selftests/bpf: Add sockopt case to verify prog_type

Make sure only sockopt programs can be attached to the setsockopt
and getsockopt hooks.

Signed-off-by: Stanislav Fomichev <sdf@google.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20240426231621.2716876-4-sdf@google.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>

diff --git a/tools/testing/selftests/bpf/prog_tests/sockopt.c b/tools/testing/selftests/bpf/prog_tests/sockopt.c
index dea340996e974d763cc894f8e3d175f28bf405fd..eaac83a7f388b6741ba53e33725d8269348a57fa 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/sockopt.c
+++ b/tools/testing/selftests/bpf/prog_tests/sockopt.c
@@ -24,6 +24,7 @@ enum sockopt_test_error {
 static struct sockopt_test {
        const char                      *descr;
        const struct bpf_insn           insns[64];
+       enum bpf_prog_type              prog_type;
        enum bpf_attach_type            attach_type;
        enum bpf_attach_type            expected_attach_type;
 
@@ -928,9 +929,40 @@ static struct sockopt_test {
 
                .error = EPERM_SETSOCKOPT,
        },
+
+       /* ==================== prog_type ====================  */
+
+       {
+               .descr = "can attach only BPF_CGROUP_SETSOCKOP",
+               .insns = {
+                       /* return 1 */
+                       BPF_MOV64_IMM(BPF_REG_0, 1),
+                       BPF_EXIT_INSN(),
+
+               },
+               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+               .attach_type = BPF_CGROUP_SETSOCKOPT,
+               .expected_attach_type = 0,
+               .error = DENY_ATTACH,
+       },
+
+       {
+               .descr = "can attach only BPF_CGROUP_GETSOCKOP",
+               .insns = {
+                       /* return 1 */
+                       BPF_MOV64_IMM(BPF_REG_0, 1),
+                       BPF_EXIT_INSN(),
+
+               },
+               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+               .attach_type = BPF_CGROUP_GETSOCKOPT,
+               .expected_attach_type = 0,
+               .error = DENY_ATTACH,
+       },
 };
 
 static int load_prog(const struct bpf_insn *insns,
+                    enum bpf_prog_type prog_type,
                     enum bpf_attach_type expected_attach_type)
 {
        LIBBPF_OPTS(bpf_prog_load_opts, opts,
@@ -947,7 +979,7 @@ static int load_prog(const struct bpf_insn *insns,
        }
        insns_cnt++;
 
-       fd = bpf_prog_load(BPF_PROG_TYPE_CGROUP_SOCKOPT, NULL, "GPL", insns, insns_cnt, &opts);
+       fd = bpf_prog_load(prog_type, NULL, "GPL", insns, insns_cnt, &opts);
        if (verbose && fd < 0)
                fprintf(stderr, "%s\n", bpf_log_buf);
 
@@ -1039,11 +1071,15 @@ static int call_getsockopt(bool use_io_uring, int fd, int level, int optname,
 static int run_test(int cgroup_fd, struct sockopt_test *test, bool use_io_uring,
                    bool use_link)
 {
+       int prog_type = BPF_PROG_TYPE_CGROUP_SOCKOPT;
        int sock_fd, err, prog_fd, link_fd = -1;
        void *optval = NULL;
        int ret = 0;
 
-       prog_fd = load_prog(test->insns, test->expected_attach_type);
+       if (test->prog_type)
+               prog_type = test->prog_type;
+
+       prog_fd = load_prog(test->insns, prog_type, test->expected_attach_type);
        if (prog_fd < 0) {
                if (test->error == DENY_LOAD)
                        return 0;