Skip to content

Commit 85be55e

Browse files
AritraDey-DevAritraDey-Dev
committed
tests: reject invalid tracepoint and LSM hook policies
This commit adds tests to ensure that invalid TracingPolicies for tracepoints and LSM hooks are properly rejected during the pre-validation phase, before any BPF resources get created. Signed-off-by: Aritra Dey <adey01027@gmail.com>
1 parent dd69889 commit 85be55e

2 files changed

Lines changed: 316 additions & 0 deletions

File tree

‎pkg/sensors/tracing/lsm_validation_test.go‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
// SPDX-License-Identifier: Apache-2.0
2+
// Copyright Authors of Tetragon
3+
4+
//go:build !windows
5+
6+
package tracing
7+
8+
import (
9+
"testing"
10+
11+
"github.com/stretchr/testify/require"
12+
13+
"github.com/cilium/tetragon/pkg/bpf"
14+
"github.com/cilium/tetragon/pkg/config"
15+
"github.com/cilium/tetragon/pkg/tracingpolicy"
16+
)
17+
18+
func TestLsmValidationBogusHook(t *testing.T) {
19+
20+
if !bpf.HasLSMPrograms() || !config.EnableLargeProgs() {
21+
t.Skip("LSM programs not supported on this kernel")
22+
}
23+
24+
crd := `
25+
apiVersion: cilium.io/v1alpha1
26+
kind: TracingPolicy
27+
metadata:
28+
name: "lsm-bogus-hook"
29+
spec:
30+
lsmhooks:
31+
- hook: "bogus_nonexistent_hook_xyz"
32+
`
33+
34+
err := checkCrd(t, crd)
35+
require.Error(t, err)
36+
}
37+
38+
func TestLsmValidationEmptyHook(t *testing.T) {
39+
40+
if !bpf.HasLSMPrograms() || !config.EnableLargeProgs() {
41+
t.Skip("LSM programs not supported on this kernel")
42+
}
43+
44+
crd := `
45+
apiVersion: cilium.io/v1alpha1
46+
kind: TracingPolicy
47+
metadata:
48+
name: "lsm-empty-hook"
49+
spec:
50+
lsmhooks:
51+
- hook: ""
52+
`
53+
54+
err := checkCrd(t, crd)
55+
require.Error(t, err)
56+
}
57+
58+
func TestLsmValidationInvalidSelector(t *testing.T) {
59+
60+
if !bpf.HasLSMPrograms() || !config.EnableLargeProgs() {
61+
t.Skip("LSM programs not supported on this kernel")
62+
}
63+
64+
crd := `
65+
apiVersion: cilium.io/v1alpha1
66+
kind: TracingPolicy
67+
metadata:
68+
name: "lsm-bad-selector"
69+
spec:
70+
lsmhooks:
71+
- hook: "file_open"
72+
selectors:
73+
- matchReturnArgs:
74+
- index: 0
75+
operator: "Equal"
76+
values:
77+
- "0"
78+
`
79+
80+
err := checkCrd(t, crd)
81+
require.Error(t, err)
82+
}
83+
84+
func TestLsmValidationArgIndexOutOfBounds(t *testing.T) {
85+
86+
if !bpf.HasLSMPrograms() || !config.EnableLargeProgs() {
87+
t.Skip("LSM programs not supported on this kernel")
88+
}
89+
90+
crd := `
91+
apiVersion: cilium.io/v1alpha1
92+
kind: TracingPolicy
93+
metadata:
94+
name: "lsm-arg-oob"
95+
spec:
96+
lsmhooks:
97+
- hook: "file_open"
98+
args:
99+
- index: 5
100+
type: "int"
101+
`
102+
103+
err := checkCrd(t, crd)
104+
require.Error(t, err)
105+
}
106+
107+
func TestLsmValidationInvalidArgType(t *testing.T) {
108+
109+
if !bpf.HasLSMPrograms() || !config.EnableLargeProgs() {
110+
t.Skip("LSM programs not supported on this kernel")
111+
}
112+
113+
crd := `
114+
apiVersion: cilium.io/v1alpha1
115+
kind: TracingPolicy
116+
metadata:
117+
name: "lsm-bad-argtype"
118+
spec:
119+
lsmhooks:
120+
- hook: "file_open"
121+
args:
122+
- index: 0
123+
type: "bogus_type_xyz"
124+
`
125+
126+
_, err := tracingpolicy.FromYAML(crd)
127+
require.Error(t, err)
128+
}
129+
130+
func TestLsmValidationValidPolicy(t *testing.T) {
131+
132+
if !bpf.HasLSMPrograms() || !config.EnableLargeProgs() {
133+
t.Skip("LSM programs not supported on this kernel")
134+
}
135+
136+
crd := `
137+
apiVersion: cilium.io/v1alpha1
138+
kind: TracingPolicy
139+
metadata:
140+
name: "lsm-valid"
141+
spec:
142+
lsmhooks:
143+
- hook: "file_open"
144+
args:
145+
- index: 0
146+
type: "file"
147+
`
148+
149+
err := checkCrd(t, crd)
150+
require.NoError(t, err)
151+
}

‎pkg/sensors/tracing/tracepoint_validation_test.go‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
// SPDX-License-Identifier: Apache-2.0
2+
// Copyright Authors of Tetragon
3+
4+
//go:build !windows
5+
6+
package tracing
7+
8+
import (
9+
"testing"
10+
11+
"github.com/stretchr/testify/require"
12+
)
13+
14+
func TestTracepointValidationWrongSubsystem(t *testing.T) {
15+
16+
crd := `
17+
apiVersion: cilium.io/v1alpha1
18+
kind: TracingPolicy
19+
metadata:
20+
name: "tp-bogus-subsystem"
21+
spec:
22+
tracepoints:
23+
- subsystem: "bogus_subsystem"
24+
event: "bogus_event"
25+
`
26+
27+
err := checkCrd(t, crd)
28+
require.Error(t, err)
29+
}
30+
31+
func TestTracepointValidationWrongEvent(t *testing.T) {
32+
33+
crd := `
34+
apiVersion: cilium.io/v1alpha1
35+
kind: TracingPolicy
36+
metadata:
37+
name: "tp-bogus-event"
38+
spec:
39+
tracepoints:
40+
- subsystem: "syscalls"
41+
event: "bogus_event_xyz"
42+
`
43+
44+
err := checkCrd(t, crd)
45+
require.Error(t, err)
46+
}
47+
48+
func TestTracepointValidationEmptySubsystem(t *testing.T) {
49+
50+
crd := `
51+
apiVersion: cilium.io/v1alpha1
52+
kind: TracingPolicy
53+
metadata:
54+
name: "tp-empty-subsystem"
55+
spec:
56+
tracepoints:
57+
- subsystem: ""
58+
event: "sys_enter_openat"
59+
`
60+
61+
err := checkCrd(t, crd)
62+
require.Error(t, err)
63+
}
64+
65+
func TestTracepointValidationEmptyEvent(t *testing.T) {
66+
67+
crd := `
68+
apiVersion: cilium.io/v1alpha1
69+
kind: TracingPolicy
70+
metadata:
71+
name: "tp-empty-event"
72+
spec:
73+
tracepoints:
74+
- subsystem: "syscalls"
75+
event: ""
76+
`
77+
78+
err := checkCrd(t, crd)
79+
require.Error(t, err)
80+
}
81+
82+
func TestTracepointValidationArgIndexOutOfBounds(t *testing.T) {
83+
84+
crd := `
85+
apiVersion: cilium.io/v1alpha1
86+
kind: TracingPolicy
87+
metadata:
88+
name: "tp-arg-oob"
89+
spec:
90+
tracepoints:
91+
- subsystem: "syscalls"
92+
event: "sys_enter_openat"
93+
args:
94+
- index: 999
95+
type: "int"
96+
`
97+
98+
err := checkCrd(t, crd)
99+
require.Error(t, err)
100+
}
101+
102+
func TestTracepointValidationRawArgIndexOutOfBounds(t *testing.T) {
103+
104+
crd := `
105+
apiVersion: cilium.io/v1alpha1
106+
kind: TracingPolicy
107+
metadata:
108+
name: "tp-raw-arg-oob"
109+
spec:
110+
tracepoints:
111+
- subsystem: "raw_syscalls"
112+
event: "sys_enter"
113+
raw: true
114+
args:
115+
- index: 6
116+
type: "int"
117+
`
118+
119+
err := checkCrd(t, crd)
120+
require.Error(t, err)
121+
}
122+
123+
func TestTracepointValidationValidPolicy(t *testing.T) {
124+
125+
crd := `
126+
apiVersion: cilium.io/v1alpha1
127+
kind: TracingPolicy
128+
metadata:
129+
name: "tp-valid"
130+
spec:
131+
tracepoints:
132+
- subsystem: "raw_syscalls"
133+
event: "sys_enter"
134+
raw: true
135+
args:
136+
- index: 4
137+
type: "syscall64"
138+
`
139+
140+
err := checkCrd(t, crd)
141+
require.NoError(t, err)
142+
}
143+
144+
func TestTracepointValidationNotifyEnforcerWithoutEnforcer(t *testing.T) {
145+
146+
crd := `
147+
apiVersion: cilium.io/v1alpha1
148+
kind: TracingPolicy
149+
metadata:
150+
name: "tp-enforcer-missing"
151+
spec:
152+
tracepoints:
153+
- subsystem: "raw_syscalls"
154+
event: "sys_enter"
155+
args:
156+
- index: 4
157+
type: "syscall64"
158+
selectors:
159+
- matchActions:
160+
- action: NotifyEnforcer
161+
`
162+
163+
err := checkCrd(t, crd)
164+
require.Error(t, err)
165+
}

0 commit comments

Comments
 (0)