Commit d02d8986 authored by Mickaël Salaün's avatar Mickaël Salaün Committed by David S. Miller

bpf: Always test unprivileged programs

If selftests are run as root, then execute the unprivileged checks as
well. This switch from 243 to 368 tests.

The test numbers are suffixed with "/u" when executed as unprivileged or
with "/p" when executed as privileged.

The geteuid() check is replaced with a capability check.

Handling capabilities requires the libcap dependency.
Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Cc: Shuah Khan <shuah@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7f73f39a
CFLAGS += -Wall -O2 -I../../../include/uapi CFLAGS += -Wall -O2 -lcap -I../../../include/uapi
test_objs = test_verifier test_tag test_maps test_lru_map test_lpm_map test_objs = test_verifier test_tag test_maps test_lru_map test_lpm_map
......
...@@ -16,6 +16,7 @@ ...@@ -16,6 +16,7 @@
#include <stdbool.h> #include <stdbool.h>
#include <sched.h> #include <sched.h>
#include <sys/capability.h>
#include <sys/resource.h> #include <sys/resource.h>
#include <linux/unistd.h> #include <linux/unistd.h>
...@@ -4574,6 +4575,55 @@ static void do_test_single(struct bpf_test *test, bool unpriv, ...@@ -4574,6 +4575,55 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
goto close_fds; goto close_fds;
} }
static bool is_admin(void)
{
cap_t caps;
cap_flag_value_t sysadmin = CAP_CLEAR;
const cap_value_t cap_val = CAP_SYS_ADMIN;
if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
perror("cap_get_flag");
return false;
}
caps = cap_get_proc();
if (!caps) {
perror("cap_get_proc");
return false;
}
if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))
perror("cap_get_flag");
if (cap_free(caps))
perror("cap_free");
return (sysadmin == CAP_SET);
}
static int set_admin(bool admin)
{
cap_t caps;
const cap_value_t cap_val = CAP_SYS_ADMIN;
int ret = -1;
caps = cap_get_proc();
if (!caps) {
perror("cap_get_proc");
return -1;
}
if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
admin ? CAP_SET : CAP_CLEAR)) {
perror("cap_set_flag");
goto out;
}
if (cap_set_proc(caps)) {
perror("cap_set_proc");
goto out;
}
ret = 0;
out:
if (cap_free(caps))
perror("cap_free");
return ret;
}
static int do_test(bool unpriv, unsigned int from, unsigned int to) static int do_test(bool unpriv, unsigned int from, unsigned int to)
{ {
int i, passes = 0, errors = 0; int i, passes = 0, errors = 0;
...@@ -4584,11 +4634,19 @@ static int do_test(bool unpriv, unsigned int from, unsigned int to) ...@@ -4584,11 +4634,19 @@ static int do_test(bool unpriv, unsigned int from, unsigned int to)
/* Program types that are not supported by non-root we /* Program types that are not supported by non-root we
* skip right away. * skip right away.
*/ */
if (unpriv && test->prog_type) if (!test->prog_type) {
continue; if (!unpriv)
set_admin(false);
printf("#%d/u %s ", i, test->descr);
do_test_single(test, true, &passes, &errors);
if (!unpriv)
set_admin(true);
}
printf("#%d %s ", i, test->descr); if (!unpriv) {
do_test_single(test, unpriv, &passes, &errors); printf("#%d/p %s ", i, test->descr);
do_test_single(test, false, &passes, &errors);
}
} }
printf("Summary: %d PASSED, %d FAILED\n", passes, errors); printf("Summary: %d PASSED, %d FAILED\n", passes, errors);
...@@ -4600,7 +4658,7 @@ int main(int argc, char **argv) ...@@ -4600,7 +4658,7 @@ int main(int argc, char **argv)
struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY }; struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY };
struct rlimit rlim = { 1 << 20, 1 << 20 }; struct rlimit rlim = { 1 << 20, 1 << 20 };
unsigned int from = 0, to = ARRAY_SIZE(tests); unsigned int from = 0, to = ARRAY_SIZE(tests);
bool unpriv = geteuid() != 0; bool unpriv = !is_admin();
if (argc == 3) { if (argc == 3) {
unsigned int l = atoi(argv[argc - 2]); unsigned int l = atoi(argv[argc - 2]);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment