target/linux/generic/backport-5.15/060-v5.18-01-bpf-selftests-Add-helpers-to-directly-use-the-capget.patch

   1 From 5287acc6f097c0c18e54401b611a877a3083b68c Mon Sep 17 00:00:00 2001
   2 From: Martin KaFai Lau <kafai@fb.com>
   3 Date: Wed, 16 Mar 2022 10:38:23 -0700
   4 Subject: [PATCH 1/3] bpf: selftests: Add helpers to directly use the capget
   5  and capset syscall
   6
   7 After upgrading to the newer libcap (>= 2.60),
   8 the libcap commit aca076443591 ("Make cap_t operations thread safe.")
   9 added a "__u8 mutex;" to the "struct _cap_struct".  It caused a few byte
  10 shift that breaks the assumption made in the "struct libcap" definition
  11 in test_verifier.c.
  12
  13 The bpf selftest usage only needs to enable and disable the effective
  14 caps of the running task.  It is easier to directly syscall the
  15 capget and capset instead.  It can also remove the libcap
  16 library dependency.
  17
  18 The cap_helpers.{c,h} is added.  One __u64 is used for all CAP_*
  19 bits instead of two __u32.
  20
  21 Signed-off-by: Martin KaFai Lau <kafai@fb.com>
  22 Signed-off-by: Alexei Starovoitov <ast@kernel.org>
  23 Acked-by: John Fastabend <john.fastabend@gmail.com>
  24 Link: https://lore.kernel.org/bpf/20220316173823.2036955-1-kafai@fb.com
  25 ---
  26  tools/testing/selftests/bpf/cap_helpers.c | 67 +++++++++++++++++++++++
  27  tools/testing/selftests/bpf/cap_helpers.h | 19 +++++++
  28  2 files changed, 86 insertions(+)
  29  create mode 100644 tools/testing/selftests/bpf/cap_helpers.c
  30  create mode 100644 tools/testing/selftests/bpf/cap_helpers.h
  31
  32 --- /dev/null
  33 +++ b/tools/testing/selftests/bpf/cap_helpers.c
  34 @@ -0,0 +1,67 @@
  35 +// SPDX-License-Identifier: GPL-2.0
  36 +#include "cap_helpers.h"
  37 +
  38 +/* Avoid including <sys/capability.h> from the libcap-devel package,
  39 + * so directly declare them here and use them from glibc.
  40 + */
  41 +int capget(cap_user_header_t header, cap_user_data_t data);
  42 +int capset(cap_user_header_t header, const cap_user_data_t data);
  43 +
  44 +int cap_enable_effective(__u64 caps, __u64 *old_caps)
  45 +{
  46 +       struct __user_cap_data_struct data[_LINUX_CAPABILITY_U32S_3];
  47 +       struct __user_cap_header_struct hdr = {
  48 +               .version = _LINUX_CAPABILITY_VERSION_3,
  49 +       };
  50 +       __u32 cap0 = caps;
  51 +       __u32 cap1 = caps >> 32;
  52 +       int err;
  53 +
  54 +       err = capget(&hdr, data);
  55 +       if (err)
  56 +               return err;
  57 +
  58 +       if (old_caps)
  59 +               *old_caps = (__u64)(data[1].effective) << 32 | data[0].effective;
  60 +
  61 +       if ((data[0].effective & cap0) == cap0 &&
  62 +           (data[1].effective & cap1) == cap1)
  63 +               return 0;
  64 +
  65 +       data[0].effective |= cap0;
  66 +       data[1].effective |= cap1;
  67 +       err = capset(&hdr, data);
  68 +       if (err)
  69 +               return err;
  70 +
  71 +       return 0;
  72 +}
  73 +
  74 +int cap_disable_effective(__u64 caps, __u64 *old_caps)
  75 +{
  76 +       struct __user_cap_data_struct data[_LINUX_CAPABILITY_U32S_3];
  77 +       struct __user_cap_header_struct hdr = {
  78 +               .version = _LINUX_CAPABILITY_VERSION_3,
  79 +       };
  80 +       __u32 cap0 = caps;
  81 +       __u32 cap1 = caps >> 32;
  82 +       int err;
  83 +
  84 +       err = capget(&hdr, data);
  85 +       if (err)
  86 +               return err;
  87 +
  88 +       if (old_caps)
  89 +               *old_caps = (__u64)(data[1].effective) << 32 | data[0].effective;
  90 +
  91 +       if (!(data[0].effective & cap0) && !(data[1].effective & cap1))
  92 +               return 0;
  93 +
  94 +       data[0].effective &= ~cap0;
  95 +       data[1].effective &= ~cap1;
  96 +       err = capset(&hdr, data);
  97 +       if (err)
  98 +               return err;
  99 +
 100 +       return 0;
 101 +}
 102 --- /dev/null
 103 +++ b/tools/testing/selftests/bpf/cap_helpers.h
 104 @@ -0,0 +1,19 @@
 105 +/* SPDX-License-Identifier: GPL-2.0 */
 106 +#ifndef __CAP_HELPERS_H
 107 +#define __CAP_HELPERS_H
 108 +
 109 +#include <linux/types.h>
 110 +#include <linux/capability.h>
 111 +
 112 +#ifndef CAP_PERFMON
 113 +#define CAP_PERFMON            38
 114 +#endif
 115 +
 116 +#ifndef CAP_BPF
 117 +#define CAP_BPF                        39
 118 +#endif
 119 +
 120 +int cap_enable_effective(__u64 caps, __u64 *old_caps);
 121 +int cap_disable_effective(__u64 caps, __u64 *old_caps);
 122 +
 123 +#endif