From: Paul Moore <paul@paul-moore.com>
To: Andrii Nakryiko <andrii.nakryiko@gmail.com>
Cc: Andrii Nakryiko <andrii@kernel.org>,
bpf@vger.kernel.org, ast@kernel.org, daniel@iogearbox.net,
kpsingh@kernel.org, keescook@chromium.org,
linux-security-module@vger.kernel.org
Subject: Re: [PATCH bpf-next 7/8] bpf, lsm: implement bpf_btf_load_security LSM hook
Date: Wed, 12 Apr 2023 22:47:03 -0400 [thread overview]
Message-ID: <CAHC9VhQ=eHb06g+VOzhfsTPpkoarqk4=LNZQNvh9kMUXjdhJgA@mail.gmail.com> (raw)
In-Reply-To: <CAEf4BzbYK2379c1fbYAwHFBW8UznoozbUA8NhB_uGGtu-3CheA@mail.gmail.com>
On Wed, Apr 12, 2023 at 9:43 PM Andrii Nakryiko
<andrii.nakryiko@gmail.com> wrote:
> On Wed, Apr 12, 2023 at 9:53 AM Paul Moore <paul@paul-moore.com> wrote:
> > On Wed, Apr 12, 2023 at 12:33 AM Andrii Nakryiko <andrii@kernel.org> wrote:
> > >
> > > Add new LSM hook, bpf_btf_load_security, that allows custom LSM security
> > > policies controlling BTF data loading permissions (BPF_BTF_LOAD command
> > > of bpf() syscall) granularly and precisely.
> > >
> > > This complements bpf_map_create_security LSM hook added earlier and
> > > follow the same semantics: 0 means perform standard kernel capabilities-based
> > > checks, negative error rejects BTF object load, while positive one skips
> > > CAP_BPF check and allows BTF data object creation.
> > >
> > > With this hook, together with bpf_map_create_security, we now can also allow
> > > trusted unprivileged process to create BPF maps that require BTF, which
> > > we take advantaged in the next patch to improve the coverage of added
> > > BPF selftest.
> > >
> > > Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
> > > ---
> > > include/linux/lsm_hook_defs.h | 1 +
> > > include/linux/lsm_hooks.h | 13 +++++++++++++
> > > include/linux/security.h | 6 ++++++
> > > kernel/bpf/bpf_lsm.c | 1 +
> > > kernel/bpf/syscall.c | 10 ++++++++++
> > > security/security.c | 4 ++++
> > > 6 files changed, 35 insertions(+)
> >
> > ...
> >
> > > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> > > index 42d8473237ab..bbf70bddc770 100644
> > > --- a/kernel/bpf/syscall.c
> > > +++ b/kernel/bpf/syscall.c
> > > @@ -4449,12 +4449,22 @@ static int bpf_obj_get_info_by_fd(const union bpf_attr *attr,
> > >
> > > static int bpf_btf_load(const union bpf_attr *attr, bpfptr_t uattr, __u32 uattr_size)
> > > {
> > > + int err;
> > > +
> > > if (CHECK_ATTR(BPF_BTF_LOAD))
> > > return -EINVAL;
> > >
> > > + /* security checks */
> > > + err = security_bpf_btf_load(attr);
> > > + if (err < 0)
> > > + return err;
> > > + if (err > 0)
> > > + goto skip_priv_checks;
> > > +
> > > if (!bpf_capable())
> > > return -EPERM;
> > >
> > > +skip_priv_checks:
> > > return btf_new_fd(attr, uattr, uattr_size);
> > > }
> >
> > Beyond the objection I brought up in the patchset cover letter, I
> > believe the work of the security_bpf_btf_load() hook presented here
> > could be done by the existing security_bpf() LSM hook. If you believe
> > that not to be the case, please let me know.
>
> security_bpf() could prevent BTF object loading only, but
> security_bpf_btf_load() can *also* allow *trusted* (according to LSM
> policy) unprivileged process to proceed. So it doesn't seem like they
> are interchangeable.
As discussed in the cover letter thread, I'm opposed to using a LSM
hook to skip/bypass/circumvent/etc. existing capability checks.
--
paul-moore.com
next prev parent reply other threads:[~2023-04-13 2:48 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-12 4:32 [PATCH bpf-next 0/8] New BPF map and BTF security LSM hooks Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 1/8] bpf: move unprivileged checks into map_create() and bpf_prog_load() Andrii Nakryiko
2023-04-12 17:49 ` Kees Cook
2023-04-13 0:22 ` Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 2/8] bpf: inline map creation logic in map_create() function Andrii Nakryiko
2023-04-12 17:53 ` Kees Cook
2023-04-13 0:22 ` Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 3/8] bpf: centralize permissions checks for all BPF map types Andrii Nakryiko
2023-04-12 18:01 ` Kees Cook
2023-04-13 0:23 ` Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 4/8] bpf, lsm: implement bpf_map_create_security LSM hook Andrii Nakryiko
2023-04-12 18:20 ` Kees Cook
2023-04-13 0:23 ` Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 5/8] selftests/bpf: validate new " Andrii Nakryiko
2023-04-12 18:23 ` Kees Cook
2023-04-13 0:23 ` Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 6/8] bpf: drop unnecessary bpf_capable() check in BPF_MAP_FREEZE command Andrii Nakryiko
2023-04-12 18:24 ` Kees Cook
2023-04-13 0:17 ` Andrii Nakryiko
2023-04-12 4:32 ` [PATCH bpf-next 7/8] bpf, lsm: implement bpf_btf_load_security LSM hook Andrii Nakryiko
2023-04-12 16:52 ` Paul Moore
2023-04-13 1:43 ` Andrii Nakryiko
2023-04-13 2:47 ` Paul Moore [this message]
2023-04-12 4:33 ` [PATCH bpf-next 8/8] selftests/bpf: enhance lsm_map_create test with BTF LSM control Andrii Nakryiko
2023-04-12 16:49 ` [PATCH bpf-next 0/8] New BPF map and BTF security LSM hooks Paul Moore
2023-04-12 17:47 ` Kees Cook
2023-04-12 18:06 ` Paul Moore
2023-04-12 18:28 ` Kees Cook
2023-04-12 19:06 ` Paul Moore
2023-04-13 1:43 ` Andrii Nakryiko
2023-04-13 2:56 ` Paul Moore
2023-04-13 5:16 ` Andrii Nakryiko
2023-04-13 15:11 ` Paul Moore
2023-04-17 23:29 ` Andrii Nakryiko
2023-04-18 0:47 ` Casey Schaufler
2023-04-21 0:00 ` Andrii Nakryiko
2023-04-18 14:21 ` Paul Moore
2023-04-21 0:00 ` Andrii Nakryiko
2023-04-21 18:57 ` Kees Cook
2023-04-13 16:54 ` Casey Schaufler
2023-04-17 23:31 ` Andrii Nakryiko
2023-04-13 19:03 ` Jonathan Corbet
2023-04-17 23:28 ` Andrii Nakryiko
2023-04-13 16:27 ` Casey Schaufler
2023-04-17 23:31 ` Andrii Nakryiko
2023-04-17 23:53 ` Casey Schaufler
2023-04-18 0:28 ` Andrii Nakryiko
2023-04-18 0:52 ` Casey Schaufler
2023-04-12 18:38 ` Casey Schaufler
2023-04-14 20:23 ` Dr. Greg
2023-04-17 23:31 ` Andrii Nakryiko
2023-04-19 10:53 ` Dr. Greg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHC9VhQ=eHb06g+VOzhfsTPpkoarqk4=LNZQNvh9kMUXjdhJgA@mail.gmail.com' \
--to=paul@paul-moore.com \
--cc=andrii.nakryiko@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=keescook@chromium.org \
--cc=kpsingh@kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).