Re: [PATCH v3 2/2] selftests/bpf: add tests to verify the enforcement of CONFIG_CGROUP_LSM_NUM

[Paul Chaignon <paul.chaignon@gmail.com>]

On Wed, May 06, 2026 at 05:05:47PM +0200, Paul Houssel wrote:
> Add a selftest that verifies the kernel correctly enforces
> CONFIG_CGROUP_LSM_NUM as the maximum number of concurrently attachable
> per-cgroup LSM hook slots.
> 
> The BPF program side (progs/cgroup_lsm_num.c) defines 12 lsm_cgroup
> programs, each attached to a distinct LSM hook. The test side
> (prog_tests/cgroup_lsm_num.c) attempts to attach all 12 programs one by
> one to a cgroup, and verifies that exactly 10 succeed and 2 are rejected,
> matching the value of CONFIG_CGROUP_LSM_NUM set to 10 in the selftest
> Kconfig fragment.
> 
> Signed-off-by: Paul Houssel <paulhoussel2@gmail.com>
> ---
>  tools/testing/selftests/bpf/config            |  1 +
>  .../selftests/bpf/prog_tests/cgroup_lsm_num.c | 60 +++++++++++++++++++
>  .../selftests/bpf/progs/cgroup_lsm_num.c      | 46 ++++++++++++++
>  3 files changed, 107 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/cgroup_lsm_num.c
>  create mode 100644 tools/testing/selftests/bpf/progs/cgroup_lsm_num.c
> 
> diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config
> index 24855381290d..e4c5dd86c640 100644
> --- a/tools/testing/selftests/bpf/config
> +++ b/tools/testing/selftests/bpf/config
> @@ -11,6 +11,7 @@ CONFIG_BPF_STREAM_PARSER=y
>  CONFIG_BPF_SYSCALL=y
>  # CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set
>  CONFIG_CGROUP_BPF=y
> +CONFIG_CGROUP_LSM_NUM=10
>  CONFIG_CRYPTO_HMAC=y
>  CONFIG_CRYPTO_SHA256=y
>  CONFIG_CRYPTO_USER_API=y
> diff --git a/tools/testing/selftests/bpf/prog_tests/cgroup_lsm_num.c b/tools/testing/selftests/bpf/prog_tests/cgroup_lsm_num.c
> new file mode 100644
> index 000000000000..1c5825c6c3d0
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/cgroup_lsm_num.c
> @@ -0,0 +1,60 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2026 Orange */
> +
> +/*
> + * Test that the kernel enforces CONFIG_CGROUP_LSM_NUM as the maximum
> + * number of concurrently used per-cgroup LSM hook slots.
> + *
> + *  - load a BPF object with 12 programs each on a distinct lsm_cgroup hook
> + *  - attach them one by one via bpf_program__attach_cgroup()
> + *  - at some point the slots are exhausted and attachment fails
> + *  - verify that 10 succeed attachment and 2 fail
> + */
> +
> +#include <test_progs.h>
> +#include <bpf/bpf.h>
> +
> +#include "cgroup_lsm_num.skel.h"
> +#include "cgroup_helpers.h"
> +
> +void test_cgroup_lsm_num(void)
> +{
> +	struct cgroup_lsm_num *skel = NULL;
> +	struct bpf_program *prog;
> +	int cgroup_fd = -1;
> +	int attached = 0;
> +	int failed = 0;
> +
> +	cgroup_fd = test__join_cgroup("/cgroup_lsm_num");
> +	if (!ASSERT_GE(cgroup_fd, 0, "join_cgroup"))
> +		return;
> +
> +	skel = cgroup_lsm_num__open_and_load();
> +	if (!ASSERT_OK_PTR(skel, "open_and_load"))
> +		goto out;
> +
> +	bpf_object__for_each_program(prog, skel->obj) {
> +		struct bpf_link *link;
> +
> +		link = bpf_program__attach_cgroup(prog, cgroup_fd);
> +		if (!link) {
> +			if (errno == EOPNOTSUPP) {
> +				test__skip();
> +				goto out;
> +			}
> +			failed++;
> +		} else {
> +			attached++;
> +		}
> +	}
> +
> +	// CONFIG_CGROUP_LSM_NUM set to 10
> +	// -> 10 programs shall be attached
> +	ASSERT_EQ(attached, 10, "at least one attached");
> +	// -> 2 programs shall be rejected
> +	ASSERT_EQ(failed, 2, "limit was enforced");
> +
> +out:
> +	close(cgroup_fd);
> +	cgroup_lsm_num__destroy(skel);
> +}
> diff --git a/tools/testing/selftests/bpf/progs/cgroup_lsm_num.c b/tools/testing/selftests/bpf/progs/cgroup_lsm_num.c
> new file mode 100644
> index 000000000000..662aee2283c2
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/cgroup_lsm_num.c
> @@ -0,0 +1,46 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2026 Orange */
> +
> +/*
> + * 12 LSM programs with lsm_cgroup attachment type, each on a distinct LSM
> + * hook. Used by prog_tests/cgroup_lsm_num.c to verify that the kernel
> + * enforces the CONFIG_CGROUP_LSM_NUM limit on unique per-cgroup LSM hook
> + * slots. With CONFIG_CGROUP_LSM_NUM set to 10, 10 shall be attached and 2
> + * rejected.
> + */
> +
> +#include "vmlinux.h"
> +#include <bpf/bpf_helpers.h>
> +#include <bpf/bpf_tracing.h>
> +
> +char _license[] SEC("license") = "GPL";
> +
> +#define LSM_CGROUP_HOOK(name, hook)		\
> +	SEC("lsm_cgroup/" #hook)		\
> +	int BPF_PROG(name) { return 1; }
> +
> +
> +LSM_CGROUP_HOOK(hook0, socket_create)
> +
> +LSM_CGROUP_HOOK(hook1, socket_post_create)
> +
> +LSM_CGROUP_HOOK(hook2, socket_socketpair)
> +
> +LSM_CGROUP_HOOK(hook3, socket_bind)
> +
> +LSM_CGROUP_HOOK(hook4, socket_connect)
> +
> +LSM_CGROUP_HOOK(hook5, socket_listen)
> +
> +LSM_CGROUP_HOOK(hook6, socket_accept)
> +
> +LSM_CGROUP_HOOK(hook7, socket_sendmsg)
> +
> +LSM_CGROUP_HOOK(hook8, socket_recvmsg)
> +
> +LSM_CGROUP_HOOK(hook9, socket_getsockname)
> +
> +LSM_CGROUP_HOOK(hook10, socket_getpeername)
> +
> +LSM_CGROUP_HOOK(hook11, socket_shutdown)

Please remove all the unnecessary newlines. One empty line after the
macro definition is enough :)

> +
> -- 
> 2.54.0
>