[RFC PATCH v4 00/15] Landlock LSM

Thu Mar 24 13:34:49 UTC 2022


3/24/2022 3:27 PM, Mickaël Salaün пишет:
> 
> On 23/03/2022 17:30, Konstantin Meskhidze wrote:
>>
>>
>> 3/17/2022 8:26 PM, Mickaël Salaün пишет:
>>>
>>> On 17/03/2022 14:01, Konstantin Meskhidze wrote:
>>>>
>>>>
>>>> 3/15/2022 8:02 PM, Mickaël Salaün пишет:
>>>>> Hi Konstantin,
>>>>>
>>>>> This series looks good! Thanks for the split in multiple patches.
>>>>>
>>>>   Thanks. I follow your recommendations.
>>>>>
>>>>> On 09/03/2022 14:44, Konstantin Meskhidze wrote:
>>>>>> Hi,
>>>>>> This is a new V4 bunch of RFC patches related to Landlock LSM 
>>>>>> network confinement.
>>>>>> It brings deep refactirong and commit splitting of previous 
>>>>>> version V3.
>>>>>> Also added additional selftests.
>>>>>>
>>>>>> This patch series can be applied on top of v5.17-rc3.
>>>>>>
>>>>>> All test were run in QEMU evironment and compiled with
>>>>>>   -static flag.
>>>>>>   1. network_test: 9/9 tests passed.
>>>>>
>>>>> I get a kernel warning running the network tests.
>>>>
>>>>    What kind of warning? Can you provide it please?
>>>
>>> You really need to get a setup that gives you such kernel warning. 
>>> When running network_test you should get:
>>> WARNING: CPU: 3 PID: 742 at security/landlock/ruleset.c:218 
>>> insert_rule+0x220/0x270
>>>
>>> Before sending new patches, please make sure you're able to catch 
>>> such issues.
>>>
>>>
>>>>>
>>>>>>   2. base_test: 8/8 tests passed.
>>>>>>   3. fs_test: 46/46 tests passed.
>>>>>>   4. ptrace_test: 4/8 tests passed.
>>>>>
>>>>> Does your test machine use Yama? That would explain the 4/8. You 
>>>>> can disable it with the appropriate sysctl.
>>>
>>> Can you answer this question?
>>>
>>>
>>>>>
>>>>>>
>>>>>> Tests were also launched for Landlock version without
>>>>>> v4 patch:
>>>>>>   1. base_test: 8/8 tests passed.
>>>>>>   2. fs_test: 46/46 tests passed.
>>>>>>   3. ptrace_test: 4/8 tests passed.
>>>>>>
>>>>>> Could not provide test coverage cause had problems with tests
>>>>>> on VM (no -static flag the tests compiling, no v4 patch applied):
>>>>>
>>     Hi, Mickaёl!
>>     I tried to get base test coverage without v4 patch applied.
>>
>>     1. Kernel configuration :
>>      - CONFIG_DEBUG_FS=y
>>      - CONFIG_GCOV_KERNEL=y
>>      - CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y
>>     2. Added GCOV_PROFILE := y in security/landlock/Makefile
> 
> I think this is useless because of CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y. I 
> don't add GCOV_PROFILE anyway.
> 
> 
>>     3. Compiled kernel  and rebooted VM with the new one.
>>     4. Run landlock selftests as root user:
>>      $ cd tools/testing/selftests/landlock
>>      $ ./base_test
>>      $ ./fs_test
>>      $ ./ptrace_test
>>     5. Copied GCOV data to some folder :
>>        $ cp -r 
>> /sys/kernel/debug/gcov/<source-dir>/linux/security/landlock/ /gcov-before
>>        $ cd /gcov-before
>>        $ lcov -c -d ./landlock -o lcov.info && genhtml -o html lcov.info
> 
> I do this step on my host but that should work as long as you have the 
> kernel sources in the same directory. I guess this is not the case. I 
> think you also need GCC >= 4.8 .
>    I found the reason why .gcda files were not executed :
   	"lcov -c -d ./landlock -o lcov.info && genhtml -o html lcov.info" 
was run not under ROOT user.
   Running lcov by ROOT one solved the issue. I will provide network test
   coverage in RFC patch V5.
   Thanks for help anyway.
>>
>> I got the next result:
>> " Capturing coverage data from ./landlock
>> Found gcov version: 9.4.0
>> Using intermediate gcov format
>> Scanning ./landlock for .gcda files ...
>> Found 7 data files in ./landlock
>> Processing landlock/setup.gcda
>> /home/kmeskhidze/work/src/gcov_before/landlock/setup.gcda:cannot open 
>> data file, assuming not executed
>> Processing landlock/object.gcda
>> /home/kmeskhidze/work/src/gcov_before/landlock/object.gcda:cannot open 
>> data file, assuming not executed
>> Processing landlock/cred.gcda
>> /home/kmeskhidze/work/src/gcov_before/landlock/cred.gcda:cannot open 
>> data file, assuming not executed
>> Processing landlock/ruleset.gcda
>> /home/kmeskhidze/work/src/gcov_before/landlock/ruleset.gcda:cannot 
>> open data file, assuming not executed
>> Processing landlock/syscalls.gcda
>> /home/kmeskhidze/work/src/gcov_before/landlock/syscalls.gcda:cannot 
>> open data file, assuming not executed
>> Processing landlock/fs.gcda
>> /home/kmeskhidze/work/src/gcov_before/landlock/fs.gcda:cannot open 
>> data file, assuming not executed
>> Processing landlock/ptrace.gcda
>> /home/kmeskhidze/work/src/gcov_before/landlock/ptrace.gcda:cannot open 
>> data file, assuming not executed
>> Finished .info-file creation
>> Reading data file lcov.info
>> Found 38 entries.
>> Found common filename prefix 
>> "/home/kmeskhidze/work/src/linux_5.13_landlock"
>> Writing .css and .png files.
>> Generating output.
>> Processing file arch/x86/include/asm/atomic64_64.h
>> Processing file arch/x86/include/asm/bitops.h
>> Processing file arch/x86/include/asm/atomic.h
>> Processing file arch/x86/include/asm/current.h
>> Processing file include/asm-generic/getorder.h
>> Processing file include/asm-generic/bitops/instrumented-non-atomic.h
>> Processing file include/linux/fs.h
>> Processing file include/linux/refcount.h
>> Processing file include/linux/kernel.h
>> Processing file include/linux/list.h
>> Processing file include/linux/sched.h
>> Processing file include/linux/overflow.h
>> Processing file include/linux/dcache.h
>> Processing file include/linux/spinlock.h
>> Processing file include/linux/file.h
>> Processing file include/linux/rcupdate.h
>> Processing file include/linux/err.h
>> Processing file include/linux/workqueue.h
>> Processing file include/linux/fortify-string.h
>> Processing file include/linux/slab.h
>> Processing file include/linux/instrumented.h
>> Processing file include/linux/uaccess.h
>> Processing file include/linux/thread_info.h
>> Processing file include/linux/rbtree.h
>> Processing file include/linux/log2.h
>> Processing file include/linux/atomic/atomic-instrumented.h
>> Processing file include/linux/atomic/atomic-long.h
>> Processing file security/landlock/fs.c
>> Processing file security/landlock/ruleset.h
>> Processing file security/landlock/ruleset.c
>> Processing file security/landlock/ptrace.c
>> Processing file security/landlock/object.h
>> Processing file security/landlock/syscalls.c
>> Processing file security/landlock/setup.c
>> Processing file security/landlock/cred.c
>> Processing file security/landlock/object.c
>> Processing file security/landlock/fs.h
>> Processing file security/landlock/cred.h
>> Writing directory view page.
>> Overall coverage rate:
>>    lines......: 0.0% (0 of 937 lines)
>>    functions..: 0.0% (0 of 67 functions) "
>>
>> Looks like .gcda files were not executed.
>> Maybe I did miss something. Any thoughts?
> .