| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 23 Jan 2024 18:21:17 -0800
From: Andrii Nakryiko <andrii@...nel.org>
To: bpf@...r.kernel.org,
netdev@...r.kernel.org,
paul@...l-moore.com,
brauner@...nel.org
Cc: torvalds@...ux-foundation.org,
linux-fsdevel@...r.kernel.org,
linux-security-module@...r.kernel.org,
kernel-team@...a.com
Subject: [PATCH v2 bpf-next 20/30] selftests/bpf: utilize string values for delegate_xxx mount options
Use both hex-based and string-based way to specify delegate mount
options for BPF FS.
Acked-by: John Fastabend <john.fastabend@...il.com>
Signed-off-by: Andrii Nakryiko <andrii@...nel.org>
---
.../testing/selftests/bpf/prog_tests/token.c | 52 ++++++++++++-------
1 file changed, 32 insertions(+), 20 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/token.c b/tools/testing/selftests/bpf/prog_tests/token.c
index 5394a0c880a9..185ed2f79315 100644
--- a/tools/testing/selftests/bpf/prog_tests/token.c
+++ b/tools/testing/selftests/bpf/prog_tests/token.c
@@ -55,14 +55,22 @@ static int restore_priv_caps(__u64 old_caps)
return cap_enable_effective(old_caps, NULL);
}
-static int set_delegate_mask(int fs_fd, const char *key, __u64 mask)
+static int set_delegate_mask(int fs_fd, const char *key, __u64 mask, const char *mask_str)
{
char buf[32];
int err;
- snprintf(buf, sizeof(buf), "0x%llx", (unsigned long long)mask);
+ if (!mask_str) {
+ if (mask == ~0ULL) {
+ mask_str = "any";
+ } else {
+ snprintf(buf, sizeof(buf), "0x%llx", (unsigned long long)mask);
+ mask_str = buf;
+ }
+ }
+
err = sys_fsconfig(fs_fd, FSCONFIG_SET_STRING, key,
- mask == ~0ULL ? "any" : buf, 0);
+ mask_str, 0);
if (err < 0)
err = -errno;
return err;
@@ -75,6 +83,10 @@ struct bpffs_opts {
__u64 maps;
__u64 progs;
__u64 attachs;
+ const char *cmds_str;
+ const char *maps_str;
+ const char *progs_str;
+ const char *attachs_str;
};
static int create_bpffs_fd(void)
@@ -93,16 +105,16 @@ static int materialize_bpffs_fd(int fs_fd, struct bpffs_opts *opts)
int mnt_fd, err;
/* set up token delegation mount options */
- err = set_delegate_mask(fs_fd, "delegate_cmds", opts->cmds);
+ err = set_delegate_mask(fs_fd, "delegate_cmds", opts->cmds, opts->cmds_str);
if (!ASSERT_OK(err, "fs_cfg_cmds"))
return err;
- err = set_delegate_mask(fs_fd, "delegate_maps", opts->maps);
+ err = set_delegate_mask(fs_fd, "delegate_maps", opts->maps, opts->maps_str);
if (!ASSERT_OK(err, "fs_cfg_maps"))
return err;
- err = set_delegate_mask(fs_fd, "delegate_progs", opts->progs);
+ err = set_delegate_mask(fs_fd, "delegate_progs", opts->progs, opts->progs_str);
if (!ASSERT_OK(err, "fs_cfg_progs"))
return err;
- err = set_delegate_mask(fs_fd, "delegate_attachs", opts->attachs);
+ err = set_delegate_mask(fs_fd, "delegate_attachs", opts->attachs, opts->attachs_str);
if (!ASSERT_OK(err, "fs_cfg_attachs"))
return err;
@@ -284,13 +296,13 @@ static void child(int sock_fd, struct bpffs_opts *opts, child_callback_fn callba
}
/* ensure unprivileged child cannot set delegation options */
- err = set_delegate_mask(fs_fd, "delegate_cmds", 0x1);
+ err = set_delegate_mask(fs_fd, "delegate_cmds", 0x1, NULL);
ASSERT_EQ(err, -EPERM, "delegate_cmd_eperm");
- err = set_delegate_mask(fs_fd, "delegate_maps", 0x1);
+ err = set_delegate_mask(fs_fd, "delegate_maps", 0x1, NULL);
ASSERT_EQ(err, -EPERM, "delegate_maps_eperm");
- err = set_delegate_mask(fs_fd, "delegate_progs", 0x1);
+ err = set_delegate_mask(fs_fd, "delegate_progs", 0x1, NULL);
ASSERT_EQ(err, -EPERM, "delegate_progs_eperm");
- err = set_delegate_mask(fs_fd, "delegate_attachs", 0x1);
+ err = set_delegate_mask(fs_fd, "delegate_attachs", 0x1, NULL);
ASSERT_EQ(err, -EPERM, "delegate_attachs_eperm");
/* pass BPF FS context object to parent */
@@ -314,22 +326,22 @@ static void child(int sock_fd, struct bpffs_opts *opts, child_callback_fn callba
}
/* ensure unprivileged child cannot reconfigure to set delegation options */
- err = set_delegate_mask(fs_fd, "delegate_cmds", ~0ULL);
+ err = set_delegate_mask(fs_fd, "delegate_cmds", 0, "any");
if (!ASSERT_EQ(err, -EPERM, "delegate_cmd_eperm_reconfig")) {
err = -EINVAL;
goto cleanup;
}
- err = set_delegate_mask(fs_fd, "delegate_maps", ~0ULL);
+ err = set_delegate_mask(fs_fd, "delegate_maps", 0, "any");
if (!ASSERT_EQ(err, -EPERM, "delegate_maps_eperm_reconfig")) {
err = -EINVAL;
goto cleanup;
}
- err = set_delegate_mask(fs_fd, "delegate_progs", ~0ULL);
+ err = set_delegate_mask(fs_fd, "delegate_progs", 0, "any");
if (!ASSERT_EQ(err, -EPERM, "delegate_progs_eperm_reconfig")) {
err = -EINVAL;
goto cleanup;
}
- err = set_delegate_mask(fs_fd, "delegate_attachs", ~0ULL);
+ err = set_delegate_mask(fs_fd, "delegate_attachs", 0, "any");
if (!ASSERT_EQ(err, -EPERM, "delegate_attachs_eperm_reconfig")) {
err = -EINVAL;
goto cleanup;
@@ -658,8 +670,8 @@ void test_token(void)
{
if (test__start_subtest("map_token")) {
struct bpffs_opts opts = {
- .cmds = 1ULL << BPF_MAP_CREATE,
- .maps = 1ULL << BPF_MAP_TYPE_STACK,
+ .cmds_str = "map_create",
+ .maps_str = "stack",
};
subtest_userns(&opts, userns_map_create);
@@ -673,9 +685,9 @@ void test_token(void)
}
if (test__start_subtest("prog_token")) {
struct bpffs_opts opts = {
- .cmds = 1ULL << BPF_PROG_LOAD,
- .progs = 1ULL << BPF_PROG_TYPE_XDP,
- .attachs = 1ULL << BPF_XDP,
+ .cmds_str = "PROG_LOAD",
+ .progs_str = "XDP",
+ .attachs_str = "xdp",
};
subtest_userns(&opts, userns_prog_load);
--
2.34.1
Powered by blists - more mailing lists