mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-09-04 20:19:47 +08:00
03e54f100d
* Load/attach a BPF program that hooks to file_mprotect (int) and bprm_committed_creds (void). * Perform an action that triggers the hook. * Verify if the audit event was received using the shared global variables for the process executed. * Verify if the mprotect returns a -EPERM. Signed-off-by: KP Singh <kpsingh@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Brendan Jackman <jackmanb@google.com> Reviewed-by: Florent Revest <revest@google.com> Reviewed-by: Thomas Garnier <thgarnie@google.com> Reviewed-by: James Morris <jamorris@linux.microsoft.com> Acked-by: Andrii Nakryiko <andriin@fb.com> Link: https://lore.kernel.org/bpf/20200329004356.27286-8-kpsingh@chromium.org
87 lines
1.6 KiB
C
87 lines
1.6 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
/*
|
|
* Copyright (C) 2020 Google LLC.
|
|
*/
|
|
|
|
#include <test_progs.h>
|
|
#include <sys/mman.h>
|
|
#include <sys/wait.h>
|
|
#include <unistd.h>
|
|
#include <malloc.h>
|
|
#include <stdlib.h>
|
|
|
|
#include "lsm.skel.h"
|
|
|
|
char *CMD_ARGS[] = {"true", NULL};
|
|
|
|
int heap_mprotect(void)
|
|
{
|
|
void *buf;
|
|
long sz;
|
|
int ret;
|
|
|
|
sz = sysconf(_SC_PAGESIZE);
|
|
if (sz < 0)
|
|
return sz;
|
|
|
|
buf = memalign(sz, 2 * sz);
|
|
if (buf == NULL)
|
|
return -ENOMEM;
|
|
|
|
ret = mprotect(buf, sz, PROT_READ | PROT_WRITE | PROT_EXEC);
|
|
free(buf);
|
|
return ret;
|
|
}
|
|
|
|
int exec_cmd(int *monitored_pid)
|
|
{
|
|
int child_pid, child_status;
|
|
|
|
child_pid = fork();
|
|
if (child_pid == 0) {
|
|
*monitored_pid = getpid();
|
|
execvp(CMD_ARGS[0], CMD_ARGS);
|
|
return -EINVAL;
|
|
} else if (child_pid > 0) {
|
|
waitpid(child_pid, &child_status, 0);
|
|
return child_status;
|
|
}
|
|
|
|
return -EINVAL;
|
|
}
|
|
|
|
void test_test_lsm(void)
|
|
{
|
|
struct lsm *skel = NULL;
|
|
int err, duration = 0;
|
|
|
|
skel = lsm__open_and_load();
|
|
if (CHECK(!skel, "skel_load", "lsm skeleton failed\n"))
|
|
goto close_prog;
|
|
|
|
err = lsm__attach(skel);
|
|
if (CHECK(err, "attach", "lsm attach failed: %d\n", err))
|
|
goto close_prog;
|
|
|
|
err = exec_cmd(&skel->bss->monitored_pid);
|
|
if (CHECK(err < 0, "exec_cmd", "err %d errno %d\n", err, errno))
|
|
goto close_prog;
|
|
|
|
CHECK(skel->bss->bprm_count != 1, "bprm_count", "bprm_count = %d\n",
|
|
skel->bss->bprm_count);
|
|
|
|
skel->bss->monitored_pid = getpid();
|
|
|
|
err = heap_mprotect();
|
|
if (CHECK(errno != EPERM, "heap_mprotect", "want errno=EPERM, got %d\n",
|
|
errno))
|
|
goto close_prog;
|
|
|
|
CHECK(skel->bss->mprotect_count != 1, "mprotect_count",
|
|
"mprotect_count = %d\n", skel->bss->mprotect_count);
|
|
|
|
close_prog:
|
|
lsm__destroy(skel);
|
|
}
|