Re: [PATCH bpf-next 3/3] selftests/bpf: Test linux_binprm user memory kfuncs

[Justin Suess <utilityemal77@gmail.com>]

On Wed, Aug 12, 2026 at 02:11:40PM +0300, Anastasios Papagiannis wrote:
> This patch adds a sleepable BPF LSM program attached to
> bprm_check_security to test bpf_copy_from_user_bprm() and
> bpf_copy_from_user_bprm_str().
> 
> Starting at bprm->p, verify that bpf_copy_from_user_bprm() can copy the
> contiguous NUL-separated argument data. Then use
> bpf_copy_from_user_bprm_str() to read each argument separately,
> by advancing the offset based on the returned length.
> 
Can you test reading environment strings as well?

It would be nice to have an example on how to do that.

Justin
> Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
> ---
>  .../bpf/prog_tests/copy_from_user_bprm.c      | 52 +++++++++++++
>  .../selftests/bpf/progs/copy_from_user_bprm.c | 74 +++++++++++++++++++
>  2 files changed, 126 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c
>  create mode 100644 tools/testing/selftests/bpf/progs/copy_from_user_bprm.c
> 
> diff --git a/tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c b/tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c
> new file mode 100644
> index 000000000000..3d5080a3975e
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c
> @@ -0,0 +1,52 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +#include <errno.h>
> +#include <sys/wait.h>
> +#include <unistd.h>
> +
> +#include <test_progs.h>
> +
> +#include "copy_from_user_bprm.skel.h"
> +
> +void test_copy_from_user_bprm(void)
> +{
> +	struct copy_from_user_bprm *skel;
> +	pid_t child;
> +	int status;
> +
> +	skel = copy_from_user_bprm__open_and_load();
> +	if (!ASSERT_OK_PTR(skel, "open_and_load"))
> +		return;
> +
> +	if (!ASSERT_OK(copy_from_user_bprm__attach(skel), "attach"))
> +		goto out;
> +
> +	child = fork();
> +	if (!ASSERT_GE(child, 0, "fork"))
> +		goto out;
> +
> +	if (!child) {
> +		char *const argv[] = { "first", "second-argument", NULL };
> +
> +		skel->bss->monitored_pid = getpid();
> +		execv("/bin/true", argv);
> +		_exit(errno);
> +	}
> +
> +	if (!ASSERT_EQ(waitpid(child, &status, 0), child, "waitpid"))
> +		goto out;
> +
> +	if (ASSERT_TRUE(WIFEXITED(status), "child_exited"))
> +		ASSERT_EQ(WEXITSTATUS(status), EPERM, "exec_errno");
> +
> +	ASSERT_EQ(skel->bss->bprm_argc, 2, "bprm_argc");
> +	ASSERT_EQ(skel->bss->invalid_flags_ret, -EINVAL, "invalid_flags_ret");
> +	ASSERT_EQ(skel->bss->copy_ret, 0, "copy_ret");
> +	ASSERT_EQ(skel->bss->str_arg0_ret, 6, "str_arg0_ret");
> +	ASSERT_EQ(skel->bss->str_arg1_ret, 16, "str_arg1_ret");
> +	ASSERT_EQ(skel->bss->args_match, 1, "args_match");
> +	ASSERT_EQ(skel->bss->str_args_match, 1, "str_args_match");
> +
> +out:
> +	copy_from_user_bprm__destroy(skel);
> +}
> diff --git a/tools/testing/selftests/bpf/progs/copy_from_user_bprm.c b/tools/testing/selftests/bpf/progs/copy_from_user_bprm.c
> new file mode 100644
> index 000000000000..679363811edc
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/copy_from_user_bprm.c
> @@ -0,0 +1,74 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +#include "vmlinux.h"
> +
> +#include <bpf/bpf_helpers.h>
> +#include <bpf/bpf_tracing.h>
> +#include <errno.h>
> +#include "bpf_misc.h"
> +
> +char _license[] SEC("license") = "GPL";
> +
> +static const char expected_args[] = "first\0second-argument";
> +static const char expected_arg0[] = "first";
> +static const char expected_arg1[] = "second-argument";
> +
> +int monitored_pid;
> +int bprm_argc;
> +int invalid_flags_ret;
> +int copy_ret;
> +int str_arg0_ret;
> +int str_arg1_ret;
> +int args_match;
> +int str_args_match;
> +
> +extern int bpf_copy_from_user_bprm(void *dst, u32 dst__sz,
> +				   const void *unsafe_ptr__ign,
> +					   const struct linux_binprm *bprm,
> +					   u64 flags) __ksym;
> +
> +extern int bpf_copy_from_user_bprm_str(void *dst, u32 dst__sz,
> +				       const void *unsafe_ptr__ign,
> +					       const struct linux_binprm *bprm,
> +					       u64 flags) __ksym;
> +
> +SEC("lsm.s/bprm_check_security")
> +int BPF_PROG(check_exec_args, struct linux_binprm *bprm, int ret)
> +{
> +	u32 pid = bpf_get_current_pid_tgid() >> 32;
> +	char args[sizeof(expected_args)];
> +	char arg0[32];
> +	char arg1[32];
> +
> +	if (ret || pid != monitored_pid)
> +		return ret;
> +
> +	bprm_argc = bprm->argc;
> +
> +	invalid_flags_ret = bpf_copy_from_user_bprm(args, sizeof(args),
> +						    (void *)bprm->p, bprm, 1);
> +
> +	copy_ret = bpf_copy_from_user_bprm(args, sizeof(args),
> +					   (void *)bprm->p, bprm, 0);
> +	if (copy_ret)
> +		return 0;
> +
> +	args_match = !__builtin_memcmp(args, expected_args, sizeof(expected_args));
> +
> +	str_arg0_ret = bpf_copy_from_user_bprm_str(arg0, sizeof(arg0),
> +						   (void *)bprm->p, bprm,
> +						BPF_F_PAD_ZEROS);
> +	if (str_arg0_ret != sizeof(expected_arg0))
> +		return 0;
> +
> +	str_arg1_ret = bpf_copy_from_user_bprm_str(arg1, sizeof(arg1),
> +						   (void *)(bprm->p + str_arg0_ret),
> +						bprm, BPF_F_PAD_ZEROS);
> +	if (str_arg1_ret != sizeof(expected_arg1))
> +		return 0;
> +
> +	str_args_match = !__builtin_memcmp(arg0, expected_arg0, sizeof(expected_arg0)) &&
> +			!__builtin_memcmp(arg1, expected_arg1, sizeof(expected_arg1));
> +
> +	return args_match && str_args_match ? -EPERM : 0;
> +}
> -- 
> 2.55.0
>