[PATCH bpf-next 6/8] selftests/bpf: Test that the BPF LSM context is read-only

[Daniel Borkmann <daniel@iogearbox.net>]

Add a new BPF selftest asserting that a store into the context of
an LSM program must be rejected.

  # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -a verifier_lsm
  [...]
  #648/1   verifier_lsm/lsm bpf prog with -4095~0 retval. test 1:OK
  #648/2   verifier_lsm/lsm bpf prog with -4095~0 retval. test 2:OK
  #648/3   verifier_lsm/lsm bpf prog with -4095~0 retval. test 4:OK
  #648/4   verifier_lsm/lsm bpf prog with -4095~0 retval. test 5:OK
  #648/5   verifier_lsm/lsm bpf prog with -4095~0 retval. test 6:OK
  #648/6   verifier_lsm/lsm retval load must reset stale register bounds:OK
  #648/7   verifier_lsm/lsm ctx is read-only:OK
  #648/8   verifier_lsm/lsm bpf prog with bool retval. test 1:OK
  #648/9   verifier_lsm/lsm bpf prog with bool retval. test 2:OK
  #648/10  verifier_lsm/lsm bpf prog with bool retval. test 3:OK
  #648/11  verifier_lsm/lsm bpf prog with bool retval. test 4:OK
  #648/12  verifier_lsm/lsm bpf prog with void retval. test 1:OK
  #648/13  verifier_lsm/lsm bpf prog with void retval. test 2:OK
  #648/14  verifier_lsm/lsm disabled hook: getprocattr:OK
  #648/15  verifier_lsm/lsm disabled hook: setprocattr:OK
  #648/16  verifier_lsm/lsm disabled hook: ismaclabel:OK
  #648/17  verifier_lsm/not null checking nullable pointer in bpf_lsm_mmap_file:OK
  #648/18  verifier_lsm/null checking nullable pointer in bpf_lsm_mmap_file:OK
  #648/19  verifier_lsm/sleepable lsm_cgroup program is rejected:OK
  #648     verifier_lsm:OK
  Summary: 1/19 PASSED, 0 SKIPPED, 0/0 FAILED

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
 tools/testing/selftests/bpf/progs/verifier_lsm.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_lsm.c b/tools/testing/selftests/bpf/progs/verifier_lsm.c
index c724bf389f5c..8fbf7862265f 100644
--- a/tools/testing/selftests/bpf/progs/verifier_lsm.c
+++ b/tools/testing/selftests/bpf/progs/verifier_lsm.c
@@ -212,4 +212,17 @@ __naked int retval_load_resets_bounds(void *ctx)
 	::: __clobber_all);
 }
 
+SEC("lsm/file_mprotect")
+__description("lsm ctx is read-only")
+__failure __msg("invalid bpf_context access")
+__naked int reject_ctx_write(void *ctx)
+{
+	asm volatile (
+	"r6 = 0;"
+	"*(u64 *)(r1 + 0) = r6;"
+	"r0 = 0;"
+	"exit;"
+	::: __clobber_all);
+}
+
 char _license[] SEC("license") = "GPL";
-- 
2.43.0