1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <sys/types.h> 4 #include <sys/socket.h> 5 #include <test_progs.h> 6 #include <bpf/btf.h> 7 8 #include "lsm_cgroup.skel.h" 9 #include "lsm_cgroup_nonvoid.skel.h" 10 #include "cgroup_helpers.h" 11 #include "network_helpers.h" 12 13 #ifndef ENOTSUPP 14 #define ENOTSUPP 524 15 #endif 16 17 static struct btf *btf; 18 19 static __u32 query_prog_cnt(int cgroup_fd, const char *attach_func) 20 { 21 LIBBPF_OPTS(bpf_prog_query_opts, p); 22 int cnt = 0; 23 int i; 24 25 ASSERT_OK(bpf_prog_query_opts(cgroup_fd, BPF_LSM_CGROUP, &p), "prog_query"); 26 27 if (!attach_func) 28 return p.prog_cnt; 29 30 /* When attach_func is provided, count the number of progs that 31 * attach to the given symbol. 32 */ 33 34 if (!btf) 35 btf = btf__load_vmlinux_btf(); 36 if (!ASSERT_OK(libbpf_get_error(btf), "btf_vmlinux")) 37 return -1; 38 39 p.prog_ids = malloc(sizeof(u32) * p.prog_cnt); 40 p.prog_attach_flags = malloc(sizeof(u32) * p.prog_cnt); 41 ASSERT_OK(bpf_prog_query_opts(cgroup_fd, BPF_LSM_CGROUP, &p), "prog_query"); 42 43 for (i = 0; i < p.prog_cnt; i++) { 44 struct bpf_prog_info info = {}; 45 __u32 info_len = sizeof(info); 46 int fd; 47 48 fd = bpf_prog_get_fd_by_id(p.prog_ids[i]); 49 ASSERT_GE(fd, 0, "prog_get_fd_by_id"); 50 ASSERT_OK(bpf_obj_get_info_by_fd(fd, &info, &info_len), "prog_info_by_fd"); 51 close(fd); 52 53 if (info.attach_btf_id == 54 btf__find_by_name_kind(btf, attach_func, BTF_KIND_FUNC)) 55 cnt++; 56 } 57 58 free(p.prog_ids); 59 free(p.prog_attach_flags); 60 61 return cnt; 62 } 63 64 static void test_lsm_cgroup_functional(void) 65 { 66 DECLARE_LIBBPF_OPTS(bpf_prog_attach_opts, attach_opts); 67 DECLARE_LIBBPF_OPTS(bpf_link_update_opts, update_opts); 68 int cgroup_fd = -1, cgroup_fd2 = -1, cgroup_fd3 = -1; 69 int listen_fd, client_fd, accepted_fd; 70 struct lsm_cgroup *skel = NULL; 71 int post_create_prog_fd2 = -1; 72 int post_create_prog_fd = -1; 73 int bind_link_fd2 = -1; 74 int bind_prog_fd2 = -1; 75 int alloc_prog_fd = -1; 76 int bind_prog_fd = -1; 77 int bind_link_fd = -1; 78 int clone_prog_fd = -1; 79 int err, fd, prio; 80 socklen_t socklen; 81 82 cgroup_fd3 = test__join_cgroup("/sock_policy_empty"); 83 if (!ASSERT_GE(cgroup_fd3, 0, "create empty cgroup")) 84 goto close_cgroup; 85 86 cgroup_fd2 = test__join_cgroup("/sock_policy_reuse"); 87 if (!ASSERT_GE(cgroup_fd2, 0, "create cgroup for reuse")) 88 goto close_cgroup; 89 90 cgroup_fd = test__join_cgroup("/sock_policy"); 91 if (!ASSERT_GE(cgroup_fd, 0, "join_cgroup")) 92 goto close_cgroup; 93 94 skel = lsm_cgroup__open_and_load(); 95 if (!ASSERT_OK_PTR(skel, "open_and_load")) 96 goto close_cgroup; 97 98 post_create_prog_fd = bpf_program__fd(skel->progs.socket_post_create); 99 post_create_prog_fd2 = bpf_program__fd(skel->progs.socket_post_create2); 100 bind_prog_fd = bpf_program__fd(skel->progs.socket_bind); 101 bind_prog_fd2 = bpf_program__fd(skel->progs.socket_bind2); 102 alloc_prog_fd = bpf_program__fd(skel->progs.socket_alloc); 103 clone_prog_fd = bpf_program__fd(skel->progs.socket_clone); 104 105 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_sk_alloc_security"), 0, "prog count"); 106 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 0, "total prog count"); 107 err = bpf_prog_attach(alloc_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0); 108 if (err == -ENOTSUPP) { 109 test__skip(); 110 goto close_cgroup; 111 } 112 if (!ASSERT_OK(err, "attach alloc_prog_fd")) 113 goto detach_cgroup; 114 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_sk_alloc_security"), 1, "prog count"); 115 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 1, "total prog count"); 116 117 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_inet_csk_clone"), 0, "prog count"); 118 err = bpf_prog_attach(clone_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0); 119 if (!ASSERT_OK(err, "attach clone_prog_fd")) 120 goto detach_cgroup; 121 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_inet_csk_clone"), 1, "prog count"); 122 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 2, "total prog count"); 123 124 /* Make sure replacing works. */ 125 126 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 0, "prog count"); 127 err = bpf_prog_attach(post_create_prog_fd, cgroup_fd, 128 BPF_LSM_CGROUP, 0); 129 if (!ASSERT_OK(err, "attach post_create_prog_fd")) 130 goto detach_cgroup; 131 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 1, "prog count"); 132 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 3, "total prog count"); 133 134 attach_opts.replace_prog_fd = post_create_prog_fd; 135 err = bpf_prog_attach_opts(post_create_prog_fd2, cgroup_fd, 136 BPF_LSM_CGROUP, &attach_opts); 137 if (!ASSERT_OK(err, "prog replace post_create_prog_fd")) 138 goto detach_cgroup; 139 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 1, "prog count"); 140 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 3, "total prog count"); 141 142 /* Try the same attach/replace via link API. */ 143 144 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 0, "prog count"); 145 bind_link_fd = bpf_link_create(bind_prog_fd, cgroup_fd, 146 BPF_LSM_CGROUP, NULL); 147 if (!ASSERT_GE(bind_link_fd, 0, "link create bind_prog_fd")) 148 goto detach_cgroup; 149 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count"); 150 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count"); 151 152 update_opts.old_prog_fd = bind_prog_fd; 153 update_opts.flags = BPF_F_REPLACE; 154 155 err = bpf_link_update(bind_link_fd, bind_prog_fd2, &update_opts); 156 if (!ASSERT_OK(err, "link update bind_prog_fd")) 157 goto detach_cgroup; 158 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count"); 159 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count"); 160 161 /* Attach another instance of bind program to another cgroup. 162 * This should trigger the reuse of the trampoline shim (two 163 * programs attaching to the same btf_id). 164 */ 165 166 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count"); 167 ASSERT_EQ(query_prog_cnt(cgroup_fd2, "bpf_lsm_socket_bind"), 0, "prog count"); 168 bind_link_fd2 = bpf_link_create(bind_prog_fd2, cgroup_fd2, 169 BPF_LSM_CGROUP, NULL); 170 if (!ASSERT_GE(bind_link_fd2, 0, "link create bind_prog_fd2")) 171 goto detach_cgroup; 172 ASSERT_EQ(query_prog_cnt(cgroup_fd2, "bpf_lsm_socket_bind"), 1, "prog count"); 173 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count"); 174 ASSERT_EQ(query_prog_cnt(cgroup_fd2, NULL), 1, "total prog count"); 175 176 /* AF_UNIX is prohibited. */ 177 178 fd = socket(AF_UNIX, SOCK_STREAM, 0); 179 ASSERT_LT(fd, 0, "socket(AF_UNIX)"); 180 close(fd); 181 182 /* AF_INET6 gets default policy (sk_priority). */ 183 184 fd = socket(AF_INET6, SOCK_STREAM, 0); 185 if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)")) 186 goto detach_cgroup; 187 188 prio = 0; 189 socklen = sizeof(prio); 190 ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0, 191 "getsockopt"); 192 ASSERT_EQ(prio, 123, "sk_priority"); 193 194 close(fd); 195 196 /* TX-only AF_PACKET is allowed. */ 197 198 ASSERT_LT(socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)), 0, 199 "socket(AF_PACKET, ..., ETH_P_ALL)"); 200 201 fd = socket(AF_PACKET, SOCK_RAW, 0); 202 ASSERT_GE(fd, 0, "socket(AF_PACKET, ..., 0)"); 203 204 /* TX-only AF_PACKET can not be rebound. */ 205 206 struct sockaddr_ll sa = { 207 .sll_family = AF_PACKET, 208 .sll_protocol = htons(ETH_P_ALL), 209 }; 210 ASSERT_LT(bind(fd, (struct sockaddr *)&sa, sizeof(sa)), 0, 211 "bind(ETH_P_ALL)"); 212 213 close(fd); 214 215 /* Trigger passive open. */ 216 217 listen_fd = start_server(AF_INET6, SOCK_STREAM, "::1", 0, 0); 218 ASSERT_GE(listen_fd, 0, "start_server"); 219 client_fd = connect_to_fd(listen_fd, 0); 220 ASSERT_GE(client_fd, 0, "connect_to_fd"); 221 accepted_fd = accept(listen_fd, NULL, NULL); 222 ASSERT_GE(accepted_fd, 0, "accept"); 223 224 prio = 0; 225 socklen = sizeof(prio); 226 ASSERT_GE(getsockopt(accepted_fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0, 227 "getsockopt"); 228 ASSERT_EQ(prio, 234, "sk_priority"); 229 230 /* These are replaced and never called. */ 231 ASSERT_EQ(skel->bss->called_socket_post_create, 0, "called_create"); 232 ASSERT_EQ(skel->bss->called_socket_bind, 0, "called_bind"); 233 234 /* AF_INET6+SOCK_STREAM 235 * AF_PACKET+SOCK_RAW 236 * listen_fd 237 * client_fd 238 * accepted_fd 239 */ 240 ASSERT_EQ(skel->bss->called_socket_post_create2, 5, "called_create2"); 241 242 /* start_server 243 * bind(ETH_P_ALL) 244 */ 245 ASSERT_EQ(skel->bss->called_socket_bind2, 2, "called_bind2"); 246 /* Single accept(). */ 247 ASSERT_EQ(skel->bss->called_socket_clone, 1, "called_clone"); 248 249 /* AF_UNIX+SOCK_STREAM (failed) 250 * AF_INET6+SOCK_STREAM 251 * AF_PACKET+SOCK_RAW (failed) 252 * AF_PACKET+SOCK_RAW 253 * listen_fd 254 * client_fd 255 * accepted_fd 256 */ 257 ASSERT_EQ(skel->bss->called_socket_alloc, 7, "called_alloc"); 258 259 close(listen_fd); 260 close(client_fd); 261 close(accepted_fd); 262 263 /* Make sure other cgroup doesn't trigger the programs. */ 264 265 if (!ASSERT_OK(join_cgroup("/sock_policy_empty"), "join root cgroup")) 266 goto detach_cgroup; 267 268 fd = socket(AF_INET6, SOCK_STREAM, 0); 269 if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)")) 270 goto detach_cgroup; 271 272 prio = 0; 273 socklen = sizeof(prio); 274 ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0, 275 "getsockopt"); 276 ASSERT_EQ(prio, 0, "sk_priority"); 277 278 close(fd); 279 280 detach_cgroup: 281 ASSERT_GE(bpf_prog_detach2(post_create_prog_fd2, cgroup_fd, 282 BPF_LSM_CGROUP), 0, "detach_create"); 283 close(bind_link_fd); 284 /* Don't close bind_link_fd2, exercise cgroup release cleanup. */ 285 ASSERT_GE(bpf_prog_detach2(alloc_prog_fd, cgroup_fd, 286 BPF_LSM_CGROUP), 0, "detach_alloc"); 287 ASSERT_GE(bpf_prog_detach2(clone_prog_fd, cgroup_fd, 288 BPF_LSM_CGROUP), 0, "detach_clone"); 289 290 close_cgroup: 291 close(cgroup_fd); 292 close(cgroup_fd2); 293 close(cgroup_fd3); 294 lsm_cgroup__destroy(skel); 295 } 296 297 static void test_lsm_cgroup_nonvoid(void) 298 { 299 struct lsm_cgroup_nonvoid *skel = NULL; 300 301 skel = lsm_cgroup_nonvoid__open_and_load(); 302 ASSERT_NULL(skel, "open succeeds"); 303 lsm_cgroup_nonvoid__destroy(skel); 304 } 305 306 void test_lsm_cgroup(void) 307 { 308 if (test__start_subtest("functional")) 309 test_lsm_cgroup_functional(); 310 if (test__start_subtest("nonvoid")) 311 test_lsm_cgroup_nonvoid(); 312 btf__free(btf); 313 } 314