Commit 3bfb49d7 authored by Marco Elver's avatar Marco Elver Committed by Alexei Starovoitov
Browse files

bpf: Refactor bpf_tracing_func_proto() and remove bpf_get_probe_write_proto() 



With bpf_get_probe_write_proto() no longer printing a message, we can
avoid it being a special case with its own permission check.

Refactor bpf_tracing_func_proto() similar to bpf_base_func_proto() to
have a section conditional on bpf_token_capable(CAP_SYS_ADMIN), where
the proto for bpf_probe_write_user() is returned. Finally, remove the
unnecessary bpf_get_probe_write_proto().

This simplifies the code, and adding additional CAP_SYS_ADMIN-only
helpers in future avoids duplicating the same CAP_SYS_ADMIN check.

Suggested-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Signed-off-by: default avatarMarco Elver <elver@google.com>
Acked-by: default avatarJiri Olsa <jolsa@kernel.org>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20241129090040.2690691-2-elver@google.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent b28573eb

kernel/trace/bpf_trace.c

+18 −12
Original line number Diff line number Diff line
@@ -357,14 +357,6 @@ static const struct bpf_func_proto bpf_probe_write_user_proto = { 
	.arg3_type	= ARG_CONST_SIZE,

};



static const struct bpf_func_proto *bpf_get_probe_write_proto(void)

{

	if (!capable(CAP_SYS_ADMIN))

		return NULL;



	return &bpf_probe_write_user_proto;

}



#define MAX_TRACE_PRINTK_VARARGS	3

#define BPF_TRACE_PRINTK_SIZE		1024
@@ -1441,6 +1433,8 @@ late_initcall(bpf_key_sig_kfuncs_init); 
static const struct bpf_func_proto *

bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)

{

	const struct bpf_func_proto *func_proto;



	switch (func_id) {

	case BPF_FUNC_map_lookup_elem:

		return &bpf_map_lookup_elem_proto;
@@ -1482,9 +1476,6 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) 
		return &bpf_perf_event_read_proto;

	case BPF_FUNC_get_prandom_u32:

		return &bpf_get_prandom_u32_proto;

	case BPF_FUNC_probe_write_user:

		return security_locked_down(LOCKDOWN_BPF_WRITE_USER) < 0 ?

		       NULL : bpf_get_probe_write_proto();

	case BPF_FUNC_probe_read_user:

		return &bpf_probe_read_user_proto;

	case BPF_FUNC_probe_read_kernel:
@@ -1563,7 +1554,22 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) 
	case BPF_FUNC_trace_vprintk:

		return bpf_get_trace_vprintk_proto();

	default:

		return bpf_base_func_proto(func_id, prog);

		break;

	}



	func_proto = bpf_base_func_proto(func_id, prog);

	if (func_proto)

		return func_proto;



	if (!bpf_token_capable(prog->aux->token, CAP_SYS_ADMIN))

		return NULL;



	switch (func_id) {

	case BPF_FUNC_probe_write_user:

		return security_locked_down(LOCKDOWN_BPF_WRITE_USER) < 0 ?

		       NULL : &bpf_probe_write_user_proto;

	default:

		return NULL;

	}

}