| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220712184128.999301-7-roberto.sassu@huawei.com>
Date: Tue, 12 Jul 2022 20:41:27 +0200
From: Roberto Sassu <roberto.sassu@...wei.com>
To: <ast@...nel.org>, <daniel@...earbox.net>,
<john.fastabend@...il.com>, <andrii@...nel.org>,
<martin.lau@...ux.dev>, <song@...nel.org>, <yhs@...com>,
<kpsingh@...nel.org>, <dhowells@...hat.com>, <jarkko@...nel.org>,
<shuah@...nel.org>
CC: <bpf@...r.kernel.org>, <keyrings@...r.kernel.org>,
<linux-security-module@...r.kernel.org>,
<linux-kselftest@...r.kernel.org>, <netdev@...r.kernel.org>,
<linux-kernel@...r.kernel.org>,
Roberto Sassu <roberto.sassu@...wei.com>
Subject: [PATCH v7 6/7] selftests/bpf: Add additional test for bpf_lookup_user_key()
Add an additional test to ensure that bpf_lookup_user_key() creates a
referenced special keyring when the KEY_LOOKUP_CREATE flag is passed to
this function.
Also ensure that the helper rejects invalid flags.
Signed-off-by: Roberto Sassu <roberto.sassu@...wei.com>
---
.../bpf/prog_tests/lookup_user_key.c | 94 +++++++++++++++++++
.../bpf/progs/test_lookup_user_key.c | 35 +++++++
2 files changed, 129 insertions(+)
create mode 100644 tools/testing/selftests/bpf/prog_tests/lookup_user_key.c
create mode 100644 tools/testing/selftests/bpf/progs/test_lookup_user_key.c
diff --git a/tools/testing/selftests/bpf/prog_tests/lookup_user_key.c b/tools/testing/selftests/bpf/prog_tests/lookup_user_key.c
new file mode 100644
index 000000000000..6487699d30f6
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/lookup_user_key.c
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (C) 2022 Huawei Technologies Duesseldorf GmbH
+ *
+ * Author: Roberto Sassu <roberto.sassu@...wei.com>
+ */
+
+#include <linux/keyctl.h>
+#include <test_progs.h>
+
+#include "test_lookup_user_key.skel.h"
+
+#define LOG_BUF_SIZE 16384
+
+#define KEY_LOOKUP_CREATE 0x01
+#define KEY_LOOKUP_PARTIAL 0x02
+
+void test_lookup_user_key(void)
+{
+ char *buf = NULL;
+ struct test_lookup_user_key *skel = NULL;
+ u32 next_id;
+ int ret;
+
+ LIBBPF_OPTS(bpf_object_open_opts, opts);
+
+ buf = malloc(LOG_BUF_SIZE);
+ if (!ASSERT_OK_PTR(buf, "malloc"))
+ goto close_prog;
+
+ opts.kernel_log_buf = buf;
+ opts.kernel_log_size = LOG_BUF_SIZE;
+ opts.kernel_log_level = 1;
+
+ skel = test_lookup_user_key__open_opts(&opts);
+ if (!ASSERT_OK_PTR(skel, "test_lookup_user_key__open_opts"))
+ goto close_prog;
+
+ ret = test_lookup_user_key__load(skel);
+
+ if (ret < 0 && strstr(buf, "unknown func bpf_lookup_user_key")) {
+ printf("%s:SKIP:bpf_lookup_user_key() helper not supported\n",
+ __func__);
+ test__skip();
+ goto close_prog;
+ }
+
+ if (!ASSERT_OK(ret, "test_lookup_user_key__load"))
+ goto close_prog;
+
+ ret = test_lookup_user_key__attach(skel);
+ if (!ASSERT_OK(ret, "test_lookup_user_key__attach"))
+ goto close_prog;
+
+ skel->bss->monitored_pid = getpid();
+ skel->bss->key_serial = KEY_SPEC_THREAD_KEYRING;
+
+ /* The thread-specific keyring does not exist, this test fails. */
+ skel->bss->flags = 0;
+
+ ret = bpf_prog_get_next_id(0, &next_id);
+ if (!ASSERT_LT(ret, 0, "bpf_prog_get_next_id"))
+ goto close_prog;
+
+ /* Force creation of the thread-specific keyring, this test succeeds. */
+ skel->bss->flags = KEY_LOOKUP_CREATE;
+
+ ret = bpf_prog_get_next_id(0, &next_id);
+ if (!ASSERT_OK(ret, "bpf_prog_get_next_id"))
+ goto close_prog;
+
+ /* Pass both lookup flags for parameter validation. */
+ skel->bss->flags = KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL;
+
+ ret = bpf_prog_get_next_id(0, &next_id);
+ if (!ASSERT_OK(ret, "bpf_prog_get_next_id"))
+ goto close_prog;
+
+ /* Pass invalid flags. */
+ skel->bss->flags = UINT64_MAX;
+
+ ret = bpf_prog_get_next_id(0, &next_id);
+ ASSERT_LT(ret, 0, "bpf_prog_get_next_id");
+
+close_prog:
+ free(buf);
+
+ if (!skel)
+ return;
+
+ skel->bss->monitored_pid = 0;
+ test_lookup_user_key__destroy(skel);
+}
diff --git a/tools/testing/selftests/bpf/progs/test_lookup_user_key.c b/tools/testing/selftests/bpf/progs/test_lookup_user_key.c
new file mode 100644
index 000000000000..5b63753ba163
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_lookup_user_key.c
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (C) 2022 Huawei Technologies Duesseldorf GmbH
+ *
+ * Author: Roberto Sassu <roberto.sassu@...wei.com>
+ */
+
+#include <errno.h>
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+
+char _license[] SEC("license") = "GPL";
+
+__u32 monitored_pid;
+__u32 key_serial;
+__u64 flags;
+
+SEC("lsm.s/bpf")
+int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size)
+{
+ struct key *key;
+ __u32 pid;
+
+ pid = bpf_get_current_pid_tgid() >> 32;
+ if (pid != monitored_pid)
+ return 0;
+
+ key = bpf_lookup_user_key(key_serial, flags);
+ if (key)
+ bpf_key_put(key);
+
+ return (key) ? 0 : -ENOENT;
+}
--
2.25.1
Powered by blists - more mailing lists