1cd324d7aSKP Singh // SPDX-License-Identifier: GPL-2.0 2cd324d7aSKP Singh 3cd324d7aSKP Singh /* 4cd324d7aSKP Singh * Copyright (C) 2020 Google LLC. 5cd324d7aSKP Singh */ 6cd324d7aSKP Singh 79cde3beeSKP Singh #include <asm-generic/errno-base.h> 89cde3beeSKP Singh #include <sys/stat.h> 9cd324d7aSKP Singh #include <test_progs.h> 10cd324d7aSKP Singh #include <linux/limits.h> 11cd324d7aSKP Singh 12cd324d7aSKP Singh #include "local_storage.skel.h" 13cd324d7aSKP Singh #include "network_helpers.h" 14cd324d7aSKP Singh 15f055f355SAlexei Starovoitov #ifndef __NR_pidfd_open 16f055f355SAlexei Starovoitov #define __NR_pidfd_open 434 17f055f355SAlexei Starovoitov #endif 18f055f355SAlexei Starovoitov 199cde3beeSKP Singh static inline int sys_pidfd_open(pid_t pid, unsigned int flags) 20cd324d7aSKP Singh { 219cde3beeSKP Singh return syscall(__NR_pidfd_open, pid, flags); 229cde3beeSKP Singh } 23cd324d7aSKP Singh 249cde3beeSKP Singh static unsigned int duration; 259cde3beeSKP Singh 269cde3beeSKP Singh #define TEST_STORAGE_VALUE 0xbeefdead 279cde3beeSKP Singh 289cde3beeSKP Singh struct storage { 299cde3beeSKP Singh void *inode; 309cde3beeSKP Singh unsigned int value; 319cde3beeSKP Singh }; 329cde3beeSKP Singh 339cde3beeSKP Singh /* Fork and exec the provided rm binary and return the exit code of the 349cde3beeSKP Singh * forked process and its pid. 359cde3beeSKP Singh */ 369cde3beeSKP Singh static int run_self_unlink(int *monitored_pid, const char *rm_path) 379cde3beeSKP Singh { 389cde3beeSKP Singh int child_pid, child_status, ret; 399cde3beeSKP Singh int null_fd; 409cde3beeSKP Singh 419cde3beeSKP Singh child_pid = fork(); 429cde3beeSKP Singh if (child_pid == 0) { 439cde3beeSKP Singh null_fd = open("/dev/null", O_WRONLY); 449cde3beeSKP Singh dup2(null_fd, STDOUT_FILENO); 459cde3beeSKP Singh dup2(null_fd, STDERR_FILENO); 469cde3beeSKP Singh close(null_fd); 479cde3beeSKP Singh 489cde3beeSKP Singh *monitored_pid = getpid(); 499cde3beeSKP Singh /* Use the copied /usr/bin/rm to delete itself 509cde3beeSKP Singh * /tmp/copy_of_rm /tmp/copy_of_rm. 519cde3beeSKP Singh */ 529cde3beeSKP Singh ret = execlp(rm_path, rm_path, rm_path, NULL); 539cde3beeSKP Singh if (ret) 549cde3beeSKP Singh exit(errno); 559cde3beeSKP Singh } else if (child_pid > 0) { 569cde3beeSKP Singh waitpid(child_pid, &child_status, 0); 579cde3beeSKP Singh return WEXITSTATUS(child_status); 589cde3beeSKP Singh } 599cde3beeSKP Singh 609cde3beeSKP Singh return -EINVAL; 619cde3beeSKP Singh } 629cde3beeSKP Singh 639cde3beeSKP Singh static bool check_syscall_operations(int map_fd, int obj_fd) 649cde3beeSKP Singh { 65*0ae6eff2SKP Singh struct storage val = { .value = TEST_STORAGE_VALUE }, 66*0ae6eff2SKP Singh lookup_val = { .value = 0 }; 679cde3beeSKP Singh int err; 689cde3beeSKP Singh 699cde3beeSKP Singh /* Looking up an existing element should fail initially */ 70*0ae6eff2SKP Singh err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 0); 719cde3beeSKP Singh if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem", 729cde3beeSKP Singh "err:%d errno:%d\n", err, errno)) 739cde3beeSKP Singh return false; 749cde3beeSKP Singh 759cde3beeSKP Singh /* Create a new element */ 76*0ae6eff2SKP Singh err = bpf_map_update_elem(map_fd, &obj_fd, &val, BPF_NOEXIST); 779cde3beeSKP Singh if (CHECK(err < 0, "bpf_map_update_elem", "err:%d errno:%d\n", err, 789cde3beeSKP Singh errno)) 799cde3beeSKP Singh return false; 809cde3beeSKP Singh 819cde3beeSKP Singh /* Lookup the newly created element */ 82*0ae6eff2SKP Singh err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 0); 839cde3beeSKP Singh if (CHECK(err < 0, "bpf_map_lookup_elem", "err:%d errno:%d", err, 849cde3beeSKP Singh errno)) 859cde3beeSKP Singh return false; 869cde3beeSKP Singh 879cde3beeSKP Singh /* Check the value of the newly created element */ 889cde3beeSKP Singh if (CHECK(lookup_val.value != val.value, "bpf_map_lookup_elem", 899cde3beeSKP Singh "value got = %x errno:%d", lookup_val.value, val.value)) 909cde3beeSKP Singh return false; 919cde3beeSKP Singh 929cde3beeSKP Singh err = bpf_map_delete_elem(map_fd, &obj_fd); 939cde3beeSKP Singh if (CHECK(err, "bpf_map_delete_elem()", "err:%d errno:%d\n", err, 949cde3beeSKP Singh errno)) 959cde3beeSKP Singh return false; 969cde3beeSKP Singh 979cde3beeSKP Singh /* The lookup should fail, now that the element has been deleted */ 98*0ae6eff2SKP Singh err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 0); 999cde3beeSKP Singh if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem", 1009cde3beeSKP Singh "err:%d errno:%d\n", err, errno)) 1019cde3beeSKP Singh return false; 1029cde3beeSKP Singh 1039cde3beeSKP Singh return true; 104cd324d7aSKP Singh } 105cd324d7aSKP Singh 106cd324d7aSKP Singh void test_test_local_storage(void) 107cd324d7aSKP Singh { 10815075bb7SKP Singh char tmp_dir_path[] = "/tmp/local_storageXXXXXX"; 1094170bc6bSKP Singh int err, serv_sk = -1, task_fd = -1, rm_fd = -1; 110cd324d7aSKP Singh struct local_storage *skel = NULL; 1112f94ac19SKP Singh char tmp_exec_path[64]; 1122f94ac19SKP Singh char cmd[256]; 113cd324d7aSKP Singh 114cd324d7aSKP Singh skel = local_storage__open_and_load(); 115cd324d7aSKP Singh if (CHECK(!skel, "skel_load", "lsm skeleton failed\n")) 116cd324d7aSKP Singh goto close_prog; 117cd324d7aSKP Singh 118cd324d7aSKP Singh err = local_storage__attach(skel); 119cd324d7aSKP Singh if (CHECK(err, "attach", "lsm attach failed: %d\n", err)) 120cd324d7aSKP Singh goto close_prog; 121cd324d7aSKP Singh 1229cde3beeSKP Singh task_fd = sys_pidfd_open(getpid(), 0); 1239cde3beeSKP Singh if (CHECK(task_fd < 0, "pidfd_open", 1249cde3beeSKP Singh "failed to get pidfd err:%d, errno:%d", task_fd, errno)) 1259cde3beeSKP Singh goto close_prog; 1269cde3beeSKP Singh 1279cde3beeSKP Singh if (!check_syscall_operations(bpf_map__fd(skel->maps.task_storage_map), 1289cde3beeSKP Singh task_fd)) 1299cde3beeSKP Singh goto close_prog; 1309cde3beeSKP Singh 1312f94ac19SKP Singh if (CHECK(!mkdtemp(tmp_dir_path), "mkdtemp", 1322f94ac19SKP Singh "unable to create tmpdir: %d\n", errno)) 1339cde3beeSKP Singh goto close_prog; 1349cde3beeSKP Singh 1352f94ac19SKP Singh snprintf(tmp_exec_path, sizeof(tmp_exec_path), "%s/copy_of_rm", 1362f94ac19SKP Singh tmp_dir_path); 1372f94ac19SKP Singh snprintf(cmd, sizeof(cmd), "cp /bin/rm %s", tmp_exec_path); 1382f94ac19SKP Singh if (CHECK_FAIL(system(cmd))) 1392f94ac19SKP Singh goto close_prog_rmdir; 1402f94ac19SKP Singh 1414170bc6bSKP Singh rm_fd = open(tmp_exec_path, O_RDONLY); 1424170bc6bSKP Singh if (CHECK(rm_fd < 0, "open", "failed to open %s err:%d, errno:%d", 1434170bc6bSKP Singh tmp_exec_path, rm_fd, errno)) 1442f94ac19SKP Singh goto close_prog_rmdir; 1454170bc6bSKP Singh 1464170bc6bSKP Singh if (!check_syscall_operations(bpf_map__fd(skel->maps.inode_storage_map), 1474170bc6bSKP Singh rm_fd)) 1482f94ac19SKP Singh goto close_prog_rmdir; 1494170bc6bSKP Singh 1509cde3beeSKP Singh /* Sets skel->bss->monitored_pid to the pid of the forked child 1519cde3beeSKP Singh * forks a child process that executes tmp_exec_path and tries to 1529cde3beeSKP Singh * unlink its executable. This operation should be denied by the loaded 1539cde3beeSKP Singh * LSM program. 1549cde3beeSKP Singh */ 1559cde3beeSKP Singh err = run_self_unlink(&skel->bss->monitored_pid, tmp_exec_path); 1569cde3beeSKP Singh if (CHECK(err != EPERM, "run_self_unlink", "err %d want EPERM\n", err)) 1572f94ac19SKP Singh goto close_prog_rmdir; 1589cde3beeSKP Singh 1599cde3beeSKP Singh /* Set the process being monitored to be the current process */ 160cd324d7aSKP Singh skel->bss->monitored_pid = getpid(); 161cd324d7aSKP Singh 1622f94ac19SKP Singh /* Move copy_of_rm to a new location so that it triggers the 1632f94ac19SKP Singh * inode_rename LSM hook with a new_dentry that has a NULL inode ptr. 1642f94ac19SKP Singh */ 1652f94ac19SKP Singh snprintf(cmd, sizeof(cmd), "mv %s/copy_of_rm %s/check_null_ptr", 1662f94ac19SKP Singh tmp_dir_path, tmp_dir_path); 1672f94ac19SKP Singh if (CHECK_FAIL(system(cmd))) 1682f94ac19SKP Singh goto close_prog_rmdir; 169cd324d7aSKP Singh 170cd324d7aSKP Singh CHECK(skel->data->inode_storage_result != 0, "inode_storage_result", 171cd324d7aSKP Singh "inode_local_storage not set\n"); 172cd324d7aSKP Singh 173cd324d7aSKP Singh serv_sk = start_server(AF_INET6, SOCK_STREAM, NULL, 0, 0); 174cd324d7aSKP Singh if (CHECK(serv_sk < 0, "start_server", "failed to start server\n")) 1752f94ac19SKP Singh goto close_prog_rmdir; 176cd324d7aSKP Singh 177cd324d7aSKP Singh CHECK(skel->data->sk_storage_result != 0, "sk_storage_result", 178cd324d7aSKP Singh "sk_local_storage not set\n"); 179cd324d7aSKP Singh 1804170bc6bSKP Singh if (!check_syscall_operations(bpf_map__fd(skel->maps.sk_storage_map), 1814170bc6bSKP Singh serv_sk)) 1822f94ac19SKP Singh goto close_prog_rmdir; 183cd324d7aSKP Singh 1842f94ac19SKP Singh close_prog_rmdir: 1852f94ac19SKP Singh snprintf(cmd, sizeof(cmd), "rm -rf %s", tmp_dir_path); 1862f94ac19SKP Singh system(cmd); 187cd324d7aSKP Singh close_prog: 1884170bc6bSKP Singh close(serv_sk); 1894170bc6bSKP Singh close(rm_fd); 1909cde3beeSKP Singh close(task_fd); 191cd324d7aSKP Singh local_storage__destroy(skel); 192cd324d7aSKP Singh } 193