bpf/prog_tests/test_local_storage.c

0001 // SPDX-License-Identifier: GPL-2.0
0002
0003 /*
0004  * Copyright (C) 2020 Google LLC.
0005  */
0006
0007 #include <asm-generic/errno-base.h>
0008 #include <sys/stat.h>
0009 #include <test_progs.h>
0010 #include <linux/limits.h>
0011
0012 #include "local_storage.skel.h"
0013 #include "network_helpers.h"
0014
0015 #ifndef __NR_pidfd_open
0016 #define __NR_pidfd_open 434
0017 #endif
0018
0019 static inline int sys_pidfd_open(pid_t pid, unsigned int flags)
0020 {
0021     return syscall(__NR_pidfd_open, pid, flags);
0022 }
0023
0024 static unsigned int duration;
0025
0026 #define TEST_STORAGE_VALUE 0xbeefdead
0027
0028 struct storage {
0029     void *inode;
0030     unsigned int value;
0031 };
0032
0033 /* Fork and exec the provided rm binary and return the exit code of the
0034  * forked process and its pid.
0035  */
0036 static int run_self_unlink(int *monitored_pid, const char *rm_path)
0037 {
0038     int child_pid, child_status, ret;
0039     int null_fd;
0040
0041     child_pid = fork();
0042     if (child_pid == 0) {
0043         null_fd = open("/dev/null", O_WRONLY);
0044         dup2(null_fd, STDOUT_FILENO);
0045         dup2(null_fd, STDERR_FILENO);
0046         close(null_fd);
0047
0048         *monitored_pid = getpid();
0049         /* Use the copied /usr/bin/rm to delete itself
0050          * /tmp/copy_of_rm /tmp/copy_of_rm.
0051          */
0052         ret = execlp(rm_path, rm_path, rm_path, NULL);
0053         if (ret)
0054             exit(errno);
0055     } else if (child_pid > 0) {
0056         waitpid(child_pid, &child_status, 0);
0057         return WEXITSTATUS(child_status);
0058     }
0059
0060     return -EINVAL;
0061 }
0062
0063 static bool check_syscall_operations(int map_fd, int obj_fd)
0064 {
0065     struct storage val = { .value = TEST_STORAGE_VALUE },
0066                lookup_val = { .value = 0 };
0067     int err;
0068
0069     /* Looking up an existing element should fail initially */
0070     err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 0);
0071     if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem",
0072           "err:%d errno:%d\n", err, errno))
0073         return false;
0074
0075     /* Create a new element */
0076     err = bpf_map_update_elem(map_fd, &obj_fd, &val, BPF_NOEXIST);
0077     if (CHECK(err < 0, "bpf_map_update_elem", "err:%d errno:%d\n", err,
0078           errno))
0079         return false;
0080
0081     /* Lookup the newly created element */
0082     err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 0);
0083     if (CHECK(err < 0, "bpf_map_lookup_elem", "err:%d errno:%d", err,
0084           errno))
0085         return false;
0086
0087     /* Check the value of the newly created element */
0088     if (CHECK(lookup_val.value != val.value, "bpf_map_lookup_elem",
0089           "value got = %x errno:%d", lookup_val.value, val.value))
0090         return false;
0091
0092     err = bpf_map_delete_elem(map_fd, &obj_fd);
0093     if (CHECK(err, "bpf_map_delete_elem()", "err:%d errno:%d\n", err,
0094           errno))
0095         return false;
0096
0097     /* The lookup should fail, now that the element has been deleted */
0098     err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 0);
0099     if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem",
0100           "err:%d errno:%d\n", err, errno))
0101         return false;
0102
0103     return true;
0104 }
0105
0106 void test_test_local_storage(void)
0107 {
0108     char tmp_dir_path[] = "/tmp/local_storageXXXXXX";
0109     int err, serv_sk = -1, task_fd = -1, rm_fd = -1;
0110     struct local_storage *skel = NULL;
0111     char tmp_exec_path[64];
0112     char cmd[256];
0113
0114     skel = local_storage__open_and_load();
0115     if (CHECK(!skel, "skel_load", "lsm skeleton failed\n"))
0116         goto close_prog;
0117
0118     err = local_storage__attach(skel);
0119     if (CHECK(err, "attach", "lsm attach failed: %d\n", err))
0120         goto close_prog;
0121
0122     task_fd = sys_pidfd_open(getpid(), 0);
0123     if (CHECK(task_fd < 0, "pidfd_open",
0124           "failed to get pidfd err:%d, errno:%d", task_fd, errno))
0125         goto close_prog;
0126
0127     if (!check_syscall_operations(bpf_map__fd(skel->maps.task_storage_map),
0128                       task_fd))
0129         goto close_prog;
0130
0131     if (CHECK(!mkdtemp(tmp_dir_path), "mkdtemp",
0132           "unable to create tmpdir: %d\n", errno))
0133         goto close_prog;
0134
0135     snprintf(tmp_exec_path, sizeof(tmp_exec_path), "%s/copy_of_rm",
0136          tmp_dir_path);
0137     snprintf(cmd, sizeof(cmd), "cp /bin/rm %s", tmp_exec_path);
0138     if (CHECK_FAIL(system(cmd)))
0139         goto close_prog_rmdir;
0140
0141     rm_fd = open(tmp_exec_path, O_RDONLY);
0142     if (CHECK(rm_fd < 0, "open", "failed to open %s err:%d, errno:%d",
0143           tmp_exec_path, rm_fd, errno))
0144         goto close_prog_rmdir;
0145
0146     if (!check_syscall_operations(bpf_map__fd(skel->maps.inode_storage_map),
0147                       rm_fd))
0148         goto close_prog_rmdir;
0149
0150     /* Sets skel->bss->monitored_pid to the pid of the forked child
0151      * forks a child process that executes tmp_exec_path and tries to
0152      * unlink its executable. This operation should be denied by the loaded
0153      * LSM program.
0154      */
0155     err = run_self_unlink(&skel->bss->monitored_pid, tmp_exec_path);
0156     if (CHECK(err != EPERM, "run_self_unlink", "err %d want EPERM\n", err))
0157         goto close_prog_rmdir;
0158
0159     /* Set the process being monitored to be the current process */
0160     skel->bss->monitored_pid = getpid();
0161
0162     /* Move copy_of_rm to a new location so that it triggers the
0163      * inode_rename LSM hook with a new_dentry that has a NULL inode ptr.
0164      */
0165     snprintf(cmd, sizeof(cmd), "mv %s/copy_of_rm %s/check_null_ptr",
0166          tmp_dir_path, tmp_dir_path);
0167     if (CHECK_FAIL(system(cmd)))
0168         goto close_prog_rmdir;
0169
0170     CHECK(skel->data->inode_storage_result != 0, "inode_storage_result",
0171           "inode_local_storage not set\n");
0172
0173     serv_sk = start_server(AF_INET6, SOCK_STREAM, NULL, 0, 0);
0174     if (CHECK(serv_sk < 0, "start_server", "failed to start server\n"))
0175         goto close_prog_rmdir;
0176
0177     CHECK(skel->data->sk_storage_result != 0, "sk_storage_result",
0178           "sk_local_storage not set\n");
0179
0180     if (!check_syscall_operations(bpf_map__fd(skel->maps.sk_storage_map),
0181                       serv_sk))
0182         goto close_prog_rmdir;
0183
0184 close_prog_rmdir:
0185     snprintf(cmd, sizeof(cmd), "rm -rf %s", tmp_dir_path);
0186     system(cmd);
0187 close_prog:
0188     close(serv_sk);
0189     close(rm_fd);
0190     close(task_fd);
0191     local_storage__destroy(skel);
0192 }