1 // SPDX-License-Identifier: GPL-2.0
4 * Copyright (C) 2020 Google LLC.
7 #include <asm-generic/errno-base.h>
9 #include <test_progs.h>
10 #include <linux/limits.h>
12 #include "local_storage.skel.h"
13 #include "network_helpers.h"
15 #ifndef __NR_pidfd_open
16 #define __NR_pidfd_open 434
19 static inline int sys_pidfd_open(pid_t pid, unsigned int flags)
21 return syscall(__NR_pidfd_open, pid, flags);
24 static unsigned int duration;
26 #define TEST_STORAGE_VALUE 0xbeefdead
31 /* Lock ensures that spin locked versions of local stoage operations
32 * also work, most operations in this tests are still single threaded
34 struct bpf_spin_lock lock;
37 /* Copies an rm binary to a temp file. dest is a mkstemp template */
38 static int copy_rm(char *dest)
40 int fd_in, fd_out = -1, ret = 0;
44 fd_in = open("/bin/rm", O_RDONLY);
48 fd_out = mkstemp(dest);
54 ret = fstat(fd_in, &stat);
60 buf = malloc(stat.st_blksize);
66 while (ret = read(fd_in, buf, stat.st_blksize), ret > 0) {
67 ret = write(fd_out, buf, ret);
80 /* Set executable permission on the copied file */
81 ret = chmod(dest, 0100);
92 /* Fork and exec the provided rm binary and return the exit code of the
93 * forked process and its pid.
95 static int run_self_unlink(int *monitored_pid, const char *rm_path)
97 int child_pid, child_status, ret;
101 if (child_pid == 0) {
102 null_fd = open("/dev/null", O_WRONLY);
103 dup2(null_fd, STDOUT_FILENO);
104 dup2(null_fd, STDERR_FILENO);
107 *monitored_pid = getpid();
108 /* Use the copied /usr/bin/rm to delete itself
109 * /tmp/copy_of_rm /tmp/copy_of_rm.
111 ret = execlp(rm_path, rm_path, rm_path, NULL);
114 } else if (child_pid > 0) {
115 waitpid(child_pid, &child_status, 0);
116 return WEXITSTATUS(child_status);
122 static bool check_syscall_operations(int map_fd, int obj_fd)
124 struct storage val = { .value = TEST_STORAGE_VALUE, .lock = { 0 } },
125 lookup_val = { .value = 0, .lock = { 0 } };
128 /* Looking up an existing element should fail initially */
129 err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val,
131 if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem",
132 "err:%d errno:%d\n", err, errno))
135 /* Create a new element */
136 err = bpf_map_update_elem(map_fd, &obj_fd, &val,
137 BPF_NOEXIST | BPF_F_LOCK);
138 if (CHECK(err < 0, "bpf_map_update_elem", "err:%d errno:%d\n", err,
142 /* Lookup the newly created element */
143 err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val,
145 if (CHECK(err < 0, "bpf_map_lookup_elem", "err:%d errno:%d", err,
149 /* Check the value of the newly created element */
150 if (CHECK(lookup_val.value != val.value, "bpf_map_lookup_elem",
151 "value got = %x errno:%d", lookup_val.value, val.value))
154 err = bpf_map_delete_elem(map_fd, &obj_fd);
155 if (CHECK(err, "bpf_map_delete_elem()", "err:%d errno:%d\n", err,
159 /* The lookup should fail, now that the element has been deleted */
160 err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val,
162 if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem",
163 "err:%d errno:%d\n", err, errno))
169 void test_test_local_storage(void)
171 char tmp_exec_path[PATH_MAX] = "/tmp/copy_of_rmXXXXXX";
172 int err, serv_sk = -1, task_fd = -1, rm_fd = -1;
173 struct local_storage *skel = NULL;
175 skel = local_storage__open_and_load();
176 if (CHECK(!skel, "skel_load", "lsm skeleton failed\n"))
179 err = local_storage__attach(skel);
180 if (CHECK(err, "attach", "lsm attach failed: %d\n", err))
183 task_fd = sys_pidfd_open(getpid(), 0);
184 if (CHECK(task_fd < 0, "pidfd_open",
185 "failed to get pidfd err:%d, errno:%d", task_fd, errno))
188 if (!check_syscall_operations(bpf_map__fd(skel->maps.task_storage_map),
192 err = copy_rm(tmp_exec_path);
193 if (CHECK(err < 0, "copy_rm", "err %d errno %d\n", err, errno))
196 rm_fd = open(tmp_exec_path, O_RDONLY);
197 if (CHECK(rm_fd < 0, "open", "failed to open %s err:%d, errno:%d",
198 tmp_exec_path, rm_fd, errno))
201 if (!check_syscall_operations(bpf_map__fd(skel->maps.inode_storage_map),
205 /* Sets skel->bss->monitored_pid to the pid of the forked child
206 * forks a child process that executes tmp_exec_path and tries to
207 * unlink its executable. This operation should be denied by the loaded
210 err = run_self_unlink(&skel->bss->monitored_pid, tmp_exec_path);
211 if (CHECK(err != EPERM, "run_self_unlink", "err %d want EPERM\n", err))
212 goto close_prog_unlink;
214 /* Set the process being monitored to be the current process */
215 skel->bss->monitored_pid = getpid();
217 /* Remove the temporary created executable */
218 err = unlink(tmp_exec_path);
219 if (CHECK(err != 0, "unlink", "unable to unlink %s: %d", tmp_exec_path,
221 goto close_prog_unlink;
223 CHECK(skel->data->inode_storage_result != 0, "inode_storage_result",
224 "inode_local_storage not set\n");
226 serv_sk = start_server(AF_INET6, SOCK_STREAM, NULL, 0, 0);
227 if (CHECK(serv_sk < 0, "start_server", "failed to start server\n"))
230 CHECK(skel->data->sk_storage_result != 0, "sk_storage_result",
231 "sk_local_storage not set\n");
233 if (!check_syscall_operations(bpf_map__fd(skel->maps.sk_storage_map),
238 unlink(tmp_exec_path);
243 local_storage__destroy(skel);