Commit 81626001 authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by Daniel Borkmann
Browse files

selftests/bpf: Use CAP_BPF and CAP_PERFMON in tests 



Make all test_verifier test exercise CAP_BPF and CAP_PERFMON

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20200513230355.7858-4-alexei.starovoitov@gmail.com
parent 2c78ee89

tools/testing/selftests/bpf/test_verifier.c

+36 −8
Original line number Diff line number Diff line
@@ -818,10 +818,18 @@ static void do_test_fixup(struct bpf_test *test, enum bpf_prog_type prog_type, 
	}

}



struct libcap {

	struct __user_cap_header_struct hdr;

	struct __user_cap_data_struct data[2];

};



static int set_admin(bool admin)

{

	cap_t caps;

	const cap_value_t cap_val = CAP_SYS_ADMIN;

	/* need CAP_BPF, CAP_NET_ADMIN, CAP_PERFMON to load progs */

	const cap_value_t cap_net_admin = CAP_NET_ADMIN;

	const cap_value_t cap_sys_admin = CAP_SYS_ADMIN;

	struct libcap *cap;

	int ret = -1;



	caps = cap_get_proc();
@@ -829,11 +837,26 @@ static int set_admin(bool admin) 
		perror("cap_get_proc");

		return -1;

	}

	if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,

	cap = (struct libcap *)caps;

	if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_sys_admin, CAP_CLEAR)) {

		perror("cap_set_flag clear admin");

		goto out;

	}

	if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_net_admin,

				admin ? CAP_SET : CAP_CLEAR)) {

		perror("cap_set_flag");

		perror("cap_set_flag set_or_clear net");

		goto out;

	}

	/* libcap is likely old and simply ignores CAP_BPF and CAP_PERFMON,

	 * so update effective bits manually

	 */

	if (admin) {

		cap->data[1].effective |= 1 << (38 /* CAP_PERFMON */ - 32);

		cap->data[1].effective |= 1 << (39 /* CAP_BPF */ - 32);

	} else {

		cap->data[1].effective &= ~(1 << (38 - 32));

		cap->data[1].effective &= ~(1 << (39 - 32));

	}

	if (cap_set_proc(caps)) {

		perror("cap_set_proc");

		goto out;
@@ -1067,9 +1090,11 @@ fail_log: 


static bool is_admin(void)

{

	cap_flag_value_t net_priv = CAP_CLEAR;

	bool perfmon_priv = false;

	bool bpf_priv = false;

	struct libcap *cap;

	cap_t caps;

	cap_flag_value_t sysadmin = CAP_CLEAR;

	const cap_value_t cap_val = CAP_SYS_ADMIN;



#ifdef CAP_IS_SUPPORTED

	if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
@@ -1082,11 +1107,14 @@ static bool is_admin(void) 
		perror("cap_get_proc");

		return false;

	}

	if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))

		perror("cap_get_flag");

	cap = (struct libcap *)caps;

	bpf_priv = cap->data[1].effective & (1 << (39/* CAP_BPF */ - 32));

	perfmon_priv = cap->data[1].effective & (1 << (38/* CAP_PERFMON */ - 32));

	if (cap_get_flag(caps, CAP_NET_ADMIN, CAP_EFFECTIVE, &net_priv))

		perror("cap_get_flag NET");

	if (cap_free(caps))

		perror("cap_free");

	return (sysadmin == CAP_SET);

	return bpf_priv && perfmon_priv && net_priv == CAP_SET;

}



static void get_unpriv_disabled()

tools/testing/selftests/bpf/verifier/calls.c

+8 −8
Original line number Diff line number Diff line
@@ -19,7 +19,7 @@ 
	BPF_MOV64_IMM(BPF_REG_0, 2),

	BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "function calls to other bpf functions are allowed for root only",

	.errstr_unpriv = "function calls to other bpf functions are allowed for",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.retval = 1,
@@ -315,7 +315,7 @@ 
	BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),

	BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "allowed for root only",

	.errstr_unpriv = "allowed for",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.retval = POINTER_VALUE,
@@ -346,7 +346,7 @@ 
	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),

	BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "allowed for root only",

	.errstr_unpriv = "allowed for",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.retval = TEST_DATA_LEN + TEST_DATA_LEN - ETH_HLEN - ETH_HLEN,
@@ -397,7 +397,7 @@ 
	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "function calls to other bpf functions are allowed for root only",

	.errstr_unpriv = "function calls to other bpf functions are allowed for",

	.fixup_map_hash_48b = { 3 },

	.result_unpriv = REJECT,

	.result = ACCEPT,
@@ -1064,7 +1064,7 @@ 
	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "allowed for root only",

	.errstr_unpriv = "allowed for",

	.result_unpriv = REJECT,

	.errstr = "R0 !read_ok",

	.result = REJECT,
@@ -1977,7 +1977,7 @@ 
	BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,

	.errstr_unpriv = "function calls to other bpf functions are allowed for root only",

	.errstr_unpriv = "function calls to other bpf functions are allowed for",

	.result_unpriv = REJECT,

	.result = ACCEPT,

},
@@ -2003,7 +2003,7 @@ 
	BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,

	.errstr_unpriv = "function calls to other bpf functions are allowed for root only",

	.errstr_unpriv = "function calls to other bpf functions are allowed for",

	.errstr = "!read_ok",

	.result = REJECT,

},
@@ -2028,7 +2028,7 @@ 
	BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,

	.errstr_unpriv = "function calls to other bpf functions are allowed for root only",

	.errstr_unpriv = "function calls to other bpf functions are allowed for",

	.errstr = "!read_ok",

	.result = REJECT,

},

tools/testing/selftests/bpf/verifier/dead_code.c

+5 −5
Original line number Diff line number Diff line
@@ -85,7 +85,7 @@ 
	BPF_MOV64_IMM(BPF_REG_0, 12),

	BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "function calls to other bpf functions are allowed for root only",

	.errstr_unpriv = "function calls to other bpf functions are allowed for",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.retval = 7,
@@ -103,7 +103,7 @@ 
	BPF_MOV64_IMM(BPF_REG_0, 12),

	BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "function calls to other bpf functions are allowed for root only",

	.errstr_unpriv = "function calls to other bpf functions are allowed for",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.retval = 7,
@@ -121,7 +121,7 @@ 
	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -5),

	BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "function calls to other bpf functions are allowed for root only",

	.errstr_unpriv = "function calls to other bpf functions are allowed for",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.retval = 7,
@@ -137,7 +137,7 @@ 
	BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),

	BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "function calls to other bpf functions are allowed for root only",

	.errstr_unpriv = "function calls to other bpf functions are allowed for",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.retval = 2,
@@ -152,7 +152,7 @@ 
	BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),

	BPF_EXIT_INSN(),

	},

	.errstr_unpriv = "function calls to other bpf functions are allowed for root only",

	.errstr_unpriv = "function calls to other bpf functions are allowed for",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.retval = 2,

CRA Git | Maintained and supported by SUSTech CRA and CCSE