1 // SPDX-License-Identifier: GPL-2.0
2
3 /*
4 * Copyright (C) 2020 Google LLC.
5 */
6
7 #include <asm-generic/errno-base.h>
8 #include <sys/stat.h>
9 #include <test_progs.h>
10 #include <linux/limits.h>
11
12 #include "local_storage.skel.h"
13 #include "network_helpers.h"
14
15 #ifndef __NR_pidfd_open
16 #define __NR_pidfd_open 434
17 #endif
18
sys_pidfd_open(pid_t pid,unsigned int flags)19 static inline int sys_pidfd_open(pid_t pid, unsigned int flags)
20 {
21 return syscall(__NR_pidfd_open, pid, flags);
22 }
23
24 static unsigned int duration;
25
26 #define TEST_STORAGE_VALUE 0xbeefdead
27
28 struct storage {
29 void *inode;
30 unsigned int value;
31 };
32
33 /* Fork and exec the provided rm binary and return the exit code of the
34 * forked process and its pid.
35 */
run_self_unlink(int * monitored_pid,const char * rm_path)36 static int run_self_unlink(int *monitored_pid, const char *rm_path)
37 {
38 int child_pid, child_status, ret;
39 int null_fd;
40
41 child_pid = fork();
42 if (child_pid == 0) {
43 null_fd = open("/dev/null", O_WRONLY);
44 dup2(null_fd, STDOUT_FILENO);
45 dup2(null_fd, STDERR_FILENO);
46 close(null_fd);
47
48 *monitored_pid = getpid();
49 /* Use the copied /usr/bin/rm to delete itself
50 * /tmp/copy_of_rm /tmp/copy_of_rm.
51 */
52 ret = execlp(rm_path, rm_path, rm_path, NULL);
53 if (ret)
54 exit(errno);
55 } else if (child_pid > 0) {
56 waitpid(child_pid, &child_status, 0);
57 return WEXITSTATUS(child_status);
58 }
59
60 return -EINVAL;
61 }
62
check_syscall_operations(int map_fd,int obj_fd)63 static bool check_syscall_operations(int map_fd, int obj_fd)
64 {
65 struct storage val = { .value = TEST_STORAGE_VALUE },
66 lookup_val = { .value = 0 };
67 int err;
68
69 /* Looking up an existing element should fail initially */
70 err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 0);
71 if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem",
72 "err:%d errno:%d\n", err, errno))
73 return false;
74
75 /* Create a new element */
76 err = bpf_map_update_elem(map_fd, &obj_fd, &val, BPF_NOEXIST);
77 if (CHECK(err < 0, "bpf_map_update_elem", "err:%d errno:%d\n", err,
78 errno))
79 return false;
80
81 /* Lookup the newly created element */
82 err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 0);
83 if (CHECK(err < 0, "bpf_map_lookup_elem", "err:%d errno:%d", err,
84 errno))
85 return false;
86
87 /* Check the value of the newly created element */
88 if (CHECK(lookup_val.value != val.value, "bpf_map_lookup_elem",
89 "value got = %x errno:%d", lookup_val.value, val.value))
90 return false;
91
92 err = bpf_map_delete_elem(map_fd, &obj_fd);
93 if (CHECK(err, "bpf_map_delete_elem()", "err:%d errno:%d\n", err,
94 errno))
95 return false;
96
97 /* The lookup should fail, now that the element has been deleted */
98 err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 0);
99 if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem",
100 "err:%d errno:%d\n", err, errno))
101 return false;
102
103 return true;
104 }
105
test_test_local_storage(void)106 void test_test_local_storage(void)
107 {
108 char tmp_dir_path[] = "/tmp/local_storageXXXXXX";
109 int err, serv_sk = -1, task_fd = -1, rm_fd = -1;
110 struct local_storage *skel = NULL;
111 char tmp_exec_path[64];
112 char cmd[256];
113
114 skel = local_storage__open_and_load();
115 if (CHECK(!skel, "skel_load", "lsm skeleton failed\n"))
116 goto close_prog;
117
118 err = local_storage__attach(skel);
119 if (CHECK(err, "attach", "lsm attach failed: %d\n", err))
120 goto close_prog;
121
122 task_fd = sys_pidfd_open(getpid(), 0);
123 if (CHECK(task_fd < 0, "pidfd_open",
124 "failed to get pidfd err:%d, errno:%d", task_fd, errno))
125 goto close_prog;
126
127 if (!check_syscall_operations(bpf_map__fd(skel->maps.task_storage_map),
128 task_fd))
129 goto close_prog;
130
131 if (CHECK(!mkdtemp(tmp_dir_path), "mkdtemp",
132 "unable to create tmpdir: %d\n", errno))
133 goto close_prog;
134
135 snprintf(tmp_exec_path, sizeof(tmp_exec_path), "%s/copy_of_rm",
136 tmp_dir_path);
137 snprintf(cmd, sizeof(cmd), "cp /bin/rm %s", tmp_exec_path);
138 if (CHECK_FAIL(system(cmd)))
139 goto close_prog_rmdir;
140
141 rm_fd = open(tmp_exec_path, O_RDONLY);
142 if (CHECK(rm_fd < 0, "open", "failed to open %s err:%d, errno:%d",
143 tmp_exec_path, rm_fd, errno))
144 goto close_prog_rmdir;
145
146 if (!check_syscall_operations(bpf_map__fd(skel->maps.inode_storage_map),
147 rm_fd))
148 goto close_prog_rmdir;
149
150 /* Sets skel->bss->monitored_pid to the pid of the forked child
151 * forks a child process that executes tmp_exec_path and tries to
152 * unlink its executable. This operation should be denied by the loaded
153 * LSM program.
154 */
155 err = run_self_unlink(&skel->bss->monitored_pid, tmp_exec_path);
156 if (CHECK(err != EPERM, "run_self_unlink", "err %d want EPERM\n", err))
157 goto close_prog_rmdir;
158
159 /* Set the process being monitored to be the current process */
160 skel->bss->monitored_pid = getpid();
161
162 /* Move copy_of_rm to a new location so that it triggers the
163 * inode_rename LSM hook with a new_dentry that has a NULL inode ptr.
164 */
165 snprintf(cmd, sizeof(cmd), "mv %s/copy_of_rm %s/check_null_ptr",
166 tmp_dir_path, tmp_dir_path);
167 if (CHECK_FAIL(system(cmd)))
168 goto close_prog_rmdir;
169
170 CHECK(skel->data->inode_storage_result != 0, "inode_storage_result",
171 "inode_local_storage not set\n");
172
173 serv_sk = start_server(AF_INET6, SOCK_STREAM, NULL, 0, 0);
174 if (CHECK(serv_sk < 0, "start_server", "failed to start server\n"))
175 goto close_prog_rmdir;
176
177 CHECK(skel->data->sk_storage_result != 0, "sk_storage_result",
178 "sk_local_storage not set\n");
179
180 if (!check_syscall_operations(bpf_map__fd(skel->maps.sk_storage_map),
181 serv_sk))
182 goto close_prog_rmdir;
183
184 close_prog_rmdir:
185 snprintf(cmd, sizeof(cmd), "rm -rf %s", tmp_dir_path);
186 system(cmd);
187 close_prog:
188 close(serv_sk);
189 close(rm_fd);
190 close(task_fd);
191 local_storage__destroy(skel);
192 }
193