Commit a9041fbd authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'security-propagate-caller-information-in-bpf-hooks' 

Blaise Boscaccy says:

====================
While trying to implement an eBPF gatekeeper program, we ran into an
issue whereas the LSM hooks are missing some relevant data.

Certain subcommands passed to the bpf() syscall can be invoked from
either the kernel or userspace. Additionally, some fields in the
bpf_attr struct contain pointers, and depending on where the
subcommand was invoked, they could point to either user or kernel
memory. One example of this is the bpf_prog_load subcommand and its
fd_array. This data is made available and used by the verifier but not
made available to the LSM subsystem. This patchset simply exposes that
information to applicable LSM hooks.

Change list:
- v6 -> v7
  - use gettid/pid in lieu of getpid/tgid in test condition
- v5 -> v6
  - fix regression caused by is_kernel renaming
  - simplify test logic
- v4 -> v5
  - merge v4 selftest breakout patch back into a single patch
  - change "is_kernel" to "kernel"
  - add selftest using new kernel flag
- v3 -> v4
  - split out selftest changes into a separate patch
- v2 -> v3
  - reorder params so that the new boolean flag is the last param
  - fixup function signatures in bpf selftests
- v1 -> v2
  - Pass a boolean flag in lieu of bpfptr_t

Revisions:
- v6
  https://lore.kernel.org/bpf/20250308013314.719150-1-bboscaccy@linux.microsoft.com/
- v5
  https://lore.kernel.org/bpf/20250307213651.3065714-1-bboscaccy@linux.microsoft.com/
- v4
  https://lore.kernel.org/bpf/20250304203123.3935371-1-bboscaccy@linux.microsoft.com/
- v3
  https://lore.kernel.org/bpf/20250303222416.3909228-1-bboscaccy@linux.microsoft.com/
- v2
  https://lore.kernel.org/bpf/20250228165322.3121535-1-bboscaccy@linux.microsoft.com/
- v1
  https://lore.kernel.org/bpf/20250226003055.1654837-1-bboscaccy@linux.microsoft.com/
====================

Link: https://patch.msgid.link/20250310221737.821889-1-bboscaccy@linux.microsoft.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents a03d3753 7987f162

include/linux/lsm_hook_defs.h

+3 −3
Original line number Diff line number Diff line
@@ -426,14 +426,14 @@ LSM_HOOK(void, LSM_RET_VOID, audit_rule_free, void *lsmrule) 
#endif /* CONFIG_AUDIT */



#ifdef CONFIG_BPF_SYSCALL

LSM_HOOK(int, 0, bpf, int cmd, union bpf_attr *attr, unsigned int size)

LSM_HOOK(int, 0, bpf, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)

LSM_HOOK(int, 0, bpf_map, struct bpf_map *map, fmode_t fmode)

LSM_HOOK(int, 0, bpf_prog, struct bpf_prog *prog)

LSM_HOOK(int, 0, bpf_map_create, struct bpf_map *map, union bpf_attr *attr,

	 struct bpf_token *token)

	 struct bpf_token *token, bool kernel)

LSM_HOOK(void, LSM_RET_VOID, bpf_map_free, struct bpf_map *map)

LSM_HOOK(int, 0, bpf_prog_load, struct bpf_prog *prog, union bpf_attr *attr,

	 struct bpf_token *token)

	 struct bpf_token *token, bool kernel)

LSM_HOOK(void, LSM_RET_VOID, bpf_prog_free, struct bpf_prog *prog)

LSM_HOOK(int, 0, bpf_token_create, struct bpf_token *token, union bpf_attr *attr,

	 const struct path *path)

include/linux/security.h

+6 −6
Original line number Diff line number Diff line
@@ -2249,14 +2249,14 @@ struct bpf_map; 
struct bpf_prog;

struct bpf_token;

#ifdef CONFIG_SECURITY

extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size);

extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size, bool kernel);

extern int security_bpf_map(struct bpf_map *map, fmode_t fmode);

extern int security_bpf_prog(struct bpf_prog *prog);

extern int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,

				   struct bpf_token *token);

				   struct bpf_token *token, bool kernel);

extern void security_bpf_map_free(struct bpf_map *map);

extern int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,

				  struct bpf_token *token);

				  struct bpf_token *token, bool kernel);

extern void security_bpf_prog_free(struct bpf_prog *prog);

extern int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,

				     const struct path *path);
@@ -2265,7 +2265,7 @@ extern int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cm 
extern int security_bpf_token_capable(const struct bpf_token *token, int cap);

#else

static inline int security_bpf(int cmd, union bpf_attr *attr,

					     unsigned int size)

			       unsigned int size, bool kernel)

{

	return 0;

}
@@ -2281,7 +2281,7 @@ static inline int security_bpf_prog(struct bpf_prog *prog) 
}



static inline int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,

					  struct bpf_token *token)

					  struct bpf_token *token, bool kernel)

{

	return 0;

}
@@ -2290,7 +2290,7 @@ static inline void security_bpf_map_free(struct bpf_map *map) 
{ }



static inline int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,

					 struct bpf_token *token)

					 struct bpf_token *token, bool kernel)

{

	return 0;

}

kernel/bpf/syscall.c

+5 −5
Original line number Diff line number Diff line
@@ -1315,7 +1315,7 @@ static bool bpf_net_capable(void) 


#define BPF_MAP_CREATE_LAST_FIELD map_token_fd

/* called via syscall */

static int map_create(union bpf_attr *attr)

static int map_create(union bpf_attr *attr, bool kernel)

{

	const struct bpf_map_ops *ops;

	struct bpf_token *token = NULL;
@@ -1505,7 +1505,7 @@ static int map_create(union bpf_attr *attr) 
			attr->btf_vmlinux_value_type_id;

	}



	err = security_bpf_map_create(map, attr, token);

	err = security_bpf_map_create(map, attr, token, kernel);

	if (err)

		goto free_map_sec;
@@ -2942,7 +2942,7 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size) 
	if (err < 0)

		goto free_prog;



	err = security_bpf_prog_load(prog, attr, token);

	err = security_bpf_prog_load(prog, attr, token, uattr.is_kernel);

	if (err)

		goto free_prog_sec;
@@ -5767,13 +5767,13 @@ static int __sys_bpf(enum bpf_cmd cmd, bpfptr_t uattr, unsigned int size) 
	if (copy_from_bpfptr(&attr, uattr, size) != 0)

		return -EFAULT;



	err = security_bpf(cmd, &attr, size);

	err = security_bpf(cmd, &attr, size, uattr.is_kernel);

	if (err < 0)

		return err;



	switch (cmd) {

	case BPF_MAP_CREATE:

		err = map_create(&attr);

		err = map_create(&attr, uattr.is_kernel);

		break;

	case BPF_MAP_LOOKUP_ELEM:

		err = map_lookup_elem(&attr);

security/security.c

+9 −6
Original line number Diff line number Diff line
@@ -5627,6 +5627,7 @@ int security_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, 
 * @cmd: command

 * @attr: bpf attribute

 * @size: size

 * @kernel: whether or not call originated from kernel

 *

 * Do a initial check for all bpf syscalls after the attribute is copied into

 * the kernel. The actual security module can implement their own rules to
@@ -5634,9 +5635,9 @@ int security_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, 
 *

 * Return: Returns 0 if permission is granted.

 */

int security_bpf(int cmd, union bpf_attr *attr, unsigned int size)

int security_bpf(int cmd, union bpf_attr *attr, unsigned int size, bool kernel)

{

	return call_int_hook(bpf, cmd, attr, size);

	return call_int_hook(bpf, cmd, attr, size, kernel);

}



/**
@@ -5673,6 +5674,7 @@ int security_bpf_prog(struct bpf_prog *prog) 
 * @map: BPF map object

 * @attr: BPF syscall attributes used to create BPF map

 * @token: BPF token used to grant user access

 * @kernel: whether or not call originated from kernel

 *

 * Do a check when the kernel creates a new BPF map. This is also the

 * point where LSM blob is allocated for LSMs that need them.
@@ -5680,9 +5682,9 @@ int security_bpf_prog(struct bpf_prog *prog) 
 * Return: Returns 0 on success, error on failure.

 */

int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,

			    struct bpf_token *token)

			    struct bpf_token *token, bool kernel)

{

	return call_int_hook(bpf_map_create, map, attr, token);

	return call_int_hook(bpf_map_create, map, attr, token, kernel);

}



/**
@@ -5690,6 +5692,7 @@ int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr, 
 * @prog: BPF program object

 * @attr: BPF syscall attributes used to create BPF program

 * @token: BPF token used to grant user access to BPF subsystem

 * @kernel: whether or not call originated from kernel

 *

 * Perform an access control check when the kernel loads a BPF program and

 * allocates associated BPF program object. This hook is also responsible for
@@ -5698,9 +5701,9 @@ int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr, 
 * Return: Returns 0 on success, error on failure.

 */

int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,

			   struct bpf_token *token)

			   struct bpf_token *token, bool kernel)

{

	return call_int_hook(bpf_prog_load, prog, attr, token);

	return call_int_hook(bpf_prog_load, prog, attr, token, kernel);

}



/**

security/selinux/hooks.c

+3 −3
Original line number Diff line number Diff line
@@ -6866,7 +6866,7 @@ static int selinux_ib_alloc_security(void *ib_sec) 


#ifdef CONFIG_BPF_SYSCALL

static int selinux_bpf(int cmd, union bpf_attr *attr,

				     unsigned int size)

		       unsigned int size, bool kernel)

{

	u32 sid = current_sid();

	int ret;
@@ -6953,7 +6953,7 @@ static int selinux_bpf_prog(struct bpf_prog *prog) 
}



static int selinux_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,

				  struct bpf_token *token)

				  struct bpf_token *token, bool kernel)

{

	struct bpf_security_struct *bpfsec;
@@ -6976,7 +6976,7 @@ static void selinux_bpf_map_free(struct bpf_map *map) 
}



static int selinux_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,

				 struct bpf_token *token)

				 struct bpf_token *token, bool kernel)

{

	struct bpf_security_struct *bpfsec;