github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Test forbidden bpf_ksock_sendto() LSM attach

Browse Source 
Similarly to '7b0dfbf5776b ("selftests/bpf: Test forbidden
bpf_ksock_send() LSM attach")', tests that the verifier filter prevents
bpf_ksock_sendto() to be called in a LSM program attached to
security_socket_sendmsg() as it would create a direct recursion.

Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261020155848.75711-4-mahe.tardy@gmail.com
This commit is contained in:
Mahe Tardy 2026-10-20 15:58:48 +00:00 committed by Alexei Starovoitov
parent 7d563ae3ed
commit d90912846f
No known key found for this signature in database
1 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
tools/testing/selftests/bpf/progs/ksock_lsm_verifier.c
View File

@ -12,7 +12,7 @@ char send_data[11] = "dummy data";
SEC("lsm.s/socket_sendmsg")
__description("bpf_ksock_send is rejected from socket_sendmsg LSM hook")
__failure __msg("calling kernel function bpf_ksock_send is not allowed")
int BPF_PROG(ksock_socket_sendmsg, struct socket *sock, struct msghdr *msg,
int BPF_PROG(socket_sendmsg_ksock_send, struct socket *sock, struct msghdr *msg,
int size, int ret)
{
struct __ksock_ctx_value *v;
@ -32,4 +32,27 @@ int BPF_PROG(ksock_socket_sendmsg, struct socket *sock, struct msghdr *msg,
return ret;
}
SEC("lsm.s/socket_sendmsg")
__description("bpf_ksock_sendto is rejected from socket_sendmsg LSM hook")
__failure __msg("calling kernel function bpf_ksock_sendto is not allowed")
int BPF_PROG(socket_sendmsg_ksock_sendto, struct socket *sock,
struct msghdr *msg, int size, int ret)
{
struct __ksock_ctx_value *v;
struct bpf_ksock *ks;
v = ksock_ctx_value_lookup();
if (!v)
return ret;
ks = bpf_kptr_xchg(&v->ctx, NULL);
if (!ks)
return ret;
bpf_ksock_sendto(ks, send_data, sizeof(send_data), NULL, 0);
bpf_ksock_release(ks);
return ret;
}
char __license[] SEC("license") = "GPL";