// SPDX-License-Identifier: GPL-2.0 // Copyright (c) 2019 Facebook #include "test_progs.h" #include "cgroup_helpers.h" #define CG_PATH "/foo" #define MAX_INSNS 512 #define FIXUP_SYSCTL_VALUE 0 char bpf_log_buf[BPF_LOG_BUF_SIZE];struct sysctl_test {const char *descr;struct bpf_insn insns[MAX_INSNS];const char *prog_file;enum bpf_attach_type attach_type;const char *sysctl;int open_flags;int seek;const char *newval;const char *oldval;enum {static struct sysctl_test tests[] = {"sysctl wrong attach_type" ,1 ),0 ,"kernel/ostype" ,"sysctl:read allow all" ,1 ),"kernel/ostype" ,"sysctl:read deny all" ,0 ),"kernel/ostype" ,"ctx:write sysctl:read read ok" ,/* If (write) */ struct bpf_sysctl, write)),1 , 2 ),/* return DENY; */ 0 ),1 ),/* else return ALLOW; */ 1 ),"kernel/ostype" ,"ctx:write sysctl:write read ok" ,/* If (write) */ struct bpf_sysctl, write)),1 , 2 ),/* return DENY; */ 0 ),1 ),/* else return ALLOW; */ 1 ),"kernel/domainname" ,"(none)" , /* same as default, should fail anyway */ "ctx:write sysctl:write read ok narrow" ,/* u64 w = (u16)write & 1; */ #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__struct bpf_sysctl, write)),#else struct bpf_sysctl, write) + 2 ),#endif 1 ),/* return 1 - w; */ 1 ),"kernel/domainname" ,"(none)" , /* same as default, should fail anyway */ "ctx:write sysctl:read write reject" ,/* write = X */ 0 ),struct bpf_sysctl, write)),1 ),"kernel/ostype" ,"ctx:file_pos sysctl:read read ok" ,/* If (file_pos == X) */ struct bpf_sysctl, file_pos)),3 , 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"kernel/ostype" ,3 ,"ctx:file_pos sysctl:read read ok narrow" ,/* If (file_pos == X) */ #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__struct bpf_sysctl, file_pos)),#else struct bpf_sysctl, file_pos) + 3 ),#endif 4 , 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"kernel/ostype" ,4 ,"ctx:file_pos sysctl:read write ok" ,/* file_pos = X */ 2 ),struct bpf_sysctl, file_pos)),1 ),"kernel/ostype" ,"nux\n" ,"sysctl_get_name sysctl_value:base ok" ,/* sysctl_get_name arg2 (buf) */ 8 ),0 ),0 ),/* sysctl_get_name arg3 (buf_len) */ 8 ),/* sysctl_get_name arg4 (flags) */ /* sysctl_get_name(ctx, buf, buf_len, flags) */ /* if (ret == expected && */ sizeof ("tcp_mem" ) - 1 , 6 ),/* buf == "tcp_mem\0") */ 0 x7463705f6d656d00ULL)),0 ),2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/tcp_mem" ,"sysctl_get_name sysctl_value:base E2BIG truncated" ,/* sysctl_get_name arg2 (buf) */ 8 ),0 ),0 ),/* sysctl_get_name arg3 (buf_len) too small */ 7 ),/* sysctl_get_name arg4 (flags) */ /* sysctl_get_name(ctx, buf, buf_len, flags) */ /* if (ret == expected && */ 6 ),/* buf[0:7] == "tcp_me\0") */ 0 x7463705f6d650000ULL)),0 ),2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/tcp_mem" ,"sysctl_get_name sysctl:full ok" ,/* sysctl_get_name arg2 (buf) */ 24 ),0 ),0 ),8 ),16 ),/* sysctl_get_name arg3 (buf_len) */ 17 ),/* sysctl_get_name arg4 (flags) */ 0 ),/* sysctl_get_name(ctx, buf, buf_len, flags) */ /* if (ret == expected && */ 16 , 14 ),/* buf[0:8] == "net/ipv4" && */ 0 x6e65742f69707634ULL)),0 ),10 ),/* buf[8:16] == "/tcp_mem" && */ 0 x2f7463705f6d656dULL)),8 ),6 ),/* buf[16:24] == "\0") */ 0 x0ULL),16 ),2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/tcp_mem" ,"sysctl_get_name sysctl:full E2BIG truncated" ,/* sysctl_get_name arg2 (buf) */ 16 ),0 ),0 ),8 ),/* sysctl_get_name arg3 (buf_len) */ 16 ),/* sysctl_get_name arg4 (flags) */ 0 ),/* sysctl_get_name(ctx, buf, buf_len, flags) */ /* if (ret == expected && */ 10 ),/* buf[0:8] == "net/ipv4" && */ 0 x6e65742f69707634ULL)),0 ),6 ),/* buf[8:16] == "/tcp_me\0") */ 0 x2f7463705f6d6500ULL)),8 ),2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/tcp_mem" ,"sysctl_get_name sysctl:full E2BIG truncated small" ,/* sysctl_get_name arg2 (buf) */ 8 ),0 ),0 ),/* sysctl_get_name arg3 (buf_len) */ 7 ),/* sysctl_get_name arg4 (flags) */ 0 ),/* sysctl_get_name(ctx, buf, buf_len, flags) */ /* if (ret == expected && */ 6 ),/* buf[0:8] == "net/ip\0") */ 0 x6e65742f69700000ULL)),0 ),2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/tcp_mem" ,"sysctl_get_current_value sysctl:read ok, gt" ,/* sysctl_get_current_value arg2 (buf) */ 8 ),/* sysctl_get_current_value arg3 (buf_len) */ 8 ),/* sysctl_get_current_value(ctx, buf, buf_len) */ /* if (ret == expected && */ 6 , 6 ),/* buf[0:6] == "Linux\n\0") */ 0 x4c696e75780a0000ULL)),0 ),2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"kernel/ostype" ,"sysctl_get_current_value sysctl:read ok, eq" ,/* sysctl_get_current_value arg2 (buf) */ 8 ),0 ),7 ),/* sysctl_get_current_value arg3 (buf_len) */ 7 ),/* sysctl_get_current_value(ctx, buf, buf_len) */ /* if (ret == expected && */ 6 , 6 ),/* buf[0:6] == "Linux\n\0") */ 0 x4c696e75780a0000ULL)),0 ),2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"kernel/ostype" ,"sysctl_get_current_value sysctl:read E2BIG truncated" ,/* sysctl_get_current_value arg2 (buf) */ 8 ),0 ),6 ),/* sysctl_get_current_value arg3 (buf_len) */ 6 ),/* sysctl_get_current_value(ctx, buf, buf_len) */ /* if (ret == expected && */ 6 ),/* buf[0:6] == "Linux\0") */ 0 x4c696e7578000000ULL)),0 ),2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"kernel/ostype" ,"sysctl_get_current_value sysctl:read EINVAL" ,/* sysctl_get_current_value arg2 (buf) */ 8 ),/* sysctl_get_current_value arg3 (buf_len) */ 8 ),/* sysctl_get_current_value(ctx, buf, buf_len) */ /* if (ret == expected && */ 4 ),/* buf[0:8] is NUL-filled) */ 0 ),0 , 2 ),/* return DENY; */ 0 ),1 ),/* else return ALLOW; */ 1 ),"net/ipv6/conf/lo/stable_secret" , /* -EIO */ "sysctl_get_current_value sysctl:write ok" ,6 ,/* sysctl_get_current_value arg2 (buf) */ 8 ),/* sysctl_get_current_value arg3 (buf_len) */ 8 ),/* sysctl_get_current_value(ctx, buf, buf_len) */ /* if (ret == expected && */ 4 , 6 ),/* buf[0:4] == expected) */ 0 ),2 ),/* return DENY; */ 0 ),1 ),/* else return ALLOW; */ 1 ),"net/ipv4/route/mtu_expires" ,"600" , /* same as default, should fail anyway */ "sysctl_get_new_value sysctl:read EINVAL" ,/* sysctl_get_new_value arg2 (buf) */ 8 ),0 ),0 ),/* sysctl_get_new_value arg3 (buf_len) */ 8 ),/* sysctl_get_new_value(ctx, buf, buf_len) */ /* if (ret == expected) */ 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/tcp_mem" ,"sysctl_get_new_value sysctl:write ok" ,/* sysctl_get_new_value arg2 (buf) */ 8 ),/* sysctl_get_new_value arg3 (buf_len) */ 4 ),/* sysctl_get_new_value(ctx, buf, buf_len) */ /* if (ret == expected && */ 3 , 4 ),/* buf[0:4] == "606\0") */ 0 ),0 x36303600), 2 ),/* return DENY; */ 0 ),1 ),/* else return ALLOW; */ 1 ),"net/ipv4/route/mtu_expires" ,"606" ,"sysctl_get_new_value sysctl:write ok long" ,/* sysctl_get_new_value arg2 (buf) */ 24 ),/* sysctl_get_new_value arg3 (buf_len) */ 24 ),/* sysctl_get_new_value(ctx, buf, buf_len) */ /* if (ret == expected && */ 23 , 14 ),/* buf[0:8] == "3000000 " && */ 0 x3330303030303020ULL)),0 ),10 ),/* buf[8:16] == "4000000 " && */ 0 x3430303030303020ULL)),8 ),6 ),/* buf[16:24] == "6000000\0") */ 0 x3630303030303000ULL)),16 ),2 ),/* return DENY; */ 0 ),1 ),/* else return ALLOW; */ 1 ),"net/ipv4/tcp_mem" ,"3000000 4000000 6000000" ,"sysctl_get_new_value sysctl:write E2BIG" ,/* sysctl_get_new_value arg2 (buf) */ 8 ),0 ),3 ),/* sysctl_get_new_value arg3 (buf_len) */ 3 ),/* sysctl_get_new_value(ctx, buf, buf_len) */ /* if (ret == expected && */ 4 ),/* buf[0:3] == "60\0") */ 0 ),0 x36300000), 2 ),/* return DENY; */ 0 ),1 ),/* else return ALLOW; */ 1 ),"net/ipv4/route/mtu_expires" ,"606" ,"sysctl_set_new_value sysctl:read EINVAL" ,/* sysctl_set_new_value arg2 (buf) */ 8 ),0 x36303000)),0 ),/* sysctl_set_new_value arg3 (buf_len) */ 3 ),/* sysctl_set_new_value(ctx, buf, buf_len) */ /* if (ret == expected) */ 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/route/mtu_expires" ,"sysctl_set_new_value sysctl:write ok" ,2 ,/* sysctl_set_new_value arg2 (buf) */ 8 ),0 ),/* sysctl_set_new_value arg3 (buf_len) */ 3 ),/* sysctl_set_new_value(ctx, buf, buf_len) */ /* if (ret == expected) */ 0 , 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/route/mtu_expires" ,"606" ,"bpf_strtoul one number string" ,/* arg1 (buf) */ 8 ),0 x36303000)),0 ),/* arg2 (buf_len) */ 4 ),/* arg3 (flags) */ 0 ),/* arg4 (res) */ 8 ),0 ),/* if (ret == expected && */ 3 , 4 ),/* res == expected) */ 0 ),600 , 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/route/mtu_expires" ,"bpf_strtoul multi number string" ,/* arg1 (buf) */ 8 ),/* "600 602\0" */ 0 x3630302036303200ULL)),0 ),/* arg2 (buf_len) */ 8 ),/* arg3 (flags) */ 0 ),/* arg4 (res) */ 8 ),0 ),/* if (ret == expected && */ 3 , 18 ),/* res == expected) */ 0 ),600 , 16 ),/* arg1 (buf) */ 8 ),/* arg2 (buf_len) */ 8 ),/* arg3 (flags) */ 0 ),/* arg4 (res) */ 16 ),/* if (ret == expected && */ 4 , 4 ),/* res == expected) */ 0 ),602 , 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/tcp_mem" ,"bpf_strtoul buf_len = 0, reject" ,/* arg1 (buf) */ 8 ),0 x36303000)),0 ),/* arg2 (buf_len) */ 0 ),/* arg3 (flags) */ 0 ),/* arg4 (res) */ 8 ),0 ),1 ),"net/ipv4/route/mtu_expires" ,"bpf_strtoul supported base, ok" ,/* arg1 (buf) */ 8 ),0 x30373700)),0 ),/* arg2 (buf_len) */ 4 ),/* arg3 (flags) */ 8 ),/* arg4 (res) */ 8 ),0 ),/* if (ret == expected && */ 3 , 4 ),/* res == expected) */ 0 ),63 , 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/route/mtu_expires" ,"bpf_strtoul unsupported base, EINVAL" ,/* arg1 (buf) */ 8 ),0 x36303000)),0 ),/* arg2 (buf_len) */ 4 ),/* arg3 (flags) */ 3 ),/* arg4 (res) */ 8 ),0 ),/* if (ret == expected) */ 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/route/mtu_expires" ,"bpf_strtoul buf with spaces only, EINVAL" ,/* arg1 (buf) */ 8 ),0 x0d0c0a09)),0 ),/* arg2 (buf_len) */ 4 ),/* arg3 (flags) */ 0 ),/* arg4 (res) */ 8 ),0 ),/* if (ret == expected) */ 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/route/mtu_expires" ,"bpf_strtoul negative number, EINVAL" ,/* arg1 (buf) */ 8 ),/* " -6\0" */ 0 x0a2d3600)),0 ),/* arg2 (buf_len) */ 4 ),/* arg3 (flags) */ 0 ),/* arg4 (res) */ 8 ),0 ),/* if (ret == expected) */ 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/route/mtu_expires" ,"bpf_strtol negative number, ok" ,/* arg1 (buf) */ 8 ),/* " -6\0" */ 0 x0a2d3600)),0 ),/* arg2 (buf_len) */ 4 ),/* arg3 (flags) */ 10 ),/* arg4 (res) */ 8 ),0 ),/* if (ret == expected && */ 3 , 4 ),/* res == expected) */ 0 ),6 , 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/route/mtu_expires" ,"bpf_strtol hex number, ok" ,/* arg1 (buf) */ 8 ),/* "0xfe" */ 0 x30786665)),0 ),/* arg2 (buf_len) */ 4 ),/* arg3 (flags) */ 0 ),/* arg4 (res) */ 8 ),0 ),/* if (ret == expected && */ 4 , 4 ),/* res == expected) */ 0 ),254 , 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/route/mtu_expires" ,"bpf_strtol max long" ,/* arg1 (buf) 9223372036854775807 */ 24 ),0 x3932323333373230ULL)),0 ),0 x3336383534373735ULL)),8 ),0 x3830370000000000ULL)),16 ),/* arg2 (buf_len) */ 19 ),/* arg3 (flags) */ 0 ),/* arg4 (res) */ 8 ),0 ),/* if (ret == expected && */ 19 , 6 ),/* res == expected) */ 0 x7fffffffffffffffULL),0 ),2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/route/mtu_expires" ,"bpf_strtol overflow, ERANGE" ,/* arg1 (buf) 9223372036854775808 */ 24 ),0 x3932323333373230ULL)),0 ),0 x3336383534373735ULL)),8 ),0 x3830380000000000ULL)),16 ),/* arg2 (buf_len) */ 19 ),/* arg3 (flags) */ 0 ),/* arg4 (res) */ 8 ),0 ),/* if (ret == expected) */ 2 ),/* return ALLOW; */ 1 ),1 ),/* else return DENY; */ 0 ),"net/ipv4/route/mtu_expires" ,"C prog: deny all writes" ,"./test_sysctl_prog.bpf.o" ,"net/ipv4/tcp_mem" ,"123 456 789" ,"C prog: deny access by name" ,"./test_sysctl_prog.bpf.o" ,"net/ipv4/route/mtu_expires" ,"C prog: read tcp_mem" ,"./test_sysctl_prog.bpf.o" ,"net/ipv4/tcp_mem" ,static size_t probe_prog_length(const struct bpf_insn *fp)for (len = MAX_INSNS - 1 ; len > 0 ; --len)if (fp[len].code != 0 || fp[len].imm != 0 )break ;return len + 1 ;static int fixup_sysctl_value(const char *buf, size_t buf_len,struct bpf_insn *prog, size_t insn_num)union {sizeof (uint64_t)];if (buf_len > sizeof (value)) {"Value is too big (%zd) to use in fixup" , buf_len);return -1 ;if (prog[insn_num].code != (BPF_LD | BPF_DW | BPF_IMM)) {"Can fixup only BPF_LD_IMM64 insns" );return -1 ;1 ].imm = (uint32_t)(value.num >> 32 );return 0 ;static int load_sysctl_prog_insns(struct sysctl_test *test,const char *sysctl_path)struct bpf_insn *prog = test->insns;int ret, insn_cnt;if (test->fixup_value_insn) {char buf[128 ];int fd;if (fd < 0 ) {"open(%s) failed" , sysctl_path);return -1 ;sizeof (buf));if (len == -1 ) {"read(%s) failed" , sysctl_path);return -1 ;if (fixup_sysctl_value(buf, len, prog, test->fixup_value_insn))return -1 ;"GPL" , prog, insn_cnt, &opts);if (ret < 0 && test->result != LOAD_REJECT) {">>> Loading program error.\n" ">>> Verifier output:\n%s\n-------\n" , bpf_log_buf);return ret;static int load_sysctl_prog_file(struct sysctl_test *test)struct bpf_object *obj;int prog_fd;if (bpf_prog_test_load(test->prog_file, BPF_PROG_TYPE_CGROUP_SYSCTL, &obj, &prog_fd)) {if (test->result != LOAD_REJECT)">>> Loading program (%s) error.\n" ,return -1 ;return prog_fd;static int load_sysctl_prog(struct sysctl_test *test, const char *sysctl_path)return test->prog_filestatic int access_sysctl(const char *sysctl_path,const struct sysctl_test *test)int err = 0 ;int fd;if (fd < 0 )return fd;if (test->seek && lseek(fd, test->seek, SEEK_SET) == -1 ) {"lseek(%d) failed" , test->seek);goto err;if (test->open_flags == O_RDONLY) {char buf[128 ];if (read(fd, buf, sizeof (buf)) == -1 )goto err;if (test->oldval &&"Read value %s != %s" , buf, test->oldval);goto err;else if (test->open_flags == O_WRONLY) {if (!test->newval) {"New value for sysctl is not set" );goto err;if (write(fd, test->newval, strlen(test->newval)) == -1 )goto err;else {"Unexpected sysctl access: neither read nor write" );goto err;goto out;1 ;return err;static int run_test_case(int cgfd, struct sysctl_test *test)enum bpf_attach_type atype = test->attach_type;char sysctl_path[128 ];int progfd = -1 ;int err = 0 ;"Test case: %s .. " , test->descr);sizeof (sysctl_path), "/proc/sys/%s" ,if (progfd < 0 ) {if (test->result == LOAD_REJECT)goto out;else goto err;if (bpf_prog_attach(progfd, cgfd, atype, BPF_F_ALLOW_OVERRIDE) < 0 ) {if (test->result == ATTACH_REJECT)goto out;else goto err;0 ;if (access_sysctl(sysctl_path, test) == -1 ) {if (test->result == OP_EPERM && errno == EPERM)goto out;else goto err;if (test->result != SUCCESS) {"Unexpected success" );goto err;goto out;1 ;/* Detaching w/o checking return code: best effort attempt. */ if (progfd != -1 )"[%s]\n" , err ? "FAIL" : "PASS" );return err;static int run_tests(int cgfd)int passes = 0 ;int fails = 0 ;int i;for (i = 0 ; i < ARRAY_SIZE(tests); ++i) {if (run_test_case(cgfd, &tests[i]))else "Summary: %d PASSED, %d FAILED\n" , passes, fails);return fails ? -1 : 0 ;void test_sysctl(void )int cgfd;if (!ASSERT_OK_FD(cgfd < 0 , "create_cgroup" ))goto out;if (!ASSERT_OK(run_tests(cgfd), "run_tests" ))goto out;return ;
Messung V0.5 in Prozent C=96 H=91 G=93
¤ Dauer der Verarbeitung: 0.37 Sekunden
(vorverarbeitet am 2026-06-08)
¤ *© Formatika GbR, Deutschland
