1 // SPDX-License-Identifier: GPL-2.0 2 3 /* 4 * Copyright (C) 2020 Google LLC. 5 */ 6 7 #include <asm-generic/errno-base.h> 8 #include <sys/stat.h> 9 #include <test_progs.h> 10 #include <linux/limits.h> 11 12 #include "local_storage.skel.h" 13 #include "network_helpers.h" 14 15 #ifndef __NR_pidfd_open 16 #define __NR_pidfd_open 434 17 #endif 18 19 static inline int sys_pidfd_open(pid_t pid, unsigned int flags) 20 { 21 return syscall(__NR_pidfd_open, pid, flags); 22 } 23 24 static unsigned int duration; 25 26 #define TEST_STORAGE_VALUE 0xbeefdead 27 28 struct storage { 29 void *inode; 30 unsigned int value; 31 /* Lock ensures that spin locked versions of local stoage operations 32 * also work, most operations in this tests are still single threaded 33 */ 34 struct bpf_spin_lock lock; 35 }; 36 37 /* Fork and exec the provided rm binary and return the exit code of the 38 * forked process and its pid. 39 */ 40 static int run_self_unlink(int *monitored_pid, const char *rm_path) 41 { 42 int child_pid, child_status, ret; 43 int null_fd; 44 45 child_pid = fork(); 46 if (child_pid == 0) { 47 null_fd = open("/dev/null", O_WRONLY); 48 dup2(null_fd, STDOUT_FILENO); 49 dup2(null_fd, STDERR_FILENO); 50 close(null_fd); 51 52 *monitored_pid = getpid(); 53 /* Use the copied /usr/bin/rm to delete itself 54 * /tmp/copy_of_rm /tmp/copy_of_rm. 55 */ 56 ret = execlp(rm_path, rm_path, rm_path, NULL); 57 if (ret) 58 exit(errno); 59 } else if (child_pid > 0) { 60 waitpid(child_pid, &child_status, 0); 61 return WEXITSTATUS(child_status); 62 } 63 64 return -EINVAL; 65 } 66 67 static bool check_syscall_operations(int map_fd, int obj_fd) 68 { 69 struct storage val = { .value = TEST_STORAGE_VALUE, .lock = { 0 } }, 70 lookup_val = { .value = 0, .lock = { 0 } }; 71 int err; 72 73 /* Looking up an existing element should fail initially */ 74 err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 75 BPF_F_LOCK); 76 if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem", 77 "err:%d errno:%d\n", err, errno)) 78 return false; 79 80 /* Create a new element */ 81 err = bpf_map_update_elem(map_fd, &obj_fd, &val, 82 BPF_NOEXIST | BPF_F_LOCK); 83 if (CHECK(err < 0, "bpf_map_update_elem", "err:%d errno:%d\n", err, 84 errno)) 85 return false; 86 87 /* Lookup the newly created element */ 88 err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 89 BPF_F_LOCK); 90 if (CHECK(err < 0, "bpf_map_lookup_elem", "err:%d errno:%d", err, 91 errno)) 92 return false; 93 94 /* Check the value of the newly created element */ 95 if (CHECK(lookup_val.value != val.value, "bpf_map_lookup_elem", 96 "value got = %x errno:%d", lookup_val.value, val.value)) 97 return false; 98 99 err = bpf_map_delete_elem(map_fd, &obj_fd); 100 if (CHECK(err, "bpf_map_delete_elem()", "err:%d errno:%d\n", err, 101 errno)) 102 return false; 103 104 /* The lookup should fail, now that the element has been deleted */ 105 err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 106 BPF_F_LOCK); 107 if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem", 108 "err:%d errno:%d\n", err, errno)) 109 return false; 110 111 return true; 112 } 113 114 void test_test_local_storage(void) 115 { 116 char tmp_dir_path[64] = "/tmp/local_storageXXXXXX"; 117 int err, serv_sk = -1, task_fd = -1, rm_fd = -1; 118 struct local_storage *skel = NULL; 119 char tmp_exec_path[64]; 120 char cmd[256]; 121 122 skel = local_storage__open_and_load(); 123 if (CHECK(!skel, "skel_load", "lsm skeleton failed\n")) 124 goto close_prog; 125 126 err = local_storage__attach(skel); 127 if (CHECK(err, "attach", "lsm attach failed: %d\n", err)) 128 goto close_prog; 129 130 task_fd = sys_pidfd_open(getpid(), 0); 131 if (CHECK(task_fd < 0, "pidfd_open", 132 "failed to get pidfd err:%d, errno:%d", task_fd, errno)) 133 goto close_prog; 134 135 if (!check_syscall_operations(bpf_map__fd(skel->maps.task_storage_map), 136 task_fd)) 137 goto close_prog; 138 139 if (CHECK(!mkdtemp(tmp_dir_path), "mkdtemp", 140 "unable to create tmpdir: %d\n", errno)) 141 goto close_prog; 142 143 snprintf(tmp_exec_path, sizeof(tmp_exec_path), "%s/copy_of_rm", 144 tmp_dir_path); 145 snprintf(cmd, sizeof(cmd), "cp /bin/rm %s", tmp_exec_path); 146 if (CHECK_FAIL(system(cmd))) 147 goto close_prog_rmdir; 148 149 rm_fd = open(tmp_exec_path, O_RDONLY); 150 if (CHECK(rm_fd < 0, "open", "failed to open %s err:%d, errno:%d", 151 tmp_exec_path, rm_fd, errno)) 152 goto close_prog_rmdir; 153 154 if (!check_syscall_operations(bpf_map__fd(skel->maps.inode_storage_map), 155 rm_fd)) 156 goto close_prog_rmdir; 157 158 /* Sets skel->bss->monitored_pid to the pid of the forked child 159 * forks a child process that executes tmp_exec_path and tries to 160 * unlink its executable. This operation should be denied by the loaded 161 * LSM program. 162 */ 163 err = run_self_unlink(&skel->bss->monitored_pid, tmp_exec_path); 164 if (CHECK(err != EPERM, "run_self_unlink", "err %d want EPERM\n", err)) 165 goto close_prog_rmdir; 166 167 /* Set the process being monitored to be the current process */ 168 skel->bss->monitored_pid = getpid(); 169 170 /* Move copy_of_rm to a new location so that it triggers the 171 * inode_rename LSM hook with a new_dentry that has a NULL inode ptr. 172 */ 173 snprintf(cmd, sizeof(cmd), "mv %s/copy_of_rm %s/check_null_ptr", 174 tmp_dir_path, tmp_dir_path); 175 if (CHECK_FAIL(system(cmd))) 176 goto close_prog_rmdir; 177 178 CHECK(skel->data->inode_storage_result != 0, "inode_storage_result", 179 "inode_local_storage not set\n"); 180 181 serv_sk = start_server(AF_INET6, SOCK_STREAM, NULL, 0, 0); 182 if (CHECK(serv_sk < 0, "start_server", "failed to start server\n")) 183 goto close_prog_rmdir; 184 185 CHECK(skel->data->sk_storage_result != 0, "sk_storage_result", 186 "sk_local_storage not set\n"); 187 188 if (!check_syscall_operations(bpf_map__fd(skel->maps.sk_storage_map), 189 serv_sk)) 190 goto close_prog_rmdir; 191 192 close_prog_rmdir: 193 snprintf(cmd, sizeof(cmd), "rm -rf %s", tmp_dir_path); 194 system(cmd); 195 close_prog: 196 close(serv_sk); 197 close(rm_fd); 198 close(task_fd); 199 local_storage__destroy(skel); 200 } 201