Re: [PATCH V4 0/3] selinux-testsuite: Add BPF tests

[Stephen Smalley <sds@tycho.nsa.gov>]

On 9/17/19 10:56 AM, Richard Haines wrote:
> Patch 1 Runs basic checks for BPF with map_create, map_read, map_write,
> prog_load and prog_run permissions.
> V2 Change - Split BPF code into bpf_common.c for others to use.
> V3 Changes - Correct style, Fix typos
> V4 Changes - Fixes as discussed in [1]
> 
> Patch 2 Updates fdreceive to test BPF security_file_receive() path using
> the common BPF code in tests/bpf.
> V2 Change - Added to use tests/bpf/bpf_common.c for BPF tests.
> V3 Changes - Run tests under tests/bpf not tests/fdreceive, fix typos.
> V4 Changes - Update to work with changes in [1]
> 
> Patch 3 - Updates Binder to test BPF path security_binder_transfer_file()
> V4 Change - New patch

With this version of the patches, all of the tests pass for me, 
including the binder tests on a kernel with binder enabled.

The audit log output lined up correctly with the expected denials. 
There was a fair amount of noise that had to be filtered/ignored though 
due to the sys_admin checks (for bpf) and sys_nice checks (for binder), 
which apparently aren't fatal to the system calls.  We might want to 
have a look sometime at avoiding unnecessary CAP_SYS_ADMIN and 
CAP_SYS_NICE checks in the bpf and binder code to avoid polluting the 
audit logs and leading people to generate overly permissive policies. 
That's not your bug to fix though.


> 
> [1] https://lore.kernel.org/selinux/19b043bc4d5efbf2f1994958c0a74709a34e3ad0.camel@btinternet.com/
> 
> Richard Haines (3):
>    selinux-testsuite: Add BPF tests
>    selinux-testsuite: Add BPF support to fdreceive test
>    selinux-testsuite: Add BPF support to binder test
> 
>   README.md                       |   4 +-
>   defconfig                       |   5 +
>   policy/Makefile                 |   4 +
>   policy/test_binder_bpf.te       |  73 ++++++++++++
>   policy/test_bpf.te              |  78 +++++++++++++
>   policy/test_fdreceive_bpf.te    |  60 ++++++++++
>   tests/Makefile                  |   7 ++
>   tests/binder/Makefile           |   5 +
>   tests/binder/binder_common.c    |  10 +-
>   tests/binder/binder_common.h    |  17 ++-
>   tests/binder/client.c           |  28 ++++-
>   tests/binder/manager.c          |   2 +-
>   tests/binder/service_provider.c | 118 ++++++++++++++-----
>   tests/bpf/.gitignore            |   2 +
>   tests/bpf/Makefile              |  17 +++
>   tests/bpf/bpf_common.c          |  53 +++++++++
>   tests/bpf/bpf_common.h          |  34 ++++++
>   tests/bpf/bpf_test.c            |  77 ++++++++++++
>   tests/bpf/test                  | 199 ++++++++++++++++++++++++++++++++
>   tests/fdreceive/Makefile        |  14 ++-
>   tests/fdreceive/client.c        |  93 +++++++++++++--
>   21 files changed, 847 insertions(+), 53 deletions(-)
>   create mode 100644 policy/test_binder_bpf.te
>   create mode 100644 policy/test_bpf.te
>   create mode 100644 policy/test_fdreceive_bpf.te
>   create mode 100644 tests/bpf/.gitignore
>   create mode 100644 tests/bpf/Makefile
>   create mode 100644 tests/bpf/bpf_common.c
>   create mode 100644 tests/bpf/bpf_common.h
>   create mode 100644 tests/bpf/bpf_test.c
>   create mode 100755 tests/bpf/test
>