From: sdf@google.com
To: Martin KaFai Lau <kafai@fb.com>
Cc: bpf@vger.kernel.org, Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
kernel-team@fb.com
Subject: Re: [PATCH bpf-next 3/3] bpf: selftests: Remove libcap usage from test_progs
Date: Wed, 16 Mar 2022 08:14:02 -0700 [thread overview]
Message-ID: <YjH+usi73AlX/6Sn@google.com> (raw)
In-Reply-To: <20220316014900.2258022-1-kafai@fb.com>
On 03/15, Martin KaFai Lau wrote:
> This patch removes the libcap usage from test_progs.
> bind_perm.c is the only user. cap_*_effective() helpers added in the
> earlier patch are directly used instead.
> No other selftest binary is using libcap, so '-lcap' is also removed
> from the Makefile.
> Cc: Stanislav Fomichev <sdf@google.com>
LGTM!
Reviewed-by: Stanislav Fomichev <sdf@google.com>
> Signed-off-by: Martin KaFai Lau <kafai@fb.com>
> ---
> tools/testing/selftests/bpf/Makefile | 5 ++-
> .../selftests/bpf/prog_tests/bind_perm.c | 45 ++++---------------
> 2 files changed, 12 insertions(+), 38 deletions(-)
> diff --git a/tools/testing/selftests/bpf/Makefile
> b/tools/testing/selftests/bpf/Makefile
> index 1c6e55740019..11f5883636c3 100644
> --- a/tools/testing/selftests/bpf/Makefile
> +++ b/tools/testing/selftests/bpf/Makefile
> @@ -25,7 +25,7 @@ CFLAGS += -g -O0 -rdynamic -Wall -Werror $(GENFLAGS)
> $(SAN_CFLAGS) \
> -I$(CURDIR) -I$(INCLUDE_DIR) -I$(GENDIR) -I$(LIBDIR) \
> -I$(TOOLSINCDIR) -I$(APIDIR) -I$(OUTPUT)
> LDFLAGS += $(SAN_CFLAGS)
> -LDLIBS += -lcap -lelf -lz -lrt -lpthread
> +LDLIBS += -lelf -lz -lrt -lpthread
> # Silence some warnings when compiled with clang
> ifneq ($(LLVM),)
> @@ -480,7 +480,8 @@ TRUNNER_TESTS_DIR := prog_tests
> TRUNNER_BPF_PROGS_DIR := progs
> TRUNNER_EXTRA_SOURCES := test_progs.c cgroup_helpers.c trace_helpers.c \
> network_helpers.c testing_helpers.c \
> - btf_helpers.c flow_dissector_load.h
> + btf_helpers.c flow_dissector_load.h \
> + cap_helpers.c
> TRUNNER_EXTRA_FILES := $(OUTPUT)/urandom_read $(OUTPUT)/bpf_testmod.ko \
> ima_setup.sh \
> $(wildcard progs/btf_dump_test_case_*.c)
> diff --git a/tools/testing/selftests/bpf/prog_tests/bind_perm.c
> b/tools/testing/selftests/bpf/prog_tests/bind_perm.c
> index eac71fbb24ce..6562b5fdcf1e 100644
> --- a/tools/testing/selftests/bpf/prog_tests/bind_perm.c
> +++ b/tools/testing/selftests/bpf/prog_tests/bind_perm.c
> @@ -4,9 +4,10 @@
> #include <stdlib.h>
> #include <sys/types.h>
> #include <sys/socket.h>
> -#include <sys/capability.h>
> +#include <linux/capability.h>
> #include "test_progs.h"
> +#include "cap_helpers.h"
> #include "bind_perm.skel.h"
> static int duration;
> @@ -49,41 +50,11 @@ void try_bind(int family, int port, int
> expected_errno)
> close(fd);
> }
> -bool cap_net_bind_service(cap_flag_value_t flag)
> -{
> - const cap_value_t cap_net_bind_service = CAP_NET_BIND_SERVICE;
> - cap_flag_value_t original_value;
> - bool was_effective = false;
> - cap_t caps;
> -
> - caps = cap_get_proc();
> - if (CHECK(!caps, "cap_get_proc", "errno %d", errno))
> - goto free_caps;
> -
> - if (CHECK(cap_get_flag(caps, CAP_NET_BIND_SERVICE, CAP_EFFECTIVE,
> - &original_value),
> - "cap_get_flag", "errno %d", errno))
> - goto free_caps;
> -
> - was_effective = (original_value == CAP_SET);
> -
> - if (CHECK(cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_net_bind_service,
> - flag),
> - "cap_set_flag", "errno %d", errno))
> - goto free_caps;
> -
> - if (CHECK(cap_set_proc(caps), "cap_set_proc", "errno %d", errno))
> - goto free_caps;
> -
> -free_caps:
> - CHECK(cap_free(caps), "cap_free", "errno %d", errno);
> - return was_effective;
> -}
> -
> void test_bind_perm(void)
> {
> - bool cap_was_effective;
> + const __u64 net_bind_svc_cap = 1ULL << CAP_NET_BIND_SERVICE;
> struct bind_perm *skel;
> + __u64 old_caps = 0;
> int cgroup_fd;
> if (create_netns())
> @@ -105,7 +76,8 @@ void test_bind_perm(void)
> if (!ASSERT_OK_PTR(skel, "bind_v6_prog"))
> goto close_skeleton;
> - cap_was_effective = cap_net_bind_service(CAP_CLEAR);
> + ASSERT_OK(cap_disable_effective(net_bind_svc_cap, &old_caps),
> + "cap_disable_effective");
> try_bind(AF_INET, 110, EACCES);
> try_bind(AF_INET6, 110, EACCES);
> @@ -113,8 +85,9 @@ void test_bind_perm(void)
> try_bind(AF_INET, 111, 0);
> try_bind(AF_INET6, 111, 0);
> - if (cap_was_effective)
> - cap_net_bind_service(CAP_SET);
> + if (old_caps & net_bind_svc_cap)
> + ASSERT_OK(cap_enable_effective(net_bind_svc_cap, NULL),
> + "cap_enable_effective");
> close_skeleton:
> bind_perm__destroy(skel);
> --
> 2.30.2
next prev parent reply other threads:[~2022-03-16 15:15 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-16 1:48 [PATCH bpf-next 0/3] Remove libcap dependency from bpf selftests Martin KaFai Lau
2022-03-16 1:48 ` [PATCH bpf-next 1/3] bpf: selftests: Add helpers to directly use the capget and capset syscall Martin KaFai Lau
2022-03-16 6:17 ` John Fastabend
2022-03-16 1:48 ` [PATCH bpf-next 2/3] bpf: selftests: Remove libcap usage from test_verifier Martin KaFai Lau
2022-03-17 2:18 ` Shung-Hsi Yu
2022-03-17 7:04 ` Shung-Hsi Yu
2022-03-16 1:49 ` [PATCH bpf-next 3/3] bpf: selftests: Remove libcap usage from test_progs Martin KaFai Lau
2022-03-16 15:14 ` sdf [this message]
2022-03-16 5:36 ` [PATCH bpf-next 0/3] Remove libcap dependency from bpf selftests Andrii Nakryiko
2022-03-16 17:17 ` Martin KaFai Lau
2022-03-16 6:20 ` John Fastabend
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YjH+usi73AlX/6Sn@google.com \
--to=sdf@google.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=kafai@fb.com \
--cc=kernel-team@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox