Commit 531118f1 authored by Song Liu's avatar Song Liu Committed by Alexei Starovoitov
Browse files

fs/xattr: bpf: Introduce security.bpf. xattr name prefix 



Introduct new xattr name prefix security.bpf., and enable reading these
xattrs from bpf kfuncs bpf_get_[file|dentry]_xattr().

As we are on it, correct the comments for return value of
bpf_get_[file|dentry]_xattr(), i.e. return length the xattr value on
success.

Signed-off-by: default avatarSong Liu <song@kernel.org>
Acked-by: default avatarChristian Brauner <brauner@kernel.org>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Reviewed-by: default avatarMatt Bobrowski <mattbobrowski@google.com>
Link: https://lore.kernel.org/r/20250130213549.3353349-2-song@kernel.org


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent b99f27e9

fs/bpf_fs_kfuncs.c

+25 −11
Original line number Diff line number Diff line
@@ -93,6 +93,24 @@ __bpf_kfunc int bpf_path_d_path(struct path *path, char *buf, size_t buf__sz) 
	return len;

}



static bool match_security_bpf_prefix(const char *name__str)

{

	return !strncmp(name__str, XATTR_NAME_BPF_LSM, XATTR_NAME_BPF_LSM_LEN);

}



static int bpf_xattr_read_permission(const char *name, struct inode *inode)

{

	if (WARN_ON(!inode))

		return -EINVAL;



	/* Allow reading xattr with user. and security.bpf. prefix */

	if (strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) &&

	    !match_security_bpf_prefix(name))

		return -EPERM;



	return inode_permission(&nop_mnt_idmap, inode, MAY_READ);

}



/**

 * bpf_get_dentry_xattr - get xattr of a dentry

 * @dentry: dentry to get xattr from
@@ -101,9 +119,10 @@ __bpf_kfunc int bpf_path_d_path(struct path *path, char *buf, size_t buf__sz) 
 *

 * Get xattr *name__str* of *dentry* and store the output in *value_ptr*.

 *

 * For security reasons, only *name__str* with prefix "user." is allowed.

 * For security reasons, only *name__str* with prefixes "user." or

 * "security.bpf." are allowed.

 *

 * Return: 0 on success, a negative value on error.

 * Return: length of the xattr value on success, a negative value on error.

 */

__bpf_kfunc int bpf_get_dentry_xattr(struct dentry *dentry, const char *name__str,

				     struct bpf_dynptr *value_p)
@@ -114,18 +133,12 @@ __bpf_kfunc int bpf_get_dentry_xattr(struct dentry *dentry, const char *name__st 
	void *value;

	int ret;



	if (WARN_ON(!inode))

		return -EINVAL;



	if (strncmp(name__str, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))

		return -EPERM;



	value_len = __bpf_dynptr_size(value_ptr);

	value = __bpf_dynptr_data_rw(value_ptr, value_len);

	if (!value)

		return -EINVAL;



	ret = inode_permission(&nop_mnt_idmap, inode, MAY_READ);

	ret = bpf_xattr_read_permission(name__str, inode);

	if (ret)

		return ret;

	return __vfs_getxattr(dentry, inode, name__str, value, value_len);
@@ -139,9 +152,10 @@ __bpf_kfunc int bpf_get_dentry_xattr(struct dentry *dentry, const char *name__st 
 *

 * Get xattr *name__str* of *file* and store the output in *value_ptr*.

 *

 * For security reasons, only *name__str* with prefix "user." is allowed.

 * For security reasons, only *name__str* with prefixes "user." or

 * "security.bpf." are allowed.

 *

 * Return: 0 on success, a negative value on error.

 * Return: length of the xattr value on success, a negative value on error.

 */

__bpf_kfunc int bpf_get_file_xattr(struct file *file, const char *name__str,

				   struct bpf_dynptr *value_p)

include/uapi/linux/xattr.h

+4 −0
Original line number Diff line number Diff line
@@ -83,6 +83,10 @@ struct xattr_args { 
#define XATTR_CAPS_SUFFIX "capability"

#define XATTR_NAME_CAPS XATTR_SECURITY_PREFIX XATTR_CAPS_SUFFIX



#define XATTR_BPF_LSM_SUFFIX "bpf."

#define XATTR_NAME_BPF_LSM (XATTR_SECURITY_PREFIX XATTR_BPF_LSM_SUFFIX)

#define XATTR_NAME_BPF_LSM_LEN (sizeof(XATTR_NAME_BPF_LSM) - 1)



#define XATTR_POSIX_ACL_ACCESS  "posix_acl_access"

#define XATTR_NAME_POSIX_ACL_ACCESS XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_ACCESS

#define XATTR_POSIX_ACL_DEFAULT  "posix_acl_default"