selftests/bpf: Add tests verifying bpf lsm userns_create hook

2022-08-16T21:39:59Z

The LSM hook userns_create was introduced to provide LSM's an opportunity to block or allow unprivileged user namespace creation. This test serves two purposes: it provides a test eBPF implementation, and tests the hook successfully blocks or allows user namespace creation. This tests 3 cases: 1. Unattached bpf program does not block unpriv user namespace creation. 2. Attached bpf program allows user namespace creation given CAP_SYS_ADMIN privileges. 3. Attached bpf program denies user namespace creation for a user without CAP_SYS_ADMIN. Acked-by: KP Singh Signed-off-by: Frederick Lawler Signed-off-by: Paul Moore

kernel/tools/testing/selftests/bpf/progs/test_deny_namespace.c, branch linux-6.2.y

selftests/bpf: Add tests verifying bpf lsm userns_create hook