1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <sys/types.h> 4 #include <sys/socket.h> 5 #include <test_progs.h> 6 #include <bpf/btf.h> 7 8 #include "lsm_cgroup.skel.h" 9 #include "lsm_cgroup_nonvoid.skel.h" 10 #include "cgroup_helpers.h" 11 #include "network_helpers.h" 12 13 #ifndef ENOTSUPP 14 #define ENOTSUPP 524 15 #endif 16 17 static struct btf *btf; 18 19 static __u32 query_prog_cnt(int cgroup_fd, const char *attach_func) 20 { 21 LIBBPF_OPTS(bpf_prog_query_opts, p); 22 int cnt = 0; 23 int i; 24 25 ASSERT_OK(bpf_prog_query_opts(cgroup_fd, BPF_LSM_CGROUP, &p), "prog_query"); 26 27 if (!attach_func) 28 return p.prog_cnt; 29 30 /* When attach_func is provided, count the number of progs that 31 * attach to the given symbol. 32 */ 33 34 if (!btf) 35 btf = btf__load_vmlinux_btf(); 36 if (!ASSERT_OK(libbpf_get_error(btf), "btf_vmlinux")) 37 return -1; 38 39 p.prog_ids = malloc(sizeof(u32) * p.prog_cnt); 40 p.prog_attach_flags = malloc(sizeof(u32) * p.prog_cnt); 41 ASSERT_OK(bpf_prog_query_opts(cgroup_fd, BPF_LSM_CGROUP, &p), "prog_query"); 42 43 for (i = 0; i < p.prog_cnt; i++) { 44 struct bpf_prog_info info = {}; 45 __u32 info_len = sizeof(info); 46 int fd; 47 48 fd = bpf_prog_get_fd_by_id(p.prog_ids[i]); 49 ASSERT_GE(fd, 0, "prog_get_fd_by_id"); 50 ASSERT_OK(bpf_obj_get_info_by_fd(fd, &info, &info_len), "prog_info_by_fd"); 51 close(fd); 52 53 if (info.attach_btf_id == 54 btf__find_by_name_kind(btf, attach_func, BTF_KIND_FUNC)) 55 cnt++; 56 } 57 58 free(p.prog_ids); 59 free(p.prog_attach_flags); 60 61 return cnt; 62 } 63 64 static void test_lsm_cgroup_functional(void) 65 { 66 DECLARE_LIBBPF_OPTS(bpf_prog_attach_opts, attach_opts); 67 DECLARE_LIBBPF_OPTS(bpf_link_update_opts, update_opts); 68 int cgroup_fd = -1, cgroup_fd2 = -1, cgroup_fd3 = -1; 69 int listen_fd, client_fd, accepted_fd; 70 struct lsm_cgroup *skel = NULL; 71 int post_create_prog_fd2 = -1; 72 int post_create_prog_fd = -1; 73 int bind_link_fd2 = -1; 74 int bind_prog_fd2 = -1; 75 int alloc_prog_fd = -1; 76 int bind_prog_fd = -1; 77 int bind_link_fd = -1; 78 int clone_prog_fd = -1; 79 int err, fd, prio; 80 socklen_t socklen; 81 82 cgroup_fd3 = test__join_cgroup("/sock_policy_empty"); 83 if (!ASSERT_GE(cgroup_fd3, 0, "create empty cgroup")) 84 goto close_cgroup; 85 86 cgroup_fd2 = test__join_cgroup("/sock_policy_reuse"); 87 if (!ASSERT_GE(cgroup_fd2, 0, "create cgroup for reuse")) 88 goto close_cgroup; 89 90 cgroup_fd = test__join_cgroup("/sock_policy"); 91 if (!ASSERT_GE(cgroup_fd, 0, "join_cgroup")) 92 goto close_cgroup; 93 94 skel = lsm_cgroup__open_and_load(); 95 if (!ASSERT_OK_PTR(skel, "open_and_load")) 96 goto close_cgroup; 97 98 post_create_prog_fd = bpf_program__fd(skel->progs.socket_post_create); 99 post_create_prog_fd2 = bpf_program__fd(skel->progs.socket_post_create2); 100 bind_prog_fd = bpf_program__fd(skel->progs.socket_bind); 101 bind_prog_fd2 = bpf_program__fd(skel->progs.socket_bind2); 102 alloc_prog_fd = bpf_program__fd(skel->progs.socket_alloc); 103 clone_prog_fd = bpf_program__fd(skel->progs.socket_clone); 104 105 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_sk_alloc_security"), 0, "prog count"); 106 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 0, "total prog count"); 107 err = bpf_prog_attach(alloc_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0); 108 if (err == -ENOTSUPP) { 109 test__skip(); 110 goto close_cgroup; 111 } 112 if (!ASSERT_OK(err, "attach alloc_prog_fd")) 113 goto detach_cgroup; 114 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_sk_alloc_security"), 1, "prog count"); 115 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 1, "total prog count"); 116 117 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_inet_csk_clone"), 0, "prog count"); 118 err = bpf_prog_attach(clone_prog_fd, cgroup_fd, BPF_LSM_CGROUP, 0); 119 if (!ASSERT_OK(err, "attach clone_prog_fd")) 120 goto detach_cgroup; 121 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_inet_csk_clone"), 1, "prog count"); 122 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 2, "total prog count"); 123 124 /* Make sure replacing works. */ 125 126 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 0, "prog count"); 127 err = bpf_prog_attach(post_create_prog_fd, cgroup_fd, 128 BPF_LSM_CGROUP, 0); 129 if (!ASSERT_OK(err, "attach post_create_prog_fd")) 130 goto detach_cgroup; 131 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 1, "prog count"); 132 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 3, "total prog count"); 133 134 attach_opts.replace_prog_fd = post_create_prog_fd; 135 err = bpf_prog_attach_opts(post_create_prog_fd2, cgroup_fd, 136 BPF_LSM_CGROUP, &attach_opts); 137 if (!ASSERT_OK(err, "prog replace post_create_prog_fd")) 138 goto detach_cgroup; 139 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_post_create"), 1, "prog count"); 140 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 3, "total prog count"); 141 142 /* Try the same attach/replace via link API. */ 143 144 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 0, "prog count"); 145 bind_link_fd = bpf_link_create(bind_prog_fd, cgroup_fd, 146 BPF_LSM_CGROUP, NULL); 147 if (!ASSERT_GE(bind_link_fd, 0, "link create bind_prog_fd")) 148 goto detach_cgroup; 149 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count"); 150 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count"); 151 152 update_opts.old_prog_fd = bind_prog_fd; 153 update_opts.flags = BPF_F_REPLACE; 154 155 err = bpf_link_update(bind_link_fd, bind_prog_fd2, &update_opts); 156 if (!ASSERT_OK(err, "link update bind_prog_fd")) 157 goto detach_cgroup; 158 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count"); 159 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count"); 160 161 /* Attach another instance of bind program to another cgroup. 162 * This should trigger the reuse of the trampoline shim (two 163 * programs attaching to the same btf_id). 164 */ 165 166 ASSERT_EQ(query_prog_cnt(cgroup_fd, "bpf_lsm_socket_bind"), 1, "prog count"); 167 ASSERT_EQ(query_prog_cnt(cgroup_fd2, "bpf_lsm_socket_bind"), 0, "prog count"); 168 bind_link_fd2 = bpf_link_create(bind_prog_fd2, cgroup_fd2, 169 BPF_LSM_CGROUP, NULL); 170 if (!ASSERT_GE(bind_link_fd2, 0, "link create bind_prog_fd2")) 171 goto detach_cgroup; 172 ASSERT_EQ(query_prog_cnt(cgroup_fd2, "bpf_lsm_socket_bind"), 1, "prog count"); 173 ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count"); 174 ASSERT_EQ(query_prog_cnt(cgroup_fd2, NULL), 1, "total prog count"); 175 176 fd = socket(AF_UNIX, SOCK_STREAM, 0); 177 if (!(skel->kconfig->CONFIG_SECURITY_APPARMOR 178 || skel->kconfig->CONFIG_SECURITY_SELINUX 179 || skel->kconfig->CONFIG_SECURITY_SMACK)) 180 /* AF_UNIX is prohibited. */ 181 ASSERT_LT(fd, 0, "socket(AF_UNIX)"); 182 close(fd); 183 184 /* AF_INET6 gets default policy (sk_priority). */ 185 186 fd = socket(AF_INET6, SOCK_STREAM, 0); 187 if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)")) 188 goto detach_cgroup; 189 190 prio = 0; 191 socklen = sizeof(prio); 192 ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0, 193 "getsockopt"); 194 ASSERT_EQ(prio, 123, "sk_priority"); 195 196 close(fd); 197 198 /* TX-only AF_PACKET is allowed. */ 199 200 ASSERT_LT(socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)), 0, 201 "socket(AF_PACKET, ..., ETH_P_ALL)"); 202 203 fd = socket(AF_PACKET, SOCK_RAW, 0); 204 ASSERT_GE(fd, 0, "socket(AF_PACKET, ..., 0)"); 205 206 /* TX-only AF_PACKET can not be rebound. */ 207 208 struct sockaddr_ll sa = { 209 .sll_family = AF_PACKET, 210 .sll_protocol = htons(ETH_P_ALL), 211 }; 212 ASSERT_LT(bind(fd, (struct sockaddr *)&sa, sizeof(sa)), 0, 213 "bind(ETH_P_ALL)"); 214 215 close(fd); 216 217 /* Trigger passive open. */ 218 219 listen_fd = start_server(AF_INET6, SOCK_STREAM, "::1", 0, 0); 220 ASSERT_GE(listen_fd, 0, "start_server"); 221 client_fd = connect_to_fd(listen_fd, 0); 222 ASSERT_GE(client_fd, 0, "connect_to_fd"); 223 accepted_fd = accept(listen_fd, NULL, NULL); 224 ASSERT_GE(accepted_fd, 0, "accept"); 225 226 prio = 0; 227 socklen = sizeof(prio); 228 ASSERT_GE(getsockopt(accepted_fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0, 229 "getsockopt"); 230 ASSERT_EQ(prio, 234, "sk_priority"); 231 232 /* These are replaced and never called. */ 233 ASSERT_EQ(skel->bss->called_socket_post_create, 0, "called_create"); 234 ASSERT_EQ(skel->bss->called_socket_bind, 0, "called_bind"); 235 236 /* AF_INET6+SOCK_STREAM 237 * AF_PACKET+SOCK_RAW 238 * AF_UNIX+SOCK_RAW if already have non-bpf lsms installed 239 * listen_fd 240 * client_fd 241 * accepted_fd 242 */ 243 if (skel->kconfig->CONFIG_SECURITY_APPARMOR 244 || skel->kconfig->CONFIG_SECURITY_SELINUX 245 || skel->kconfig->CONFIG_SECURITY_SMACK) 246 /* AF_UNIX+SOCK_RAW if already have non-bpf lsms installed */ 247 ASSERT_EQ(skel->bss->called_socket_post_create2, 6, "called_create2"); 248 else 249 ASSERT_EQ(skel->bss->called_socket_post_create2, 5, "called_create2"); 250 251 /* start_server 252 * bind(ETH_P_ALL) 253 */ 254 ASSERT_EQ(skel->bss->called_socket_bind2, 2, "called_bind2"); 255 /* Single accept(). */ 256 ASSERT_EQ(skel->bss->called_socket_clone, 1, "called_clone"); 257 258 /* AF_UNIX+SOCK_STREAM (failed) 259 * AF_INET6+SOCK_STREAM 260 * AF_PACKET+SOCK_RAW (failed) 261 * AF_PACKET+SOCK_RAW 262 * listen_fd 263 * client_fd 264 * accepted_fd 265 */ 266 ASSERT_EQ(skel->bss->called_socket_alloc, 7, "called_alloc"); 267 268 close(listen_fd); 269 close(client_fd); 270 close(accepted_fd); 271 272 /* Make sure other cgroup doesn't trigger the programs. */ 273 274 if (!ASSERT_OK(join_cgroup("/sock_policy_empty"), "join root cgroup")) 275 goto detach_cgroup; 276 277 fd = socket(AF_INET6, SOCK_STREAM, 0); 278 if (!ASSERT_GE(fd, 0, "socket(SOCK_STREAM)")) 279 goto detach_cgroup; 280 281 prio = 0; 282 socklen = sizeof(prio); 283 ASSERT_GE(getsockopt(fd, SOL_SOCKET, SO_PRIORITY, &prio, &socklen), 0, 284 "getsockopt"); 285 ASSERT_EQ(prio, 0, "sk_priority"); 286 287 close(fd); 288 289 detach_cgroup: 290 ASSERT_GE(bpf_prog_detach2(post_create_prog_fd2, cgroup_fd, 291 BPF_LSM_CGROUP), 0, "detach_create"); 292 close(bind_link_fd); 293 /* Don't close bind_link_fd2, exercise cgroup release cleanup. */ 294 ASSERT_GE(bpf_prog_detach2(alloc_prog_fd, cgroup_fd, 295 BPF_LSM_CGROUP), 0, "detach_alloc"); 296 ASSERT_GE(bpf_prog_detach2(clone_prog_fd, cgroup_fd, 297 BPF_LSM_CGROUP), 0, "detach_clone"); 298 299 close_cgroup: 300 close(cgroup_fd); 301 close(cgroup_fd2); 302 close(cgroup_fd3); 303 lsm_cgroup__destroy(skel); 304 } 305 306 static void test_lsm_cgroup_nonvoid(void) 307 { 308 struct lsm_cgroup_nonvoid *skel = NULL; 309 310 skel = lsm_cgroup_nonvoid__open_and_load(); 311 ASSERT_NULL(skel, "open succeeds"); 312 lsm_cgroup_nonvoid__destroy(skel); 313 } 314 315 void test_lsm_cgroup(void) 316 { 317 if (test__start_subtest("functional")) 318 test_lsm_cgroup_functional(); 319 if (test__start_subtest("nonvoid")) 320 test_lsm_cgroup_nonvoid(); 321 btf__free(btf); 322 } 323