From patchwork Wed Jul 10 18:00:23 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Javier Honduvilla Coto X-Patchwork-Id: 1130523 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=fb.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=fb.com header.i=@fb.com header.b="g2DoiuZ+"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45kRmt6rwWz9s4Y for ; Thu, 11 Jul 2019 04:00:30 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728095AbfGJSA3 (ORCPT ); Wed, 10 Jul 2019 14:00:29 -0400 Received: from mx0a-00082601.pphosted.com ([67.231.145.42]:35052 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727691AbfGJSA3 (ORCPT ); Wed, 10 Jul 2019 14:00:29 -0400 Received: from pps.filterd (m0044010.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x6AHxnPS000502 for ; Wed, 10 Jul 2019 11:00:28 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-type; s=facebook; bh=dCDtpmdoOXH4SykdUSimSmMPCLojngDnYnct4jVmayo=; b=g2DoiuZ+X1dH5elFfUGqqD7hQQZSdbvbTdmTmcN8B9PVocuBTLhY4mnEtThxT5BrYStC AD/qt1SluhDI6FE6q80dkcqx6MeXEfrJQaOkB8eqh2WooaOgUuOrME2tIfcZ0qMuRXGU QjQA7JYd1H0688xbQJXEknZpprKI5ZV3k24= Received: from maileast.thefacebook.com ([163.114.130.16]) by mx0a-00082601.pphosted.com with ESMTP id 2tnkgm0x60-4 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Wed, 10 Jul 2019 11:00:27 -0700 Received: from mx-out.facebook.com (2620:10d:c0a8:1b::d) by mail.thefacebook.com (2620:10d:c0a8:83::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Wed, 10 Jul 2019 11:00:25 -0700 Received: by devvm424.lla2.facebook.com (Postfix, from userid 134475) id CE85D11FAA300; Wed, 10 Jul 2019 11:00:25 -0700 (PDT) Smtp-Origin-Hostprefix: devvm From: Javier Honduvilla Coto Smtp-Origin-Hostname: devvm424.lla2.facebook.com To: CC: , , Smtp-Origin-Cluster: lla2c09 Subject: [PATCH v6 bpf-next 1/3] bpf: add bpf_descendant_of helper Date: Wed, 10 Jul 2019 11:00:23 -0700 Message-ID: <20190710180025.94726-2-javierhonduco@fb.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190710180025.94726-1-javierhonduco@fb.com> References: <20190410203631.1576576-1-javierhonduco@fb.com> <20190710180025.94726-1-javierhonduco@fb.com> X-FB-Internal: Safe MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-10_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=fb_default_notspam policy=fb_default score=0 priorityscore=1501 malwarescore=0 suspectscore=1 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1907100203 X-FB-Internal: deliver Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This patch adds the bpf_descendant_of helper which accepts a PID and returns 1 if the PID of the process currently being executed is a descendant of it or if it's itself. Returns 0 otherwise. The passed PID should be the one as seen from the "global" pid namespace as the processes' PIDs in the hierarchy are resolved using the context of said initial namespace. This is very useful in tracing programs when we want to filter by a given PID and all the children it might spawn. The current workarounds most people implement for this purpose have issues: - Attaching to process spawning syscalls and dynamically add those PIDs to some bpf map that would be used to filter is cumbersome and potentially racy. - Unrolling some loop to perform what this helper is doing consumes lots of instructions. That and the impossibility to jump backwards makes it really hard to be correct in really large process chains. Signed-off-by: Javier Honduvilla Coto --- include/linux/bpf.h | 1 + include/uapi/linux/bpf.h | 20 +++++++++++++++++++- kernel/bpf/core.c | 1 + kernel/bpf/helpers.c | 27 +++++++++++++++++++++++++++ kernel/trace/bpf_trace.c | 2 ++ 5 files changed, 50 insertions(+), 1 deletion(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 18f4cc2c6acd..4e861138887d 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1053,6 +1053,7 @@ extern const struct bpf_func_proto bpf_get_local_storage_proto; extern const struct bpf_func_proto bpf_strtol_proto; extern const struct bpf_func_proto bpf_strtoul_proto; extern const struct bpf_func_proto bpf_tcp_sock_proto; +extern const struct bpf_func_proto bpf_descendant_of_proto; /* Shared helpers among cBPF and eBPF. */ void bpf_user_rnd_init_once(void); diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 5695ab53e354..7e8c2bd654f5 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -2713,6 +2713,23 @@ union bpf_attr { * **-EPERM** if no permission to send the *sig*. * * **-EAGAIN** if bpf program can try again. + * + * int bpf_descendant_of(pid_t pid) + * Description + * Determine if the process identified by *pid* is an ancestor + * (or equal) of the user process executed in this tracing + * context. This is useful when filtering events happening + * to a process and all of its descendants. + * + * Note that *pid* must be the pid from the global namespace + * as the pids of the process chain will be resolved using the + * initial pid namespace viewer context. + * Return + * * 1 if the process identified by *pid* is an ancestor, or equal, + * of the currently executing process within the global pid + * namespace + * + * * 0 otherwise. */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -2824,7 +2841,8 @@ union bpf_attr { FN(strtoul), \ FN(sk_storage_get), \ FN(sk_storage_delete), \ - FN(send_signal), + FN(send_signal), \ + FN(descendant_of), /* integer value in 'imm' field of BPF_CALL instruction selects which helper * function eBPF program intends to call diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 16079550db6d..8f7f0ec8cded 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2039,6 +2039,7 @@ const struct bpf_func_proto bpf_get_current_uid_gid_proto __weak; const struct bpf_func_proto bpf_get_current_comm_proto __weak; const struct bpf_func_proto bpf_get_current_cgroup_id_proto __weak; const struct bpf_func_proto bpf_get_local_storage_proto __weak; +const struct bpf_func_proto bpf_descendant_of_proto __weak; const struct bpf_func_proto * __weak bpf_get_trace_printk_proto(void) { diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index 5e28718928ca..2214194e5f49 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -11,6 +11,7 @@ #include #include #include +#include #include "../../lib/kstrtox.h" @@ -487,3 +488,29 @@ const struct bpf_func_proto bpf_strtoul_proto = { .arg4_type = ARG_PTR_TO_LONG, }; #endif + +BPF_CALL_1(bpf_descendant_of, pid_t, pid) +{ + int result = 0; + struct task_struct *task = current; + + if (pid == 0) + return 1; + + while (task != &init_task) { + if (task->pid == pid) { + result = 1; + break; + } + task = rcu_dereference(task->real_parent); + } + + return result; +} + +const struct bpf_func_proto bpf_descendant_of_proto = { + .func = bpf_descendant_of, + .gpl_only = false, + .ret_type = RET_INTEGER, + .arg1_type = ARG_ANYTHING, +}; diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index ca1255d14576..797d7b4a8e9a 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -703,6 +703,8 @@ tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) return &bpf_get_prandom_u32_proto; case BPF_FUNC_probe_read_str: return &bpf_probe_read_str_proto; + case BPF_FUNC_descendant_of: + return &bpf_descendant_of_proto; #ifdef CONFIG_CGROUPS case BPF_FUNC_get_current_cgroup_id: return &bpf_get_current_cgroup_id_proto; From patchwork Wed Jul 10 18:00:24 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Javier Honduvilla Coto X-Patchwork-Id: 1130524 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=fb.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=fb.com header.i=@fb.com header.b="nzZg9BxR"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45kRmy41Qvz9s4Y for ; Thu, 11 Jul 2019 04:00:34 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728180AbfGJSAc (ORCPT ); Wed, 10 Jul 2019 14:00:32 -0400 Received: from mx0a-00082601.pphosted.com ([67.231.145.42]:33594 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727697AbfGJSAa (ORCPT ); Wed, 10 Jul 2019 14:00:30 -0400 Received: from pps.filterd (m0109334.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x6AHwHag014885 for ; Wed, 10 Jul 2019 11:00:29 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-type; s=facebook; bh=5FHhKB44YPugc3jIrj5xLrQSCWsm8IgFUhUwzhBR2+c=; b=nzZg9BxRed5i/hdo7azJJfGdNckvqXgpc1Ac1ksVdKw8i6kSQhQ/uy1gG4eiGBh9RSHL fnKsayCosDPNN8m/u7oL9uhsKm2XYiwSQVkYWrByZK7AdDtnzWb/RJcsbW9Nf/xwqQmJ Td4+TAsuT8YaadTUX8zqQxciBAd4Cezh9SQ= Received: from maileast.thefacebook.com ([163.114.130.16]) by mx0a-00082601.pphosted.com with ESMTP id 2tnhfc1jdx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Wed, 10 Jul 2019 11:00:29 -0700 Received: from mx-out.facebook.com (2620:10d:c0a8:1b::d) by mail.thefacebook.com (2620:10d:c0a8:83::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Wed, 10 Jul 2019 11:00:27 -0700 Received: by devvm424.lla2.facebook.com (Postfix, from userid 134475) id D333A11FAA302; Wed, 10 Jul 2019 11:00:25 -0700 (PDT) Smtp-Origin-Hostprefix: devvm From: Javier Honduvilla Coto Smtp-Origin-Hostname: devvm424.lla2.facebook.com To: CC: , , Smtp-Origin-Cluster: lla2c09 Subject: [PATCH v6 bpf-next 2/3] bpf: sync kernel uapi headers Date: Wed, 10 Jul 2019 11:00:24 -0700 Message-ID: <20190710180025.94726-3-javierhonduco@fb.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190710180025.94726-1-javierhonduco@fb.com> References: <20190410203631.1576576-1-javierhonduco@fb.com> <20190710180025.94726-1-javierhonduco@fb.com> X-FB-Internal: Safe MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-10_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=fb_default_notspam policy=fb_default score=0 priorityscore=1501 malwarescore=0 suspectscore=1 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1907100203 X-FB-Internal: deliver Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Sync kernel uapi headers. Signed-off-by: Javier Honduvilla Coto --- tools/include/uapi/linux/bpf.h | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 402208581b2d..505ee91898c2 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -2710,6 +2710,23 @@ union bpf_attr { * **-EPERM** if no permission to send the *sig*. * * **-EAGAIN** if bpf program can try again. + * + * int bpf_descendant_of(pid_t pid) + * Description + * Determine if the process identified by *pid* is an ancestor + * (or equal) of the user process executed in this tracing + * context. This is useful when filtering events happening + * to a process and all of its descendants. + * + * Note that *pid* must be the pid from the global namespace + * as the pids of the process chain will be resolved using the + * initial pid namespace viewer context. + * Return + * * 1 if the process identified by *pid* is an ancestor, or equal, + * of the currently executing process within the global pid + * namespace + * + * * 0 otherwise. */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -2821,7 +2838,8 @@ union bpf_attr { FN(strtoul), \ FN(sk_storage_get), \ FN(sk_storage_delete), \ - FN(send_signal), + FN(send_signal), \ + FN(descendant_of), /* integer value in 'imm' field of BPF_CALL instruction selects which helper * function eBPF program intends to call From patchwork Wed Jul 10 18:00:25 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Javier Honduvilla Coto X-Patchwork-Id: 1130525 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=fb.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=fb.com header.i=@fb.com header.b="XMhi3ivE"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45kRmz0gZ5z9sBF for ; Thu, 11 Jul 2019 04:00:35 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728109AbfGJSAc (ORCPT ); Wed, 10 Jul 2019 14:00:32 -0400 Received: from mx0b-00082601.pphosted.com ([67.231.153.30]:43488 "EHLO mx0b-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727546AbfGJSAa (ORCPT ); Wed, 10 Jul 2019 14:00:30 -0400 Received: from pps.filterd (m0148460.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x6AHwsA7001508 for ; Wed, 10 Jul 2019 11:00:27 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-type; s=facebook; bh=6WEzr//yaDglSJhUOKkjNMmHDEmGgaj3M7ezL/S0PGM=; b=XMhi3ivE86qgix1yKqGYD2IVERtcjFjHAf1jFDsfnrsuY4NJumrzOw4Dx9GkMirG5gLn iw/3qpJu4fbpeyWCyR7wnR1gCvVgXKBsb6gzzUcIOyqq/CDWVyWsENDE7vWrRSGlt53J 8/UD9jRD7mR/5tw1TnxA9x5aKkOrVZrfKPY= Received: from maileast.thefacebook.com ([163.114.130.16]) by mx0a-00082601.pphosted.com with ESMTP id 2tnj4ts8um-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Wed, 10 Jul 2019 11:00:27 -0700 Received: from mx-out.facebook.com (2620:10d:c0a8:1b::d) by mail.thefacebook.com (2620:10d:c0a8:82::d) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Wed, 10 Jul 2019 11:00:26 -0700 Received: by devvm424.lla2.facebook.com (Postfix, from userid 134475) id D791111FAA304; Wed, 10 Jul 2019 11:00:25 -0700 (PDT) Smtp-Origin-Hostprefix: devvm From: Javier Honduvilla Coto Smtp-Origin-Hostname: devvm424.lla2.facebook.com To: CC: , , Smtp-Origin-Cluster: lla2c09 Subject: [PATCH v6 bpf-next 3/3] bpf: add tests for bpf_descendant_of Date: Wed, 10 Jul 2019 11:00:25 -0700 Message-ID: <20190710180025.94726-4-javierhonduco@fb.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190710180025.94726-1-javierhonduco@fb.com> References: <20190410203631.1576576-1-javierhonduco@fb.com> <20190710180025.94726-1-javierhonduco@fb.com> X-FB-Internal: Safe MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-10_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=fb_default_notspam policy=fb_default score=0 priorityscore=1501 malwarescore=0 suspectscore=1 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1907100203 X-FB-Internal: deliver Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Adding the following test cases: - bpf_descendant_of(current->pid) == 1 - bpf_descendant_of(current->real_parent->pid) == 1 - bpf_descendant_of(1) == 1 - bpf_descendant_of(0) == 1 - bpf_descendant_of(-1) == 0 - bpf_descendant_of(current->children[0]->pid) == 0 Signed-off-by: Javier Honduvilla Coto --- tools/testing/selftests/bpf/.gitignore | 1 + tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/bpf_helpers.h | 3 + .../bpf/progs/test_descendant_of_kern.c | 43 +++ .../selftests/bpf/test_descendant_of_user.c | 266 ++++++++++++++++++ 5 files changed, 314 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/bpf/progs/test_descendant_of_kern.c create mode 100644 tools/testing/selftests/bpf/test_descendant_of_user.c diff --git a/tools/testing/selftests/bpf/.gitignore b/tools/testing/selftests/bpf/.gitignore index 90f70d2c7c22..4b63d7105ba2 100644 --- a/tools/testing/selftests/bpf/.gitignore +++ b/tools/testing/selftests/bpf/.gitignore @@ -43,3 +43,4 @@ test_sockopt test_sockopt_sk test_sockopt_multi test_tcp_rtt +test_descendant_of_user diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index 2620406a53ec..b3dc1e26c41c 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -27,7 +27,7 @@ TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map test test_cgroup_storage test_select_reuseport test_section_names \ test_netcnt test_tcpnotify_user test_sock_fields test_sysctl test_hashmap \ test_btf_dump test_cgroup_attach xdping test_sockopt test_sockopt_sk \ - test_sockopt_multi test_tcp_rtt + test_sockopt_multi test_tcp_rtt test_descendant_of_user BPF_OBJ_FILES = $(patsubst %.c,%.o, $(notdir $(wildcard progs/*.c))) TEST_GEN_FILES = $(BPF_OBJ_FILES) diff --git a/tools/testing/selftests/bpf/bpf_helpers.h b/tools/testing/selftests/bpf/bpf_helpers.h index 5a3d92c8bec8..7525783ffbc9 100644 --- a/tools/testing/selftests/bpf/bpf_helpers.h +++ b/tools/testing/selftests/bpf/bpf_helpers.h @@ -1,4 +1,6 @@ /* SPDX-License-Identifier: GPL-2.0 */ +#include + #ifndef __BPF_HELPERS_H #define __BPF_HELPERS_H @@ -228,6 +230,7 @@ static void *(*bpf_sk_storage_get)(void *map, struct bpf_sock *sk, static int (*bpf_sk_storage_delete)(void *map, struct bpf_sock *sk) = (void *)BPF_FUNC_sk_storage_delete; static int (*bpf_send_signal)(unsigned sig) = (void *)BPF_FUNC_send_signal; +static int (*bpf_descendant_of)(pid_t pid) = (void *) BPF_FUNC_descendant_of; /* llvm builtin functions that eBPF C program may use to * emit BPF_LD_ABS and BPF_LD_IND instructions diff --git a/tools/testing/selftests/bpf/progs/test_descendant_of_kern.c b/tools/testing/selftests/bpf/progs/test_descendant_of_kern.c new file mode 100644 index 000000000000..802e01595527 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/test_descendant_of_kern.c @@ -0,0 +1,43 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include +#include "bpf_helpers.h" + +struct bpf_map_def SEC("maps") pidmap = { + .type = BPF_MAP_TYPE_ARRAY, + .key_size = sizeof(__u32), + .value_size = sizeof(__u32), + .max_entries = 2, +}; + +struct bpf_map_def SEC("maps") resultmap = { + .type = BPF_MAP_TYPE_ARRAY, + .key_size = sizeof(__u32), + .value_size = sizeof(__u32), + .max_entries = 1, +}; + +SEC("tracepoint/syscalls/sys_enter_open") +int trace(void *ctx) +{ + __u32 pid = bpf_get_current_pid_tgid(); + __u32 current_key = 0, ancestor_key = 1, *expected_pid, *ancestor_pid; + __u32 *val; + + expected_pid = bpf_map_lookup_elem(&pidmap, ¤t_key); + if (!expected_pid || *expected_pid != pid) + return 0; + + ancestor_pid = bpf_map_lookup_elem(&pidmap, &ancestor_key); + if (!ancestor_pid) + return 0; + + val = bpf_map_lookup_elem(&resultmap, ¤t_key); + if (val) + *val = bpf_descendant_of(*ancestor_pid); + + return 0; +} + +char _license[] SEC("license") = "GPL"; +__u32 _version SEC("version") = 1; diff --git a/tools/testing/selftests/bpf/test_descendant_of_user.c b/tools/testing/selftests/bpf/test_descendant_of_user.c new file mode 100644 index 000000000000..f616c8c976a4 --- /dev/null +++ b/tools/testing/selftests/bpf/test_descendant_of_user.c @@ -0,0 +1,266 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include + +#define CHECK(condition, tag, format...) \ + ({ \ + int __ret = !!(condition); \ + if (__ret) { \ + printf("%s:FAIL:%s ", __func__, tag); \ + printf(format); \ + } else { \ + printf("%s:PASS:%s\n", __func__, tag); \ + } \ + __ret; \ + }) + +static int bpf_find_map(const char *test, struct bpf_object *obj, + const char *name) +{ + struct bpf_map *map; + + map = bpf_object__find_map_by_name(obj, name); + if (!map) + return -1; + return bpf_map__fd(map); +} + +int main(int argc, char **argv) +{ + const char *probe_name = "syscalls/sys_enter_open"; + const char *file = "test_descendant_of_kern.o"; + int err, bytes, efd, prog_fd, pmu_fd; + int resultmap_fd, pidmap_fd; + struct perf_event_attr attr = {}; + struct bpf_object *obj; + __u32 descendant_of_result = 0; + __u32 key = 0, pid; + int exit_code = EXIT_FAILURE; + char buf[256]; + + int child_pid, ancestor_pid, root_fd, nonexistant = -42; + __u32 ancestor_key = 1; + int pipefd[2]; + char marker[1]; + + err = bpf_prog_load(file, BPF_PROG_TYPE_TRACEPOINT, &obj, &prog_fd); + if (CHECK(err, "bpf_prog_load", "err %d errno %d\n", err, errno)) + goto fail; + + resultmap_fd = bpf_find_map(__func__, obj, "resultmap"); + if (CHECK(resultmap_fd < 0, "bpf_find_map", "err %d errno %d\n", + resultmap_fd, errno)) + goto close_prog; + + pidmap_fd = bpf_find_map(__func__, obj, "pidmap"); + if (CHECK(pidmap_fd < 0, "bpf_find_map", "err %d errno %d\n", pidmap_fd, + errno)) + goto close_prog; + + pid = getpid(); + bpf_map_update_elem(pidmap_fd, &key, &pid, 0); + bpf_map_update_elem(pidmap_fd, &ancestor_key, &pid, 0); + + snprintf(buf, sizeof(buf), "/sys/kernel/debug/tracing/events/%s/id", + probe_name); + efd = open(buf, O_RDONLY, 0); + if (CHECK(efd < 0, "open", "err %d errno %d\n", efd, errno)) + goto close_prog; + bytes = read(efd, buf, sizeof(buf)); + close(efd); + if (CHECK(bytes <= 0 || bytes >= sizeof(buf), "read", + "bytes %d errno %d\n", bytes, errno)) + goto close_prog; + + attr.config = strtol(buf, NULL, 0); + attr.type = PERF_TYPE_TRACEPOINT; + attr.sample_type = PERF_SAMPLE_RAW; + attr.sample_period = 1; + attr.wakeup_events = 1; + + pmu_fd = syscall(__NR_perf_event_open, &attr, getpid(), -1, -1, 0); + if (CHECK(pmu_fd < 0, "perf_event_open", "err %d errno %d\n", pmu_fd, + errno)) + goto close_prog; + + err = ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0); + if (CHECK(err, "perf_event_ioc_enable", "err %d errno %d\n", err, + errno)) + goto close_pmu; + + err = ioctl(pmu_fd, PERF_EVENT_IOC_SET_BPF, prog_fd); + if (CHECK(err, "perf_event_ioc_set_bpf", "err %d errno %d\n", err, + errno)) + goto close_pmu; + + // Test that descendant_of(current->pid) is true + bpf_map_update_elem(pidmap_fd, &key, &pid, 0); + bpf_map_update_elem(pidmap_fd, &ancestor_key, &pid, 0); + bpf_map_update_elem(resultmap_fd, &key, &nonexistant, 0); + + root_fd = open("/", O_RDONLY); + if (CHECK(efd < 0, "open", "errno %d\n", errno)) + goto close_prog; + close(root_fd); + + err = bpf_map_lookup_elem(resultmap_fd, &key, &descendant_of_result); + if (CHECK(err, "bpf_map_lookup_elem", "err %d errno %d\n", err, errno)) + goto close_pmu; + if (CHECK(descendant_of_result != 1, + "descendant_of is true with same pid", "%d == %d\n", + descendant_of_result, 1)) + goto close_pmu; + + // Test that PID 1 an ancestor + bpf_map_update_elem(pidmap_fd, &key, &pid, 0); + ancestor_pid = 1; + bpf_map_update_elem(pidmap_fd, &ancestor_key, &ancestor_pid, 0); + bpf_map_update_elem(resultmap_fd, &key, &nonexistant, 0); + + root_fd = open("/", O_RDONLY); + if (CHECK(efd < 0, "open", "errno %d\n", errno)) + goto close_prog; + close(root_fd); + + err = bpf_map_lookup_elem(resultmap_fd, &key, &descendant_of_result); + if (CHECK(err, "bpf_map_lookup_elem", "err %d errno %d\n", err, errno)) + goto close_pmu; + if (CHECK(descendant_of_result != 1, "descendant_of reaches init", + "%d == %d\n", descendant_of_result, 1)) + goto close_pmu; + + // Test that PID 0 is an ancestor + bpf_map_update_elem(pidmap_fd, &key, &pid, 0); + ancestor_pid = 0; + bpf_map_update_elem(pidmap_fd, &ancestor_key, &ancestor_pid, 0); + bpf_map_update_elem(resultmap_fd, &key, &nonexistant, 0); + + root_fd = open("/", O_RDONLY); + if (CHECK(efd < 0, "open", "errno %d\n", errno)) + goto close_prog; + close(root_fd); + + err = bpf_map_lookup_elem(resultmap_fd, &key, &descendant_of_result); + if (CHECK(err, "bpf_map_lookup_elem", "err %d errno %d\n", err, errno)) + goto close_pmu; + if (CHECK(descendant_of_result != 1, "PID 0 is our ancestor", + "%d == %d\n", descendant_of_result, 1)) + goto close_pmu; + + // Test that we don't go over PID 0 + bpf_map_update_elem(pidmap_fd, &key, &pid, 0); + ancestor_pid = -1; + bpf_map_update_elem(pidmap_fd, &ancestor_key, &ancestor_pid, 0); + bpf_map_update_elem(resultmap_fd, &key, &nonexistant, 0); + + root_fd = open("/", O_RDONLY); + if (CHECK(efd < 0, "open", "errno %d\n", errno)) + goto close_prog; + close(root_fd); + + err = bpf_map_lookup_elem(resultmap_fd, &key, &descendant_of_result); + if (CHECK(err, "bpf_map_lookup_elem", "err %d errno %d\n", err, errno)) + goto close_pmu; + if (CHECK(descendant_of_result != 0, + "descendant_of does not go over PID 0", "%d == %d\n", + descendant_of_result, 0)) + goto close_pmu; + + // Test that we are an ancestor of our child + pipe(pipefd); + child_pid = fork(); + if (child_pid == -1) { + printf("fork failed\n"); + goto close_pmu; + } else if (child_pid == 0) { + close(pipefd[1]); + read(pipefd[0], &marker, 1); + + root_fd = open("/", O_RDONLY); + if (CHECK(efd < 0, "open", "errno %d\n", errno)) + goto close_prog; + close(root_fd); + + close(pipefd[0]); + _exit(EXIT_SUCCESS); + } else { + close(pipefd[0]); + bpf_map_update_elem(resultmap_fd, &key, &nonexistant, 0); + bpf_map_update_elem(pidmap_fd, &key, &child_pid, 0); + bpf_map_update_elem(pidmap_fd, &ancestor_key, &pid, 0); + + write(pipefd[1], &marker, 1); + wait(NULL); + close(pipefd[1]); + + err = bpf_map_lookup_elem(resultmap_fd, &key, + &descendant_of_result); + if (CHECK(err, "bpf_map_lookup_elem", "err %d errno %d\n", err, + errno)) + goto close_pmu; + if (CHECK(descendant_of_result != 1, "descendant_of of parent", + "%d == %d\n", descendant_of_result, 1)) + goto close_pmu; + } + + // Test that a child of ours doesn't belong to our ancestors + bpf_map_update_elem(pidmap_fd, &key, &pid, 0); + bpf_map_update_elem(resultmap_fd, &key, &nonexistant, 0); + + pipe(pipefd); + child_pid = fork(); + if (child_pid == -1) { + printf("fork failed\n"); + goto close_pmu; + } else if (child_pid == 0) { + close(pipefd[1]); + read(pipefd[0], marker, 1); + close(pipefd[0]); + _exit(EXIT_SUCCESS); + } else { + close(pipefd[0]); + + bpf_map_update_elem(pidmap_fd, &ancestor_key, &child_pid, 0); + + root_fd = open("/", O_RDONLY); + if (CHECK(efd < 0, "open", "errno %d\n", errno)) + goto close_prog; + close(root_fd); + + write(pipefd[1], marker, 1); + wait(NULL); + close(pipefd[1]); + + err = bpf_map_lookup_elem(resultmap_fd, &key, + &descendant_of_result); + if (CHECK(err, "bpf_map_lookup_elem", "err %d errno %d\n", err, + errno)) + goto close_pmu; + if (CHECK(descendant_of_result != 0, "descendant_of of child", + "%d == %d\n", descendant_of_result, 0)) + goto close_pmu; + } + + exit_code = EXIT_SUCCESS; + printf("%s:PASS\n", argv[0]); + +close_pmu: + close(pmu_fd); +close_prog: + bpf_object__close(obj); +fail: + return exit_code; +}