[PATCH bpf-next 4/8] selftests/bpf: Test verifier filter for ksock connect on LSM attach

[Mahe Tardy <mahe.tardy@gmail.com>]

Tests that the verifier filter prevents bpf_ksock_connect() to be called
in a LSM program attached to security_socket_connect() as it would
create a direct recursion. Also checks that the other LSM hook unrelated
kfuncs can be called.

Moreover, checks that calling bpf_ksock_connect() is prevented also from
security_socket_sendmsg() as it would allow to create two BPF programs
that would call each other in a cycle through LSMs.

Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
---
 .../selftests/bpf/progs/ksock_lsm_verifier.c  | 59 +++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/ksock_lsm_verifier.c b/tools/testing/selftests/bpf/progs/ksock_lsm_verifier.c
index 740ed370d28f..7b5d118e5750 100644
--- a/tools/testing/selftests/bpf/progs/ksock_lsm_verifier.c
+++ b/tools/testing/selftests/bpf/progs/ksock_lsm_verifier.c
@@ -48,5 +48,64 @@ int BPF_PROG(socket_sendmsg_ksock_allowed, struct socket *sock,
 	return ret;
 }

+SEC("lsm.s/socket_sendmsg")
+__description("bpf_ksock_connect is rejected from socket_sendmsg LSM hook")
+__failure __msg("calling kernel function bpf_ksock_connect is not allowed")
+int BPF_PROG(socket_sendmsg_ksock_connect, struct socket *sock,
+	     struct msghdr *msg, int size, int ret)
+{
+	struct bpf_ksock *ks;
+	union bpf_ksock_addr addr = {};
+
+	ks = ksock_ctx_get();
+	if (!ks)
+		return ret;
+
+	bpf_ksock_connect(ks, &addr, sizeof(addr));
+	bpf_ksock_release(ks);
+	return ret;
+}
+
+SEC("lsm.s/socket_connect")
+__description("bpf_ksock_connect is rejected from socket_connect LSM hook")
+__failure __msg("calling kernel function bpf_ksock_connect is not allowed")
+int BPF_PROG(socket_connect_ksock_connect, struct socket *sock, struct sockaddr *address,
+	     int addrlen, int ret)
+{
+	struct __ksock_ctx_value *v;
+	union bpf_ksock_addr addr = {};
+	struct bpf_ksock *ks;
+
+	v = ksock_ctx_value_lookup();
+	if (!v)
+		return ret;
+
+	ks = bpf_kptr_xchg(&v->ctx, NULL);
+	if (!ks)
+		return ret;
+
+	bpf_ksock_connect(ks, &addr, sizeof(addr));
+	bpf_ksock_release(ks);
+
+	return ret;
+}
+
+SEC("lsm.s/socket_connect")
+__description("bpf_ksock operations other than connect are allowed from socket_connect LSM hook")
+__success
+int BPF_PROG(socket_connect_ksock_allowed, struct socket *sock,
+	     struct sockaddr *address, int addrlen, int ret)
+{
+	struct bpf_ksock *ks;
+
+	ks = ksock_ctx_get();
+	if (!ks)
+		return ret;
+
+	bpf_ksock_send(ks, send_data, sizeof(send_data));
+	bpf_ksock_release(ks);
+
+	return ret;
+}

 char __license[] SEC("license") = "GPL";
--
2.43.0