block device integrity hooks with dm-verity.
6 *
7 * Creates a dm-verity device over loopback, which triggers
8 * security_bdev_setintegrity() during verity_preresume().
9 * Verifies that the BPF program correctly tracks the integrity
10 * metadata in its hashmap.
11 */
12
13 #define _GNU_SOURCE
14 #include <test_progs.h>
15 #include <fcntl.h>
16 #include <stdio.h>
17 #include <stdlib.h>
18 #include <string.h>
19 #include <sys/stat.h>
20 #include <sys/sysmacros.h>
21 #include <sys/types.h>
22 #include <unistd.h>
23 #include "lsm_bdev.skel.h"
24
25 /* Must match the definition in progs/lsm_bdev.c. */
26 struct verity_info {
27 __u8 has_roothash;
28 __u8 sig_valid;
29 __u32 setintegrity_cnt;
30 };
31
32 #define DATA_SIZE_MB 8
33 #define HASH_SIZE_MB 1
34 #define DM_NAME "bpf_test_verity"
35 #define DM_DEV_PATH "/dev/mapper/" DM_NAME
36
37 /* Run a command and optionally capture the first line of stdout. */
run_cmd(const char * cmd,char * out,size_t out_sz)38 static int run_cmd(const char *cmd, char *out, size_t out_sz)
39 {
40 FILE *fp;
41 int ret;
42
43 fp = popen(cmd, "r");
44 if (!fp)
45 return -1;
46
47 if (out && out_sz > 0) {
48 if (!fgets(out, out_sz, fp))
49 out[0] = '\0';
50 /* strip trailing newline */
51 out[strcspn(out, "\n")] = '\0';
52 }
53
54 ret = pclose(fp);
55 return WIFEXITED(ret) ? WEXITSTATUS(ret) : -1;
56 }
57
has_prerequisites(void)58 static bool has_prerequisites(void)
59 {
60 if (getuid() != 0) {
61 printf("SKIP: must be root\n");
62 return false;
63 }
64
65 if (run_cmd("modprobe loop 2>/dev/null", NULL, 0) &&
66 run_cmd("ls /dev/loop-control 2>/dev/null", NULL, 0)) {
67 printf("SKIP: no loop device support\n");
68 return false;
69 }
70
71 if (run_cmd("modprobe dm-verity 2>/dev/null", NULL, 0) &&
72 run_cmd("dmsetup targets 2>/dev/null | grep -q verity", NULL, 0)) {
73 printf("SKIP: dm-verity module not available\n");
74 return false;
75 }
76
77 if (run_cmd("which veritysetup >/dev/null 2>&1", NULL, 0)) {
78 printf("SKIP: veritysetup not found\n");
79 return false;
80 }
81
82 return true;
83 }
84
test_lsm_bdev(void)85 void test_lsm_bdev(void)
86 {
87 char data_img[] = "/tmp/bpf_verity_data_XXXXXX";
88 char hash_img[] = "/tmp/bpf_verity_hash_XXXXXX";
89 char data_loop[64] = {};
90 char hash_loop[64] = {};
91 char roothash[256] = {};
92 char cmd[512];
93 int data_fd = -1, hash_fd = -1;
94 struct lsm_bdev *skel = NULL;
95 struct verity_info val;
96 struct stat st;
97 __u32 dev_key;
98 int err;
99
100 if (!has_prerequisites()) {
101 test__skip();
102 return;
103 }
104
105 /* Clean up any stale device from a previous crashed run. */
106 snprintf(cmd, sizeof(cmd), "dmsetup remove %s 2>/dev/null", DM_NAME);
107 run_cmd(cmd, NULL, 0);
108
109 /* Create temporary image files. */
110 data_fd = mkstemp(data_img);
111 if (!ASSERT_OK_FD(data_fd, "mkstemp data"))
112 return;
113
114 hash_fd = mkstemp(hash_img);
115 if (!ASSERT_OK_FD(hash_fd, "mkstemp hash"))
116 goto cleanup;
117
118 if (!ASSERT_OK(ftruncate(data_fd, DATA_SIZE_MB * 1024 * 1024),
119 "truncate data"))
120 goto cleanup;
121
122 if (!ASSERT_OK(ftruncate(hash_fd, HASH_SIZE_MB * 1024 * 1024),
123 "truncate hash"))
124 goto cleanup;
125
126 close(data_fd);
127 data_fd = -1;
128 close(hash_fd);
129 hash_fd = -1;
130
131 /* Set up loop devices. */
132 snprintf(cmd, sizeof(cmd),
133 "losetup --find --show %s 2>/dev/null", data_img);
134 if (!ASSERT_OK(run_cmd(cmd, data_loop, sizeof(data_loop)),
135 "losetup data"))
136 goto teardown;
137
138 snprintf(cmd, sizeof(cmd),
139 "losetup --find --show %s 2>/dev/null", hash_img);
140 if (!ASSERT_OK(run_cmd(cmd, hash_loop, sizeof(hash_loop)),
141 "losetup hash"))
142 goto teardown;
143
144 /* Format the dm-verity device and capture the root hash. */
145 snprintf(cmd, sizeof(cmd),
146 "veritysetup format %s %s 2>/dev/null | "
147 "grep -i 'root hash' | awk '{print $NF}'",
148 data_loop, hash_loop);
149 if (!ASSERT_OK(run_cmd(cmd, roothash, sizeof(roothash)),
150 "veritysetup format"))
151 goto teardown;
152
153 if (!ASSERT_GT((int)strlen(roothash), 0, "roothash not empty"))
154 goto teardown;
155
156 /* Load and attach BPF program before activating dm-verity. */
157 skel = lsm_bdev__open_and_load();
158 if (!ASSERT_OK_PTR(skel, "skel open_and_load"))
159 goto teardown;
160
161 err = lsm_bdev__attach(skel);
162 if (!ASSERT_OK(err, "skel attach"))
163 goto teardown;
164
165 /* Activate dm-verity — triggers verity_preresume() hooks. */
166 snprintf(cmd, sizeof(cmd),
167 "veritysetup open %s %s %s %s 2>/dev/null",
168 data_loop, DM_NAME, hash_loop, roothash);
169 if (!ASSERT_OK(run_cmd(cmd, NULL, 0), "veritysetup open"))
170 goto teardown;
171
172 /* Get the dm device's dev_t. */
173 if (!ASSERT_OK(stat(DM_DEV_PATH, &st), "stat dm dev"))
174 goto remove_dm;
175
176 dev_key = (major(st.st_rdev) << 20) | minor(st.st_rdev);
177
178 /* Look up the device in the BPF map and verify. */
179 err = bpf_map__lookup_elem(skel->maps.verity_devices,
180 &dev_key, sizeof(dev_key),
181 &val, sizeof(val), 0);
182 if (!ASSERT_OK(err, "map lookup"))
183 goto remove_dm;
184
185 ASSERT_EQ(val.has_roothash, 1, "has_roothash");
186 ASSERT_EQ(val.sig_valid, 0, "sig_valid (unsigned)");
187 /*
188 * verity_preresume() always calls security_bdev_setintegrity()
189 * for the roothash. The signature-validity call only happens
190 * when CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG is enabled.
191 */
192 ASSERT_GE(val.setintegrity_cnt, 1, "setintegrity_cnt min");
193 ASSERT_LE(val.setintegrity_cnt, 2, "setintegrity_cnt max");
194
195 /* Verify that the alloc hook fired at least once. */
196 ASSERT_GT(skel->bss->alloc_count, 0, "alloc_count");
197
198 remove_dm:
199 snprintf(cmd, sizeof(cmd), "dmsetup remove %s 2>/dev/null", DM_NAME);
200 run_cmd(cmd, NULL, 0);
201
202 teardown:
203 if (data_loop[0]) {
204 snprintf(cmd, sizeof(cmd), "losetup -d %s 2>/dev/null",
205 data_loop);
206 run_cmd(cmd, NULL, 0);
207 }
208 if (hash_loop[0]) {
209 snprintf(cmd, sizeof(cmd), "losetup -d %s 2>/dev/null",
210 hash_loop);
211 run_cmd(cmd, NULL, 0);
212 }
213
214 cleanup:
215 lsm_bdev__destroy(skel);
216 if (data_fd >= 0)
217 close(data_fd);
218 if (hash_fd >= 0)
219 close(hash_fd);
220 unlink(data_img);
221 unlink(hash_img);
222 }
223