selftests/bpf: Add tests verifying bpf lsm userns_create hook

Browse source

The LSM hook userns_create was introduced to provide LSM's an
opportunity to block or allow unprivileged user namespace creation. This
test serves two purposes: it provides a test eBPF implementation, and
tests the hook successfully blocks or allows user namespace creation.

This tests 3 cases:

        1. Unattached bpf program does not block unpriv user namespace
           creation.
        2. Attached bpf program allows user namespace creation given
           CAP_SYS_ADMIN privileges.
        3. Attached bpf program denies user namespace creation for a
           user without CAP_SYS_ADMIN.

Acked-by: KP Singh <kpsingh@kernel.org>
Signed-off-by: Frederick Lawler <fred@cloudflare.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

...

This commit is contained in:

Frederick Lawler 2022-08-15 11:20:27 -05:00 • committed by Paul Moore

parent 401e64b3a4

commit d5810139cc

2 changed files with 135 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

102

tools/testing/selftests/bpf/prog_tests/deny_namespace.c

View file

33

tools/testing/selftests/bpf/progs/test_deny_namespace.c

View file