1 // SPDX-License-Identifier: GPL-2.0 2 3 /* 4 * Copyright (C) 2020 Google LLC. 5 */ 6 7 #include <asm-generic/errno-base.h> 8 #include <sys/stat.h> 9 #include <test_progs.h> 10 #include <linux/limits.h> 11 12 #include "local_storage.skel.h" 13 #include "network_helpers.h" 14 #include "task_local_storage_helpers.h" 15 16 static unsigned int duration; 17 18 #define TEST_STORAGE_VALUE 0xbeefdead 19 20 struct storage { 21 void *inode; 22 unsigned int value; 23 }; 24 25 /* Fork and exec the provided rm binary and return the exit code of the 26 * forked process and its pid. 27 */ 28 static int run_self_unlink(int *monitored_pid, const char *rm_path) 29 { 30 int child_pid, child_status, ret; 31 int null_fd; 32 33 child_pid = fork(); 34 if (child_pid == 0) { 35 null_fd = open("/dev/null", O_WRONLY); 36 dup2(null_fd, STDOUT_FILENO); 37 dup2(null_fd, STDERR_FILENO); 38 close(null_fd); 39 40 *monitored_pid = getpid(); 41 /* Use the copied /usr/bin/rm to delete itself 42 * /tmp/copy_of_rm /tmp/copy_of_rm. 43 */ 44 ret = execlp(rm_path, rm_path, rm_path, NULL); 45 if (ret) 46 exit(errno); 47 } else if (child_pid > 0) { 48 waitpid(child_pid, &child_status, 0); 49 return WEXITSTATUS(child_status); 50 } 51 52 return -EINVAL; 53 } 54 55 static bool check_syscall_operations(int map_fd, int obj_fd) 56 { 57 struct storage val = { .value = TEST_STORAGE_VALUE }, 58 lookup_val = { .value = 0 }; 59 int err; 60 61 /* Looking up an existing element should fail initially */ 62 err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 0); 63 if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem", 64 "err:%d errno:%d\n", err, errno)) 65 return false; 66 67 /* Create a new element */ 68 err = bpf_map_update_elem(map_fd, &obj_fd, &val, BPF_NOEXIST); 69 if (CHECK(err < 0, "bpf_map_update_elem", "err:%d errno:%d\n", err, 70 errno)) 71 return false; 72 73 /* Lookup the newly created element */ 74 err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 0); 75 if (CHECK(err < 0, "bpf_map_lookup_elem", "err:%d errno:%d", err, 76 errno)) 77 return false; 78 79 /* Check the value of the newly created element */ 80 if (CHECK(lookup_val.value != val.value, "bpf_map_lookup_elem", 81 "value got = %x errno:%d", lookup_val.value, val.value)) 82 return false; 83 84 err = bpf_map_delete_elem(map_fd, &obj_fd); 85 if (CHECK(err, "bpf_map_delete_elem()", "err:%d errno:%d\n", err, 86 errno)) 87 return false; 88 89 /* The lookup should fail, now that the element has been deleted */ 90 err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val, 0); 91 if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem", 92 "err:%d errno:%d\n", err, errno)) 93 return false; 94 95 return true; 96 } 97 98 void test_test_local_storage(void) 99 { 100 char tmp_dir_path[] = "/tmp/local_storageXXXXXX"; 101 int err, serv_sk = -1, task_fd = -1, rm_fd = -1; 102 struct local_storage *skel = NULL; 103 char tmp_exec_path[64]; 104 char cmd[256]; 105 106 skel = local_storage__open_and_load(); 107 if (CHECK(!skel, "skel_load", "lsm skeleton failed\n")) 108 goto close_prog; 109 110 err = local_storage__attach(skel); 111 if (CHECK(err, "attach", "lsm attach failed: %d\n", err)) 112 goto close_prog; 113 114 task_fd = sys_pidfd_open(getpid(), 0); 115 if (CHECK(task_fd < 0, "pidfd_open", 116 "failed to get pidfd err:%d, errno:%d", task_fd, errno)) 117 goto close_prog; 118 119 if (!check_syscall_operations(bpf_map__fd(skel->maps.task_storage_map), 120 task_fd)) 121 goto close_prog; 122 123 if (CHECK(!mkdtemp(tmp_dir_path), "mkdtemp", 124 "unable to create tmpdir: %d\n", errno)) 125 goto close_prog; 126 127 snprintf(tmp_exec_path, sizeof(tmp_exec_path), "%s/copy_of_rm", 128 tmp_dir_path); 129 snprintf(cmd, sizeof(cmd), "cp /bin/rm %s", tmp_exec_path); 130 if (CHECK_FAIL(system(cmd))) 131 goto close_prog_rmdir; 132 133 rm_fd = open(tmp_exec_path, O_RDONLY); 134 if (CHECK(rm_fd < 0, "open", "failed to open %s err:%d, errno:%d", 135 tmp_exec_path, rm_fd, errno)) 136 goto close_prog_rmdir; 137 138 if (!check_syscall_operations(bpf_map__fd(skel->maps.inode_storage_map), 139 rm_fd)) 140 goto close_prog_rmdir; 141 142 /* Sets skel->bss->monitored_pid to the pid of the forked child 143 * forks a child process that executes tmp_exec_path and tries to 144 * unlink its executable. This operation should be denied by the loaded 145 * LSM program. 146 */ 147 err = run_self_unlink(&skel->bss->monitored_pid, tmp_exec_path); 148 if (CHECK(err != EPERM, "run_self_unlink", "err %d want EPERM\n", err)) 149 goto close_prog_rmdir; 150 151 /* Set the process being monitored to be the current process */ 152 skel->bss->monitored_pid = getpid(); 153 154 /* Move copy_of_rm to a new location so that it triggers the 155 * inode_rename LSM hook with a new_dentry that has a NULL inode ptr. 156 */ 157 snprintf(cmd, sizeof(cmd), "mv %s/copy_of_rm %s/check_null_ptr", 158 tmp_dir_path, tmp_dir_path); 159 if (CHECK_FAIL(system(cmd))) 160 goto close_prog_rmdir; 161 162 CHECK(skel->data->inode_storage_result != 0, "inode_storage_result", 163 "inode_local_storage not set\n"); 164 165 serv_sk = start_server(AF_INET6, SOCK_STREAM, NULL, 0, 0); 166 if (CHECK(serv_sk < 0, "start_server", "failed to start server\n")) 167 goto close_prog_rmdir; 168 169 CHECK(skel->data->sk_storage_result != 0, "sk_storage_result", 170 "sk_local_storage not set\n"); 171 172 if (!check_syscall_operations(bpf_map__fd(skel->maps.sk_storage_map), 173 serv_sk)) 174 goto close_prog_rmdir; 175 176 close_prog_rmdir: 177 snprintf(cmd, sizeof(cmd), "rm -rf %s", tmp_dir_path); 178 system(cmd); 179 close_prog: 180 close(serv_sk); 181 close(rm_fd); 182 close(task_fd); 183 local_storage__destroy(skel); 184 } 185