1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */
3 #define _GNU_SOURCE
4 #include <test_progs.h>
5 #include <bpf/btf.h>
6 #include "cap_helpers.h"
7 #include <fcntl.h>
8 #include <sched.h>
9 #include <signal.h>
10 #include <unistd.h>
11 #include <linux/filter.h>
12 #include <linux/unistd.h>
13 #include <linux/mount.h>
14 #include <sys/socket.h>
15 #include <sys/stat.h>
16 #include <sys/syscall.h>
17 #include <sys/un.h>
18 #include "priv_map.skel.h"
19 #include "priv_prog.skel.h"
20 #include "dummy_st_ops_success.skel.h"
21 #include "token_lsm.skel.h"
22 #include "priv_freplace_prog.skel.h"
23
sys_mount(const char * dev_name,const char * dir_name,const char * type,unsigned long flags,const void * data)24 static inline int sys_mount(const char *dev_name, const char *dir_name,
25 const char *type, unsigned long flags,
26 const void *data)
27 {
28 return syscall(__NR_mount, dev_name, dir_name, type, flags, data);
29 }
30
sys_fsopen(const char * fsname,unsigned flags)31 static inline int sys_fsopen(const char *fsname, unsigned flags)
32 {
33 return syscall(__NR_fsopen, fsname, flags);
34 }
35
sys_fspick(int dfd,const char * path,unsigned flags)36 static inline int sys_fspick(int dfd, const char *path, unsigned flags)
37 {
38 return syscall(__NR_fspick, dfd, path, flags);
39 }
40
sys_fsconfig(int fs_fd,unsigned cmd,const char * key,const void * val,int aux)41 static inline int sys_fsconfig(int fs_fd, unsigned cmd, const char *key, const void *val, int aux)
42 {
43 return syscall(__NR_fsconfig, fs_fd, cmd, key, val, aux);
44 }
45
sys_fsmount(int fs_fd,unsigned flags,unsigned ms_flags)46 static inline int sys_fsmount(int fs_fd, unsigned flags, unsigned ms_flags)
47 {
48 return syscall(__NR_fsmount, fs_fd, flags, ms_flags);
49 }
50
sys_move_mount(int from_dfd,const char * from_path,int to_dfd,const char * to_path,unsigned flags)51 static inline int sys_move_mount(int from_dfd, const char *from_path,
52 int to_dfd, const char *to_path,
53 unsigned flags)
54 {
55 return syscall(__NR_move_mount, from_dfd, from_path, to_dfd, to_path, flags);
56 }
57
drop_priv_caps(__u64 * old_caps)58 static int drop_priv_caps(__u64 *old_caps)
59 {
60 return cap_disable_effective((1ULL << CAP_BPF) |
61 (1ULL << CAP_PERFMON) |
62 (1ULL << CAP_NET_ADMIN) |
63 (1ULL << CAP_SYS_ADMIN), old_caps);
64 }
65
restore_priv_caps(__u64 old_caps)66 static int restore_priv_caps(__u64 old_caps)
67 {
68 return cap_enable_effective(old_caps, NULL);
69 }
70
set_delegate_mask(int fs_fd,const char * key,__u64 mask,const char * mask_str)71 static int set_delegate_mask(int fs_fd, const char *key, __u64 mask, const char *mask_str)
72 {
73 char buf[32];
74 int err;
75
76 if (!mask_str) {
77 if (mask == ~0ULL) {
78 mask_str = "any";
79 } else {
80 snprintf(buf, sizeof(buf), "0x%llx", (unsigned long long)mask);
81 mask_str = buf;
82 }
83 }
84
85 err = sys_fsconfig(fs_fd, FSCONFIG_SET_STRING, key,
86 mask_str, 0);
87 if (err < 0)
88 err = -errno;
89 return err;
90 }
91
92 #define zclose(fd) do { if (fd >= 0) close(fd); fd = -1; } while (0)
93
94 struct bpffs_opts {
95 __u64 cmds;
96 __u64 maps;
97 __u64 progs;
98 __u64 attachs;
99 const char *cmds_str;
100 const char *maps_str;
101 const char *progs_str;
102 const char *attachs_str;
103 };
104
create_bpffs_fd(void)105 static int create_bpffs_fd(void)
106 {
107 int fs_fd;
108
109 /* create VFS context */
110 fs_fd = sys_fsopen("bpf", 0);
111 ASSERT_GE(fs_fd, 0, "fs_fd");
112
113 return fs_fd;
114 }
115
materialize_bpffs_fd(int fs_fd,struct bpffs_opts * opts)116 static int materialize_bpffs_fd(int fs_fd, struct bpffs_opts *opts)
117 {
118 int mnt_fd, err;
119
120 /* set up token delegation mount options */
121 err = set_delegate_mask(fs_fd, "delegate_cmds", opts->cmds, opts->cmds_str);
122 if (!ASSERT_OK(err, "fs_cfg_cmds"))
123 return err;
124 err = set_delegate_mask(fs_fd, "delegate_maps", opts->maps, opts->maps_str);
125 if (!ASSERT_OK(err, "fs_cfg_maps"))
126 return err;
127 err = set_delegate_mask(fs_fd, "delegate_progs", opts->progs, opts->progs_str);
128 if (!ASSERT_OK(err, "fs_cfg_progs"))
129 return err;
130 err = set_delegate_mask(fs_fd, "delegate_attachs", opts->attachs, opts->attachs_str);
131 if (!ASSERT_OK(err, "fs_cfg_attachs"))
132 return err;
133
134 /* instantiate FS object */
135 err = sys_fsconfig(fs_fd, FSCONFIG_CMD_CREATE, NULL, NULL, 0);
136 if (err < 0)
137 return -errno;
138
139 /* create O_PATH fd for detached mount */
140 mnt_fd = sys_fsmount(fs_fd, 0, 0);
141 if (err < 0)
142 return -errno;
143
144 return mnt_fd;
145 }
146
147 /* send FD over Unix domain (AF_UNIX) socket */
sendfd(int sockfd,int fd)148 static int sendfd(int sockfd, int fd)
149 {
150 struct msghdr msg = {};
151 struct cmsghdr *cmsg;
152 int fds[1] = { fd }, err;
153 char iobuf[1];
154 struct iovec io = {
155 .iov_base = iobuf,
156 .iov_len = sizeof(iobuf),
157 };
158 union {
159 char buf[CMSG_SPACE(sizeof(fds))];
160 struct cmsghdr align;
161 } u;
162
163 msg.msg_iov = &io;
164 msg.msg_iovlen = 1;
165 msg.msg_control = u.buf;
166 msg.msg_controllen = sizeof(u.buf);
167 cmsg = CMSG_FIRSTHDR(&msg);
168 cmsg->cmsg_level = SOL_SOCKET;
169 cmsg->cmsg_type = SCM_RIGHTS;
170 cmsg->cmsg_len = CMSG_LEN(sizeof(fds));
171 memcpy(CMSG_DATA(cmsg), fds, sizeof(fds));
172
173 err = sendmsg(sockfd, &msg, 0);
174 if (err < 0)
175 err = -errno;
176 if (!ASSERT_EQ(err, 1, "sendmsg"))
177 return -EINVAL;
178
179 return 0;
180 }
181
182 /* receive FD over Unix domain (AF_UNIX) socket */
recvfd(int sockfd,int * fd)183 static int recvfd(int sockfd, int *fd)
184 {
185 struct msghdr msg = {};
186 struct cmsghdr *cmsg;
187 int fds[1], err;
188 char iobuf[1];
189 struct iovec io = {
190 .iov_base = iobuf,
191 .iov_len = sizeof(iobuf),
192 };
193 union {
194 char buf[CMSG_SPACE(sizeof(fds))];
195 struct cmsghdr align;
196 } u;
197
198 msg.msg_iov = &io;
199 msg.msg_iovlen = 1;
200 msg.msg_control = u.buf;
201 msg.msg_controllen = sizeof(u.buf);
202
203 err = recvmsg(sockfd, &msg, 0);
204 if (err < 0)
205 err = -errno;
206 if (!ASSERT_EQ(err, 1, "recvmsg"))
207 return -EINVAL;
208
209 cmsg = CMSG_FIRSTHDR(&msg);
210 if (!ASSERT_OK_PTR(cmsg, "cmsg_null") ||
211 !ASSERT_EQ(cmsg->cmsg_len, CMSG_LEN(sizeof(fds)), "cmsg_len") ||
212 !ASSERT_EQ(cmsg->cmsg_level, SOL_SOCKET, "cmsg_level") ||
213 !ASSERT_EQ(cmsg->cmsg_type, SCM_RIGHTS, "cmsg_type"))
214 return -EINVAL;
215
216 memcpy(fds, CMSG_DATA(cmsg), sizeof(fds));
217 *fd = fds[0];
218
219 return 0;
220 }
221
write_nointr(int fd,const void * buf,size_t count)222 static ssize_t write_nointr(int fd, const void *buf, size_t count)
223 {
224 ssize_t ret;
225
226 do {
227 ret = write(fd, buf, count);
228 } while (ret < 0 && errno == EINTR);
229
230 return ret;
231 }
232
write_file(const char * path,const void * buf,size_t count)233 static int write_file(const char *path, const void *buf, size_t count)
234 {
235 int fd;
236 ssize_t ret;
237
238 fd = open(path, O_WRONLY | O_CLOEXEC | O_NOCTTY | O_NOFOLLOW);
239 if (fd < 0)
240 return -1;
241
242 ret = write_nointr(fd, buf, count);
243 close(fd);
244 if (ret < 0 || (size_t)ret != count)
245 return -1;
246
247 return 0;
248 }
249
create_and_enter_userns(void)250 static int create_and_enter_userns(void)
251 {
252 uid_t uid;
253 gid_t gid;
254 char map[100];
255
256 uid = getuid();
257 gid = getgid();
258
259 if (unshare(CLONE_NEWUSER))
260 return -1;
261
262 if (write_file("/proc/self/setgroups", "deny", sizeof("deny") - 1) &&
263 errno != ENOENT)
264 return -1;
265
266 snprintf(map, sizeof(map), "0 %d 1", uid);
267 if (write_file("/proc/self/uid_map", map, strlen(map)))
268 return -1;
269
270
271 snprintf(map, sizeof(map), "0 %d 1", gid);
272 if (write_file("/proc/self/gid_map", map, strlen(map)))
273 return -1;
274
275 if (setgid(0))
276 return -1;
277
278 if (setuid(0))
279 return -1;
280
281 return 0;
282 }
283
284 typedef int (*child_callback_fn)(int bpffs_fd, struct token_lsm *lsm_skel);
285
child(int sock_fd,struct bpffs_opts * opts,child_callback_fn callback)286 static void child(int sock_fd, struct bpffs_opts *opts, child_callback_fn callback)
287 {
288 int mnt_fd = -1, fs_fd = -1, err = 0, bpffs_fd = -1, token_fd = -1;
289 struct token_lsm *lsm_skel = NULL;
290
291 /* load and attach LSM "policy" before we go into unpriv userns */
292 lsm_skel = token_lsm__open_and_load();
293 if (!ASSERT_OK_PTR(lsm_skel, "lsm_skel_load")) {
294 err = -EINVAL;
295 goto cleanup;
296 }
297 lsm_skel->bss->my_pid = getpid();
298 err = token_lsm__attach(lsm_skel);
299 if (!ASSERT_OK(err, "lsm_skel_attach"))
300 goto cleanup;
301
302 /* setup userns with root mappings */
303 err = create_and_enter_userns();
304 if (!ASSERT_OK(err, "create_and_enter_userns"))
305 goto cleanup;
306
307 /* setup mountns to allow creating BPF FS (fsopen("bpf")) from unpriv process */
308 err = unshare(CLONE_NEWNS);
309 if (!ASSERT_OK(err, "create_mountns"))
310 goto cleanup;
311
312 err = sys_mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, 0);
313 if (!ASSERT_OK(err, "remount_root"))
314 goto cleanup;
315
316 fs_fd = create_bpffs_fd();
317 if (!ASSERT_GE(fs_fd, 0, "create_bpffs_fd")) {
318 err = -EINVAL;
319 goto cleanup;
320 }
321
322 /* ensure unprivileged child cannot set delegation options */
323 err = set_delegate_mask(fs_fd, "delegate_cmds", 0x1, NULL);
324 ASSERT_EQ(err, -EPERM, "delegate_cmd_eperm");
325 err = set_delegate_mask(fs_fd, "delegate_maps", 0x1, NULL);
326 ASSERT_EQ(err, -EPERM, "delegate_maps_eperm");
327 err = set_delegate_mask(fs_fd, "delegate_progs", 0x1, NULL);
328 ASSERT_EQ(err, -EPERM, "delegate_progs_eperm");
329 err = set_delegate_mask(fs_fd, "delegate_attachs", 0x1, NULL);
330 ASSERT_EQ(err, -EPERM, "delegate_attachs_eperm");
331
332 /* pass BPF FS context object to parent */
333 err = sendfd(sock_fd, fs_fd);
334 if (!ASSERT_OK(err, "send_fs_fd"))
335 goto cleanup;
336 zclose(fs_fd);
337
338 /* avoid mucking around with mount namespaces and mounting at
339 * well-known path, just get detach-mounted BPF FS fd back from parent
340 */
341 err = recvfd(sock_fd, &mnt_fd);
342 if (!ASSERT_OK(err, "recv_mnt_fd"))
343 goto cleanup;
344
345 /* try to fspick() BPF FS and try to add some delegation options */
346 fs_fd = sys_fspick(mnt_fd, "", FSPICK_EMPTY_PATH);
347 if (!ASSERT_GE(fs_fd, 0, "bpffs_fspick")) {
348 err = -EINVAL;
349 goto cleanup;
350 }
351
352 /* ensure unprivileged child cannot reconfigure to set delegation options */
353 err = set_delegate_mask(fs_fd, "delegate_cmds", 0, "any");
354 if (!ASSERT_EQ(err, -EPERM, "delegate_cmd_eperm_reconfig")) {
355 err = -EINVAL;
356 goto cleanup;
357 }
358 err = set_delegate_mask(fs_fd, "delegate_maps", 0, "any");
359 if (!ASSERT_EQ(err, -EPERM, "delegate_maps_eperm_reconfig")) {
360 err = -EINVAL;
361 goto cleanup;
362 }
363 err = set_delegate_mask(fs_fd, "delegate_progs", 0, "any");
364 if (!ASSERT_EQ(err, -EPERM, "delegate_progs_eperm_reconfig")) {
365 err = -EINVAL;
366 goto cleanup;
367 }
368 err = set_delegate_mask(fs_fd, "delegate_attachs", 0, "any");
369 if (!ASSERT_EQ(err, -EPERM, "delegate_attachs_eperm_reconfig")) {
370 err = -EINVAL;
371 goto cleanup;
372 }
373 zclose(fs_fd);
374
375 bpffs_fd = openat(mnt_fd, ".", 0, O_RDWR);
376 if (!ASSERT_GE(bpffs_fd, 0, "bpffs_open")) {
377 err = -EINVAL;
378 goto cleanup;
379 }
380
381 /* create BPF token FD and pass it to parent for some extra checks */
382 token_fd = bpf_token_create(bpffs_fd, NULL);
383 if (!ASSERT_GT(token_fd, 0, "child_token_create")) {
384 err = -EINVAL;
385 goto cleanup;
386 }
387 err = sendfd(sock_fd, token_fd);
388 if (!ASSERT_OK(err, "send_token_fd"))
389 goto cleanup;
390 zclose(token_fd);
391
392 /* do custom test logic with customly set up BPF FS instance */
393 err = callback(bpffs_fd, lsm_skel);
394 if (!ASSERT_OK(err, "test_callback"))
395 goto cleanup;
396
397 err = 0;
398 cleanup:
399 zclose(sock_fd);
400 zclose(mnt_fd);
401 zclose(fs_fd);
402 zclose(bpffs_fd);
403 zclose(token_fd);
404
405 lsm_skel->bss->my_pid = 0;
406 token_lsm__destroy(lsm_skel);
407
408 exit(-err);
409 }
410
wait_for_pid(pid_t pid)411 static int wait_for_pid(pid_t pid)
412 {
413 int status, ret;
414
415 again:
416 ret = waitpid(pid, &status, 0);
417 if (ret == -1) {
418 if (errno == EINTR)
419 goto again;
420
421 return -1;
422 }
423
424 if (!WIFEXITED(status))
425 return -1;
426
427 return WEXITSTATUS(status);
428 }
429
parent(int child_pid,struct bpffs_opts * bpffs_opts,int sock_fd)430 static void parent(int child_pid, struct bpffs_opts *bpffs_opts, int sock_fd)
431 {
432 int fs_fd = -1, mnt_fd = -1, token_fd = -1, err;
433
434 err = recvfd(sock_fd, &fs_fd);
435 if (!ASSERT_OK(err, "recv_bpffs_fd"))
436 goto cleanup;
437
438 mnt_fd = materialize_bpffs_fd(fs_fd, bpffs_opts);
439 if (!ASSERT_GE(mnt_fd, 0, "materialize_bpffs_fd")) {
440 err = -EINVAL;
441 goto cleanup;
442 }
443 zclose(fs_fd);
444
445 /* pass BPF FS context object to parent */
446 err = sendfd(sock_fd, mnt_fd);
447 if (!ASSERT_OK(err, "send_mnt_fd"))
448 goto cleanup;
449 zclose(mnt_fd);
450
451 /* receive BPF token FD back from child for some extra tests */
452 err = recvfd(sock_fd, &token_fd);
453 if (!ASSERT_OK(err, "recv_token_fd"))
454 goto cleanup;
455
456 err = wait_for_pid(child_pid);
457 ASSERT_OK(err, "waitpid_child");
458
459 cleanup:
460 zclose(sock_fd);
461 zclose(fs_fd);
462 zclose(mnt_fd);
463 zclose(token_fd);
464
465 if (child_pid > 0)
466 (void)kill(child_pid, SIGKILL);
467 }
468
subtest_userns(struct bpffs_opts * bpffs_opts,child_callback_fn child_cb)469 static void subtest_userns(struct bpffs_opts *bpffs_opts,
470 child_callback_fn child_cb)
471 {
472 int sock_fds[2] = { -1, -1 };
473 int child_pid = 0, err;
474
475 err = socketpair(AF_UNIX, SOCK_STREAM, 0, sock_fds);
476 if (!ASSERT_OK(err, "socketpair"))
477 goto cleanup;
478
479 child_pid = fork();
480 if (!ASSERT_GE(child_pid, 0, "fork"))
481 goto cleanup;
482
483 if (child_pid == 0) {
484 zclose(sock_fds[0]);
485 return child(sock_fds[1], bpffs_opts, child_cb);
486
487 } else {
488 zclose(sock_fds[1]);
489 return parent(child_pid, bpffs_opts, sock_fds[0]);
490 }
491
492 cleanup:
493 zclose(sock_fds[0]);
494 zclose(sock_fds[1]);
495 if (child_pid > 0)
496 (void)kill(child_pid, SIGKILL);
497 }
498
userns_map_create(int mnt_fd,struct token_lsm * lsm_skel)499 static int userns_map_create(int mnt_fd, struct token_lsm *lsm_skel)
500 {
501 LIBBPF_OPTS(bpf_map_create_opts, map_opts);
502 int err, token_fd = -1, map_fd = -1;
503 __u64 old_caps = 0;
504
505 /* create BPF token from BPF FS mount */
506 token_fd = bpf_token_create(mnt_fd, NULL);
507 if (!ASSERT_GT(token_fd, 0, "token_create")) {
508 err = -EINVAL;
509 goto cleanup;
510 }
511
512 /* while inside non-init userns, we need both a BPF token *and*
513 * CAP_BPF inside current userns to create privileged map; let's test
514 * that neither BPF token alone nor namespaced CAP_BPF is sufficient
515 */
516 err = drop_priv_caps(&old_caps);
517 if (!ASSERT_OK(err, "drop_caps"))
518 goto cleanup;
519
520 /* no token, no CAP_BPF -> fail */
521 map_opts.map_flags = 0;
522 map_opts.token_fd = 0;
523 map_fd = bpf_map_create(BPF_MAP_TYPE_STACK, "wo_token_wo_bpf", 0, 8, 1, &map_opts);
524 if (!ASSERT_LT(map_fd, 0, "stack_map_wo_token_wo_cap_bpf_should_fail")) {
525 err = -EINVAL;
526 goto cleanup;
527 }
528
529 /* token without CAP_BPF -> fail */
530 map_opts.map_flags = BPF_F_TOKEN_FD;
531 map_opts.token_fd = token_fd;
532 map_fd = bpf_map_create(BPF_MAP_TYPE_STACK, "w_token_wo_bpf", 0, 8, 1, &map_opts);
533 if (!ASSERT_LT(map_fd, 0, "stack_map_w_token_wo_cap_bpf_should_fail")) {
534 err = -EINVAL;
535 goto cleanup;
536 }
537
538 /* get back effective local CAP_BPF (and CAP_SYS_ADMIN) */
539 err = restore_priv_caps(old_caps);
540 if (!ASSERT_OK(err, "restore_caps"))
541 goto cleanup;
542
543 /* CAP_BPF without token -> fail */
544 map_opts.map_flags = 0;
545 map_opts.token_fd = 0;
546 map_fd = bpf_map_create(BPF_MAP_TYPE_STACK, "wo_token_w_bpf", 0, 8, 1, &map_opts);
547 if (!ASSERT_LT(map_fd, 0, "stack_map_wo_token_w_cap_bpf_should_fail")) {
548 err = -EINVAL;
549 goto cleanup;
550 }
551
552 /* finally, namespaced CAP_BPF + token -> success */
553 map_opts.map_flags = BPF_F_TOKEN_FD;
554 map_opts.token_fd = token_fd;
555 map_fd = bpf_map_create(BPF_MAP_TYPE_STACK, "w_token_w_bpf", 0, 8, 1, &map_opts);
556 if (!ASSERT_GT(map_fd, 0, "stack_map_w_token_w_cap_bpf")) {
557 err = -EINVAL;
558 goto cleanup;
559 }
560
561 cleanup:
562 zclose(token_fd);
563 zclose(map_fd);
564 return err;
565 }
566
userns_btf_load(int mnt_fd,struct token_lsm * lsm_skel)567 static int userns_btf_load(int mnt_fd, struct token_lsm *lsm_skel)
568 {
569 LIBBPF_OPTS(bpf_btf_load_opts, btf_opts);
570 int err, token_fd = -1, btf_fd = -1;
571 const void *raw_btf_data;
572 struct btf *btf = NULL;
573 __u32 raw_btf_size;
574 __u64 old_caps = 0;
575
576 /* create BPF token from BPF FS mount */
577 token_fd = bpf_token_create(mnt_fd, NULL);
578 if (!ASSERT_GT(token_fd, 0, "token_create")) {
579 err = -EINVAL;
580 goto cleanup;
581 }
582
583 /* while inside non-init userns, we need both a BPF token *and*
584 * CAP_BPF inside current userns to create privileged map; let's test
585 * that neither BPF token alone nor namespaced CAP_BPF is sufficient
586 */
587 err = drop_priv_caps(&old_caps);
588 if (!ASSERT_OK(err, "drop_caps"))
589 goto cleanup;
590
591 /* setup a trivial BTF data to load to the kernel */
592 btf = btf__new_empty();
593 if (!ASSERT_OK_PTR(btf, "empty_btf"))
594 goto cleanup;
595
596 ASSERT_GT(btf__add_int(btf, "int", 4, 0), 0, "int_type");
597
598 raw_btf_data = btf__raw_data(btf, &raw_btf_size);
599 if (!ASSERT_OK_PTR(raw_btf_data, "raw_btf_data"))
600 goto cleanup;
601
602 /* no token + no CAP_BPF -> failure */
603 btf_opts.btf_flags = 0;
604 btf_opts.token_fd = 0;
605 btf_fd = bpf_btf_load(raw_btf_data, raw_btf_size, &btf_opts);
606 if (!ASSERT_LT(btf_fd, 0, "no_token_no_cap_should_fail"))
607 goto cleanup;
608
609 /* token + no CAP_BPF -> failure */
610 btf_opts.btf_flags = BPF_F_TOKEN_FD;
611 btf_opts.token_fd = token_fd;
612 btf_fd = bpf_btf_load(raw_btf_data, raw_btf_size, &btf_opts);
613 if (!ASSERT_LT(btf_fd, 0, "token_no_cap_should_fail"))
614 goto cleanup;
615
616 /* get back effective local CAP_BPF (and CAP_SYS_ADMIN) */
617 err = restore_priv_caps(old_caps);
618 if (!ASSERT_OK(err, "restore_caps"))
619 goto cleanup;
620
621 /* token + CAP_BPF -> success */
622 btf_opts.btf_flags = BPF_F_TOKEN_FD;
623 btf_opts.token_fd = token_fd;
624 btf_fd = bpf_btf_load(raw_btf_data, raw_btf_size, &btf_opts);
625 if (!ASSERT_GT(btf_fd, 0, "token_and_cap_success"))
626 goto cleanup;
627
628 err = 0;
629 cleanup:
630 btf__free(btf);
631 zclose(btf_fd);
632 zclose(token_fd);
633 return err;
634 }
635
userns_prog_load(int mnt_fd,struct token_lsm * lsm_skel)636 static int userns_prog_load(int mnt_fd, struct token_lsm *lsm_skel)
637 {
638 LIBBPF_OPTS(bpf_prog_load_opts, prog_opts);
639 int err, token_fd = -1, prog_fd = -1;
640 struct bpf_insn insns[] = {
641 /* bpf_jiffies64() requires CAP_BPF */
642 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_jiffies64),
643 /* bpf_get_current_task() requires CAP_PERFMON */
644 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_current_task),
645 /* r0 = 0; exit; */
646 BPF_MOV64_IMM(BPF_REG_0, 0),
647 BPF_EXIT_INSN(),
648 };
649 size_t insn_cnt = ARRAY_SIZE(insns);
650 __u64 old_caps = 0;
651
652 /* create BPF token from BPF FS mount */
653 token_fd = bpf_token_create(mnt_fd, NULL);
654 if (!ASSERT_GT(token_fd, 0, "token_create")) {
655 err = -EINVAL;
656 goto cleanup;
657 }
658
659 /* validate we can successfully load BPF program with token; this
660 * being XDP program (CAP_NET_ADMIN) using bpf_jiffies64() (CAP_BPF)
661 * and bpf_get_current_task() (CAP_PERFMON) helpers validates we have
662 * BPF token wired properly in a bunch of places in the kernel
663 */
664 prog_opts.prog_flags = BPF_F_TOKEN_FD;
665 prog_opts.token_fd = token_fd;
666 prog_opts.expected_attach_type = BPF_XDP;
667 prog_fd = bpf_prog_load(BPF_PROG_TYPE_XDP, "token_prog", "GPL",
668 insns, insn_cnt, &prog_opts);
669 if (!ASSERT_GT(prog_fd, 0, "prog_fd")) {
670 err = -EPERM;
671 goto cleanup;
672 }
673
674 /* no token + caps -> failure */
675 prog_opts.prog_flags = 0;
676 prog_opts.token_fd = 0;
677 prog_fd = bpf_prog_load(BPF_PROG_TYPE_XDP, "token_prog", "GPL",
678 insns, insn_cnt, &prog_opts);
679 if (!ASSERT_EQ(prog_fd, -EPERM, "prog_fd_eperm")) {
680 err = -EPERM;
681 goto cleanup;
682 }
683
684 err = drop_priv_caps(&old_caps);
685 if (!ASSERT_OK(err, "drop_caps"))
686 goto cleanup;
687
688 /* no caps + token -> failure */
689 prog_opts.prog_flags = BPF_F_TOKEN_FD;
690 prog_opts.token_fd = token_fd;
691 prog_fd = bpf_prog_load(BPF_PROG_TYPE_XDP, "token_prog", "GPL",
692 insns, insn_cnt, &prog_opts);
693 if (!ASSERT_EQ(prog_fd, -EPERM, "prog_fd_eperm")) {
694 err = -EPERM;
695 goto cleanup;
696 }
697
698 /* no caps + no token -> definitely a failure */
699 prog_opts.prog_flags = 0;
700 prog_opts.token_fd = 0;
701 prog_fd = bpf_prog_load(BPF_PROG_TYPE_XDP, "token_prog", "GPL",
702 insns, insn_cnt, &prog_opts);
703 if (!ASSERT_EQ(prog_fd, -EPERM, "prog_fd_eperm")) {
704 err = -EPERM;
705 goto cleanup;
706 }
707
708 err = 0;
709 cleanup:
710 zclose(prog_fd);
711 zclose(token_fd);
712 return err;
713 }
714
userns_obj_priv_map(int mnt_fd,struct token_lsm * lsm_skel)715 static int userns_obj_priv_map(int mnt_fd, struct token_lsm *lsm_skel)
716 {
717 LIBBPF_OPTS(bpf_object_open_opts, opts);
718 char buf[256];
719 struct priv_map *skel;
720 int err;
721
722 skel = priv_map__open_and_load();
723 if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load")) {
724 priv_map__destroy(skel);
725 return -EINVAL;
726 }
727
728 /* use bpf_token_path to provide BPF FS path */
729 snprintf(buf, sizeof(buf), "/proc/self/fd/%d", mnt_fd);
730 opts.bpf_token_path = buf;
731 skel = priv_map__open_opts(&opts);
732 if (!ASSERT_OK_PTR(skel, "obj_token_path_open"))
733 return -EINVAL;
734
735 err = priv_map__load(skel);
736 priv_map__destroy(skel);
737 if (!ASSERT_OK(err, "obj_token_path_load"))
738 return -EINVAL;
739
740 return 0;
741 }
742
userns_obj_priv_prog(int mnt_fd,struct token_lsm * lsm_skel)743 static int userns_obj_priv_prog(int mnt_fd, struct token_lsm *lsm_skel)
744 {
745 LIBBPF_OPTS(bpf_object_open_opts, opts);
746 char buf[256];
747 struct priv_prog *skel;
748 int err;
749
750 skel = priv_prog__open_and_load();
751 if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load")) {
752 priv_prog__destroy(skel);
753 return -EINVAL;
754 }
755
756 /* use bpf_token_path to provide BPF FS path */
757 snprintf(buf, sizeof(buf), "/proc/self/fd/%d", mnt_fd);
758 opts.bpf_token_path = buf;
759 skel = priv_prog__open_opts(&opts);
760 if (!ASSERT_OK_PTR(skel, "obj_token_path_open"))
761 return -EINVAL;
762 err = priv_prog__load(skel);
763 priv_prog__destroy(skel);
764 if (!ASSERT_OK(err, "obj_token_path_load"))
765 return -EINVAL;
766
767 /* provide BPF token, but reject bpf_token_capable() with LSM */
768 lsm_skel->bss->reject_capable = true;
769 lsm_skel->bss->reject_cmd = false;
770 skel = priv_prog__open_opts(&opts);
771 if (!ASSERT_OK_PTR(skel, "obj_token_lsm_reject_cap_open"))
772 return -EINVAL;
773 err = priv_prog__load(skel);
774 priv_prog__destroy(skel);
775 if (!ASSERT_ERR(err, "obj_token_lsm_reject_cap_load"))
776 return -EINVAL;
777
778 /* provide BPF token, but reject bpf_token_cmd() with LSM */
779 lsm_skel->bss->reject_capable = false;
780 lsm_skel->bss->reject_cmd = true;
781 skel = priv_prog__open_opts(&opts);
782 if (!ASSERT_OK_PTR(skel, "obj_token_lsm_reject_cmd_open"))
783 return -EINVAL;
784 err = priv_prog__load(skel);
785 priv_prog__destroy(skel);
786 if (!ASSERT_ERR(err, "obj_token_lsm_reject_cmd_load"))
787 return -EINVAL;
788
789 return 0;
790 }
791
userns_obj_priv_freplace_setup(int mnt_fd,struct priv_freplace_prog ** fr_skel,struct priv_prog ** skel,int * tgt_fd)792 static int userns_obj_priv_freplace_setup(int mnt_fd, struct priv_freplace_prog **fr_skel,
793 struct priv_prog **skel, int *tgt_fd)
794 {
795 LIBBPF_OPTS(bpf_object_open_opts, opts);
796 int err;
797 char buf[256];
798
799 /* use bpf_token_path to provide BPF FS path */
800 snprintf(buf, sizeof(buf), "/proc/self/fd/%d", mnt_fd);
801 opts.bpf_token_path = buf;
802 *skel = priv_prog__open_opts(&opts);
803 if (!ASSERT_OK_PTR(*skel, "priv_prog__open_opts"))
804 return -EINVAL;
805 err = priv_prog__load(*skel);
806 if (!ASSERT_OK(err, "priv_prog__load"))
807 return -EINVAL;
808
809 *fr_skel = priv_freplace_prog__open_opts(&opts);
810 if (!ASSERT_OK_PTR(*skel, "priv_freplace_prog__open_opts"))
811 return -EINVAL;
812
813 *tgt_fd = bpf_program__fd((*skel)->progs.xdp_prog1);
814 return 0;
815 }
816
817 /* Verify that freplace works from user namespace, because bpf token is loaded
818 * in bpf_object__prepare
819 */
userns_obj_priv_freplace_prog(int mnt_fd,struct token_lsm * lsm_skel)820 static int userns_obj_priv_freplace_prog(int mnt_fd, struct token_lsm *lsm_skel)
821 {
822 struct priv_freplace_prog *fr_skel = NULL;
823 struct priv_prog *skel = NULL;
824 int err, tgt_fd;
825
826 err = userns_obj_priv_freplace_setup(mnt_fd, &fr_skel, &skel, &tgt_fd);
827 if (!ASSERT_OK(err, "setup"))
828 goto out;
829
830 err = bpf_object__prepare(fr_skel->obj);
831 if (!ASSERT_OK(err, "freplace__prepare"))
832 goto out;
833
834 err = bpf_program__set_attach_target(fr_skel->progs.new_xdp_prog2, tgt_fd, "xdp_prog1");
835 if (!ASSERT_OK(err, "set_attach_target"))
836 goto out;
837
838 err = priv_freplace_prog__load(fr_skel);
839 ASSERT_OK(err, "priv_freplace_prog__load");
840
841 out:
842 priv_freplace_prog__destroy(fr_skel);
843 priv_prog__destroy(skel);
844 return err;
845 }
846
847 /* Verify that replace fails to set attach target from user namespace without bpf token */
userns_obj_priv_freplace_prog_fail(int mnt_fd,struct token_lsm * lsm_skel)848 static int userns_obj_priv_freplace_prog_fail(int mnt_fd, struct token_lsm *lsm_skel)
849 {
850 struct priv_freplace_prog *fr_skel = NULL;
851 struct priv_prog *skel = NULL;
852 int err, tgt_fd;
853
854 err = userns_obj_priv_freplace_setup(mnt_fd, &fr_skel, &skel, &tgt_fd);
855 if (!ASSERT_OK(err, "setup"))
856 goto out;
857
858 err = bpf_program__set_attach_target(fr_skel->progs.new_xdp_prog2, tgt_fd, "xdp_prog1");
859 if (ASSERT_ERR(err, "attach fails"))
860 err = 0;
861 else
862 err = -EINVAL;
863
864 out:
865 priv_freplace_prog__destroy(fr_skel);
866 priv_prog__destroy(skel);
867 return err;
868 }
869
870 /* this test is called with BPF FS that doesn't delegate BPF_BTF_LOAD command,
871 * which should cause struct_ops application to fail, as BTF won't be uploaded
872 * into the kernel, even if STRUCT_OPS programs themselves are allowed
873 */
validate_struct_ops_load(int mnt_fd,bool expect_success)874 static int validate_struct_ops_load(int mnt_fd, bool expect_success)
875 {
876 LIBBPF_OPTS(bpf_object_open_opts, opts);
877 char buf[256];
878 struct dummy_st_ops_success *skel;
879 int err;
880
881 snprintf(buf, sizeof(buf), "/proc/self/fd/%d", mnt_fd);
882 opts.bpf_token_path = buf;
883 skel = dummy_st_ops_success__open_opts(&opts);
884 if (!ASSERT_OK_PTR(skel, "obj_token_path_open"))
885 return -EINVAL;
886
887 err = dummy_st_ops_success__load(skel);
888 dummy_st_ops_success__destroy(skel);
889 if (expect_success) {
890 if (!ASSERT_OK(err, "obj_token_path_load"))
891 return -EINVAL;
892 } else /* expect failure */ {
893 if (!ASSERT_ERR(err, "obj_token_path_load"))
894 return -EINVAL;
895 }
896
897 return 0;
898 }
899
userns_obj_priv_btf_fail(int mnt_fd,struct token_lsm * lsm_skel)900 static int userns_obj_priv_btf_fail(int mnt_fd, struct token_lsm *lsm_skel)
901 {
902 return validate_struct_ops_load(mnt_fd, false /* should fail */);
903 }
904
userns_obj_priv_btf_success(int mnt_fd,struct token_lsm * lsm_skel)905 static int userns_obj_priv_btf_success(int mnt_fd, struct token_lsm *lsm_skel)
906 {
907 return validate_struct_ops_load(mnt_fd, true /* should succeed */);
908 }
909
token_bpffs_custom_dir()910 static const char *token_bpffs_custom_dir()
911 {
912 return getenv("BPF_SELFTESTS_BPF_TOKEN_DIR") ?: "/tmp/bpf-token-fs";
913 }
914
915 #define TOKEN_ENVVAR "LIBBPF_BPF_TOKEN_PATH"
916
userns_obj_priv_implicit_token(int mnt_fd,struct token_lsm * lsm_skel)917 static int userns_obj_priv_implicit_token(int mnt_fd, struct token_lsm *lsm_skel)
918 {
919 LIBBPF_OPTS(bpf_object_open_opts, opts);
920 struct dummy_st_ops_success *skel;
921 int err;
922
923 /* before we mount BPF FS with token delegation, struct_ops skeleton
924 * should fail to load
925 */
926 skel = dummy_st_ops_success__open_and_load();
927 if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load")) {
928 dummy_st_ops_success__destroy(skel);
929 return -EINVAL;
930 }
931
932 /* mount custom BPF FS over /sys/fs/bpf so that libbpf can create BPF
933 * token automatically and implicitly
934 */
935 err = sys_move_mount(mnt_fd, "", AT_FDCWD, "/sys/fs/bpf", MOVE_MOUNT_F_EMPTY_PATH);
936 if (!ASSERT_OK(err, "move_mount_bpffs"))
937 return -EINVAL;
938
939 /* disable implicit BPF token creation by setting
940 * LIBBPF_BPF_TOKEN_PATH envvar to empty value, load should fail
941 */
942 err = setenv(TOKEN_ENVVAR, "", 1 /*overwrite*/);
943 if (!ASSERT_OK(err, "setenv_token_path"))
944 return -EINVAL;
945 skel = dummy_st_ops_success__open_and_load();
946 if (!ASSERT_ERR_PTR(skel, "obj_token_envvar_disabled_load")) {
947 unsetenv(TOKEN_ENVVAR);
948 dummy_st_ops_success__destroy(skel);
949 return -EINVAL;
950 }
951 unsetenv(TOKEN_ENVVAR);
952
953 /* now the same struct_ops skeleton should succeed thanks to libbpf
954 * creating BPF token from /sys/fs/bpf mount point
955 */
956 skel = dummy_st_ops_success__open_and_load();
957 if (!ASSERT_OK_PTR(skel, "obj_implicit_token_load"))
958 return -EINVAL;
959
960 dummy_st_ops_success__destroy(skel);
961
962 /* now disable implicit token through empty bpf_token_path, should fail */
963 opts.bpf_token_path = "";
964 skel = dummy_st_ops_success__open_opts(&opts);
965 if (!ASSERT_OK_PTR(skel, "obj_empty_token_path_open"))
966 return -EINVAL;
967
968 err = dummy_st_ops_success__load(skel);
969 dummy_st_ops_success__destroy(skel);
970 if (!ASSERT_ERR(err, "obj_empty_token_path_load"))
971 return -EINVAL;
972
973 return 0;
974 }
975
userns_obj_priv_implicit_token_envvar(int mnt_fd,struct token_lsm * lsm_skel)976 static int userns_obj_priv_implicit_token_envvar(int mnt_fd, struct token_lsm *lsm_skel)
977 {
978 const char *custom_dir = token_bpffs_custom_dir();
979 LIBBPF_OPTS(bpf_object_open_opts, opts);
980 struct dummy_st_ops_success *skel;
981 int err;
982
983 /* before we mount BPF FS with token delegation, struct_ops skeleton
984 * should fail to load
985 */
986 skel = dummy_st_ops_success__open_and_load();
987 if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load")) {
988 dummy_st_ops_success__destroy(skel);
989 return -EINVAL;
990 }
991
992 /* mount custom BPF FS over custom location, so libbpf can't create
993 * BPF token implicitly, unless pointed to it through
994 * LIBBPF_BPF_TOKEN_PATH envvar
995 */
996 rmdir(custom_dir);
997 if (!ASSERT_OK(mkdir(custom_dir, 0777), "mkdir_bpffs_custom"))
998 goto err_out;
999 err = sys_move_mount(mnt_fd, "", AT_FDCWD, custom_dir, MOVE_MOUNT_F_EMPTY_PATH);
1000 if (!ASSERT_OK(err, "move_mount_bpffs"))
1001 goto err_out;
1002
1003 /* even though we have BPF FS with delegation, it's not at default
1004 * /sys/fs/bpf location, so we still fail to load until envvar is set up
1005 */
1006 skel = dummy_st_ops_success__open_and_load();
1007 if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load2")) {
1008 dummy_st_ops_success__destroy(skel);
1009 goto err_out;
1010 }
1011
1012 err = setenv(TOKEN_ENVVAR, custom_dir, 1 /*overwrite*/);
1013 if (!ASSERT_OK(err, "setenv_token_path"))
1014 goto err_out;
1015
1016 /* now the same struct_ops skeleton should succeed thanks to libbpf
1017 * creating BPF token from custom mount point
1018 */
1019 skel = dummy_st_ops_success__open_and_load();
1020 if (!ASSERT_OK_PTR(skel, "obj_implicit_token_load"))
1021 goto err_out;
1022
1023 dummy_st_ops_success__destroy(skel);
1024
1025 /* now disable implicit token through empty bpf_token_path, envvar
1026 * will be ignored, should fail
1027 */
1028 opts.bpf_token_path = "";
1029 skel = dummy_st_ops_success__open_opts(&opts);
1030 if (!ASSERT_OK_PTR(skel, "obj_empty_token_path_open"))
1031 goto err_out;
1032
1033 err = dummy_st_ops_success__load(skel);
1034 dummy_st_ops_success__destroy(skel);
1035 if (!ASSERT_ERR(err, "obj_empty_token_path_load"))
1036 goto err_out;
1037
1038 rmdir(custom_dir);
1039 unsetenv(TOKEN_ENVVAR);
1040 return 0;
1041 err_out:
1042 rmdir(custom_dir);
1043 unsetenv(TOKEN_ENVVAR);
1044 return -EINVAL;
1045 }
1046
1047 #define bit(n) (1ULL << (n))
1048
test_token(void)1049 void test_token(void)
1050 {
1051 if (test__start_subtest("map_token")) {
1052 struct bpffs_opts opts = {
1053 .cmds_str = "map_create",
1054 .maps_str = "stack",
1055 };
1056
1057 subtest_userns(&opts, userns_map_create);
1058 }
1059 if (test__start_subtest("btf_token")) {
1060 struct bpffs_opts opts = {
1061 .cmds = 1ULL << BPF_BTF_LOAD,
1062 };
1063
1064 subtest_userns(&opts, userns_btf_load);
1065 }
1066 if (test__start_subtest("prog_token")) {
1067 struct bpffs_opts opts = {
1068 .cmds_str = "PROG_LOAD",
1069 .progs_str = "XDP",
1070 .attachs_str = "xdp",
1071 };
1072
1073 subtest_userns(&opts, userns_prog_load);
1074 }
1075 if (test__start_subtest("obj_priv_map")) {
1076 struct bpffs_opts opts = {
1077 .cmds = bit(BPF_MAP_CREATE),
1078 .maps = bit(BPF_MAP_TYPE_QUEUE),
1079 };
1080
1081 subtest_userns(&opts, userns_obj_priv_map);
1082 }
1083 if (test__start_subtest("obj_priv_prog")) {
1084 struct bpffs_opts opts = {
1085 .cmds = bit(BPF_PROG_LOAD),
1086 .progs = bit(BPF_PROG_TYPE_XDP),
1087 .attachs = ~0ULL,
1088 };
1089
1090 subtest_userns(&opts, userns_obj_priv_prog);
1091 }
1092 if (test__start_subtest("obj_priv_freplace_prog")) {
1093 struct bpffs_opts opts = {
1094 .cmds = bit(BPF_BTF_LOAD) | bit(BPF_PROG_LOAD) | bit(BPF_BTF_GET_FD_BY_ID),
1095 .progs = bit(BPF_PROG_TYPE_EXT) | bit(BPF_PROG_TYPE_XDP),
1096 .attachs = ~0ULL,
1097 };
1098 subtest_userns(&opts, userns_obj_priv_freplace_prog);
1099 }
1100 if (test__start_subtest("obj_priv_freplace_prog_fail")) {
1101 struct bpffs_opts opts = {
1102 .cmds = bit(BPF_BTF_LOAD) | bit(BPF_PROG_LOAD) | bit(BPF_BTF_GET_FD_BY_ID),
1103 .progs = bit(BPF_PROG_TYPE_EXT) | bit(BPF_PROG_TYPE_XDP),
1104 .attachs = ~0ULL,
1105 };
1106 subtest_userns(&opts, userns_obj_priv_freplace_prog_fail);
1107 }
1108 if (test__start_subtest("obj_priv_btf_fail")) {
1109 struct bpffs_opts opts = {
1110 /* disallow BTF loading */
1111 .cmds = bit(BPF_MAP_CREATE) | bit(BPF_PROG_LOAD),
1112 .maps = bit(BPF_MAP_TYPE_STRUCT_OPS),
1113 .progs = bit(BPF_PROG_TYPE_STRUCT_OPS),
1114 .attachs = ~0ULL,
1115 };
1116
1117 subtest_userns(&opts, userns_obj_priv_btf_fail);
1118 }
1119 if (test__start_subtest("obj_priv_btf_success")) {
1120 struct bpffs_opts opts = {
1121 /* allow BTF loading */
1122 .cmds = bit(BPF_BTF_LOAD) | bit(BPF_MAP_CREATE) | bit(BPF_PROG_LOAD),
1123 .maps = bit(BPF_MAP_TYPE_STRUCT_OPS),
1124 .progs = bit(BPF_PROG_TYPE_STRUCT_OPS),
1125 .attachs = ~0ULL,
1126 };
1127
1128 subtest_userns(&opts, userns_obj_priv_btf_success);
1129 }
1130 if (test__start_subtest("obj_priv_implicit_token")) {
1131 struct bpffs_opts opts = {
1132 /* allow BTF loading */
1133 .cmds = bit(BPF_BTF_LOAD) | bit(BPF_MAP_CREATE) | bit(BPF_PROG_LOAD),
1134 .maps = bit(BPF_MAP_TYPE_STRUCT_OPS),
1135 .progs = bit(BPF_PROG_TYPE_STRUCT_OPS),
1136 .attachs = ~0ULL,
1137 };
1138
1139 subtest_userns(&opts, userns_obj_priv_implicit_token);
1140 }
1141 if (test__start_subtest("obj_priv_implicit_token_envvar")) {
1142 struct bpffs_opts opts = {
1143 /* allow BTF loading */
1144 .cmds = bit(BPF_BTF_LOAD) | bit(BPF_MAP_CREATE) | bit(BPF_PROG_LOAD),
1145 .maps = bit(BPF_MAP_TYPE_STRUCT_OPS),
1146 .progs = bit(BPF_PROG_TYPE_STRUCT_OPS),
1147 .attachs = ~0ULL,
1148 };
1149
1150 subtest_userns(&opts, userns_obj_priv_implicit_token_envvar);
1151 }
1152 }
1153