From: Martin KaFai Lau <kafai@fb.com>
To: KP Singh <kpsingh@chromium.org>
Cc: <linux-kernel@vger.kernel.org>, <bpf@vger.kernel.org>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Song Liu <songliubraving@fb.com>, Paul Turner <pjt@google.com>,
Jann Horn <jannh@google.com>, Hao Luo <haoluo@google.com>
Subject: Re: [PATCH bpf-next v4 8/9] bpf: Add tests for task_local_storage
Date: Thu, 5 Nov 2020 14:02:50 -0800 [thread overview]
Message-ID: <20201105220250.uvm3unmbne36lsoz@kafai-mbp.dhcp.thefacebook.com> (raw)
In-Reply-To: <20201105144755.214341-9-kpsingh@chromium.org>
On Thu, Nov 05, 2020 at 03:47:54PM +0100, KP Singh wrote:
> From: KP Singh <kpsingh@google.com>
>
> The test exercises the syscall based map operations by creating a pidfd
> for the current process.
>
> For verifying kernel / LSM functionality, the test implements a simple
> MAC policy which denies an executable from unlinking itself. The LSM
> program bprm_committed_creds sets a task_local_storage with a pointer to
> the inode. This is then used to detect if the task is trying to unlink
> itself in the inode_unlink LSM hook.
>
> The test copies /bin/rm to /tmp and executes it in a child thread with
> the intention of deleting itself. A successful test should prevent the
> the running executable from deleting itself.
>
> The bpf programs are also updated to call bpf_spin_{lock, unlock} to
> trigger the verfier checks for spin locks.
>
> The temporary file is cleaned up later in the test.
>
> Signed-off-by: KP Singh <kpsingh@google.com>
> ---
> .../bpf/prog_tests/test_local_storage.c | 167 ++++++++++++++++--
> .../selftests/bpf/progs/local_storage.c | 61 ++++++-
> 2 files changed, 210 insertions(+), 18 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/test_local_storage.c b/tools/testing/selftests/bpf/prog_tests/test_local_storage.c
> index 91cd6f357246..feba23f8848b 100644
> --- a/tools/testing/selftests/bpf/prog_tests/test_local_storage.c
> +++ b/tools/testing/selftests/bpf/prog_tests/test_local_storage.c
> @@ -4,30 +4,149 @@
> * Copyright (C) 2020 Google LLC.
> */
>
> +#define _GNU_SOURCE
> +
> +#include <asm-generic/errno-base.h>
> +#include <unistd.h>
> +#include <sys/stat.h>
> #include <test_progs.h>
> #include <linux/limits.h>
>
> #include "local_storage.skel.h"
> #include "network_helpers.h"
>
> -int create_and_unlink_file(void)
> +static inline int sys_pidfd_open(pid_t pid, unsigned int flags)
> +{
> + return syscall(__NR_pidfd_open, pid, flags);
> +}
> +
> +unsigned int duration;
static
> +
> +#define TEST_STORAGE_VALUE 0xbeefdead
> +
> +struct storage {
> + void *inode;
> + unsigned int value;
> + /* Lock ensures that spin locked versions of local stoage operations
> + * also work, most operations in this tests are still single threaded
> + */
> + struct bpf_spin_lock lock;
> +};
> +
> +/* Copies an rm binary to a temp file. dest is a mkstemp template */
> +int copy_rm(char *dest)
static
> {
> - char fname[PATH_MAX] = "/tmp/fileXXXXXX";
> - int fd;
> + int ret, fd_in, fd_out;
> + struct stat stat;
>
> - fd = mkstemp(fname);
> - if (fd < 0)
> - return fd;
> + fd_in = open("/bin/rm", O_RDONLY);
> + if (fd_in < 0)
> + return fd_in;
>
> - close(fd);
> - unlink(fname);
> + fd_out = mkstemp(dest);
> + if (fd_out < 0)
> + return fd_out;
> +
> + ret = fstat(fd_in, &stat);
> + if (ret == -1)
> + return errno;
> +
> + ret = copy_file_range(fd_in, NULL, fd_out, NULL, stat.st_size, 0);
> + if (ret == -1)
> + return errno;
> +
> + /* Set executable permission on the copied file */
> + ret = chmod(dest, 0100);
> + if (ret == -1)
> + return errno;
> +
> + close(fd_in);
> + close(fd_out);
fd_in and fd_out are not closed in error cases.
> return 0;
> }
>
> +/* Fork and exec the provided rm binary and return the exit code of the
> + * forked process and its pid.
> + */
> +int run_self_unlink(int *monitored_pid, const char *rm_path)
static
[ ... ]
> +bool check_syscall_operations(int map_fd, int obj_fd)
static
[ ... ]
> void test_test_local_storage(void)
> {
> + char tmp_exec_path[PATH_MAX] = "/tmp/copy_of_rmXXXXXX";
> + int err, serv_sk = -1, task_fd = -1;
> struct local_storage *skel = NULL;
> - int err, duration = 0, serv_sk = -1;
>
> skel = local_storage__open_and_load();
> if (CHECK(!skel, "skel_load", "lsm skeleton failed\n"))
> @@ -37,10 +156,35 @@ void test_test_local_storage(void)
> if (CHECK(err, "attach", "lsm attach failed: %d\n", err))
> goto close_prog;
>
> + task_fd = sys_pidfd_open(getpid(), 0);
> + if (CHECK(task_fd < 0, "pidfd_open",
> + "failed to get pidfd err:%d, errno:%d", task_fd, errno))
> + goto close_prog;
> +
> + if (!check_syscall_operations(bpf_map__fd(skel->maps.task_storage_map),
> + task_fd))
> + goto close_prog;
> +
> + err = copy_rm(tmp_exec_path);
> + if (CHECK(err < 0, "copy_rm", "err %d errno %d\n", err, errno))
> + goto close_prog;
> +
> + /* Sets skel->bss->monitored_pid to the pid of the forked child
> + * forks a child process that executes tmp_exec_path and tries to
> + * unlink its executable. This operation should be denied by the loaded
> + * LSM program.
> + */
> + err = run_self_unlink(&skel->bss->monitored_pid, tmp_exec_path);
> + if (CHECK(err != EPERM, "run_self_unlink", "err %d want EPERM\n", err))
> + goto close_prog;
> +
> + /* Set the process being monitored to be the current process */
> skel->bss->monitored_pid = getpid();
>
> - err = create_and_unlink_file();
> - if (CHECK(err < 0, "exec_cmd", "err %d errno %d\n", err, errno))
> + /* Remove the temporary created executable */
> + err = unlink(tmp_exec_path);
Will tmp_exec_path file be removed if there is error earlier?
> + if (CHECK(err != 0, "unlink", "unable to unlink %s: %d", tmp_exec_path,
> + errno))
> goto close_prog;
>
> CHECK(skel->data->inode_storage_result != 0, "inode_storage_result",
> @@ -56,5 +200,6 @@ void test_test_local_storage(void)
> close(serv_sk);
>
> close_prog:
> + close(task_fd);
> local_storage__destroy(skel);
> }
next prev parent reply other threads:[~2020-11-05 22:03 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-05 14:47 [PATCH bpf-next v4 0/9] Implement task_local_storage KP Singh
2020-11-05 14:47 ` [PATCH bpf-next v4 1/9] bpf: Allow LSM programs to use bpf spin locks KP Singh
2020-11-05 18:45 ` Song Liu
2020-11-05 20:39 ` Martin KaFai Lau
2020-11-05 14:47 ` [PATCH bpf-next v4 2/9] bpf: Implement task local storage KP Singh
2020-11-05 21:16 ` Martin KaFai Lau
2020-11-05 14:47 ` [PATCH bpf-next v4 3/9] libbpf: Add support for " KP Singh
2020-11-05 14:47 ` [PATCH bpf-next v4 4/9] bpftool: " KP Singh
2020-11-05 21:18 ` Martin KaFai Lau
2020-11-05 14:47 ` [PATCH bpf-next v4 5/9] bpf: Implement get_current_task_btf and RET_PTR_TO_BTF_ID KP Singh
2020-11-05 21:24 ` Martin KaFai Lau
2020-11-05 14:47 ` [PATCH bpf-next v4 6/9] bpf: Fix tests for local_storage KP Singh
2020-11-05 14:47 ` [PATCH bpf-next v4 7/9] bpf: Update selftests for local_storage to use vmlinux.h KP Singh
2020-11-05 14:47 ` [PATCH bpf-next v4 8/9] bpf: Add tests for task_local_storage KP Singh
2020-11-05 22:02 ` Martin KaFai Lau [this message]
2020-11-05 22:32 ` KP Singh
2020-11-05 14:47 ` [PATCH bpf-next v4 9/9] bpf: Exercise syscall operations for inode and sk storage KP Singh
2020-11-05 22:07 ` Martin KaFai Lau
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201105220250.uvm3unmbne36lsoz@kafai-mbp.dhcp.thefacebook.com \
--to=kafai@fb.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=haoluo@google.com \
--cc=jannh@google.com \
--cc=kpsingh@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pjt@google.com \
--cc=songliubraving@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).