Skip to content

Commit e6b10c9

Browse files
fomichevKernel Patches Daemon
fomichev
authored and
Kernel Patches Daemon
committed
selftests/bpf: lsm_cgroup functional test
Functional test that exercises the following: 1. apply default sk_priority policy 2. permit TX-only AF_PACKET socket 3. cgroup attach/detach/replace 4. reusing trampoline shim Signed-off-by: Stanislav Fomichev <[email protected]>
1 parent 1fccd00 commit e6b10c9

File tree

2 files changed

+339
-0
lines changed

2 files changed

+339
-0
lines changed

‎tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
// SPDX-License-Identifier: GPL-2.0
2+
3+
#include <sys/types.h>
4+
#include <sys/socket.h>
5+
#include <test_progs.h>
6+
7+
#include "lsm_cgroup.skel.h"
8+
#include "cgroup_helpers.h"
9+
#include "network_helpers.h"
10+
11+
void test_lsm_cgroup(void)
12+
{
13+
DECLARE_LIBBPF_OPTS(bpf_prog_attach_opts, attach_opts);
14+
DECLARE_LIBBPF_OPTS(bpf_link_update_opts, update_opts);
15+
int cgroup_fd, cgroup_fd2, err, fd, prio;
16+
int listen_fd, client_fd, accepted_fd;
17+
struct lsm_cgroup *skel = NULL;
18+
int post_create_prog_fd2 = -1;
19+
int post_create_prog_fd = -1;
20+
int bind_link_fd2 = -1;
21+
int bind_prog_fd2 = -1;
22+
int alloc_prog_fd = -1;
23+
int bind_prog_fd = -1;
24+
int bind_link_fd = -1;
25+
int clone_prog_fd = -1;
26+
socklen_t socklen;
27+
28+
cgroup_fd = test__join_cgroup("/sock_policy");
29+
if (!ASSERT_GE(cgroup_fd, 0, "join_cgroup"))
30+
goto close_skel;
31+
32+
cgroup_fd2 = create_and_get_cgroup("/sock_policy2");
33+
if (!ASSERT_GE(cgroup_fd2, 0, "create second cgroup"))
34+
goto close_skel;
35+
36+
skel = lsm_cgroup__open_and_load();
37+
if (!ASSERT_OK_PTR(skel, "open_and_load"))
38+
goto close_cgroup;
39+
40+
post_create_prog_fd = bpf_program__fd(skel->progs.socket_post_create);
41+
post_create_prog_fd2 = bpf_program__fd(skel->progs.socket_post_create2);
42+
bind_prog_fd = bpf_program__fd(skel->progs.socket_bind);
43+
bind_prog_fd2 = bpf_program__fd(skel->progs.socket_bind2);
44+
alloc_prog_fd = bpf_program__fd(skel->progs.socket_alloc);
45+
clone_prog_fd = bpf_program__fd(skel->progs.socket_clone);
46+
47+
err = bpf_prog_attach(alloc_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0);
48+
if (!ASSERT_OK(err, "attach alloc_prog_fd"))
49+
goto detach_cgroup;
50+
51+
err = bpf_prog_attach(clone_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0);
52+
if (!ASSERT_OK(err, "attach clone_prog_fd"))
53+
goto detach_cgroup;
54+
55+
/* Make sure replacing works.
56+
*/
57+
58+
err = bpf_prog_attach(post_create_prog_fd, cgroup_fd,
59+
BPF_LSM_CGROUP, 0);
60+
if (!ASSERT_OK(err, "attach post_create_prog_fd"))
61+
goto close_cgroup;
62+
63+
attach_opts.replace_prog_fd = post_create_prog_fd;
64+
err = bpf_prog_attach_opts(post_create_prog_fd2, cgroup_fd,
65+
BPF_LSM_CGROUP, &attach_opts);
66+
if (!ASSERT_OK(err, "prog replace post_create_prog_fd"))
67+
goto detach_cgroup;
68+
69+
/* Try the same attach/replace via link API.
70+
*/
71+
72+
bind_link_fd = bpf_link_create(bind_prog_fd, cgroup_fd,
73+
BPF_LSM_CGROUP, NULL);
74+
if (!ASSERT_GE(bind_link_fd, 0, "link create bind_prog_fd"))
75+
goto detach_cgroup;
76+
77+
update_opts.old_prog_fd = bind_prog_fd;
78+
update_opts.flags = BPF_F_REPLACE;
79+
80+
err = bpf_link_update(bind_link_fd, bind_prog_fd2, &update_opts);
81+
if (!ASSERT_OK(err, "link update bind_prog_fd"))
82+
goto detach_cgroup;
83+
84+
/* Attach another instance of bind program to another cgroup.
85+
* This should trigger the reuse of the trampoline shim (two
86+
* programs attaching to the same btf_id).
87+
*/
88+
89+
bind_link_fd2 = bpf_link_create(bind_prog_fd2, cgroup_fd2,
90+
BPF_LSM_CGROUP, NULL);
91+
if (!ASSERT_GE(bind_link_fd2, 0, "link create bind_prog_fd2"))
92+
goto detach_cgroup;
93+
94+
/* AF_UNIX is prohibited.
95+
*/
96+
97+
fd = socket(AF_UNIX, SOCK_STREAM, 0);
98+
ASSERT_LT(fd, 0, "socket(AF_UNIX)");
99+
100+
/* AF_INET6 gets default policy (sk_priority).
101+
*/
102+
103+
fd = socket(AF_INET6, SOCK_STREAM, 0);
104+
if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)"))
105+
goto detach_cgroup;
106+
107+
prio = 0;
108+
socklen = sizeof(prio);
109+
ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
110+
"getsockopt");
111+
ASSERT_EQ(prio, 123, "sk_priority");
112+
113+
close(fd);
114+
115+
/* TX-only AF_PACKET is allowed.
116+
*/
117+
118+
ASSERT_LT(socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)), 0,
119+
"socket(AF_PACKET, ..., ETH_P_ALL)");
120+
121+
fd = socket(AF_PACKET, SOCK_RAW, 0);
122+
ASSERT_GE(fd, 0, "socket(AF_PACKET, ..., 0)");
123+
124+
/* TX-only AF_PACKET can not be rebound.
125+
*/
126+
127+
struct sockaddr_ll sa = {
128+
.sll_family = AF_PACKET,
129+
.sll_protocol = htons(ETH_P_ALL),
130+
};
131+
ASSERT_LT(bind(fd, (struct sockaddr *)&sa, sizeof(sa)), 0,
132+
"bind(ETH_P_ALL)");
133+
134+
close(fd);
135+
136+
/* Trigger passive open.
137+
*/
138+
139+
listen_fd = start_server(AF_INET6, SOCK_STREAM, "::1", 0, 0);
140+
ASSERT_GE(listen_fd, 0, "start_server");
141+
client_fd = connect_to_fd(listen_fd, 0);
142+
ASSERT_GE(client_fd, 0, "connect_to_fd");
143+
accepted_fd = accept(listen_fd, NULL, NULL);
144+
ASSERT_GE(accepted_fd, 0, "accept");
145+
146+
prio = 0;
147+
socklen = sizeof(prio);
148+
ASSERT_GE(getsockopt(accepted_fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
149+
"getsockopt");
150+
ASSERT_EQ(prio, 234, "sk_priority");
151+
152+
/* These are replaced and never called. */
153+
ASSERT_EQ(skel->bss->called_socket_post_create, 0, "called_create");
154+
ASSERT_EQ(skel->bss->called_socket_bind, 0, "called_bind");
155+
156+
/* AF_INET6+SOCK_STREAM
157+
* AF_PACKET+SOCK_RAW
158+
* listen_fd
159+
* client_fd
160+
* accepted_fd
161+
*/
162+
ASSERT_EQ(skel->bss->called_socket_post_create2, 5, "called_create2");
163+
164+
/* start_server
165+
* bind(ETH_P_ALL)
166+
*/
167+
ASSERT_EQ(skel->bss->called_socket_bind2, 2, "called_bind2");
168+
/* Single accept(). */
169+
ASSERT_EQ(skel->bss->called_socket_clone, 1, "called_clone");
170+
171+
/* AF_UNIX+SOCK_STREAM (failed)
172+
* AF_INET6+SOCK_STREAM
173+
* AF_PACKET+SOCK_RAW (failed)
174+
* AF_PACKET+SOCK_RAW
175+
* listen_fd
176+
* client_fd
177+
* accepted_fd
178+
*/
179+
ASSERT_EQ(skel->bss->called_socket_alloc, 7, "called_alloc");
180+
181+
/* Make sure other cgroup doesn't trigger the programs.
182+
*/
183+
184+
if (!ASSERT_OK(join_cgroup(""), "join root cgroup"))
185+
goto detach_cgroup;
186+
187+
fd = socket(AF_INET6, SOCK_STREAM, 0);
188+
if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)"))
189+
goto detach_cgroup;
190+
191+
prio = 0;
192+
socklen = sizeof(prio);
193+
ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0,
194+
"getsockopt");
195+
ASSERT_EQ(prio, 0, "sk_priority");
196+
197+
close(fd);
198+
199+
detach_cgroup:
200+
ASSERT_GE(bpf_prog_detach2(post_create_prog_fd2, cgroup_fd,
201+
BPF_LSM_CGROUP), 0, "detach_create");
202+
close(bind_link_fd);
203+
/* Don't close bind_link_fd2, exercise cgroup release cleanup. */
204+
ASSERT_GE(bpf_prog_detach2(alloc_prog_fd, cgroup_fd,
205+
BPF_LSM_CGROUP), 0, "detach_alloc");
206+
ASSERT_GE(bpf_prog_detach2(clone_prog_fd, cgroup_fd,
207+
BPF_LSM_CGROUP), 0, "detach_clone");
208+
209+
close_cgroup:
210+
close(cgroup_fd);
211+
close_skel:
212+
lsm_cgroup__destroy(skel);
213+
}

‎tools/testing/selftests/bpf/progs/lsm_cgroup.c

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
// SPDX-License-Identifier: GPL-2.0
2+
3+
#include "vmlinux.h"
4+
#include <bpf/bpf_helpers.h>
5+
#include <bpf/bpf_tracing.h>
6+
7+
char _license[] SEC("license") = "GPL";
8+
9+
#ifndef AF_PACKET
10+
#define AF_PACKET 17
11+
#endif
12+
13+
#ifndef AF_UNIX
14+
#define AF_UNIX 1
15+
#endif
16+
17+
#ifndef EPERM
18+
#define EPERM 1
19+
#endif
20+
21+
int called_socket_post_create;
22+
int called_socket_post_create2;
23+
int called_socket_bind;
24+
int called_socket_bind2;
25+
int called_socket_alloc;
26+
int called_socket_clone;
27+
28+
static __always_inline int real_create(struct socket *sock, int family,
29+
int protocol)
30+
{
31+
struct sock *sk;
32+
33+
/* Reject non-tx-only AF_PACKET.
34+
*/
35+
if (family == AF_PACKET && protocol != 0)
36+
return 0; /* EPERM */
37+
38+
sk = sock->sk;
39+
if (!sk)
40+
return 1;
41+
42+
/* The rest of the sockets get default policy.
43+
*/
44+
sk->sk_priority = 123;
45+
return 1;
46+
}
47+
48+
/* __cgroup_bpf_run_lsm_socket */
49+
SEC("lsm_cgroup/socket_post_create")
50+
int BPF_PROG(socket_post_create, struct socket *sock, int family,
51+
int type, int protocol, int kern)
52+
{
53+
called_socket_post_create++;
54+
return real_create(sock, family, protocol);
55+
}
56+
57+
/* __cgroup_bpf_run_lsm_socket */
58+
SEC("lsm_cgroup/socket_post_create")
59+
int BPF_PROG(socket_post_create2, struct socket *sock, int family,
60+
int type, int protocol, int kern)
61+
{
62+
called_socket_post_create2++;
63+
return real_create(sock, family, protocol);
64+
}
65+
66+
static __always_inline int real_bind(struct socket *sock,
67+
struct sockaddr *address,
68+
int addrlen)
69+
{
70+
struct sockaddr_ll sa = {};
71+
72+
if (sock->sk->__sk_common.skc_family != AF_PACKET)
73+
return 1;
74+
75+
if (sock->sk->sk_kern_sock)
76+
return 1;
77+
78+
bpf_probe_read_kernel(&sa, sizeof(sa), address);
79+
if (sa.sll_protocol)
80+
return 0; /* EPERM */
81+
82+
return 1;
83+
}
84+
85+
/* __cgroup_bpf_run_lsm_socket */
86+
SEC("lsm_cgroup/socket_bind")
87+
int BPF_PROG(socket_bind, struct socket *sock, struct sockaddr *address,
88+
int addrlen)
89+
{
90+
called_socket_bind++;
91+
return real_bind(sock, address, addrlen);
92+
}
93+
94+
/* __cgroup_bpf_run_lsm_socket */
95+
SEC("lsm_cgroup/socket_bind")
96+
int BPF_PROG(socket_bind2, struct socket *sock, struct sockaddr *address,
97+
int addrlen)
98+
{
99+
called_socket_bind2++;
100+
return real_bind(sock, address, addrlen);
101+
}
102+
103+
/* __cgroup_bpf_run_lsm_current (via bpf_lsm_current_hooks) */
104+
SEC("lsm_cgroup/sk_alloc_security")
105+
int BPF_PROG(socket_alloc, struct sock *sk, int family, gfp_t priority)
106+
{
107+
called_socket_alloc++;
108+
if (family == AF_UNIX)
109+
return 0; /* EPERM */
110+
return 1;
111+
}
112+
113+
/* __cgroup_bpf_run_lsm_sock */
114+
SEC("lsm_cgroup/inet_csk_clone")
115+
int BPF_PROG(socket_clone, struct sock *newsk, const struct request_sock *req)
116+
{
117+
called_socket_clone++;
118+
119+
if (!newsk)
120+
return 1;
121+
122+
/* Accepted request sockets get a different priority.
123+
*/
124+
newsk->sk_priority = 234;
125+
return 1;
126+
}

0 commit comments

Comments
 (0)