Commit f568a3d4 authored by Andrii Nakryiko's avatar Andrii Nakryiko Committed by Alexei Starovoitov
Browse files

bpf,lsm: Add BPF token LSM hooks 



Wire up bpf_token_create and bpf_token_free LSM hooks, which allow to
allocate LSM security blob (we add `void *security` field to struct
bpf_token for that), but also control who can instantiate BPF token.
This follows existing pattern for BPF map and BPF prog.

Also add security_bpf_token_allow_cmd() and security_bpf_token_capable()
LSM hooks that allow LSM implementation to control and negate (if
necessary) BPF token's delegation of a specific bpf_cmd and capability,
respectively.

Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarPaul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/bpf/20240124022127.2379740-12-andrii@kernel.org
parent a2431c7e

include/linux/bpf.h

+3 −0
Original line number Diff line number Diff line
@@ -1634,6 +1634,9 @@ struct bpf_token { 
	u64 allowed_maps;

	u64 allowed_progs;

	u64 allowed_attachs;

#ifdef CONFIG_SECURITY

	void *security;

#endif

};



struct bpf_struct_ops_value;

include/linux/lsm_hook_defs.h

+5 −0
Original line number Diff line number Diff line
@@ -410,6 +410,11 @@ LSM_HOOK(void, LSM_RET_VOID, bpf_map_free, struct bpf_map *map) 
LSM_HOOK(int, 0, bpf_prog_load, struct bpf_prog *prog, union bpf_attr *attr,

	 struct bpf_token *token)

LSM_HOOK(void, LSM_RET_VOID, bpf_prog_free, struct bpf_prog *prog)

LSM_HOOK(int, 0, bpf_token_create, struct bpf_token *token, union bpf_attr *attr,

	 struct path *path)

LSM_HOOK(void, LSM_RET_VOID, bpf_token_free, struct bpf_token *token)

LSM_HOOK(int, 0, bpf_token_cmd, const struct bpf_token *token, enum bpf_cmd cmd)

LSM_HOOK(int, 0, bpf_token_capable, const struct bpf_token *token, int cap)

#endif /* CONFIG_BPF_SYSCALL */



LSM_HOOK(int, 0, locked_down, enum lockdown_reason what)

include/linux/security.h

+25 −0
Original line number Diff line number Diff line
@@ -32,6 +32,7 @@ 
#include <linux/string.h>

#include <linux/mm.h>

#include <linux/sockptr.h>

#include <linux/bpf.h>

#include <uapi/linux/lsm.h>



struct linux_binprm;
@@ -2075,6 +2076,11 @@ extern void security_bpf_map_free(struct bpf_map *map); 
extern int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,

				  struct bpf_token *token);

extern void security_bpf_prog_free(struct bpf_prog *prog);

extern int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,

				     struct path *path);

extern void security_bpf_token_free(struct bpf_token *token);

extern int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd);

extern int security_bpf_token_capable(const struct bpf_token *token, int cap);

#else

static inline int security_bpf(int cmd, union bpf_attr *attr,

					     unsigned int size)
@@ -2109,6 +2115,25 @@ static inline int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr * 


static inline void security_bpf_prog_free(struct bpf_prog *prog)

{ }



static inline int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,

				     struct path *path)

{

	return 0;

}



static inline void security_bpf_token_free(struct bpf_token *token)

{ }



static inline int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd)

{

	return 0;

}



static inline int security_bpf_token_capable(const struct bpf_token *token, int cap)

{

	return 0;

}

#endif /* CONFIG_SECURITY */

#endif /* CONFIG_BPF_SYSCALL */

kernel/bpf/bpf_lsm.c

+4 −0
Original line number Diff line number Diff line
@@ -265,6 +265,10 @@ BTF_ID(func, bpf_lsm_bpf_map_free) 
BTF_ID(func, bpf_lsm_bpf_prog)

BTF_ID(func, bpf_lsm_bpf_prog_load)

BTF_ID(func, bpf_lsm_bpf_prog_free)

BTF_ID(func, bpf_lsm_bpf_token_create)

BTF_ID(func, bpf_lsm_bpf_token_free)

BTF_ID(func, bpf_lsm_bpf_token_cmd)

BTF_ID(func, bpf_lsm_bpf_token_capable)

BTF_ID(func, bpf_lsm_bprm_check_security)

BTF_ID(func, bpf_lsm_bprm_committed_creds)

BTF_ID(func, bpf_lsm_bprm_committing_creds)

kernel/bpf/token.c

+11 −1
Original line number Diff line number Diff line
@@ -7,6 +7,7 @@ 
#include <linux/idr.h>

#include <linux/namei.h>

#include <linux/user_namespace.h>

#include <linux/security.h>



static bool bpf_ns_capable(struct user_namespace *ns, int cap)

{
@@ -21,6 +22,8 @@ bool bpf_token_capable(const struct bpf_token *token, int cap) 
	userns = token ? token->userns : &init_user_ns;

	if (!bpf_ns_capable(userns, cap))

		return false;

	if (token && security_bpf_token_capable(token, cap) < 0)

		return false;

	return true;

}
@@ -31,6 +34,7 @@ void bpf_token_inc(struct bpf_token *token) 


static void bpf_token_free(struct bpf_token *token)

{

	security_bpf_token_free(token);

	put_user_ns(token->userns);

	kfree(token);

}
@@ -193,6 +197,10 @@ int bpf_token_create(union bpf_attr *attr) 
	token->allowed_progs = mnt_opts->delegate_progs;

	token->allowed_attachs = mnt_opts->delegate_attachs;



	err = security_bpf_token_create(token, attr, &path);

	if (err)

		goto out_token;



	fd = get_unused_fd_flags(O_CLOEXEC);

	if (fd < 0) {

		err = fd;
@@ -237,7 +245,9 @@ bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd) 
{

	if (!token)

		return false;

	return token->allowed_cmds & (1ULL << cmd);

	if (!(token->allowed_cmds & (1ULL << cmd)))

		return false;

	return security_bpf_token_cmd(token, cmd) == 0;

}



bool bpf_token_allow_map_type(const struct bpf_token *token, enum bpf_map_type type)