Commit ac13a426 authored by Song Liu's avatar Song Liu Committed by Alexei Starovoitov
Browse files

bpf: Add kfunc bpf_get_dentry_xattr() to read xattr from dentry 



This kfunc can be used in LSM hooks with dentry, such as:

  security_inode_listxattr
  security_inode_permission

and many more.

Acked-by: default avatarChristian Brauner <brauner@kernel.org>
Signed-off-by: default avatarSong Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20240806230904.71194-3-song@kernel.org


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent fa4e5afa

fs/bpf_fs_kfuncs.c

+33 −9
Original line number Diff line number Diff line
@@ -94,26 +94,29 @@ __bpf_kfunc int bpf_path_d_path(struct path *path, char *buf, size_t buf__sz) 
}



/**

 * bpf_get_file_xattr - get xattr of a file

 * @file: file to get xattr from

 * bpf_get_dentry_xattr - get xattr of a dentry

 * @dentry: dentry to get xattr from

 * @name__str: name of the xattr

 * @value_p: output buffer of the xattr value

 *

 * Get xattr *name__str* of *file* and store the output in *value_ptr*.

 * Get xattr *name__str* of *dentry* and store the output in *value_ptr*.

 *

 * For security reasons, only *name__str* with prefix "user." is allowed.

 *

 * Return: 0 on success, a negative value on error.

 */

__bpf_kfunc int bpf_get_file_xattr(struct file *file, const char *name__str,

__bpf_kfunc int bpf_get_dentry_xattr(struct dentry *dentry, const char *name__str,

				     struct bpf_dynptr *value_p)

{

	struct bpf_dynptr_kern *value_ptr = (struct bpf_dynptr_kern *)value_p;

	struct dentry *dentry;

	struct inode *inode = d_inode(dentry);

	u32 value_len;

	void *value;

	int ret;



	if (WARN_ON(!inode))

		return -EINVAL;



	if (strncmp(name__str, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))

		return -EPERM;
@@ -122,11 +125,31 @@ __bpf_kfunc int bpf_get_file_xattr(struct file *file, const char *name__str, 
	if (!value)

		return -EINVAL;



	dentry = file_dentry(file);

	ret = inode_permission(&nop_mnt_idmap, dentry->d_inode, MAY_READ);

	ret = inode_permission(&nop_mnt_idmap, inode, MAY_READ);

	if (ret)

		return ret;

	return __vfs_getxattr(dentry, dentry->d_inode, name__str, value, value_len);

	return __vfs_getxattr(dentry, inode, name__str, value, value_len);

}



/**

 * bpf_get_file_xattr - get xattr of a file

 * @file: file to get xattr from

 * @name__str: name of the xattr

 * @value_p: output buffer of the xattr value

 *

 * Get xattr *name__str* of *file* and store the output in *value_ptr*.

 *

 * For security reasons, only *name__str* with prefix "user." is allowed.

 *

 * Return: 0 on success, a negative value on error.

 */

__bpf_kfunc int bpf_get_file_xattr(struct file *file, const char *name__str,

				   struct bpf_dynptr *value_p)

{

	struct dentry *dentry;



	dentry = file_dentry(file);

	return bpf_get_dentry_xattr(dentry, name__str, value_p);

}



__bpf_kfunc_end_defs();
@@ -136,6 +159,7 @@ BTF_ID_FLAGS(func, bpf_get_task_exe_file, 
	     KF_ACQUIRE | KF_TRUSTED_ARGS | KF_RET_NULL)

BTF_ID_FLAGS(func, bpf_put_file, KF_RELEASE)

BTF_ID_FLAGS(func, bpf_path_d_path, KF_TRUSTED_ARGS)

BTF_ID_FLAGS(func, bpf_get_dentry_xattr, KF_SLEEPABLE | KF_TRUSTED_ARGS)

BTF_ID_FLAGS(func, bpf_get_file_xattr, KF_SLEEPABLE | KF_TRUSTED_ARGS)

BTF_KFUNCS_END(bpf_fs_kfunc_set_ids)