diff mbox series

[RESEND,RFC,3/3] selftests/bpf: Check if return values of LSM programs are allowed

Message ID 20221028165423.386151-3-roberto.sassu@huaweicloud.com (mailing list archive)
State RFC
Delegated to: BPF
Headers show
Series [RESEND,RFC,1/3] lsm: Clarify documentation of vm_enough_memory hook | expand

Checks

Context Check Description
bpf/vmtest-bpf-next-VM_Test-1 fail Logs for ShellCheck
netdev/tree_selection success Guessed tree name to be net-next
netdev/fixes_present success Fixes tag not required for -next series
netdev/subject_prefix success Link
netdev/cover_letter warning Series does not have a cover letter
netdev/patch_count success Link
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/cc_maintainers warning 1 maintainers not CCed: roberto.sassu@huawei.com
netdev/build_clang success Errors and warnings before: 0 this patch: 0
netdev/module_param success Was 0 now: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/checkpatch warning WARNING: Missing or malformed SPDX-License-Identifier tag in line 1 WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-next-VM_Test-5 success Logs for llvm-toolchain
bpf/vmtest-bpf-next-VM_Test-6 success Logs for set-matrix
bpf/vmtest-bpf-next-VM_Test-3 success Logs for build for x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-4 success Logs for build for x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-2 success Logs for build for s390x with gcc
bpf/vmtest-bpf-next-VM_Test-23 success Logs for test_verifier on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-8 success Logs for test_maps on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-9 success Logs for test_maps on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-12 fail Logs for test_progs on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-14 fail Logs for test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-15 fail Logs for test_progs_no_alu32 on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-17 success Logs for test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-18 success Logs for test_progs_no_alu32_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-20 success Logs for test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-21 success Logs for test_progs_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-24 success Logs for test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-11 fail Logs for test_progs on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-13 success Logs for test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-16 success Logs for test_progs_no_alu32_parallel on s390x with gcc
bpf/vmtest-bpf-next-PR fail PR summary
bpf/vmtest-bpf-next-VM_Test-7 success Logs for test_maps on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-10 success Logs for test_progs on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-19 success Logs for test_progs_parallel on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-22 success Logs for test_verifier on s390x with gcc

Commit Message

Roberto Sassu Oct. 28, 2022, 4:54 p.m. UTC 
From: Roberto Sassu <roberto.sassu@huawei.com>

Ensure that the eBPF verifier allows to load only LSM programs that return
an allowed value depending on the LSM hook they attach to.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 .../testing/selftests/bpf/verifier/lsm_ret.c  | 148 ++++++++++++++++++
 1 file changed, 148 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/verifier/lsm_ret.c
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/verifier/lsm_ret.c b/tools/testing/selftests/bpf/verifier/lsm_ret.c
new file mode 100644
index 000000000000..1a11f47fb24a
--- /dev/null
+++ b/tools/testing/selftests/bpf/verifier/lsm_ret.c
@@ -0,0 +1,148 @@ 
+{
+	"lsm return value: positive not allowed, return -EPERM",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, -EPERM),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_LSM,
+	.kfunc = "inode_permission",
+	.expected_attach_type = BPF_LSM_MAC,
+	.result = ACCEPT,
+},
+{
+	"lsm return value: positive not allowed, return zero",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_LSM,
+	.kfunc = "inode_permission",
+	.expected_attach_type = BPF_LSM_MAC,
+	.result = ACCEPT,
+},
+{
+	"lsm return value: positive not allowed, return one",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, 1),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_LSM,
+	.kfunc = "inode_permission",
+	.expected_attach_type = BPF_LSM_MAC,
+	.errstr = "Invalid R0, cannot return positive value",
+	.result = REJECT,
+},
+{
+	"lsm return value: zero/positive not allowed, return -EPERM",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, -EPERM),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_LSM,
+	.kfunc = "inode_init_security",
+	.expected_attach_type = BPF_LSM_MAC,
+	.result = ACCEPT,
+},
+{
+	"lsm return value: zero/positive not allowed, return zero",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_LSM,
+	.kfunc = "inode_init_security",
+	.expected_attach_type = BPF_LSM_MAC,
+	.errstr = "Invalid R0, cannot return zero value",
+	.result = REJECT,
+},
+{
+	"lsm return value: zero/positive not allowed, return one",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, 1),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_LSM,
+	.kfunc = "inode_init_security",
+	.expected_attach_type = BPF_LSM_MAC,
+	.errstr = "Invalid R0, cannot return positive value",
+	.result = REJECT,
+},
+{
+	"lsm return value: positive allowed, return one",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, 1),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_LSM,
+	.kfunc = "getprocattr",
+	.expected_attach_type = BPF_LSM_MAC,
+	.result = ACCEPT,
+},
+{
+	"lsm return value: positive allowed, return two",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, 2),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_LSM,
+	.kfunc = "getprocattr",
+	.expected_attach_type = BPF_LSM_MAC,
+	.result = ACCEPT,
+},
+{
+	"lsm return value: only one allowed, return one",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, 1),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_LSM,
+	.kfunc = "audit_rule_match",
+	.expected_attach_type = BPF_LSM_MAC,
+	.result = ACCEPT,
+},
+{
+	"lsm return value: only one allowed, return two",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, 2),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_LSM,
+	.kfunc = "audit_rule_match",
+	.expected_attach_type = BPF_LSM_MAC,
+	.errstr = "Invalid R0, can return only one as positive value",
+	.result = REJECT,
+},
+{
+	"lsm return value: negative not allowed, return -EPERM",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, -EPERM),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_LSM,
+	.kfunc = "vm_enough_memory",
+	.expected_attach_type = BPF_LSM_MAC,
+	.errstr = "Invalid R0, cannot return negative value",
+	.result = REJECT,
+},
+{
+	"lsm return value: negative not allowed, return zero",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_LSM,
+	.kfunc = "vm_enough_memory",
+	.expected_attach_type = BPF_LSM_MAC,
+	.result = ACCEPT,
+},
+{
+	"lsm return value: negative not allowed, return one",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, 1),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_LSM,
+	.kfunc = "vm_enough_memory",
+	.expected_attach_type = BPF_LSM_MAC,
+	.result = ACCEPT,
+},