LXR linux/tools/testing/selftests/bpf/test_dev

   1// SPDX-License-Identifier: GPL-2.0-only
   2/* Copyright (c) 2017 Facebook
   3 */
   4
   5#include <stdio.h>
   6#include <stdlib.h>
   7#include <string.h>
   8#include <errno.h>
   9#include <assert.h>
  10#include <sys/time.h>
  11
  12#include <linux/bpf.h>
  13#include <bpf/bpf.h>
  14#include <bpf/libbpf.h>
  15
  16#include "cgroup_helpers.h"
  17#include "bpf_rlimit.h"
  18
  19#define DEV_CGROUP_PROG "./dev_cgroup.o"
  20
  21#define TEST_CGROUP "/test-bpf-based-device-cgroup/"
  22
  23int main(int argc, char **argv)
  24{
  25        struct bpf_object *obj;
  26        int error = EXIT_FAILURE;
  27        int prog_fd, cgroup_fd;
  28        __u32 prog_cnt;
  29
  30        if (bpf_prog_load(DEV_CGROUP_PROG, BPF_PROG_TYPE_CGROUP_DEVICE,
  31                          &obj, &prog_fd)) {
  32                printf("Failed to load DEV_CGROUP program\n");
  33                goto out;
  34        }
  35
  36        cgroup_fd = cgroup_setup_and_join(TEST_CGROUP);
  37        if (cgroup_fd < 0) {
  38                printf("Failed to create test cgroup\n");
  39                goto out;
  40        }
  41
  42        /* Attach bpf program */
  43        if (bpf_prog_attach(prog_fd, cgroup_fd, BPF_CGROUP_DEVICE, 0)) {
  44                printf("Failed to attach DEV_CGROUP program");
  45                goto err;
  46        }
  47
  48        if (bpf_prog_query(cgroup_fd, BPF_CGROUP_DEVICE, 0, NULL, NULL,
  49                           &prog_cnt)) {
  50                printf("Failed to query attached programs");
  51                goto err;
  52        }
  53
  54        /* All operations with /dev/zero and and /dev/urandom are allowed,
  55         * everything else is forbidden.
  56         */
  57        assert(system("rm -f /tmp/test_dev_cgroup_null") == 0);
  58        assert(system("mknod /tmp/test_dev_cgroup_null c 1 3"));
  59        assert(system("rm -f /tmp/test_dev_cgroup_null") == 0);
  60
  61        /* /dev/zero is whitelisted */
  62        assert(system("rm -f /tmp/test_dev_cgroup_zero") == 0);
  63        assert(system("mknod /tmp/test_dev_cgroup_zero c 1 5") == 0);
  64        assert(system("rm -f /tmp/test_dev_cgroup_zero") == 0);
  65
  66        assert(system("dd if=/dev/urandom of=/dev/zero count=64") == 0);
  67
  68        /* src is allowed, target is forbidden */
  69        assert(system("dd if=/dev/urandom of=/dev/full count=64"));
  70
  71        /* src is forbidden, target is allowed */
  72        assert(system("dd if=/dev/random of=/dev/zero count=64"));
  73
  74        error = 0;
  75        printf("test_dev_cgroup:PASS\n");
  76
  77err:
  78        cleanup_cgroup_environment();
  79
  80out:
  81        return error;
  82}
  83