| Message ID | 20200326142823.26277-8-kpsingh@chromium.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | MAC and Audit policy using eBPF (KRSI) | expand |
On Thu, Mar 26, 2020 at 7:30 AM KP Singh <kpsingh@chromium.org> wrote: > > From: KP Singh <kpsingh@google.com> > > * Load/attach a BPF program that hooks to file_mprotect (int) > and bprm_committed_creds (void). > * Perform an action that triggers the hook. > * Verify if the audit event was received using the shared global > variables for the process executed. > * Verify if the mprotect returns a -EPERM. > > Signed-off-by: KP Singh <kpsingh@google.com> > Reviewed-by: Brendan Jackman <jackmanb@google.com> > Reviewed-by: Florent Revest <revest@google.com> > Reviewed-by: Thomas Garnier <thgarnie@google.com> > --- Please fix endlines below. With that: Acked-by: Andrii Nakryiko <andriin@fb.com> > tools/testing/selftests/bpf/config | 2 + > .../selftests/bpf/prog_tests/test_lsm.c | 86 +++++++++++++++++++ > tools/testing/selftests/bpf/progs/lsm.c | 48 +++++++++++ > 3 files changed, 136 insertions(+) > create mode 100644 tools/testing/selftests/bpf/prog_tests/test_lsm.c > create mode 100644 tools/testing/selftests/bpf/progs/lsm.c > [...] > +void test_test_lsm(void) > +{ > + struct lsm *skel = NULL; > + int err, duration = 0; > + > + skel = lsm__open_and_load(); > + if (CHECK(!skel, "skel_load", "lsm skeleton failed\n")) > + goto close_prog; > + > + err = lsm__attach(skel); > + if (CHECK(err, "attach", "lsm attach failed: %d\n", err)) > + goto close_prog; > + > + err = exec_cmd(&skel->bss->monitored_pid); > + if (CHECK(err < 0, "exec_cmd", "err %d errno %d\n", err, errno)) > + goto close_prog; > + > + CHECK(skel->bss->bprm_count != 1, "bprm_count", "bprm_count = %d", \n is missing > + skel->bss->bprm_count); > + > + skel->bss->monitored_pid = getpid(); > + > + err = heap_mprotect(); > + if (CHECK(errno != EPERM, "heap_mprotect", "want errno=EPERM, got %d\n", > + errno)) > + goto close_prog; > + > + CHECK(skel->bss->mprotect_count != 1, "mprotect_count", > + "mprotect_count = %d", skel->bss->mprotect_count); \n is missing > + > +close_prog: > + lsm__destroy(skel); > +} [...]
On 26-Mär 12:24, Andrii Nakryiko wrote: > On Thu, Mar 26, 2020 at 7:30 AM KP Singh <kpsingh@chromium.org> wrote: > > > > From: KP Singh <kpsingh@google.com> > > > > * Load/attach a BPF program that hooks to file_mprotect (int) > > and bprm_committed_creds (void). > > * Perform an action that triggers the hook. > > * Verify if the audit event was received using the shared global > > variables for the process executed. > > * Verify if the mprotect returns a -EPERM. > > > > Signed-off-by: KP Singh <kpsingh@google.com> > > Reviewed-by: Brendan Jackman <jackmanb@google.com> > > Reviewed-by: Florent Revest <revest@google.com> > > Reviewed-by: Thomas Garnier <thgarnie@google.com> > > --- > > Please fix endlines below. With that: > > Acked-by: Andrii Nakryiko <andriin@fb.com> > > > tools/testing/selftests/bpf/config | 2 + > > .../selftests/bpf/prog_tests/test_lsm.c | 86 +++++++++++++++++++ > > tools/testing/selftests/bpf/progs/lsm.c | 48 +++++++++++ > > 3 files changed, 136 insertions(+) > > create mode 100644 tools/testing/selftests/bpf/prog_tests/test_lsm.c > > create mode 100644 tools/testing/selftests/bpf/progs/lsm.c > > > > [...] > > > +void test_test_lsm(void) > > +{ > > + struct lsm *skel = NULL; > > + int err, duration = 0; > > + > > + skel = lsm__open_and_load(); > > + if (CHECK(!skel, "skel_load", "lsm skeleton failed\n")) > > + goto close_prog; > > + > > + err = lsm__attach(skel); > > + if (CHECK(err, "attach", "lsm attach failed: %d\n", err)) > > + goto close_prog; > > + > > + err = exec_cmd(&skel->bss->monitored_pid); > > + if (CHECK(err < 0, "exec_cmd", "err %d errno %d\n", err, errno)) > > + goto close_prog; > > + > > + CHECK(skel->bss->bprm_count != 1, "bprm_count", "bprm_count = %d", > > \n is missing Done. > > > + skel->bss->bprm_count); > > + > > + skel->bss->monitored_pid = getpid(); > > + > > + err = heap_mprotect(); > > + if (CHECK(errno != EPERM, "heap_mprotect", "want errno=EPERM, got %d\n", > > + errno)) > > + goto close_prog; > > + > > + CHECK(skel->bss->mprotect_count != 1, "mprotect_count", > > + "mprotect_count = %d", skel->bss->mprotect_count); > > \n is missing Done. - KP > > > + > > +close_prog: > > + lsm__destroy(skel); > > +} > > [...]
On Thu, 26 Mar 2020, KP Singh wrote: > From: KP Singh <kpsingh@google.com> > > * Load/attach a BPF program that hooks to file_mprotect (int) > and bprm_committed_creds (void). > * Perform an action that triggers the hook. > * Verify if the audit event was received using the shared global > variables for the process executed. > * Verify if the mprotect returns a -EPERM. > > Signed-off-by: KP Singh <kpsingh@google.com> > Reviewed-by: Brendan Jackman <jackmanb@google.com> > Reviewed-by: Florent Revest <revest@google.com> > Reviewed-by: Thomas Garnier <thgarnie@google.com> Cool stuff! Reviewed-by: James Morris <jamorris@linux.microsoft.com>
diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config index 5dc109f4c097..60e3ae5d4e48 100644 --- a/tools/testing/selftests/bpf/config +++ b/tools/testing/selftests/bpf/config @@ -35,3 +35,5 @@ CONFIG_MPLS_ROUTING=m CONFIG_MPLS_IPTUNNEL=m CONFIG_IPV6_SIT=m CONFIG_BPF_JIT=y +CONFIG_BPF_LSM=y +CONFIG_SECURITY=y diff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c new file mode 100644 index 000000000000..6eb7060e4422 --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c @@ -0,0 +1,86 @@ +// SPDX-License-Identifier: GPL-2.0 + +/* + * Copyright (C) 2020 Google LLC. + */ + +#include <test_progs.h> +#include <sys/mman.h> +#include <sys/wait.h> +#include <unistd.h> +#include <malloc.h> +#include <stdlib.h> + +#include "lsm.skel.h" + +char *CMD_ARGS[] = {"true", NULL}; + +int heap_mprotect(void) +{ + void *buf; + long sz; + int ret; + + sz = sysconf(_SC_PAGESIZE); + if (sz < 0) + return sz; + + buf = memalign(sz, 2 * sz); + if (buf == NULL) + return -ENOMEM; + + ret = mprotect(buf, sz, PROT_READ | PROT_EXEC); + free(buf); + return ret; +} + +int exec_cmd(int *monitored_pid) +{ + int child_pid, child_status; + + child_pid = fork(); + if (child_pid == 0) { + *monitored_pid = getpid(); + execvp(CMD_ARGS[0], CMD_ARGS); + return -EINVAL; + } else if (child_pid > 0) { + waitpid(child_pid, &child_status, 0); + return child_status; + } + + return -EINVAL; +} + +void test_test_lsm(void) +{ + struct lsm *skel = NULL; + int err, duration = 0; + + skel = lsm__open_and_load(); + if (CHECK(!skel, "skel_load", "lsm skeleton failed\n")) + goto close_prog; + + err = lsm__attach(skel); + if (CHECK(err, "attach", "lsm attach failed: %d\n", err)) + goto close_prog; + + err = exec_cmd(&skel->bss->monitored_pid); + if (CHECK(err < 0, "exec_cmd", "err %d errno %d\n", err, errno)) + goto close_prog; + + CHECK(skel->bss->bprm_count != 1, "bprm_count", "bprm_count = %d", + skel->bss->bprm_count); + + skel->bss->monitored_pid = getpid(); + + err = heap_mprotect(); + if (CHECK(errno != EPERM, "heap_mprotect", "want errno=EPERM, got %d\n", + errno)) + goto close_prog; + + CHECK(skel->bss->mprotect_count != 1, "mprotect_count", + "mprotect_count = %d", skel->bss->mprotect_count); + +close_prog: + lsm__destroy(skel); +} diff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selftests/bpf/progs/lsm.c new file mode 100644 index 000000000000..a4e3c223028d --- /dev/null +++ b/tools/testing/selftests/bpf/progs/lsm.c @@ -0,0 +1,48 @@ +// SPDX-License-Identifier: GPL-2.0 + +/* + * Copyright 2020 Google LLC. + */ + +#include "vmlinux.h" +#include <bpf/bpf_helpers.h> +#include <bpf/bpf_tracing.h> +#include <errno.h> + +char _license[] SEC("license") = "GPL"; + +int monitored_pid = 0; +int mprotect_count = 0; +int bprm_count = 0; + +SEC("lsm/file_mprotect") +int BPF_PROG(test_int_hook, struct vm_area_struct *vma, + unsigned long reqprot, unsigned long prot, int ret) +{ + if (ret != 0) + return ret; + + __u32 pid = bpf_get_current_pid_tgid() >> 32; + int is_heap = 0; + + is_heap = (vma->vm_start >= vma->vm_mm->start_brk && + vma->vm_end <= vma->vm_mm->brk); + + if (is_heap && monitored_pid == pid) { + mprotect_count++; + ret = -EPERM; + } + + return ret; +} + +SEC("lsm/bprm_committed_creds") +int BPF_PROG(test_void_hook, struct linux_binprm *bprm) +{ + __u32 pid = bpf_get_current_pid_tgid() >> 32; + + if (monitored_pid == pid) + bprm_count++; + + return 0; +}