[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <6230B3E5-E6B7-4D79-B3A4-9A250B19B242@meta.com>
Date: Fri, 27 Jun 2025 16:20:58 +0000
From: Song Liu <songliubraving@...a.com>
To: Alexei Starovoitov <alexei.starovoitov@...il.com>
CC: Song Liu <song@...nel.org>, Christian Brauner <brauner@...nel.org>,
Kernel
Team <kernel-team@...a.com>,
Andrii Nakryiko <andrii@...nel.org>, Eduard
<eddyz87@...il.com>,
Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann
<daniel@...earbox.net>,
Martin KaFai Lau <martin.lau@...ux.dev>,
Alexander
Viro <viro@...iv.linux.org.uk>, Jan Kara <jack@...e.cz>,
KP Singh
<kpsingh@...nel.org>,
Matt Bobrowski <mattbobrowski@...gle.com>,
Amir
Goldstein <amir73il@...il.com>,
Greg Kroah-Hartman
<gregkh@...uxfoundation.org>,
Tejun Heo <tj@...nel.org>, Daan De Meyer
<daan.j.demeyer@...il.com>,
bpf <bpf@...r.kernel.org>,
Linux-Fsdevel
<linux-fsdevel@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>,
LSM
List <linux-security-module@...r.kernel.org>
Subject: Re: [PATCH v3 bpf-next 0/4] Introduce bpf_cgroup_read_xattr
> On Jun 27, 2025, at 8:59 AM, Alexei Starovoitov <alexei.starovoitov@...il.com> wrote:
>
> On Thu, Jun 26, 2025 at 9:04 PM Song Liu <song@...nel.org> wrote:
>>
>> On Thu, Jun 26, 2025 at 7:14 PM Alexei Starovoitov
>> <alexei.starovoitov@...il.com> wrote:
>> [...]
>>> ./test_progs -t lsm_cgroup
>>> Summary: 1/2 PASSED, 0 SKIPPED, 0 FAILED
>>> ./test_progs -t lsm_cgroup
>>> Summary: 1/2 PASSED, 0 SKIPPED, 0 FAILED
>>> ./test_progs -t cgroup_xattr
>>> Summary: 1/8 PASSED, 0 SKIPPED, 0 FAILED
>>> ./test_progs -t lsm_cgroup
>>> test_lsm_cgroup_functional:PASS:bind(ETH_P_ALL) 0 nsec
>>> (network_helpers.c:121: errno: Cannot assign requested address) Failed
>>> to bind socket
>>> test_lsm_cgroup_functional:FAIL:start_server unexpected start_server:
>>> actual -1 < expected 0
>>> (network_helpers.c:360: errno: Bad file descriptor) getsockopt(SOL_PROTOCOL)
>>> test_lsm_cgroup_functional:FAIL:connect_to_fd unexpected
>>> connect_to_fd: actual -1 < expected 0
>>> test_lsm_cgroup_functional:FAIL:accept unexpected accept: actual -1 < expected 0
>>> test_lsm_cgroup_functional:FAIL:getsockopt unexpected getsockopt:
>>> actual -1 < expected 0
>>> test_lsm_cgroup_functional:FAIL:sk_priority unexpected sk_priority:
>>> actual 0 != expected 234
>>> ...
>>> Summary: 0/1 PASSED, 0 SKIPPED, 1 FAILED
>>>
>>>
>>> Song,
>>> Please follow up with the fix for selftest.
>>> It will be in bpf-next only.
>>
>> The issue is because cgroup_xattr calls "ip link set dev lo up"
>> in setup, and calls "ip link set dev lo down" in cleanup. Most
>> other tests only call "ip link set dev lo up". IOW, it appears to
>> me that cgroup_xattr is doing the cleanup properly. To fix this,
>> we can either remove "dev lo down" from cgroup_xattr, or add
>> "dev lo up" to lsm_cgroups. Do you have any preference one
>> way or another?
>
> It messes with "lo" without switching netns? Ouch.
Ah, I see the problem now.
> Not sure what tests you copied that code from,
> but all "ip" commands, ping_group_range, and sockets
> don't need to be in the test. Instead of triggering
> progs through lsm/socket_connect hook can't you use
> a simple hook like lsm/bpf or lsm/file_open that doesn't require
> networking setup ?
Yeah, let me fix the test with a different hook.
Thanks,
Song
Powered by blists - more mailing lists