| Age | Commit message (Collapse) | Author |
|---|
|
Two sets of tests are added to exercise the not _locked and _locked
version of the kfuncs. For both tests, user space accesses xattr
security.bpf.foo on a testfile. The BPF program is triggered by user
space access (on LSM hook inode_[set|get]_xattr) and sets or removes
xattr security.bpf.bar. Then user space then validates that xattr
security.bpf.bar is set or removed as expected.
Note that, in both tests, the BPF programs use the not _locked kfuncs.
The verifier picks the proper kfuncs based on the calling context.
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20250130213549.3353349-6-song@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
|
|
Extend test_progs fs_kfuncs to cover different xattr names. Specifically:
xattr name "user.kfuncs" and "security.bpf.xxx" can be read from BPF
program with kfuncs bpf_get_[file|dentry]_xattr(); while "security.bpf"
and "security.selinux" cannot be read.
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20250130213549.3353349-3-song@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
|
|
Add test for bpf_get_dentry_xattr on hook security_inode_getxattr.
Verify that the kfunc can read the xattr. Also test failing getxattr
from user space by returning non-zero from the LSM bpf program.
Acked-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20240806230904.71194-4-song@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
|
|
`fs_kfuncs.c`'s `test_xattr` would fail the test even when the
filesystem did not support xattr, for instance when /tmp is mounted as
tmpfs.
This change checks errno when setxattr fail. If the failure is due to
the operation being unsupported, we will skip the test (just like we
would if verity was not enabled on the FS.
Before the change, fs_kfuncs test would fail in test_axattr:
$ vmtest -k $(make -s image_name) './tools/testing/selftests/bpf/test_progs -a fs_kfuncs'
=> bzImage
===> Booting
[ 0.000000] rcu: RCU restricting CPUs from NR_CPUS=128 to
nr_cpu_
===> Setting up VM
===> Running command
[ 4.157491] bpf_testmod: loading out-of-tree module taints kernel.
[ 4.161515] bpf_testmod: module verification failed: signature and/or
required key missing - tainting kernel
test_xattr:PASS:create_file 0 nsec
test_xattr:FAIL:setxattr unexpected error: -1 (errno 95)
#90/1 fs_kfuncs/xattr:FAIL
#90/2 fs_kfuncs/fsverity:SKIP
#90 fs_kfuncs:FAIL
All error logs:
test_xattr:PASS:create_file 0 nsec
test_xattr:FAIL:setxattr unexpected error: -1 (errno 95)
#90/1 fs_kfuncs/xattr:FAIL
#90 fs_kfuncs:FAIL
Summary: 0/0 PASSED, 1 SKIPPED, 1 FAILED
Test plan:
$ touch tmpfs_file && truncate -s 1G tmpfs_file && mkfs.ext4 tmpfs_file
# /tmp mounted as tmpfs
$ vmtest -k $(make -s image_name) './tools/testing/selftests/bpf/test_progs -a fs_kfuncs'
=> bzImage
===> Booting
===> Setting up VM
===> Running command
WARNING! Selftests relying on bpf_testmod.ko will be skipped.
Can't find bpf_testmod.ko kernel module: -2
#90/1 fs_kfuncs/xattr:SKIP
#90/2 fs_kfuncs/fsverity:SKIP
#90 fs_kfuncs:SKIP
Summary: 1/0 PASSED, 2 SKIPPED, 0 FAILED
# /tmp mounted as ext4 with xattr enabled but not verity
$ vmtest -k $(make -s image_name) 'mount -o loop tmpfs_file /tmp && \
/tools/testing/selftests/bpf/test_progs -a fs_kfuncs'
=> bzImage
===> Booting
===> Setting up VM
===> Running command
[ 4.067071] loop0: detected capacity change from 0 to 2097152
[ 4.191882] EXT4-fs (loop0): mounted filesystem
407ffa36-4553-4c8c-8c78-134443630f69 r/w with ordered data mode. Quota
mode: none.
WARNING! Selftests relying on bpf_testmod.ko will be skipped.
Can't find bpf_testmod.ko kernel module: -2
#90/1 fs_kfuncs/xattr:OK
#90/2 fs_kfuncs/fsverity:SKIP
#90 fs_kfuncs:OK (SKIP: 1/2)
Summary: 1/1 PASSED, 1 SKIPPED, 0 FAILED
$ tune2fs -O verity tmpfs_file
# /tmp as ext4 with both xattr and verity enabled
$ vmtest -k $(make -s image_name) 'mount -o loop tmpfs_file /tmp && \
./tools/testing/selftests/bpf/test_progs -a fs_kfuncs'
=> bzImage
===> Booting
===> Setting up VM
===> Running command
[ 4.291434] loop0: detected capacity change from 0 to 2097152
[ 4.460828] EXT4-fs (loop0): recovery complete
[ 4.468631] EXT4-fs (loop0): mounted filesystem
7b4a7b7f-c442-4b06-9ede-254e63cceb52 r/w with ordered data mode. Quota
mode: none.
[ 4.988074] fs-verity: sha256 using implementation "sha256-generic"
WARNING! Selftests relying on bpf_testmod.ko will be skipped.
Can't find bpf_testmod.ko kernel module: -2
#90/1 fs_kfuncs/xattr:OK
#90/2 fs_kfuncs/fsverity:OK
#90 fs_kfuncs:OK
Summary: 1/2 PASSED, 0 SKIPPED, 0 FAILED
Fixes: 341f06fdddf7 ("selftests/bpf: Add tests for filesystem kfuncs")
Signed-off-by: Manu Bretelle <chantr4@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20231211180733.763025-1-chantr4@gmail.com
|
|
Add selftests for two new filesystem kfuncs:
1. bpf_get_file_xattr
2. bpf_get_fsverity_digest
These tests simply make sure the two kfuncs work. Another selftest will be
added to demonstrate how to use these kfuncs to verify file signature.
CONFIG_FS_VERITY is added to selftests config. However, this is not
sufficient to guarantee bpf_get_fsverity_digest works. This is because
fsverity need to be enabled at file system level (for example, with tune2fs
on ext4). If local file system doesn't have this feature enabled, just skip
the test.
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20231129234417.856536-6-song@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
|
