selftests/bpf: Add test for bpftool access to read-only protected maps

Browse source

Add selftest cases that validate bpftool's expected behavior when
accessing maps protected from modification via security_bpf_map.

The test includes a BPF program attached to security_bpf_map with two maps:
- A protected map that only allows read-only access
- An unprotected map that allows full access

The test script attaches the BPF program to security_bpf_map and
verifies that for the bpftool map command:
- Read access works on both maps
- Write access fails on the protected map
- Write access succeeds on the unprotected map
- These behaviors remain consistent when the maps are pinned

Signed-off-by: Slava Imameev <slava.imameev@crowdstrike.com>
Reviewed-by: Quentin Monnet <qmo@kernel.org>
Link: https://lore.kernel.org/r/20250620151812.13952-2-slava.imameev@crowdstrike.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

...

This commit is contained in:

Slava Imameev 2025-06-21 01:18:12 +10:00 • committed by Alexei Starovoitov

parent d32179e8c2

commit f8b19aeca1

4 changed files with 490 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

tools/testing/selftests/bpf/Makefile

View file

22

tools/testing/selftests/bpf/progs/bpf_iter_map_elem.c

View file

69

tools/testing/selftests/bpf/progs/security_bpf_map.c

View file

398

tools/testing/selftests/bpf/test_bpftool_map.sh Executable file

View file