From: Kees Cook <keescook@chromium.org>
To: Paul Moore <paul@paul-moore.com>
Cc: Andrii Nakryiko <andrii@kernel.org>,
bpf@vger.kernel.org, ast@kernel.org, daniel@iogearbox.net,
kpsingh@kernel.org, linux-security-module@vger.kernel.org
Subject: Re: [PATCH bpf-next 0/8] New BPF map and BTF security LSM hooks
Date: Wed, 12 Apr 2023 10:47:13 -0700 [thread overview]
Message-ID: <6436eea2.170a0220.97ead.52a8@mx.google.com> (raw)
In-Reply-To: <CAHC9VhQHmdZYnR=+rX-3FcRh127mhJt=jAnototfTiuSoOTptg@mail.gmail.com>
On Wed, Apr 12, 2023 at 12:49:06PM -0400, Paul Moore wrote:
> On Wed, Apr 12, 2023 at 12:33 AM Andrii Nakryiko <andrii@kernel.org> wrote:
> >
> > Add new LSM hooks, bpf_map_create_security and bpf_btf_load_security, which
> > are meant to allow highly-granular LSM-based control over the usage of BPF
> > subsytem. Specifically, to control the creation of BPF maps and BTF data
> > objects, which are fundamental building blocks of any modern BPF application.
> >
> > These new hooks are able to override default kernel-side CAP_BPF-based (and
> > sometimes CAP_NET_ADMIN-based) permission checks. It is now possible to
> > implement LSM policies that could granularly enforce more restrictions on
> > a per-BPF map basis (beyond checking coarse CAP_BPF/CAP_NET_ADMIN
> > capabilities), but also, importantly, allow to *bypass kernel-side
> > enforcement* of CAP_BPF/CAP_NET_ADMIN checks for trusted applications and use
> > cases.
>
> One of the hallmarks of the LSM has always been that it is
> non-authoritative: it cannot unilaterally grant access, it can only
> restrict what would have been otherwise permitted on a traditional
> Linux system. Put another way, a LSM should not undermine the Linux
> discretionary access controls, e.g. capabilities.
>
> If there is a problem with the eBPF capability-based access controls,
> that problem needs to be addressed in how the core eBPF code
> implements its capability checks, not by modifying the LSM mechanism
> to bypass these checks.
I think semantics matter here. I wouldn't view this as _bypassing_
capability enforcement: it's just more fine-grained access control.
For example, in many places we have things like:
if (!some_check(...) && !capable(...))
return -EPERM;
I would expect this is a similar logic. An operation can succeed if the
access control requirement is met. The mismatch we have through-out the
kernel is that capability checks aren't strictly done by LSM hooks. And
this series conceptually, I think, doesn't violate that -- it's changing
the logic of the capability checks, not the LSM (i.e. there no LSM hooks
yet here).
The reason CAP_BPF was created was because there was nothing else that
would be fine-grained enough at the time.
--
Kees Cook
next prev parent reply other threads:[~2023-04-12 17:47 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-12 4:32 [PATCH bpf-next 0/8] New BPF map and BTF security LSM hooks Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 1/8] bpf: move unprivileged checks into map_create() and bpf_prog_load() Andrii Nakryiko
2023-04-12 17:49 ` Kees Cook
2023-04-13 0:22 ` Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 2/8] bpf: inline map creation logic in map_create() function Andrii Nakryiko
2023-04-12 17:53 ` Kees Cook
2023-04-13 0:22 ` Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 3/8] bpf: centralize permissions checks for all BPF map types Andrii Nakryiko
2023-04-12 18:01 ` Kees Cook
2023-04-13 0:23 ` Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 4/8] bpf, lsm: implement bpf_map_create_security LSM hook Andrii Nakryiko
2023-04-12 18:20 ` Kees Cook
2023-04-13 0:23 ` Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 5/8] selftests/bpf: validate new " Andrii Nakryiko
2023-04-12 18:23 ` Kees Cook
2023-04-13 0:23 ` Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 6/8] bpf: drop unnecessary bpf_capable() check in BPF_MAP_FREEZE command Andrii Nakryiko
2023-04-12 18:24 ` Kees Cook
2023-04-13 0:17 ` Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 7/8] bpf, lsm: implement bpf_btf_load_security LSM hook Andrii Nakryiko
2023-04-12 16:52 ` Paul Moore
2023-04-13 1:43 ` Andrii Nakryiko
2023-04-13 2:47 ` Paul Moore
2023-04-12 4:33 ` [PATCH bpf-next 8/8] selftests/bpf: enhance lsm_map_create test with BTF LSM control Andrii Nakryiko
2023-04-12 16:49 ` [PATCH bpf-next 0/8] New BPF map and BTF security LSM hooks Paul Moore
2023-04-12 17:47 ` Kees Cook [this message]
2023-04-12 18:06 ` Paul Moore
2023-04-12 18:28 ` Kees Cook
2023-04-12 19:06 ` Paul Moore
2023-04-13 1:43 ` Andrii Nakryiko
2023-04-13 2:56 ` Paul Moore
2023-04-13 5:16 ` Andrii Nakryiko
2023-04-13 15:11 ` Paul Moore
2023-04-17 23:29 ` Andrii Nakryiko
2023-04-18 0:47 ` Casey Schaufler
2023-04-21 0:00 ` Andrii Nakryiko
2023-04-18 14:21 ` Paul Moore
2023-04-21 0:00 ` Andrii Nakryiko
2023-04-21 18:57 ` Kees Cook
2023-04-13 16:54 ` Casey Schaufler
2023-04-17 23:31 ` Andrii Nakryiko
2023-04-13 19:03 ` Jonathan Corbet
2023-04-17 23:28 ` Andrii Nakryiko
2023-04-13 16:27 ` Casey Schaufler
2023-04-17 23:31 ` Andrii Nakryiko
2023-04-17 23:53 ` Casey Schaufler
2023-04-18 0:28 ` Andrii Nakryiko
2023-04-18 0:52 ` Casey Schaufler
2023-04-12 18:38 ` Casey Schaufler
2023-04-14 20:23 ` Dr. Greg
2023-04-17 23:31 ` Andrii Nakryiko
2023-04-19 10:53 ` Dr. Greg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6436eea2.170a0220.97ead.52a8@mx.google.com \
--to=keescook@chromium.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=kpsingh@kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).