bpf: selftests: Remove libcap usage from test_progs

This patch removes the libcap usage from test_progs.
bind_perm.c is the only user.  cap_*_effective() helpers added in the
earlier patch are directly used instead.

No other selftest binary is using libcap, so '-lcap' is also removed
from the Makefile.

Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Stanislav Fomichev <sdf@google.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20220316173835.2039334-1-kafai@fb.com

diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 1c6e557..11f5883 100644 (file)
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -25,7 +25,7 @@ CFLAGS += -g -O0 -rdynamic -Wall -Werror $(GENFLAGS) $(SAN_CFLAGS)    \
          -I$(CURDIR) -I$(INCLUDE_DIR) -I$(GENDIR) -I$(LIBDIR)          \
          -I$(TOOLSINCDIR) -I$(APIDIR) -I$(OUTPUT)
 LDFLAGS += $(SAN_CFLAGS)
-LDLIBS += -lcap -lelf -lz -lrt -lpthread
+LDLIBS += -lelf -lz -lrt -lpthread
 
 # Silence some warnings when compiled with clang
 ifneq ($(LLVM),)
@@ -480,7 +480,8 @@ TRUNNER_TESTS_DIR := prog_tests
 TRUNNER_BPF_PROGS_DIR := progs
 TRUNNER_EXTRA_SOURCES := test_progs.c cgroup_helpers.c trace_helpers.c \
                         network_helpers.c testing_helpers.c            \
-                        btf_helpers.c flow_dissector_load.h
+                        btf_helpers.c flow_dissector_load.h            \
+                        cap_helpers.c
 TRUNNER_EXTRA_FILES := $(OUTPUT)/urandom_read $(OUTPUT)/bpf_testmod.ko \
                       ima_setup.sh                                     \
                       $(wildcard progs/btf_dump_test_case_*.c)

diff --git a/tools/testing/selftests/bpf/prog_tests/bind_perm.c b/tools/testing/selftests/bpf/prog_tests/bind_perm.c
index eac71fb..a1766a2 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/bind_perm.c
+++ b/tools/testing/selftests/bpf/prog_tests/bind_perm.c
@@ -4,9 +4,9 @@
 #include <stdlib.h>
 #include <sys/types.h>
 #include <sys/socket.h>
-#include <sys/capability.h>
 
 #include "test_progs.h"
+#include "cap_helpers.h"
 #include "bind_perm.skel.h"
 
 static int duration;
@@ -49,41 +49,11 @@ close_socket:
                close(fd);
 }
 
-bool cap_net_bind_service(cap_flag_value_t flag)
-{
-       const cap_value_t cap_net_bind_service = CAP_NET_BIND_SERVICE;
-       cap_flag_value_t original_value;
-       bool was_effective = false;
-       cap_t caps;
-
-       caps = cap_get_proc();
-       if (CHECK(!caps, "cap_get_proc", "errno %d", errno))
-               goto free_caps;
-
-       if (CHECK(cap_get_flag(caps, CAP_NET_BIND_SERVICE, CAP_EFFECTIVE,
-                              &original_value),
-                 "cap_get_flag", "errno %d", errno))
-               goto free_caps;
-
-       was_effective = (original_value == CAP_SET);
-
-       if (CHECK(cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_net_bind_service,
-                              flag),
-                 "cap_set_flag", "errno %d", errno))
-               goto free_caps;
-
-       if (CHECK(cap_set_proc(caps), "cap_set_proc", "errno %d", errno))
-               goto free_caps;
-
-free_caps:
-       CHECK(cap_free(caps), "cap_free", "errno %d", errno);
-       return was_effective;
-}
-
 void test_bind_perm(void)
 {
-       bool cap_was_effective;
+       const __u64 net_bind_svc_cap = 1ULL << CAP_NET_BIND_SERVICE;
        struct bind_perm *skel;
+       __u64 old_caps = 0;
        int cgroup_fd;
 
        if (create_netns())
@@ -105,7 +75,8 @@ void test_bind_perm(void)
        if (!ASSERT_OK_PTR(skel, "bind_v6_prog"))
                goto close_skeleton;
 
-       cap_was_effective = cap_net_bind_service(CAP_CLEAR);
+       ASSERT_OK(cap_disable_effective(net_bind_svc_cap, &old_caps),
+                 "cap_disable_effective");
 
        try_bind(AF_INET, 110, EACCES);
        try_bind(AF_INET6, 110, EACCES);
@@ -113,8 +84,9 @@ void test_bind_perm(void)
        try_bind(AF_INET, 111, 0);
        try_bind(AF_INET6, 111, 0);
 
-       if (cap_was_effective)
-               cap_net_bind_service(CAP_SET);
+       if (old_caps & net_bind_svc_cap)
+               ASSERT_OK(cap_enable_effective(net_bind_svc_cap, NULL),
+                         "cap_enable_effective");
 
 close_skeleton:
        bind_perm__destroy(skel);