1 // SPDX-License-Identifier: GPL-2.0
2
3 /*
4 * Copyright (C) 2020 Google LLC.
5 */
6
7 #include <test_progs.h>
8 #include <sys/mman.h>
9 #include <sys/wait.h>
10 #include <unistd.h>
11 #include <malloc.h>
12 #include <stdlib.h>
13 #include <unistd.h>
14
15 #include "lsm.skel.h"
16 #include "lsm_tailcall.skel.h"
17
18 char *CMD_ARGS[] = {"true", NULL};
19
20 #define GET_PAGE_ADDR(ADDR, PAGE_SIZE) \
21 (char *)(((unsigned long) (ADDR + PAGE_SIZE)) & ~(PAGE_SIZE-1))
22
stack_mprotect(void)23 int stack_mprotect(void)
24 {
25 void *buf;
26 long sz;
27 int ret;
28
29 sz = sysconf(_SC_PAGESIZE);
30 if (sz < 0)
31 return sz;
32
33 buf = alloca(sz * 3);
34 ret = mprotect(GET_PAGE_ADDR(buf, sz), sz,
35 PROT_READ | PROT_WRITE | PROT_EXEC);
36 return ret;
37 }
38
exec_cmd(int * monitored_pid)39 int exec_cmd(int *monitored_pid)
40 {
41 int child_pid, child_status;
42
43 child_pid = fork();
44 if (child_pid == 0) {
45 *monitored_pid = getpid();
46 execvp(CMD_ARGS[0], CMD_ARGS);
47 return -EINVAL;
48 } else if (child_pid > 0) {
49 waitpid(child_pid, &child_status, 0);
50 return child_status;
51 }
52
53 return -EINVAL;
54 }
55
test_lsm_basic(void)56 static void test_lsm_basic(void)
57 {
58 struct lsm *skel = NULL;
59 int err, duration = 0;
60 int buf = 1234;
61
62 skel = lsm__open_and_load();
63 if (CHECK(!skel, "skel_load", "lsm skeleton failed\n"))
64 goto close_prog;
65
66 err = lsm__attach(skel);
67 if (CHECK(err, "attach", "lsm attach failed: %d\n", err))
68 goto close_prog;
69
70 err = exec_cmd(&skel->bss->monitored_pid);
71 if (CHECK(err < 0, "exec_cmd", "err %d errno %d\n", err, errno))
72 goto close_prog;
73
74 CHECK(skel->bss->bprm_count != 1, "bprm_count", "bprm_count = %d\n",
75 skel->bss->bprm_count);
76
77 skel->bss->monitored_pid = getpid();
78
79 err = stack_mprotect();
80 if (CHECK(errno != EPERM, "stack_mprotect", "want err=EPERM, got %d\n",
81 errno))
82 goto close_prog;
83
84 CHECK(skel->bss->mprotect_count != 1, "mprotect_count",
85 "mprotect_count = %d\n", skel->bss->mprotect_count);
86
87 syscall(__NR_setdomainname, &buf, -2L);
88 syscall(__NR_setdomainname, 0, -3L);
89 syscall(__NR_setdomainname, ~0L, -4L);
90
91 CHECK(skel->bss->copy_test != 3, "copy_test",
92 "copy_test = %d\n", skel->bss->copy_test);
93
94 close_prog:
95 lsm__destroy(skel);
96 }
97
test_lsm_tailcall(void)98 static void test_lsm_tailcall(void)
99 {
100 struct lsm_tailcall *skel = NULL;
101 int map_fd, prog_fd;
102 int err, key;
103
104 skel = lsm_tailcall__open_and_load();
105 if (!ASSERT_OK_PTR(skel, "lsm_tailcall__skel_load"))
106 goto close_prog;
107
108 map_fd = bpf_map__fd(skel->maps.jmp_table);
109 if (CHECK_FAIL(map_fd < 0))
110 goto close_prog;
111
112 prog_fd = bpf_program__fd(skel->progs.lsm_file_permission_prog);
113 if (CHECK_FAIL(prog_fd < 0))
114 goto close_prog;
115
116 key = 0;
117 err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY);
118 if (CHECK_FAIL(!err))
119 goto close_prog;
120
121 prog_fd = bpf_program__fd(skel->progs.lsm_file_alloc_security_prog);
122 if (CHECK_FAIL(prog_fd < 0))
123 goto close_prog;
124
125 err = bpf_map_update_elem(map_fd, &key, &prog_fd, BPF_ANY);
126 if (CHECK_FAIL(err))
127 goto close_prog;
128
129 close_prog:
130 lsm_tailcall__destroy(skel);
131 }
132
test_test_lsm(void)133 void test_test_lsm(void)
134 {
135 if (test__start_subtest("lsm_basic"))
136 test_lsm_basic();
137 if (test__start_subtest("lsm_tailcall"))
138 test_lsm_tailcall();
139 }
140