1 // SPDX-License-Identifier: GPL-2.0 2 3 /* 4 * Copyright (C) 2020 Google LLC. 5 */ 6 7 #include <test_progs.h> 8 #include <sys/mman.h> 9 #include <sys/wait.h> 10 #include <unistd.h> 11 #include <malloc.h> 12 #include <stdlib.h> 13 14 #include "lsm.skel.h" 15 #include "lsm_tailcall.skel.h" 16 17 char *CMD_ARGS[] = {"true", NULL}; 18 19 #define GET_PAGE_ADDR(ADDR, PAGE_SIZE) \ 20 (char *)(((unsigned long) (ADDR + PAGE_SIZE)) & ~(PAGE_SIZE-1)) 21 22 int stack_mprotect(void) 23 { 24 void *buf; 25 long sz; 26 int ret; 27 28 sz = sysconf(_SC_PAGESIZE); 29 if (sz < 0) 30 return sz; 31 32 buf = alloca(sz * 3); 33 ret = mprotect(GET_PAGE_ADDR(buf, sz), sz, 34 PROT_READ | PROT_WRITE | PROT_EXEC); 35 return ret; 36 } 37 38 int exec_cmd(int *monitored_pid) 39 { 40 int child_pid, child_status; 41 42 child_pid = fork(); 43 if (child_pid == 0) { 44 *monitored_pid = getpid(); 45 execvp(CMD_ARGS[0], CMD_ARGS); 46 return -EINVAL; 47 } else if (child_pid > 0) { 48 waitpid(child_pid, &child_status, 0); 49 return child_status; 50 } 51 52 return -EINVAL; 53 } 54 55 static int test_lsm(struct lsm *skel) 56 { 57 struct bpf_link *link; 58 int buf = 1234; 59 int err; 60 61 err = lsm__attach(skel); 62 if (!ASSERT_OK(err, "attach")) 63 return err; 64 65 /* Check that already linked program can't be attached again. */ 66 link = bpf_program__attach(skel->progs.test_int_hook); 67 if (!ASSERT_ERR_PTR(link, "attach_link")) 68 return -1; 69 70 err = exec_cmd(&skel->bss->monitored_pid); 71 if (!ASSERT_OK(err, "exec_cmd")) 72 return err; 73 74 ASSERT_EQ(skel->bss->bprm_count, 1, "bprm_count"); 75 76 skel->bss->monitored_pid = getpid(); 77 78 err = stack_mprotect(); 79 if (!ASSERT_EQ(err, -1, "stack_mprotect") || 80 !ASSERT_EQ(errno, EPERM, "stack_mprotect")) 81 return err; 82 83 ASSERT_EQ(skel->bss->mprotect_count, 1, "mprotect_count"); 84 85 syscall(__NR_setdomainname, &buf, -2L); 86 syscall(__NR_setdomainname, 0, -3L); 87 syscall(__NR_setdomainname, ~0L, -4L); 88 89 ASSERT_EQ(skel->bss->copy_test, 3, "copy_test"); 90 91 lsm__detach(skel); 92 93 skel->bss->copy_test = 0; 94 skel->bss->bprm_count = 0; 95 skel->bss->mprotect_count = 0; 96 return 0; 97 } 98 99 static void test_lsm_basic(void) 100 { 101 struct lsm *skel = NULL; 102 int err; 103 104 skel = lsm__open_and_load(); 105 if (!ASSERT_OK_PTR(skel, "lsm_skel_load")) 106 goto close_prog; 107 108 err = test_lsm(skel); 109 if (!ASSERT_OK(err, "test_lsm_first_attach")) 110 goto close_prog; 111 112 err = test_lsm(skel); 113 ASSERT_OK(err, "test_lsm_second_attach"); 114 115 close_prog: 116 lsm__destroy(skel); 117 } 118 119 static void test_lsm_tailcall(void) 120 { 121 struct lsm_tailcall *skel = NULL; 122 int map_fd, prog_fd; 123 int err, key; 124 125 skel = lsm_tailcall__open_and_load(); 126 if (!ASSERT_OK_PTR(skel, "lsm_tailcall__skel_load")) 127 goto close_prog; 128 129 map_fd = bpf_map__fd(skel->maps.jmp_table); 130 if (CHECK_FAIL(map_fd < 0)) 131 goto close_prog; 132 133 prog_fd = bpf_program__fd(skel->progs.lsm_file_permission_prog); 134 if (CHECK_FAIL(prog_fd < 0)) 135 goto close_prog; 136 137 key = 0; 138 err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY); 139 if (CHECK_FAIL(!err)) 140 goto close_prog; 141 142 prog_fd = bpf_program__fd(skel->progs.lsm_file_alloc_security_prog); 143 if (CHECK_FAIL(prog_fd < 0)) 144 goto close_prog; 145 146 err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY); 147 if (CHECK_FAIL(err)) 148 goto close_prog; 149 150 close_prog: 151 lsm_tailcall__destroy(skel); 152 } 153 154 void test_test_lsm(void) 155 { 156 if (test__start_subtest("lsm_basic")) 157 test_lsm_basic(); 158 if (test__start_subtest("lsm_tailcall")) 159 test_lsm_tailcall(); 160 } 161