|
| 1 | +#!/usr/bin/env bash |
| 2 | +set -euo pipefail |
| 3 | + |
| 4 | +BIN="${BIN:-./build/aegisbpf}" |
| 5 | +PRESERVE_TMP_ON_FAIL="${PRESERVE_TMP_ON_FAIL:-0}" |
| 6 | + |
| 7 | +declare -i TOTAL_CHECKS=0 |
| 8 | +declare -i PASSED_CHECKS=0 |
| 9 | +declare -i FAILED_CHECKS=0 |
| 10 | + |
| 11 | +AGENT_PID="" |
| 12 | +TMP_DIR="" |
| 13 | +LOG_FILE="" |
| 14 | + |
| 15 | +cleanup() { |
| 16 | + local exit_code=$? |
| 17 | + if [[ -n "${AGENT_PID}" ]]; then |
| 18 | + kill "${AGENT_PID}" 2>/dev/null || true |
| 19 | + wait "${AGENT_PID}" 2>/dev/null || true |
| 20 | + AGENT_PID="" |
| 21 | + fi |
| 22 | + if [[ -n "${TMP_DIR}" && -d "${TMP_DIR}" ]]; then |
| 23 | + if [[ "${PRESERVE_TMP_ON_FAIL}" == "1" && ${exit_code} -ne 0 ]]; then |
| 24 | + echo "Preserving failed run artifacts at ${TMP_DIR}" >&2 |
| 25 | + else |
| 26 | + rm -rf "${TMP_DIR}" |
| 27 | + fi |
| 28 | + fi |
| 29 | +} |
| 30 | +trap cleanup EXIT |
| 31 | + |
| 32 | +pass() { |
| 33 | + local label="$1" |
| 34 | + TOTAL_CHECKS=$((TOTAL_CHECKS + 1)) |
| 35 | + PASSED_CHECKS=$((PASSED_CHECKS + 1)) |
| 36 | + echo "[PASS] ${label}" |
| 37 | +} |
| 38 | + |
| 39 | +fail() { |
| 40 | + local label="$1" |
| 41 | + local detail="$2" |
| 42 | + TOTAL_CHECKS=$((TOTAL_CHECKS + 1)) |
| 43 | + FAILED_CHECKS=$((FAILED_CHECKS + 1)) |
| 44 | + echo "[FAIL] ${label}: ${detail}" >&2 |
| 45 | +} |
| 46 | + |
| 47 | +run_expect_success() { |
| 48 | + local label="$1" |
| 49 | + shift |
| 50 | + if "$@" >/dev/null 2>&1; then |
| 51 | + pass "${label}" |
| 52 | + else |
| 53 | + fail "${label}" "command failed unexpectedly" |
| 54 | + fi |
| 55 | +} |
| 56 | + |
| 57 | +run_expect_blocked() { |
| 58 | + local label="$1" |
| 59 | + shift |
| 60 | + if "$@" >/dev/null 2>&1; then |
| 61 | + fail "${label}" "command succeeded (expected block)" |
| 62 | + else |
| 63 | + pass "${label}" |
| 64 | + fi |
| 65 | +} |
| 66 | + |
| 67 | +require_prereqs() { |
| 68 | + if [[ $EUID -ne 0 ]]; then |
| 69 | + echo "Must run as root (BPF LSM enforcement tests)." >&2 |
| 70 | + exit 1 |
| 71 | + fi |
| 72 | + |
| 73 | + if [[ ! -x "${BIN}" ]]; then |
| 74 | + echo "Agent binary not found at ${BIN}. Build first." >&2 |
| 75 | + exit 1 |
| 76 | + fi |
| 77 | + |
| 78 | + if [[ ! -f /sys/fs/cgroup/cgroup.controllers ]]; then |
| 79 | + echo "cgroup v2 is required at /sys/fs/cgroup." >&2 |
| 80 | + exit 1 |
| 81 | + fi |
| 82 | + |
| 83 | + if ! grep -qw bpf /sys/kernel/security/lsm 2>/dev/null; then |
| 84 | + echo "BPF LSM is not enabled; this suite requires enforce-capable kernel." >&2 |
| 85 | + exit 1 |
| 86 | + fi |
| 87 | +} |
| 88 | + |
| 89 | +start_agent() { |
| 90 | + local enforce_signal="$1" |
| 91 | + LOG_FILE="${TMP_DIR}/agent-${enforce_signal}.log" |
| 92 | + "${BIN}" run --enforce --enforce-signal="${enforce_signal}" >"${LOG_FILE}" 2>&1 & |
| 93 | + AGENT_PID=$! |
| 94 | + sleep 1 |
| 95 | + if ! kill -0 "${AGENT_PID}" 2>/dev/null; then |
| 96 | + echo "Agent failed to start for signal=${enforce_signal}. Log:" >&2 |
| 97 | + cat "${LOG_FILE}" >&2 || true |
| 98 | + exit 1 |
| 99 | + fi |
| 100 | +} |
| 101 | + |
| 102 | +stop_agent() { |
| 103 | + if [[ -n "${AGENT_PID}" ]]; then |
| 104 | + kill "${AGENT_PID}" 2>/dev/null || true |
| 105 | + wait "${AGENT_PID}" 2>/dev/null || true |
| 106 | + AGENT_PID="" |
| 107 | + fi |
| 108 | +} |
| 109 | + |
| 110 | +expected_action_for_signal() { |
| 111 | + case "$1" in |
| 112 | + none) |
| 113 | + echo "BLOCK" |
| 114 | + ;; |
| 115 | + term) |
| 116 | + echo "TERM" |
| 117 | + ;; |
| 118 | + int) |
| 119 | + echo "INT" |
| 120 | + ;; |
| 121 | + *) |
| 122 | + echo "Unsupported enforce signal: $1" >&2 |
| 123 | + exit 1 |
| 124 | + ;; |
| 125 | + esac |
| 126 | +} |
| 127 | + |
| 128 | +run_signal_suite() { |
| 129 | + local signal="$1" |
| 130 | + local expected_action="$2" |
| 131 | + local scenario_dir="${TMP_DIR}/${signal}" |
| 132 | + local target="${scenario_dir}/target.txt" |
| 133 | + local symlink_path="${scenario_dir}/target.symlink" |
| 134 | + local hardlink_path="${scenario_dir}/target.hardlink" |
| 135 | + |
| 136 | + mkdir -p "${scenario_dir}" |
| 137 | + printf 'signal=%s\n' "${signal}" >"${target}" |
| 138 | + ln -sf "${target}" "${symlink_path}" |
| 139 | + ln "${target}" "${hardlink_path}" |
| 140 | + |
| 141 | + local inode |
| 142 | + inode="$(stat -c %i "${target}")" |
| 143 | + |
| 144 | + start_agent "${signal}" |
| 145 | + |
| 146 | + if ! "${BIN}" block add "${target}" >/dev/null 2>&1; then |
| 147 | + echo "Failed to add block rule for ${target}" >&2 |
| 148 | + exit 1 |
| 149 | + fi |
| 150 | + |
| 151 | + # 10 blocked-open assertions per signal mode. |
| 152 | + run_expect_blocked "${signal}: cat direct" cat "${target}" |
| 153 | + run_expect_blocked "${signal}: head direct" head -c 1 "${target}" |
| 154 | + run_expect_blocked "${signal}: tail direct" tail -c 1 "${target}" |
| 155 | + run_expect_blocked "${signal}: dd direct" dd if="${target}" of=/dev/null bs=1 count=1 status=none |
| 156 | + run_expect_blocked "${signal}: grep direct" grep -m1 . "${target}" |
| 157 | + run_expect_blocked "${signal}: python direct" python3 -c "import pathlib,sys; pathlib.Path(sys.argv[1]).read_bytes()" "${target}" |
| 158 | + run_expect_blocked "${signal}: cat symlink" cat "${symlink_path}" |
| 159 | + run_expect_blocked "${signal}: head symlink" head -c 1 "${symlink_path}" |
| 160 | + run_expect_blocked "${signal}: cat hardlink" cat "${hardlink_path}" |
| 161 | + run_expect_blocked "${signal}: dd hardlink" dd if="${hardlink_path}" of=/dev/null bs=1 count=1 status=none |
| 162 | + |
| 163 | + sleep 1 |
| 164 | + run_expect_success "${signal}: expected action logged" grep -q "\"action\":\"${expected_action}\"" "${LOG_FILE}" |
| 165 | + run_expect_success "${signal}: inode logged" grep -q "\"ino\":${inode}" "${LOG_FILE}" |
| 166 | + |
| 167 | + "${BIN}" block del "${target}" >/dev/null 2>&1 || true |
| 168 | + stop_agent |
| 169 | +} |
| 170 | + |
| 171 | +main() { |
| 172 | + require_prereqs |
| 173 | + |
| 174 | + TMP_DIR="$(mktemp -d /tmp/aegisbpf_e2e_matrix.XXXXXX)" |
| 175 | + echo "Running kernel enforcement matrix using ${BIN}" |
| 176 | + echo "Workspace: ${TMP_DIR}" |
| 177 | + |
| 178 | + local signal |
| 179 | + for signal in none term int; do |
| 180 | + run_signal_suite "${signal}" "$(expected_action_for_signal "${signal}")" |
| 181 | + done |
| 182 | + |
| 183 | + echo |
| 184 | + echo "E2E matrix summary: passed=${PASSED_CHECKS} failed=${FAILED_CHECKS} total=${TOTAL_CHECKS}" |
| 185 | + if ((FAILED_CHECKS > 0)); then |
| 186 | + exit 1 |
| 187 | + fi |
| 188 | +} |
| 189 | + |
| 190 | +main "$@" |
0 commit comments