From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754799AbdKAPVk (ORCPT ); Wed, 1 Nov 2017 11:21:40 -0400 Received: from mx0a-00082601.pphosted.com ([67.231.145.42]:57938 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754662AbdKAPVf (ORCPT ); Wed, 1 Nov 2017 11:21:35 -0400 From: Roman Gushchin To: CC: Tejun Heo , Alexei Starovoitov , Daniel Borkmann , , Roman Gushchin Subject: [PATCH net-next 4/4] selftests/bpf: add a test for device cgroup controller Date: Wed, 1 Nov 2017 11:20:37 -0400 Message-ID: <20171101152037.3288-5-guro@fb.com> X-Mailer: git-send-email 2.13.6 In-Reply-To: <20171101152037.3288-1-guro@fb.com> References: <20171101152037.3288-1-guro@fb.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [2620:10d:c091:200::3:5dcb] X-ClientProxiedBy: CO2PR04CA0099.namprd04.prod.outlook.com (2603:10b6:104:6::25) To SN2PR15MB1086.namprd15.prod.outlook.com (2603:10b6:804:22::8) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 5e195765-d783-4e0f-4a49-08d5213c2a54 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(4534020)(4602075)(2017052603199);SRVR:SN2PR15MB1086; X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;3:flo8UIDWniQgNmRrUXI26dpaPZm5EQUxmVK+TOKHaZbAZDQMxq33BHsBeSatPD2wsTJ3VdMPQySE8MrBGpv+mPezaEzUcUQig3zyLhhFjTd6JRc9HUuE6U1fbpfvTYVVfL7GYwTWI+XipecYs9Vc7zcQPu2Yp54dlAoZXtERKFTZcIzRSCLkMWP1eS5Rf7HcJMzDYJKZ2iKz9s/meucI4YUQrFhEAhYO89p3tirDhnom1fwqPA42kZeDOPMV+OhW;25:8bnIpneU8oaKRsVe00VxIhkDsofi3QDHlcacAZ0AMYm06XphUG9yCvfDSknncc91r7sdCGbh0PTicdNATH4fSpIueBXo8hiHdgZuLbismHdGBl6QRYpB6vYvPVmdj/mvNs+l1L0dp3t58b5JY6k50xtTx46ug6Y1IP0I/51KYvzUznldXW21/l0tz+17ouRFz2oGcjOrXxFU2QDMAl6QSxV2rrXhwy95TiegPB1Zx9Xw6i6JeHGxgjugDlHggJym2dGaj8GUvNTIGcDQwLo5Fuu3krAa2sWLrS8IsvsZSckLcsGWFfzoBxHfeSDBqNzeYvWHqSMGj0lsbwgCNTQy1A==;31:uMgNkOFC9wMknKn5bCqepkB+oitaTBw60fsyroxV1OhbFukBE3AasMMnylS6VrL30WvLJJOBnGxaLwIL0FOw15MCXTYEGEkuj1f04At4Zh689D7MGvIEyOFvEElqL98GnqQowTiI4OE3dz7E6qRPz012Le9PX+zhNAoGAM1gjbVTLcQ9XWHHJYHnvxlvE56nC/WXFLvmNh+cOzCQXy1EvGKwpbv05V8MlMgKQvsVSzk= X-MS-TrafficTypeDiagnostic: SN2PR15MB1086: X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;20:I5yftaQQLnp2WoiX+lIxvFA/DYQWkKIdjTU5X673eByotxio8tO6XtbJH9stlBCCN68VJ+tcuvoxG1JzVsNI2aN46ZRnYyYJ7ofamm7yG+UqSVHeeg6f+11b0HEah1aWjog4ab9LpzUTPj6TVg5BlDyG+eVnfkDtUnytZbucZFrCEeRTp/XkgaYNxx6wjNJm6tLTFYJknOezx7AJ4MD/She6xXtS7A/rN+eflUG/EQxbiMA/0aweiKtc3A1g/95O0TTwmQzFssCGgf6oK7h72DJBT6ifnUOEhgSolXTzFb+jqrgj4lkt12DlKApjrhxdLHbatz/EjCi6A6T88uUHffM9rVgj1G0qZ21VOvBU4eOvdRtEJSKHMLQ6w0bhpUgTFoMWDVo1/07g97E596pwyscc6azKD5ZUP7mHrEttghqOJePNch7CkLlIS9+50EKURjxjJTVcfS8mlfnvgdEZlMpagR099HVd8+t7foOVKKuvLSd6cXlqoKC5ILZbrCSd;4:8RhCT/8E2zr/f+0tIzq0U2qlOGzS7vCoL1JvdQqYGnuMNXaLINqmQ+Qnba8ZOeepVp3VGCEkPoPwpZqpnU0HZCi3Z8XSU2A2SonimsaNwhdm9tbVeNrv5jxP4y7g+g/+9oJ6G/P7aQuDzkQc8CSkV+n9/Nx3UmC1yvwB2wVpYrWA0dW8cXQQjDKRcSxqCjDGo/JbDQ53z1SxTiZHfIMxI3ROFTr4o0Usto38zpdvLa8ROfwgk3W996hmQ1+tGbeAU78+n/5gWJ79X0QauG6suHyqEqfKtcQbxVvA06qEK3GI2pkArNtX/hf5zExbKEk5bCGgnynvgJyQDhqtoiWyuB6PQDYgZ5hpYW+xNjdKsjk= X-Exchange-Antispam-Report-Test: UriScan:(67672495146484)(81227570615382); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(11241501159)(6040450)(2401047)(8121501046)(5005006)(3002001)(93006095)(93001095)(3231020)(10201501046)(100000703101)(100105400095)(6041248)(20161123560025)(20161123558100)(20161123555025)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123562025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN2PR15MB1086;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN2PR15MB1086; X-Forefront-PRVS: 0478C23FE0 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(6009001)(376002)(346002)(199003)(189002)(6116002)(189998001)(25786009)(6506006)(54906003)(36756003)(6666003)(86362001)(8676002)(47776003)(2950100002)(68736007)(2361001)(5660300001)(1076002)(2351001)(106356001)(33646002)(105586002)(101416001)(6916009)(8936002)(50466002)(478600001)(316002)(6512007)(48376002)(5003940100001)(53936002)(81166006)(2906002)(305945005)(50986999)(97736004)(7736002)(76176999)(5890100001)(53416004)(69596002)(6486002)(81156014)(4326008)(50226002)(16586007)(2004002)(42262002);DIR:OUT;SFP:1102;SCL:1;SRVR:SN2PR15MB1086;H:castle.thefacebook.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;SN2PR15MB1086;23:2OEKLBZD1uknB0ygNdfKBM2yM58O6hJ86IIalh2zC?= =?us-ascii?Q?0nklwuu2V3zSrs5vmSIJGlKS5lmRqqJX7tKSCWxcn06V4SMA5au4QGFtNs0V?= =?us-ascii?Q?gEfxKJkLzNxq4hX7JRPlJ3mkAeNRPNdTd2/8+HwcDe6hUILWpzgQqCZyqEUB?= =?us-ascii?Q?d2ZdJEyWJ4OxFGSNWuoVeizODa42X2+PgervgZvGd+Sg1LfHPr6BTDfNS/QA?= =?us-ascii?Q?CYPWeIdHrtm8onl5da9/2T1fHBVVFPhtoAcG5n3D8xt9FBqXveRIGSTtDPcy?= =?us-ascii?Q?ZGi3C6pmpgULLjtW4+QCkN4I3qqTsupDa67yfUFnDIYFldGIavgxGR5EX4Ae?= =?us-ascii?Q?B2ACS/DZn/ooem/mMzdNgvDubeavMpDupvln20KbRfPLLvop4cBqNiF6cAtH?= =?us-ascii?Q?9ad+tFixaL1Igb+4GI9AVOf9nN0hAMvWrtQkmK97h45ivjybVrqLH3hHLxEN?= =?us-ascii?Q?TxsrAqpbcoyQV0TCkfoCC31UDD5xznA3hm9bNem31KsLjvSiOmqKCe53+IVR?= =?us-ascii?Q?g5/4i9rQ8wv7SljodckQ4QkgB7VQcFjOgeGS8DTmUR5ONHEEGgRGjSNiuXkS?= =?us-ascii?Q?VoFVO5m46eHpPlDu4U7PtRs97RSnCiXqFi5Jlgcu3dYtAleMbweSKA4ma2+r?= =?us-ascii?Q?B9ztSlM19fDzGAQHKWJAeIU6QJkmbpT9SS83+pshIWrCkaQONWLE+5l8dy8l?= =?us-ascii?Q?5i/uPUQ6BbeUCxCQn+hVVzYK2SiCbjZ9LXtiQvQO28oYb2n40A5097C0ixgV?= =?us-ascii?Q?w2WBICjxRBxs5jzLuDEmFAFEZkkbqL5TSlgsSdcuQxRay2o/+Dsr6cLWgFBr?= =?us-ascii?Q?+0Aatp6l72+B0hqFLCq74ALIOq+JRhGyznpwLWIGbhOfeig2FFKfk0l2g2Il?= =?us-ascii?Q?F8wZI6g01JiK7ML9l0f3yDeOfrDIK8TezveZ6NRrKSfiMJYm3efVa3DLbLEE?= =?us-ascii?Q?PUF4unNQKXAFKzUgo/fd9QMLZPdUdcEfnqFLFnSN/1uGq/Sl+vpDN5p12fae?= =?us-ascii?Q?E0JzhVV+eRRjg8rQtM05eXSvFPXzcTWSYFl1Es45WEvZu4PXW7DvWLf6uC5N?= =?us-ascii?Q?fCER4Us2cVvvvvynqySP6GpcgoNwNj1I3E6zRzFmJHTeVeyyAABwt2z89+/2?= =?us-ascii?Q?vaXpL6Ym+8TxyUS4ZMJo9PvPA4uyJrWULXdBxOKXVeM3sUDR/PfaLYUd5BS4?= =?us-ascii?Q?nb4SZH8eNAJYaY=3D?= X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;6:myJNfOf/m/hzm5hRwBLd1odtRvvQu987n6zPLd+FUvnFo3LGEOTX/zzgDDmusP5nsSV27Saf6U0RzQ2/RSmIhPXNgIHEKCk8plpYts/3XZru2p5Nl8K3d1ZxSYURBcHtY/AlfsQA0+RRMKFWgLoOT9hSHOMBXubeISUn3eLSWNBWUjXzj+fBODNOEZ39K+ite7HbP69OoliHmtkPxYSj4RUUTTyyGee+qhuofHgzIIgoMsaCE8c3vjKckaftBFG0YQ1BEfA0vmELa42jFC7TWfcYjZHhtsl0geuwMIJz9mYv9Oe3wJuPD6i+A2EWKEBzoVtwtOKJ35+6qn87MBmD8NSQv5ZalKThYRubMrU/9Ek=;5:62NB/tr9JKzmC3P7HjfuA+mJWxcgxstId+Ki0c+MgduhM+e+O9z3XCvboKWI21TN01p0YtfDzHU9rS8TOMgrqxC0mA5ddiTf1hmMAvC6nKg0C6VPSjb4pZHJUMTLd4pgXZKQujLXJsxPk8/e+D6iL8S50r0ss6jKo3Dy+KIkX30=;24:1wf07ALqBynnmYkLloHJaklrUt4q4ETEPXnxcKbt39Z2+xscZwJ2zl4iMPKUgvw0iTdS1fCL735Ns7VpbnCIl2MxCP35vO65iMIEPS8m9tg=;7:9mkLXC1Akj1PkzcSw38ts+NMm7NwY0FofkZLjtZNPgJqrjw0+bYSY9uabGB+piU//lA41wfs8DxX8uWgpL/KXXUDvBOYc/VghQQ1OsnpHxMGMjG5Gh8qune9id6fycpIdmGCx0birNWVWq9QJ2JCwvJXPrBYUJ1TDIrsro83jCzuSWz52ROQzd9wFEnhdu+tEMbfedm4KuY8JoQPAvWBieKHmV4D1oCJu/eGf7kZvjgigdQhI5G+I41L/wh+Gzo3 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;20:1deeJEtpgXF/6RSAKrSTZkg1Hvwb7oKlguhGEDFz2gIHExpKNX5dr88AYlMkag0i5zxktetZXISRmghp7NwHjJ7PE8VO6r4l70UtzwzSasBXKeWg+kZaDRbh7f3Pp6eKeO385fD9pHj0enLuljna4fjWGATPdUe32Lln/SP6QH0= X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Nov 2017 15:21:02.2682 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 5e195765-d783-4e0f-4a49-08d5213c2a54 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN2PR15MB1086 X-OriginatorOrg: fb.com X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-11-01_03:,, signatures=0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Add a test for device cgroup controller. The test loads a simple bpf program which logs all device access attempts using trace_printk() and forbids all operations except operations with /dev/zero and /dev/urandom. Then the test creates and joins a test cgroup, and attaches the bpf program to it. Then it tries to perform some simple device operations and checks the result: create /dev/null (should fail) create /dev/zero (should pass) copy data from /dev/urandom to /dev/zero (should pass) copy data from /dev/urandom to /dev/full (should fail) copy data from /dev/random to /dev/zero (should fail) Signed-off-by: Roman Gushchin Acked-by: Alexei Starovoitov Acked-by: Tejun Heo Cc: Daniel Borkmann --- tools/testing/selftests/bpf/Makefile | 4 +- tools/testing/selftests/bpf/dev_cgroup.c | 60 +++++++++++++++++ tools/testing/selftests/bpf/test_dev_cgroup.c | 93 +++++++++++++++++++++++++++ 3 files changed, 155 insertions(+), 2 deletions(-) create mode 100644 tools/testing/selftests/bpf/dev_cgroup.c create mode 100644 tools/testing/selftests/bpf/test_dev_cgroup.c diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index 36c34f0218a3..64ba3684a4f4 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -12,11 +12,11 @@ CFLAGS += -Wall -O2 -I$(APIDIR) -I$(LIBDIR) -I$(GENDIR) $(GENFLAGS) -I../../../i LDLIBS += -lcap -lelf TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map test_progs \ - test_align test_verifier_log + test_align test_verifier_log test_dev_cgroup TEST_GEN_FILES = test_pkt_access.o test_xdp.o test_l4lb.o test_tcp_estats.o test_obj_id.o \ test_pkt_md_access.o test_xdp_redirect.o test_xdp_meta.o sockmap_parse_prog.o \ - sockmap_verdict_prog.o + sockmap_verdict_prog.o dev_cgroup.o TEST_PROGS := test_kmod.sh test_xdp_redirect.sh test_xdp_meta.sh diff --git a/tools/testing/selftests/bpf/dev_cgroup.c b/tools/testing/selftests/bpf/dev_cgroup.c new file mode 100644 index 000000000000..f15d5befa099 --- /dev/null +++ b/tools/testing/selftests/bpf/dev_cgroup.c @@ -0,0 +1,60 @@ +/* Copyright (c) 2017 Facebook + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of version 2 of the GNU General Public + * License as published by the Free Software Foundation. + */ + +#include +#include +#include "bpf_helpers.h" + +SEC("cgroup/dev") +int bpf_prog1(struct bpf_cgroup_dev_ctx *ctx) +{ + short type = ctx->access_type & 0xFFFF; +#ifdef DEBUG + short access = ctx->access_type >> 16; + char fmt[] = " %d:%d \n"; + + switch (type) { + case DEV_BPF_DEV_BLOCK: + fmt[0] = 'b'; + break; + case DEV_BPF_DEV_CHAR: + fmt[0] = 'c'; + break; + default: + fmt[0] = '?'; + break; + } + + if (access & DEV_BPF_ACC_READ) + fmt[8] = 'r'; + + if (access & DEV_BPF_ACC_WRITE) + fmt[9] = 'w'; + + if (access & DEV_BPF_ACC_MKNOD) + fmt[10] = 'm'; + + bpf_trace_printk(fmt, sizeof(fmt), ctx->major, ctx->minor); +#endif + + /* Allow access to /dev/zero and /dev/random. + * Forbid everything else. + */ + if (ctx->major != 1 || type != DEV_BPF_DEV_CHAR) + return 0; + + switch (ctx->minor) { + case 5: /* 1:5 /dev/zero */ + case 9: /* 1:9 /dev/urandom */ + return 1; + } + + return 0; +} + +char _license[] SEC("license") = "GPL"; +__u32 _version SEC("version") = LINUX_VERSION_CODE; diff --git a/tools/testing/selftests/bpf/test_dev_cgroup.c b/tools/testing/selftests/bpf/test_dev_cgroup.c new file mode 100644 index 000000000000..02c85d6c89b0 --- /dev/null +++ b/tools/testing/selftests/bpf/test_dev_cgroup.c @@ -0,0 +1,93 @@ +/* Copyright (c) 2017 Facebook + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of version 2 of the GNU General Public + * License as published by the Free Software Foundation. + */ + +#include +#include +#include +#include +#include + +#include +#include +#include + +#include "cgroup_helpers.h" + +#define DEV_CGROUP_PROG "./dev_cgroup.o" + +#define TEST_CGROUP "test-bpf-based-device-cgroup/" + +int main(int argc, char **argv) +{ + struct bpf_object *obj; + int error = EXIT_FAILURE; + int prog_fd, cgroup_fd; + __u32 prog_cnt; + + if (bpf_prog_load(DEV_CGROUP_PROG, BPF_PROG_TYPE_CGROUP_DEVICE, + &obj, &prog_fd)) { + printf("Failed to load DEV_CGROUP program\n"); + goto err; + } + + if (setup_cgroup_environment()) { + printf("Failed to load DEV_CGROUP program\n"); + goto err; + } + + /* Create a cgroup, get fd, and join it */ + cgroup_fd = create_and_get_cgroup(TEST_CGROUP); + if (!cgroup_fd) { + printf("Failed to create test cgroup\n"); + goto err; + } + + if (join_cgroup(TEST_CGROUP)) { + printf("Failed to join cgroup\n"); + goto err; + } + + /* Attach bpf program */ + if (bpf_prog_attach(prog_fd, cgroup_fd, BPF_CGROUP_DEVICE, 0)) { + printf("Failed to attach DEV_CGROUP program"); + goto err; + } + + if (bpf_prog_query(cgroup_fd, BPF_CGROUP_DEVICE, 0, NULL, NULL, + &prog_cnt)) { + printf("Failed to query attached programs"); + goto err; + } + + /* All operations with /dev/zero and and /dev/urandom are allowed, + * everything else is forbidden. + */ + assert(system("rm -f /tmp/test_dev_cgroup_null") == 0); + assert(system("mknod /tmp/test_dev_cgroup_null c 1 3")); + assert(system("rm -f /tmp/test_dev_cgroup_null") == 0); + + /* /dev/zero is whitelisted */ + assert(system("rm -f /tmp/test_dev_cgroup_zero") == 0); + assert(system("mknod /tmp/test_dev_cgroup_zero c 1 5") == 0); + assert(system("rm -f /tmp/test_dev_cgroup_zero") == 0); + + assert(system("dd if=/dev/urandom of=/dev/zero count=64") == 0); + + /* src is allowed, target is forbidden */ + assert(system("dd if=/dev/urandom of=/dev/full count=64")); + + /* src is forbidden, target is allowed */ + assert(system("dd if=/dev/random of=/dev/zero count=64")); + + error = 0; + printf("test_dev_cgroup:PASS\n"); + +err: + cleanup_cgroup_environment(); + + return error; +} -- 2.13.6