Skip to content

Commit 39a850d

Browse files
AritraDey-Devmtardy
AritraDey-Dev
authored and
mtardy
committed
tests: reject invalid tracepoint and LSM hook policies
This commit adds tests to ensure that invalid TracingPolicies for tracepoints and LSM hooks are properly rejected during the pre-validation phase, before any BPF resources get created. Signed-off-by: Aritra Dey <adey01027@gmail.com>
1 parent 498aafd commit 39a850d

2 files changed

Lines changed: 302 additions & 0 deletions

File tree

‎pkg/sensors/tracing/lsm_validation_test.go‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
// SPDX-License-Identifier: Apache-2.0
2+
// Copyright Authors of Tetragon
3+
4+
//go:build !windows
5+
6+
package tracing
7+
8+
import (
9+
"testing"
10+
11+
"github.com/stretchr/testify/require"
12+
13+
"github.com/cilium/tetragon/pkg/bpf"
14+
"github.com/cilium/tetragon/pkg/config"
15+
"github.com/cilium/tetragon/pkg/tracingpolicy"
16+
)
17+
18+
func TestLsmValidationBogusHook(t *testing.T) {
19+
if !bpf.HasLSMPrograms() || !config.EnableLargeProgs() {
20+
t.Skip("LSM programs not supported on this kernel")
21+
}
22+
23+
crd := `
24+
apiVersion: cilium.io/v1alpha1
25+
kind: TracingPolicy
26+
metadata:
27+
name: "lsm-bogus-hook"
28+
spec:
29+
lsmhooks:
30+
- hook: "bogus_nonexistent_hook_xyz"
31+
`
32+
33+
err := checkCrd(t, crd)
34+
require.Error(t, err)
35+
}
36+
37+
func TestLsmValidationEmptyHook(t *testing.T) {
38+
if !bpf.HasLSMPrograms() || !config.EnableLargeProgs() {
39+
t.Skip("LSM programs not supported on this kernel")
40+
}
41+
42+
crd := `
43+
apiVersion: cilium.io/v1alpha1
44+
kind: TracingPolicy
45+
metadata:
46+
name: "lsm-empty-hook"
47+
spec:
48+
lsmhooks:
49+
- hook: ""
50+
`
51+
52+
err := checkCrd(t, crd)
53+
require.Error(t, err)
54+
}
55+
56+
func TestLsmValidationInvalidSelector(t *testing.T) {
57+
if !bpf.HasLSMPrograms() || !config.EnableLargeProgs() {
58+
t.Skip("LSM programs not supported on this kernel")
59+
}
60+
61+
crd := `
62+
apiVersion: cilium.io/v1alpha1
63+
kind: TracingPolicy
64+
metadata:
65+
name: "lsm-bad-selector"
66+
spec:
67+
lsmhooks:
68+
- hook: "file_open"
69+
selectors:
70+
- matchReturnArgs:
71+
- index: 0
72+
operator: "Equal"
73+
values:
74+
- "0"
75+
`
76+
77+
err := checkCrd(t, crd)
78+
require.Error(t, err)
79+
}
80+
81+
func TestLsmValidationArgIndexOutOfBounds(t *testing.T) {
82+
if !bpf.HasLSMPrograms() || !config.EnableLargeProgs() {
83+
t.Skip("LSM programs not supported on this kernel")
84+
}
85+
86+
crd := `
87+
apiVersion: cilium.io/v1alpha1
88+
kind: TracingPolicy
89+
metadata:
90+
name: "lsm-arg-oob"
91+
spec:
92+
lsmhooks:
93+
- hook: "file_open"
94+
args:
95+
- index: 5
96+
type: "int"
97+
`
98+
99+
err := checkCrd(t, crd)
100+
require.Error(t, err)
101+
}
102+
103+
func TestLsmValidationInvalidArgType(t *testing.T) {
104+
if !bpf.HasLSMPrograms() || !config.EnableLargeProgs() {
105+
t.Skip("LSM programs not supported on this kernel")
106+
}
107+
108+
crd := `
109+
apiVersion: cilium.io/v1alpha1
110+
kind: TracingPolicy
111+
metadata:
112+
name: "lsm-bad-argtype"
113+
spec:
114+
lsmhooks:
115+
- hook: "file_open"
116+
args:
117+
- index: 0
118+
type: "bogus_type_xyz"
119+
`
120+
121+
_, err := tracingpolicy.FromYAML(crd)
122+
require.Error(t, err)
123+
}
124+
125+
func TestLsmValidationValidPolicy(t *testing.T) {
126+
if !bpf.HasLSMPrograms() || !config.EnableLargeProgs() {
127+
t.Skip("LSM programs not supported on this kernel")
128+
}
129+
130+
crd := `
131+
apiVersion: cilium.io/v1alpha1
132+
kind: TracingPolicy
133+
metadata:
134+
name: "lsm-valid"
135+
spec:
136+
lsmhooks:
137+
- hook: "file_open"
138+
args:
139+
- index: 0
140+
type: "file"
141+
`
142+
143+
err := checkCrd(t, crd)
144+
require.NoError(t, err)
145+
}

‎pkg/sensors/tracing/tracepoint_validation_test.go‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
// SPDX-License-Identifier: Apache-2.0
2+
// Copyright Authors of Tetragon
3+
4+
//go:build !windows
5+
6+
package tracing
7+
8+
import (
9+
"testing"
10+
11+
"github.com/stretchr/testify/require"
12+
)
13+
14+
func TestTracepointValidationWrongSubsystem(t *testing.T) {
15+
crd := `
16+
apiVersion: cilium.io/v1alpha1
17+
kind: TracingPolicy
18+
metadata:
19+
name: "tp-bogus-subsystem"
20+
spec:
21+
tracepoints:
22+
- subsystem: "bogus_subsystem"
23+
event: "bogus_event"
24+
`
25+
26+
err := checkCrd(t, crd)
27+
require.Error(t, err)
28+
}
29+
30+
func TestTracepointValidationWrongEvent(t *testing.T) {
31+
crd := `
32+
apiVersion: cilium.io/v1alpha1
33+
kind: TracingPolicy
34+
metadata:
35+
name: "tp-bogus-event"
36+
spec:
37+
tracepoints:
38+
- subsystem: "syscalls"
39+
event: "bogus_event_xyz"
40+
`
41+
42+
err := checkCrd(t, crd)
43+
require.Error(t, err)
44+
}
45+
46+
func TestTracepointValidationEmptySubsystem(t *testing.T) {
47+
crd := `
48+
apiVersion: cilium.io/v1alpha1
49+
kind: TracingPolicy
50+
metadata:
51+
name: "tp-empty-subsystem"
52+
spec:
53+
tracepoints:
54+
- subsystem: ""
55+
event: "sys_enter_openat"
56+
`
57+
58+
err := checkCrd(t, crd)
59+
require.Error(t, err)
60+
}
61+
62+
func TestTracepointValidationEmptyEvent(t *testing.T) {
63+
crd := `
64+
apiVersion: cilium.io/v1alpha1
65+
kind: TracingPolicy
66+
metadata:
67+
name: "tp-empty-event"
68+
spec:
69+
tracepoints:
70+
- subsystem: "syscalls"
71+
event: ""
72+
`
73+
74+
err := checkCrd(t, crd)
75+
require.Error(t, err)
76+
}
77+
78+
func TestTracepointValidationArgIndexOutOfBounds(t *testing.T) {
79+
crd := `
80+
apiVersion: cilium.io/v1alpha1
81+
kind: TracingPolicy
82+
metadata:
83+
name: "tp-arg-oob"
84+
spec:
85+
tracepoints:
86+
- subsystem: "syscalls"
87+
event: "sys_enter_openat"
88+
args:
89+
- index: 999
90+
type: "int"
91+
`
92+
93+
err := checkCrd(t, crd)
94+
require.Error(t, err)
95+
}
96+
97+
func TestTracepointValidationRawArgIndexOutOfBounds(t *testing.T) {
98+
crd := `
99+
apiVersion: cilium.io/v1alpha1
100+
kind: TracingPolicy
101+
metadata:
102+
name: "tp-raw-arg-oob"
103+
spec:
104+
tracepoints:
105+
- subsystem: "raw_syscalls"
106+
event: "sys_enter"
107+
raw: true
108+
args:
109+
- index: 6
110+
type: "int"
111+
`
112+
113+
err := checkCrd(t, crd)
114+
require.Error(t, err)
115+
}
116+
117+
func TestTracepointValidationValidPolicy(t *testing.T) {
118+
crd := `
119+
apiVersion: cilium.io/v1alpha1
120+
kind: TracingPolicy
121+
metadata:
122+
name: "tp-valid"
123+
spec:
124+
tracepoints:
125+
- subsystem: "raw_syscalls"
126+
event: "sys_enter"
127+
raw: true
128+
args:
129+
- index: 4
130+
type: "syscall64"
131+
`
132+
133+
err := checkCrd(t, crd)
134+
require.NoError(t, err)
135+
}
136+
137+
func TestTracepointValidationNotifyEnforcerWithoutEnforcer(t *testing.T) {
138+
crd := `
139+
apiVersion: cilium.io/v1alpha1
140+
kind: TracingPolicy
141+
metadata:
142+
name: "tp-enforcer-missing"
143+
spec:
144+
tracepoints:
145+
- subsystem: "raw_syscalls"
146+
event: "sys_enter"
147+
args:
148+
- index: 4
149+
type: "syscall64"
150+
selectors:
151+
- matchActions:
152+
- action: NotifyEnforcer
153+
`
154+
155+
err := checkCrd(t, crd)
156+
require.Error(t, err)
157+
}

0 commit comments

Comments
 (0)