From: KP Singh <kpsingh@chromium.org>
To: Stephen Smalley <stephen.smalley.work@gmail.com>
Cc: Casey Schaufler <casey@schaufler-ca.com>,
linux-kernel@vger.kernel.org, bpf@vger.kernel.org,
LSM List <linux-security-module@vger.kernel.org>,
Brendan Jackman <jackmanb@google.com>,
Florent Revest <revest@google.com>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
James Morris <jmorris@namei.org>,
Kees Cook <keescook@chromium.org>, Paul Turner <pjt@google.com>,
Jann Horn <jannh@google.com>,
Florent Revest <revest@chromium.org>,
Brendan Jackman <jackmanb@chromium.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: Re: [PATCH bpf-next v5 5/7] bpf: lsm: Initialize the BPF LSM hooks
Date: Tue, 24 Mar 2020 15:42:14 +0100 [thread overview]
Message-ID: <20200324144214.GA1040@chromium.org> (raw)
In-Reply-To: <CAEjxPJ7LCZYDXN1rYMBA2rko0zbTp0UU0THx0bhsAnv0Eg4Ptg@mail.gmail.com>
On 24-Mär 10:37, Stephen Smalley wrote:
> On Mon, Mar 23, 2020 at 9:52 PM KP Singh <kpsingh@chromium.org> wrote:
> >
> > On 23-Mär 18:13, Casey Schaufler wrote:
> > > On 3/23/2020 9:44 AM, KP Singh wrote:
> > > > From: KP Singh <kpsingh@google.com>
> > > >
> > > > The bpf_lsm_ nops are initialized into the LSM framework like any other
> > > > LSM. Some LSM hooks do not have 0 as their default return value. The
> > > > __weak symbol for these hooks is overridden by a corresponding
> > > > definition in security/bpf/hooks.c
> > > >
> > > > + return 0;
> >
> > [...]
> >
> > > > +}
> > > > +
> > > > +DEFINE_LSM(bpf) = {
> > > > + .name = "bpf",
> > > > + .init = bpf_lsm_init,
> > >
> > > Have you given up on the "BPF must be last" requirement?
> >
> > Yes, we dropped it for as the BPF programs require CAP_SYS_ADMIN
> > anwyays so the position ~shouldn't~ matter. (based on some of the
> > discussions we had on the BPF_MODIFY_RETURN patches).
> >
> > However, This can be added later (in a separate patch) if really
> > deemed necessary.
>
> It matters for SELinux, as I previously explained. A process that has
> CAP_SYS_ADMIN is not assumed to be able to circumvent MAC policy.
> And executing prior to SELinux allows the bpf program to access and
> potentially leak to userspace information that wouldn't be visible to
> the
> process itself. However, I thought you were handling the order issue
> by putting it last in the list of lsms?
We can still do that if it does not work for SELinux.
Would it be okay to add bpf as LSM_ORDER_LAST?
LSMs like Landlock can then add LSM_ORDER_UNPRIVILEGED to even end up
after bpf?
- KP
next prev parent reply other threads:[~2020-03-24 14:42 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-23 16:44 [PATCH bpf-next v5 0/8] MAC and Audit policy using eBPF (KRSI) KP Singh
2020-03-23 16:44 ` [PATCH bpf-next v5 1/7] bpf: Introduce BPF_PROG_TYPE_LSM KP Singh
2020-03-23 19:02 ` Yonghong Song
2020-03-23 16:44 ` [PATCH bpf-next v5 2/7] security: Refactor declaration of LSM hooks KP Singh
2020-03-23 19:33 ` Kees Cook
2020-03-23 19:56 ` Andrii Nakryiko
2020-03-24 16:06 ` KP Singh
2020-03-23 16:44 ` [PATCH bpf-next v5 3/7] bpf: lsm: provide attachment points for BPF LSM programs KP Singh
2020-03-23 19:04 ` Yonghong Song
2020-03-23 19:33 ` Kees Cook
2020-03-23 19:59 ` Andrii Nakryiko
2020-03-24 10:39 ` KP Singh
2020-03-24 16:12 ` KP Singh
2020-03-24 21:26 ` Andrii Nakryiko
2020-03-24 22:39 ` KP Singh
2020-03-23 16:44 ` [PATCH bpf-next v5 4/7] bpf: lsm: Implement attach, detach and execution KP Singh
2020-03-23 19:16 ` Yonghong Song
2020-03-23 19:44 ` KP Singh
2020-03-23 20:18 ` Andrii Nakryiko
2020-03-24 19:00 ` KP Singh
2020-03-24 14:35 ` Stephen Smalley
2020-03-24 14:50 ` KP Singh
2020-03-24 14:58 ` Stephen Smalley
2020-03-24 16:25 ` Casey Schaufler
2020-03-24 17:49 ` Stephen Smalley
2020-03-24 18:01 ` Kees Cook
2020-03-24 18:06 ` KP Singh
2020-03-24 18:21 ` Stephen Smalley
2020-03-24 18:27 ` KP Singh
2020-03-24 18:31 ` KP Singh
2020-03-24 18:34 ` Kees Cook
2020-03-24 18:33 ` Kees Cook
2020-03-23 16:44 ` [PATCH bpf-next v5 5/7] bpf: lsm: Initialize the BPF LSM hooks KP Singh
2020-03-23 19:44 ` Kees Cook
2020-03-23 19:47 ` KP Singh
2020-03-23 20:21 ` Andrii Nakryiko
2020-03-23 20:47 ` Casey Schaufler
2020-03-23 21:44 ` Kees Cook
2020-03-24 1:13 ` Casey Schaufler
2020-03-24 1:52 ` KP Singh
2020-03-24 14:37 ` Stephen Smalley
2020-03-24 14:42 ` KP Singh [this message]
2020-03-24 14:51 ` Stephen Smalley
2020-03-24 14:51 ` KP Singh
2020-03-24 17:57 ` Kees Cook
2020-03-23 16:44 ` [PATCH bpf-next v5 6/7] tools/libbpf: Add support for BPF_PROG_TYPE_LSM KP Singh
2020-03-23 19:21 ` Yonghong Song
2020-03-23 20:25 ` Andrii Nakryiko
2020-03-24 1:57 ` KP Singh
2020-03-23 16:44 ` [PATCH bpf-next v5 7/7] bpf: lsm: Add selftests " KP Singh
2020-03-23 20:04 ` Yonghong Song
2020-03-24 20:04 ` KP Singh
2020-03-24 23:54 ` Andrii Nakryiko
2020-03-25 0:36 ` KP Singh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200324144214.GA1040@chromium.org \
--to=kpsingh@chromium.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=casey@schaufler-ca.com \
--cc=daniel@iogearbox.net \
--cc=gregkh@linuxfoundation.org \
--cc=jackmanb@chromium.org \
--cc=jackmanb@google.com \
--cc=jannh@google.com \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=pjt@google.com \
--cc=revest@chromium.org \
--cc=revest@google.com \
--cc=stephen.smalley.work@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).