Commit 750e7857 authored by Jie Jiang's avatar Jie Jiang Committed by Andrii Nakryiko
Browse files

bpf: Support uid and gid when mounting bpffs 



Parse uid and gid in bpf_parse_param() so that they can be passed in as
the `data` parameter when mount() bpffs. This will be useful when we
want to control which user/group has the control to the mounted bpffs,
otherwise a separate chown() call will be needed.

Signed-off-by: default avatarJie Jiang <jiejiang@chromium.org>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Acked-by: default avatarMike Frysinger <vapier@chromium.org>
Acked-by: default avatarChristian Brauner <brauner@kernel.org>
Acked-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20231212093923.497838-1-jiejiang@chromium.org
parent 62d9a969

include/linux/bpf.h

+2 −0
Original line number Diff line number Diff line
@@ -1595,6 +1595,8 @@ struct bpf_link_primer { 
};



struct bpf_mount_opts {

	kuid_t uid;

	kgid_t gid;

	umode_t mode;



	/* BPF token-related delegation options */

kernel/bpf/inode.c

+49 −1
Original line number Diff line number Diff line
@@ -601,9 +601,16 @@ EXPORT_SYMBOL(bpf_prog_get_type_path); 
static int bpf_show_options(struct seq_file *m, struct dentry *root)

{

	struct bpf_mount_opts *opts = root->d_sb->s_fs_info;

	umode_t mode = d_inode(root)->i_mode & S_IALLUGO & ~S_ISVTX;

	struct inode *inode = d_inode(root);

	umode_t mode = inode->i_mode & S_IALLUGO & ~S_ISVTX;

	u64 mask;



	if (!uid_eq(inode->i_uid, GLOBAL_ROOT_UID))

		seq_printf(m, ",uid=%u",

			   from_kuid_munged(&init_user_ns, inode->i_uid));

	if (!gid_eq(inode->i_gid, GLOBAL_ROOT_GID))

		seq_printf(m, ",gid=%u",

			   from_kgid_munged(&init_user_ns, inode->i_gid));

	if (mode != S_IRWXUGO)

		seq_printf(m, ",mode=%o", mode);
@@ -652,6 +659,8 @@ const struct super_operations bpf_super_ops = { 
};



enum {

	OPT_UID,

	OPT_GID,

	OPT_MODE,

	OPT_DELEGATE_CMDS,

	OPT_DELEGATE_MAPS,
@@ -660,6 +669,8 @@ enum { 
};



static const struct fs_parameter_spec bpf_fs_parameters[] = {

	fsparam_u32	("uid",				OPT_UID),

	fsparam_u32	("gid",				OPT_GID),

	fsparam_u32oct	("mode",			OPT_MODE),

	fsparam_string	("delegate_cmds",		OPT_DELEGATE_CMDS),

	fsparam_string	("delegate_maps",		OPT_DELEGATE_MAPS),
@@ -672,6 +683,8 @@ static int bpf_parse_param(struct fs_context *fc, struct fs_parameter *param) 
{

	struct bpf_mount_opts *opts = fc->s_fs_info;

	struct fs_parse_result result;

	kuid_t uid;

	kgid_t gid;

	int opt, err;

	u64 msk;
@@ -694,6 +707,34 @@ static int bpf_parse_param(struct fs_context *fc, struct fs_parameter *param) 
	}



	switch (opt) {

	case OPT_UID:

		uid = make_kuid(current_user_ns(), result.uint_32);

		if (!uid_valid(uid))

			goto bad_value;



		/*

		 * The requested uid must be representable in the

		 * filesystem's idmapping.

		 */

		if (!kuid_has_mapping(fc->user_ns, uid))

			goto bad_value;



		opts->uid = uid;

		break;

	case OPT_GID:

		gid = make_kgid(current_user_ns(), result.uint_32);

		if (!gid_valid(gid))

			goto bad_value;



		/*

		 * The requested gid must be representable in the

		 * filesystem's idmapping.

		 */

		if (!kgid_has_mapping(fc->user_ns, gid))

			goto bad_value;



		opts->gid = gid;

		break;

	case OPT_MODE:

		opts->mode = result.uint_32 & S_IALLUGO;

		break;
@@ -722,6 +763,9 @@ static int bpf_parse_param(struct fs_context *fc, struct fs_parameter *param) 
	}



	return 0;



bad_value:

	return invalfc(fc, "Bad value for '%s'", param->key);

}



struct bpf_preload_ops *bpf_preload_ops;
@@ -808,6 +852,8 @@ static int bpf_fill_super(struct super_block *sb, struct fs_context *fc) 
	sb->s_op = &bpf_super_ops;



	inode = sb->s_root->d_inode;

	inode->i_uid = opts->uid;

	inode->i_gid = opts->gid;

	inode->i_op = &bpf_dir_iops;

	inode->i_mode &= ~S_IALLUGO;

	populate_bpffs(sb->s_root);
@@ -843,6 +889,8 @@ static int bpf_init_fs_context(struct fs_context *fc) 
		return -ENOMEM;



	opts->mode = S_IRWXUGO;

	opts->uid = current_fsuid();

	opts->gid = current_fsgid();



	/* start out with no BPF token delegation enabled */

	opts->delegate_cmds = 0;