1fc975906SRoberto Sassu // SPDX-License-Identifier: GPL-2.0
2fc975906SRoberto Sassu
3fc975906SRoberto Sassu /*
4fc975906SRoberto Sassu * Copyright (C) 2022 Huawei Technologies Duesseldorf GmbH
5fc975906SRoberto Sassu *
6fc975906SRoberto Sassu * Author: Roberto Sassu <roberto.sassu@huawei.com>
7fc975906SRoberto Sassu */
8fc975906SRoberto Sassu
9fc975906SRoberto Sassu #include <stdio.h>
10fc975906SRoberto Sassu #include <errno.h>
11fc975906SRoberto Sassu #include <stdlib.h>
12fc975906SRoberto Sassu #include <unistd.h>
13fc975906SRoberto Sassu #include <endian.h>
14fc975906SRoberto Sassu #include <limits.h>
15fc975906SRoberto Sassu #include <sys/stat.h>
16fc975906SRoberto Sassu #include <sys/wait.h>
17fc975906SRoberto Sassu #include <sys/mman.h>
18fc975906SRoberto Sassu #include <linux/keyctl.h>
19fc975906SRoberto Sassu #include <test_progs.h>
20fc975906SRoberto Sassu
21fc975906SRoberto Sassu #include "test_verify_pkcs7_sig.skel.h"
22fc975906SRoberto Sassu
23fc975906SRoberto Sassu #define MAX_DATA_SIZE (1024 * 1024)
24fc975906SRoberto Sassu #define MAX_SIG_SIZE 1024
25fc975906SRoberto Sassu
26fc975906SRoberto Sassu #define VERIFY_USE_SECONDARY_KEYRING (1UL)
27fc975906SRoberto Sassu #define VERIFY_USE_PLATFORM_KEYRING (2UL)
28fc975906SRoberto Sassu
29fc975906SRoberto Sassu /* In stripped ARM and x86-64 modules, ~ is surprisingly rare. */
30fc975906SRoberto Sassu #define MODULE_SIG_STRING "~Module signature appended~\n"
31fc975906SRoberto Sassu
32fc975906SRoberto Sassu /*
33fc975906SRoberto Sassu * Module signature information block.
34fc975906SRoberto Sassu *
35fc975906SRoberto Sassu * The constituents of the signature section are, in order:
36fc975906SRoberto Sassu *
37fc975906SRoberto Sassu * - Signer's name
38fc975906SRoberto Sassu * - Key identifier
39fc975906SRoberto Sassu * - Signature data
40fc975906SRoberto Sassu * - Information block
41fc975906SRoberto Sassu */
42fc975906SRoberto Sassu struct module_signature {
43fc975906SRoberto Sassu __u8 algo; /* Public-key crypto algorithm [0] */
44fc975906SRoberto Sassu __u8 hash; /* Digest algorithm [0] */
45fc975906SRoberto Sassu __u8 id_type; /* Key identifier type [PKEY_ID_PKCS7] */
46fc975906SRoberto Sassu __u8 signer_len; /* Length of signer's name [0] */
47fc975906SRoberto Sassu __u8 key_id_len; /* Length of key identifier [0] */
48fc975906SRoberto Sassu __u8 __pad[3];
49fc975906SRoberto Sassu __be32 sig_len; /* Length of signature data */
50fc975906SRoberto Sassu };
51fc975906SRoberto Sassu
52fc975906SRoberto Sassu struct data {
53fc975906SRoberto Sassu __u8 data[MAX_DATA_SIZE];
54fc975906SRoberto Sassu __u32 data_len;
55fc975906SRoberto Sassu __u8 sig[MAX_SIG_SIZE];
56fc975906SRoberto Sassu __u32 sig_len;
57fc975906SRoberto Sassu };
58fc975906SRoberto Sassu
59fc975906SRoberto Sassu static bool kfunc_not_supported;
60fc975906SRoberto Sassu
libbpf_print_cb(enum libbpf_print_level level,const char * fmt,va_list args)61fc975906SRoberto Sassu static int libbpf_print_cb(enum libbpf_print_level level, const char *fmt,
62fc975906SRoberto Sassu va_list args)
63fc975906SRoberto Sassu {
64*56e1a504SIlya Leoshkevich if (level == LIBBPF_WARN)
65*56e1a504SIlya Leoshkevich vprintf(fmt, args);
66*56e1a504SIlya Leoshkevich
67fc975906SRoberto Sassu if (strcmp(fmt, "libbpf: extern (func ksym) '%s': not found in kernel or module BTFs\n"))
68fc975906SRoberto Sassu return 0;
69fc975906SRoberto Sassu
70fc975906SRoberto Sassu if (strcmp(va_arg(args, char *), "bpf_verify_pkcs7_signature"))
71fc975906SRoberto Sassu return 0;
72fc975906SRoberto Sassu
73fc975906SRoberto Sassu kfunc_not_supported = true;
74fc975906SRoberto Sassu return 0;
75fc975906SRoberto Sassu }
76fc975906SRoberto Sassu
_run_setup_process(const char * setup_dir,const char * cmd)77fc975906SRoberto Sassu static int _run_setup_process(const char *setup_dir, const char *cmd)
78fc975906SRoberto Sassu {
79fc975906SRoberto Sassu int child_pid, child_status;
80fc975906SRoberto Sassu
81fc975906SRoberto Sassu child_pid = fork();
82fc975906SRoberto Sassu if (child_pid == 0) {
83fc975906SRoberto Sassu execlp("./verify_sig_setup.sh", "./verify_sig_setup.sh", cmd,
84fc975906SRoberto Sassu setup_dir, NULL);
85fc975906SRoberto Sassu exit(errno);
86fc975906SRoberto Sassu
87fc975906SRoberto Sassu } else if (child_pid > 0) {
88fc975906SRoberto Sassu waitpid(child_pid, &child_status, 0);
89fc975906SRoberto Sassu return WEXITSTATUS(child_status);
90fc975906SRoberto Sassu }
91fc975906SRoberto Sassu
92fc975906SRoberto Sassu return -EINVAL;
93fc975906SRoberto Sassu }
94fc975906SRoberto Sassu
populate_data_item_str(const char * tmp_dir,struct data * data_item)95fc975906SRoberto Sassu static int populate_data_item_str(const char *tmp_dir, struct data *data_item)
96fc975906SRoberto Sassu {
97fc975906SRoberto Sassu struct stat st;
98fc975906SRoberto Sassu char data_template[] = "/tmp/dataXXXXXX";
99fc975906SRoberto Sassu char path[PATH_MAX];
100fc975906SRoberto Sassu int ret, fd, child_status, child_pid;
101fc975906SRoberto Sassu
102fc975906SRoberto Sassu data_item->data_len = 4;
103fc975906SRoberto Sassu memcpy(data_item->data, "test", data_item->data_len);
104fc975906SRoberto Sassu
105fc975906SRoberto Sassu fd = mkstemp(data_template);
106fc975906SRoberto Sassu if (fd == -1)
107fc975906SRoberto Sassu return -errno;
108fc975906SRoberto Sassu
109fc975906SRoberto Sassu ret = write(fd, data_item->data, data_item->data_len);
110fc975906SRoberto Sassu
111fc975906SRoberto Sassu close(fd);
112fc975906SRoberto Sassu
113fc975906SRoberto Sassu if (ret != data_item->data_len) {
114fc975906SRoberto Sassu ret = -EIO;
115fc975906SRoberto Sassu goto out;
116fc975906SRoberto Sassu }
117fc975906SRoberto Sassu
118fc975906SRoberto Sassu child_pid = fork();
119fc975906SRoberto Sassu
120fc975906SRoberto Sassu if (child_pid == -1) {
121fc975906SRoberto Sassu ret = -errno;
122fc975906SRoberto Sassu goto out;
123fc975906SRoberto Sassu }
124fc975906SRoberto Sassu
125fc975906SRoberto Sassu if (child_pid == 0) {
126fc975906SRoberto Sassu snprintf(path, sizeof(path), "%s/signing_key.pem", tmp_dir);
127fc975906SRoberto Sassu
128fc975906SRoberto Sassu return execlp("./sign-file", "./sign-file", "-d", "sha256",
129fc975906SRoberto Sassu path, path, data_template, NULL);
130fc975906SRoberto Sassu }
131fc975906SRoberto Sassu
132fc975906SRoberto Sassu waitpid(child_pid, &child_status, 0);
133fc975906SRoberto Sassu
134fc975906SRoberto Sassu ret = WEXITSTATUS(child_status);
135fc975906SRoberto Sassu if (ret)
136fc975906SRoberto Sassu goto out;
137fc975906SRoberto Sassu
138fc975906SRoberto Sassu snprintf(path, sizeof(path), "%s.p7s", data_template);
139fc975906SRoberto Sassu
140fc975906SRoberto Sassu ret = stat(path, &st);
141fc975906SRoberto Sassu if (ret == -1) {
142fc975906SRoberto Sassu ret = -errno;
143fc975906SRoberto Sassu goto out;
144fc975906SRoberto Sassu }
145fc975906SRoberto Sassu
146fc975906SRoberto Sassu if (st.st_size > sizeof(data_item->sig)) {
147fc975906SRoberto Sassu ret = -EINVAL;
148fc975906SRoberto Sassu goto out_sig;
149fc975906SRoberto Sassu }
150fc975906SRoberto Sassu
151fc975906SRoberto Sassu data_item->sig_len = st.st_size;
152fc975906SRoberto Sassu
153fc975906SRoberto Sassu fd = open(path, O_RDONLY);
154fc975906SRoberto Sassu if (fd == -1) {
155fc975906SRoberto Sassu ret = -errno;
156fc975906SRoberto Sassu goto out_sig;
157fc975906SRoberto Sassu }
158fc975906SRoberto Sassu
159fc975906SRoberto Sassu ret = read(fd, data_item->sig, data_item->sig_len);
160fc975906SRoberto Sassu
161fc975906SRoberto Sassu close(fd);
162fc975906SRoberto Sassu
163fc975906SRoberto Sassu if (ret != data_item->sig_len) {
164fc975906SRoberto Sassu ret = -EIO;
165fc975906SRoberto Sassu goto out_sig;
166fc975906SRoberto Sassu }
167fc975906SRoberto Sassu
168fc975906SRoberto Sassu ret = 0;
169fc975906SRoberto Sassu out_sig:
170fc975906SRoberto Sassu unlink(path);
171fc975906SRoberto Sassu out:
172fc975906SRoberto Sassu unlink(data_template);
173fc975906SRoberto Sassu return ret;
174fc975906SRoberto Sassu }
175fc975906SRoberto Sassu
populate_data_item_mod(struct data * data_item)176fc975906SRoberto Sassu static int populate_data_item_mod(struct data *data_item)
177fc975906SRoberto Sassu {
178fc975906SRoberto Sassu char mod_path[PATH_MAX], *mod_path_ptr;
179fc975906SRoberto Sassu struct stat st;
180fc975906SRoberto Sassu void *mod;
181fc975906SRoberto Sassu FILE *fp;
182fc975906SRoberto Sassu struct module_signature ms;
183fc975906SRoberto Sassu int ret, fd, modlen, marker_len, sig_len;
184fc975906SRoberto Sassu
185fc975906SRoberto Sassu data_item->data_len = 0;
186fc975906SRoberto Sassu
187fc975906SRoberto Sassu if (stat("/lib/modules", &st) == -1)
188fc975906SRoberto Sassu return 0;
189fc975906SRoberto Sassu
190fc975906SRoberto Sassu /* Requires CONFIG_TCP_CONG_BIC=m. */
191fc975906SRoberto Sassu fp = popen("find /lib/modules/$(uname -r) -name tcp_bic.ko", "r");
192fc975906SRoberto Sassu if (!fp)
193fc975906SRoberto Sassu return 0;
194fc975906SRoberto Sassu
195fc975906SRoberto Sassu mod_path_ptr = fgets(mod_path, sizeof(mod_path), fp);
196fc975906SRoberto Sassu pclose(fp);
197fc975906SRoberto Sassu
198fc975906SRoberto Sassu if (!mod_path_ptr)
199fc975906SRoberto Sassu return 0;
200fc975906SRoberto Sassu
201fc975906SRoberto Sassu mod_path_ptr = strchr(mod_path, '\n');
202fc975906SRoberto Sassu if (!mod_path_ptr)
203fc975906SRoberto Sassu return 0;
204fc975906SRoberto Sassu
205fc975906SRoberto Sassu *mod_path_ptr = '\0';
206fc975906SRoberto Sassu
207fc975906SRoberto Sassu if (stat(mod_path, &st) == -1)
208fc975906SRoberto Sassu return 0;
209fc975906SRoberto Sassu
210fc975906SRoberto Sassu modlen = st.st_size;
211fc975906SRoberto Sassu marker_len = sizeof(MODULE_SIG_STRING) - 1;
212fc975906SRoberto Sassu
213fc975906SRoberto Sassu fd = open(mod_path, O_RDONLY);
214fc975906SRoberto Sassu if (fd == -1)
215fc975906SRoberto Sassu return -errno;
216fc975906SRoberto Sassu
217fc975906SRoberto Sassu mod = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
218fc975906SRoberto Sassu
219fc975906SRoberto Sassu close(fd);
220fc975906SRoberto Sassu
221fc975906SRoberto Sassu if (mod == MAP_FAILED)
222fc975906SRoberto Sassu return -errno;
223fc975906SRoberto Sassu
224fc975906SRoberto Sassu if (strncmp(mod + modlen - marker_len, MODULE_SIG_STRING, marker_len)) {
225fc975906SRoberto Sassu ret = -EINVAL;
226fc975906SRoberto Sassu goto out;
227fc975906SRoberto Sassu }
228fc975906SRoberto Sassu
229fc975906SRoberto Sassu modlen -= marker_len;
230fc975906SRoberto Sassu
231fc975906SRoberto Sassu memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
232fc975906SRoberto Sassu
233fc975906SRoberto Sassu sig_len = __be32_to_cpu(ms.sig_len);
234fc975906SRoberto Sassu modlen -= sig_len + sizeof(ms);
235fc975906SRoberto Sassu
236fc975906SRoberto Sassu if (modlen > sizeof(data_item->data)) {
237fc975906SRoberto Sassu ret = -E2BIG;
238fc975906SRoberto Sassu goto out;
239fc975906SRoberto Sassu }
240fc975906SRoberto Sassu
241fc975906SRoberto Sassu memcpy(data_item->data, mod, modlen);
242fc975906SRoberto Sassu data_item->data_len = modlen;
243fc975906SRoberto Sassu
244fc975906SRoberto Sassu if (sig_len > sizeof(data_item->sig)) {
245fc975906SRoberto Sassu ret = -E2BIG;
246fc975906SRoberto Sassu goto out;
247fc975906SRoberto Sassu }
248fc975906SRoberto Sassu
249fc975906SRoberto Sassu memcpy(data_item->sig, mod + modlen, sig_len);
250fc975906SRoberto Sassu data_item->sig_len = sig_len;
251fc975906SRoberto Sassu ret = 0;
252fc975906SRoberto Sassu out:
253fc975906SRoberto Sassu munmap(mod, st.st_size);
254fc975906SRoberto Sassu return ret;
255fc975906SRoberto Sassu }
256fc975906SRoberto Sassu
test_verify_pkcs7_sig(void)257fc975906SRoberto Sassu void test_verify_pkcs7_sig(void)
258fc975906SRoberto Sassu {
259fc975906SRoberto Sassu libbpf_print_fn_t old_print_cb;
260fc975906SRoberto Sassu char tmp_dir_template[] = "/tmp/verify_sigXXXXXX";
261fc975906SRoberto Sassu char *tmp_dir;
262fc975906SRoberto Sassu struct test_verify_pkcs7_sig *skel = NULL;
263fc975906SRoberto Sassu struct bpf_map *map;
264fc975906SRoberto Sassu struct data data;
265fc975906SRoberto Sassu int ret, zero = 0;
266fc975906SRoberto Sassu
267fc975906SRoberto Sassu /* Trigger creation of session keyring. */
268fc975906SRoberto Sassu syscall(__NR_request_key, "keyring", "_uid.0", NULL,
269fc975906SRoberto Sassu KEY_SPEC_SESSION_KEYRING);
270fc975906SRoberto Sassu
271fc975906SRoberto Sassu tmp_dir = mkdtemp(tmp_dir_template);
272fc975906SRoberto Sassu if (!ASSERT_OK_PTR(tmp_dir, "mkdtemp"))
273fc975906SRoberto Sassu return;
274fc975906SRoberto Sassu
275fc975906SRoberto Sassu ret = _run_setup_process(tmp_dir, "setup");
276fc975906SRoberto Sassu if (!ASSERT_OK(ret, "_run_setup_process"))
277fc975906SRoberto Sassu goto close_prog;
278fc975906SRoberto Sassu
279fc975906SRoberto Sassu skel = test_verify_pkcs7_sig__open();
280fc975906SRoberto Sassu if (!ASSERT_OK_PTR(skel, "test_verify_pkcs7_sig__open"))
281fc975906SRoberto Sassu goto close_prog;
282fc975906SRoberto Sassu
283fc975906SRoberto Sassu old_print_cb = libbpf_set_print(libbpf_print_cb);
284fc975906SRoberto Sassu ret = test_verify_pkcs7_sig__load(skel);
285fc975906SRoberto Sassu libbpf_set_print(old_print_cb);
286fc975906SRoberto Sassu
287fc975906SRoberto Sassu if (ret < 0 && kfunc_not_supported) {
288fc975906SRoberto Sassu printf(
289fc975906SRoberto Sassu "%s:SKIP:bpf_verify_pkcs7_signature() kfunc not supported\n",
290fc975906SRoberto Sassu __func__);
291fc975906SRoberto Sassu test__skip();
292fc975906SRoberto Sassu goto close_prog;
293fc975906SRoberto Sassu }
294fc975906SRoberto Sassu
295fc975906SRoberto Sassu if (!ASSERT_OK(ret, "test_verify_pkcs7_sig__load"))
296fc975906SRoberto Sassu goto close_prog;
297fc975906SRoberto Sassu
298fc975906SRoberto Sassu ret = test_verify_pkcs7_sig__attach(skel);
299fc975906SRoberto Sassu if (!ASSERT_OK(ret, "test_verify_pkcs7_sig__attach"))
300fc975906SRoberto Sassu goto close_prog;
301fc975906SRoberto Sassu
302fc975906SRoberto Sassu map = bpf_object__find_map_by_name(skel->obj, "data_input");
303fc975906SRoberto Sassu if (!ASSERT_OK_PTR(map, "data_input not found"))
304fc975906SRoberto Sassu goto close_prog;
305fc975906SRoberto Sassu
306fc975906SRoberto Sassu skel->bss->monitored_pid = getpid();
307fc975906SRoberto Sassu
308fc975906SRoberto Sassu /* Test without data and signature. */
309fc975906SRoberto Sassu skel->bss->user_keyring_serial = KEY_SPEC_SESSION_KEYRING;
310fc975906SRoberto Sassu
311fc975906SRoberto Sassu ret = bpf_map_update_elem(bpf_map__fd(map), &zero, &data, BPF_ANY);
312fc975906SRoberto Sassu if (!ASSERT_LT(ret, 0, "bpf_map_update_elem data_input"))
313fc975906SRoberto Sassu goto close_prog;
314fc975906SRoberto Sassu
315fc975906SRoberto Sassu /* Test successful signature verification with session keyring. */
316fc975906SRoberto Sassu ret = populate_data_item_str(tmp_dir, &data);
317fc975906SRoberto Sassu if (!ASSERT_OK(ret, "populate_data_item_str"))
318fc975906SRoberto Sassu goto close_prog;
319fc975906SRoberto Sassu
320fc975906SRoberto Sassu ret = bpf_map_update_elem(bpf_map__fd(map), &zero, &data, BPF_ANY);
321fc975906SRoberto Sassu if (!ASSERT_OK(ret, "bpf_map_update_elem data_input"))
322fc975906SRoberto Sassu goto close_prog;
323fc975906SRoberto Sassu
324fc975906SRoberto Sassu /* Test successful signature verification with testing keyring. */
325fc975906SRoberto Sassu skel->bss->user_keyring_serial = syscall(__NR_request_key, "keyring",
326fc975906SRoberto Sassu "ebpf_testing_keyring", NULL,
327fc975906SRoberto Sassu KEY_SPEC_SESSION_KEYRING);
328fc975906SRoberto Sassu
329fc975906SRoberto Sassu ret = bpf_map_update_elem(bpf_map__fd(map), &zero, &data, BPF_ANY);
330fc975906SRoberto Sassu if (!ASSERT_OK(ret, "bpf_map_update_elem data_input"))
331fc975906SRoberto Sassu goto close_prog;
332fc975906SRoberto Sassu
333fc975906SRoberto Sassu /*
334fc975906SRoberto Sassu * Ensure key_task_permission() is called and rejects the keyring
335fc975906SRoberto Sassu * (no Search permission).
336fc975906SRoberto Sassu */
337fc975906SRoberto Sassu syscall(__NR_keyctl, KEYCTL_SETPERM, skel->bss->user_keyring_serial,
338fc975906SRoberto Sassu 0x37373737);
339fc975906SRoberto Sassu
340fc975906SRoberto Sassu ret = bpf_map_update_elem(bpf_map__fd(map), &zero, &data, BPF_ANY);
341fc975906SRoberto Sassu if (!ASSERT_LT(ret, 0, "bpf_map_update_elem data_input"))
342fc975906SRoberto Sassu goto close_prog;
343fc975906SRoberto Sassu
344fc975906SRoberto Sassu syscall(__NR_keyctl, KEYCTL_SETPERM, skel->bss->user_keyring_serial,
345fc975906SRoberto Sassu 0x3f3f3f3f);
346fc975906SRoberto Sassu
347fc975906SRoberto Sassu /*
348fc975906SRoberto Sassu * Ensure key_validate() is called and rejects the keyring (key expired)
349fc975906SRoberto Sassu */
350fc975906SRoberto Sassu syscall(__NR_keyctl, KEYCTL_SET_TIMEOUT,
351fc975906SRoberto Sassu skel->bss->user_keyring_serial, 1);
352fc975906SRoberto Sassu sleep(1);
353fc975906SRoberto Sassu
354fc975906SRoberto Sassu ret = bpf_map_update_elem(bpf_map__fd(map), &zero, &data, BPF_ANY);
355fc975906SRoberto Sassu if (!ASSERT_LT(ret, 0, "bpf_map_update_elem data_input"))
356fc975906SRoberto Sassu goto close_prog;
357fc975906SRoberto Sassu
358fc975906SRoberto Sassu skel->bss->user_keyring_serial = KEY_SPEC_SESSION_KEYRING;
359fc975906SRoberto Sassu
360fc975906SRoberto Sassu /* Test with corrupted data (signature verification should fail). */
361fc975906SRoberto Sassu data.data[0] = 'a';
362fc975906SRoberto Sassu ret = bpf_map_update_elem(bpf_map__fd(map), &zero, &data, BPF_ANY);
363fc975906SRoberto Sassu if (!ASSERT_LT(ret, 0, "bpf_map_update_elem data_input"))
364fc975906SRoberto Sassu goto close_prog;
365fc975906SRoberto Sassu
366fc975906SRoberto Sassu ret = populate_data_item_mod(&data);
367fc975906SRoberto Sassu if (!ASSERT_OK(ret, "populate_data_item_mod"))
368fc975906SRoberto Sassu goto close_prog;
369fc975906SRoberto Sassu
370fc975906SRoberto Sassu /* Test signature verification with system keyrings. */
371fc975906SRoberto Sassu if (data.data_len) {
372fc975906SRoberto Sassu skel->bss->user_keyring_serial = 0;
373fc975906SRoberto Sassu skel->bss->system_keyring_id = 0;
374fc975906SRoberto Sassu
375fc975906SRoberto Sassu ret = bpf_map_update_elem(bpf_map__fd(map), &zero, &data,
376fc975906SRoberto Sassu BPF_ANY);
377fc975906SRoberto Sassu if (!ASSERT_OK(ret, "bpf_map_update_elem data_input"))
378fc975906SRoberto Sassu goto close_prog;
379fc975906SRoberto Sassu
380fc975906SRoberto Sassu skel->bss->system_keyring_id = VERIFY_USE_SECONDARY_KEYRING;
381fc975906SRoberto Sassu
382fc975906SRoberto Sassu ret = bpf_map_update_elem(bpf_map__fd(map), &zero, &data,
383fc975906SRoberto Sassu BPF_ANY);
384fc975906SRoberto Sassu if (!ASSERT_OK(ret, "bpf_map_update_elem data_input"))
385fc975906SRoberto Sassu goto close_prog;
386fc975906SRoberto Sassu
387fc975906SRoberto Sassu skel->bss->system_keyring_id = VERIFY_USE_PLATFORM_KEYRING;
388fc975906SRoberto Sassu
389fc975906SRoberto Sassu ret = bpf_map_update_elem(bpf_map__fd(map), &zero, &data,
390fc975906SRoberto Sassu BPF_ANY);
391fc975906SRoberto Sassu ASSERT_LT(ret, 0, "bpf_map_update_elem data_input");
392fc975906SRoberto Sassu }
393fc975906SRoberto Sassu
394fc975906SRoberto Sassu close_prog:
395fc975906SRoberto Sassu _run_setup_process(tmp_dir, "cleanup");
396fc975906SRoberto Sassu
397fc975906SRoberto Sassu if (!skel)
398fc975906SRoberto Sassu return;
399fc975906SRoberto Sassu
400fc975906SRoberto Sassu skel->bss->monitored_pid = 0;
401fc975906SRoberto Sassu test_verify_pkcs7_sig__destroy(skel);
402fc975906SRoberto Sassu }
403