Received: by 2002:a25:6193:0:0:0:0:0 with SMTP id v141csp1795269ybb; Thu, 26 Mar 2020 07:30:03 -0700 (PDT) X-Google-Smtp-Source: ADFU+vt5KH7Vj0dwPED+p/CLk+0Xj2YJLpcXfgSadU7pAYWVLpKbpxXfFQPZKQPd6bNCfOGqJxYU X-Received: by 2002:aca:ad93:: with SMTP id w141mr235399oie.54.1585233003413; Thu, 26 Mar 2020 07:30:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1585233003; cv=none; d=google.com; s=arc-20160816; b=pmC56RmPyCiodGU0FXRfpspfu5QHmsXhR3DfJd0BUdnKlb5A5/YRCd9bqcbDeYtfua VNlnIqZ72CymTjrWfibRIds6YxSqGU75cvvfxN1NOq4aWrpOPBGX8UZpnp6IM+Qc2u6G AGXhug/3yxDbXn6h3Adltyz1VTPnK4xWcGrd6TVD0jy6BW3iEThqbIl6PsGGcP/YcLq+ LV7CnKJwcuwHZYydcf3BCaauCjvPJsE2CJfiFw7WkZ9kVPPHFSSeqBMQn/MAUUqdO0K+ Uru0TEML0TK8DPamVmAR6OEOozcsaTM3H42+kd0Kvi4uq3q4s/bw8QmqqpEws1Gfjozm 9wZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=0D2qE0TthBZ6mLMUn5wGGpixTsHsgsgDg257+To4wvU=; b=nVbYQkeRg3MBcLt3HOE0ioIKyD/Wms4djr2FwMvHNk4ZjnHVziIjdHuVaJLtLiAolE g0OIXT2scaZO1Q6rnebodRANK9HQ0/1mQcwrLBUIOzXOLf+qS3P0OJLoTFzcuHsTMGPT B/6TQBx4MlgALY6ThTq4dqNPjz9b+jtSs8EK6w5ghRJsB2eIX0UKmnAbHRhIinVB2hXj ukA4IhGvQ09N49JqoYXW9Aui5MyOtz2+XLGBnWaWuWAjmpJ9rY1QXwndFtv9mQlTBcGI qKNUGXEUItDauzfBoPcr348D7tTvc3as62CL97iBzFYyEycsRW56y4cMkC8ZqNBuEOa7 kurw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b="XYUKCxo/"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id e27si1141323oth.300.2020.03.26.07.29.50; Thu, 26 Mar 2020 07:30:03 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b="XYUKCxo/"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728365AbgCZO3I (ORCPT + 99 others); Thu, 26 Mar 2020 10:29:08 -0400 Received: from mail-wm1-f66.google.com ([209.85.128.66]:35126 "EHLO mail-wm1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728208AbgCZO2o (ORCPT ); Thu, 26 Mar 2020 10:28:44 -0400 Received: by mail-wm1-f66.google.com with SMTP id m3so7247844wmi.0 for ; Thu, 26 Mar 2020 07:28:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=0D2qE0TthBZ6mLMUn5wGGpixTsHsgsgDg257+To4wvU=; b=XYUKCxo/IwmasfiaT9g/7rlTqCKHtu3uL2ytSOnB+a0JO9I/KdH0zKD952z9ZG1EhK wzVv99GCUTNAkbMwF2wvKUwa37J4e1YfGWbwhRl/fHmGEIALX9bbtXbhw9iVTqSGJHgm FOXuRfhA4QEs49hriaN27YoGaZuLXlVoWDTBo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=0D2qE0TthBZ6mLMUn5wGGpixTsHsgsgDg257+To4wvU=; b=gQL/7fVh5MFByJyVOgft+/MOxFpTF10AxViatcNqSNwt2h4dcW4q7+x41n8R+U8anx T29EpeoQqDhsXSiGT1rJeTXp6bF6Lk66lDkL7zXgkGt7sVAGtJVmsARJ6++E7mRUmxMG yhzkJZ6RkdFepY7bcaYc1dMO4VoaPXOC2qaRCEw+VU4Nm6iB5h3pNENaYsyWlLfKn5Wu /wgiY0IlYffF1jpx/WBZ5XLq3hG49iT70I+sDhQcQqhA13h5cmaNuEWMt63x0oSX/DhV 3EF+Nc6j1mbxikl3N9BDePclm3hngIDRfBMPha2PwpAq018uQfKjq+ctZQYsq7lcxYb8 kS4Q== X-Gm-Message-State: ANhLgQ2xGix89dJmm9yLf6cR2E6mxHCXkAkzcrnoynN6qLN17eaM91DK ADSMAu6TdGCr1iWotMQXKXFwVLDdgVI= X-Received: by 2002:a05:600c:2f90:: with SMTP id t16mr257591wmn.66.1585232922642; Thu, 26 Mar 2020 07:28:42 -0700 (PDT) Received: from kpsingh-kernel.localdomain (77-56-209-237.dclient.hispeed.ch. [77.56.209.237]) by smtp.gmail.com with ESMTPSA id q3sm3643971wru.87.2020.03.26.07.28.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 26 Mar 2020 07:28:42 -0700 (PDT) From: KP Singh To: linux-kernel@vger.kernel.org, bpf@vger.kernel.org, linux-security-module@vger.kernel.org Cc: Brendan Jackman , Florent Revest , Thomas Garnier , Alexei Starovoitov , Daniel Borkmann , James Morris , Kees Cook , Paul Turner , Jann Horn , Florent Revest , Brendan Jackman , Greg Kroah-Hartman Subject: [PATCH bpf-next v7 7/8] bpf: lsm: Add selftests for BPF_PROG_TYPE_LSM Date: Thu, 26 Mar 2020 15:28:22 +0100 Message-Id: <20200326142823.26277-8-kpsingh@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200326142823.26277-1-kpsingh@chromium.org> References: <20200326142823.26277-1-kpsingh@chromium.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: KP Singh * Load/attach a BPF program that hooks to file_mprotect (int) and bprm_committed_creds (void). * Perform an action that triggers the hook. * Verify if the audit event was received using the shared global variables for the process executed. * Verify if the mprotect returns a -EPERM. Signed-off-by: KP Singh Reviewed-by: Brendan Jackman Reviewed-by: Florent Revest Reviewed-by: Thomas Garnier --- tools/testing/selftests/bpf/config | 2 + .../selftests/bpf/prog_tests/test_lsm.c | 86 +++++++++++++++++++ tools/testing/selftests/bpf/progs/lsm.c | 48 +++++++++++ 3 files changed, 136 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/test_lsm.c create mode 100644 tools/testing/selftests/bpf/progs/lsm.c diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config index 5dc109f4c097..60e3ae5d4e48 100644 --- a/tools/testing/selftests/bpf/config +++ b/tools/testing/selftests/bpf/config @@ -35,3 +35,5 @@ CONFIG_MPLS_ROUTING=m CONFIG_MPLS_IPTUNNEL=m CONFIG_IPV6_SIT=m CONFIG_BPF_JIT=y +CONFIG_BPF_LSM=y +CONFIG_SECURITY=y diff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c new file mode 100644 index 000000000000..6eb7060e4422 --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c @@ -0,0 +1,86 @@ +// SPDX-License-Identifier: GPL-2.0 + +/* + * Copyright (C) 2020 Google LLC. + */ + +#include +#include +#include +#include +#include +#include + +#include "lsm.skel.h" + +char *CMD_ARGS[] = {"true", NULL}; + +int heap_mprotect(void) +{ + void *buf; + long sz; + int ret; + + sz = sysconf(_SC_PAGESIZE); + if (sz < 0) + return sz; + + buf = memalign(sz, 2 * sz); + if (buf == NULL) + return -ENOMEM; + + ret = mprotect(buf, sz, PROT_READ | PROT_EXEC); + free(buf); + return ret; +} + +int exec_cmd(int *monitored_pid) +{ + int child_pid, child_status; + + child_pid = fork(); + if (child_pid == 0) { + *monitored_pid = getpid(); + execvp(CMD_ARGS[0], CMD_ARGS); + return -EINVAL; + } else if (child_pid > 0) { + waitpid(child_pid, &child_status, 0); + return child_status; + } + + return -EINVAL; +} + +void test_test_lsm(void) +{ + struct lsm *skel = NULL; + int err, duration = 0; + + skel = lsm__open_and_load(); + if (CHECK(!skel, "skel_load", "lsm skeleton failed\n")) + goto close_prog; + + err = lsm__attach(skel); + if (CHECK(err, "attach", "lsm attach failed: %d\n", err)) + goto close_prog; + + err = exec_cmd(&skel->bss->monitored_pid); + if (CHECK(err < 0, "exec_cmd", "err %d errno %d\n", err, errno)) + goto close_prog; + + CHECK(skel->bss->bprm_count != 1, "bprm_count", "bprm_count = %d", + skel->bss->bprm_count); + + skel->bss->monitored_pid = getpid(); + + err = heap_mprotect(); + if (CHECK(errno != EPERM, "heap_mprotect", "want errno=EPERM, got %d\n", + errno)) + goto close_prog; + + CHECK(skel->bss->mprotect_count != 1, "mprotect_count", + "mprotect_count = %d", skel->bss->mprotect_count); + +close_prog: + lsm__destroy(skel); +} diff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selftests/bpf/progs/lsm.c new file mode 100644 index 000000000000..a4e3c223028d --- /dev/null +++ b/tools/testing/selftests/bpf/progs/lsm.c @@ -0,0 +1,48 @@ +// SPDX-License-Identifier: GPL-2.0 + +/* + * Copyright 2020 Google LLC. + */ + +#include "vmlinux.h" +#include +#include +#include + +char _license[] SEC("license") = "GPL"; + +int monitored_pid = 0; +int mprotect_count = 0; +int bprm_count = 0; + +SEC("lsm/file_mprotect") +int BPF_PROG(test_int_hook, struct vm_area_struct *vma, + unsigned long reqprot, unsigned long prot, int ret) +{ + if (ret != 0) + return ret; + + __u32 pid = bpf_get_current_pid_tgid() >> 32; + int is_heap = 0; + + is_heap = (vma->vm_start >= vma->vm_mm->start_brk && + vma->vm_end <= vma->vm_mm->brk); + + if (is_heap && monitored_pid == pid) { + mprotect_count++; + ret = -EPERM; + } + + return ret; +} + +SEC("lsm/bprm_committed_creds") +int BPF_PROG(test_void_hook, struct linux_binprm *bprm) +{ + __u32 pid = bpf_get_current_pid_tgid() >> 32; + + if (monitored_pid == pid) + bprm_count++; + + return 0; +} -- 2.20.1