From: Mikko Ylinen <mikko.ylinen@linux.intel.com>
To: KP Singh <kpsingh@chromium.org>,
linux-kernel@vger.kernel.org, bpf@vger.kernel.org,
linux-security-module@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
James Morris <jmorris@namei.org>,
Kees Cook <keescook@chromium.org>, Paul Turner <pjt@google.com>,
Jann Horn <jannh@google.com>,
Florent Revest <revest@chromium.org>,
Brendan Jackman <jackmanb@chromium.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: Re: [PATCH bpf-next v9 0/8] MAC and Audit policy using eBPF (KRSI)
Date: Wed, 29 Apr 2020 15:31:47 +0300 [thread overview]
Message-ID: <0165887d-e9d0-c03e-18b9-72e74a0cbd59@linux.intel.com> (raw)
In-Reply-To: <20200329004356.27286-1-kpsingh@chromium.org>
Hi,
On 29/03/2020 02:43, KP Singh wrote:
> # How does it work?
>
> The patchset introduces a new eBPF (https://docs.cilium.io/en/v1.6/bpf/)
> program type BPF_PROG_TYPE_LSM which can only be attached to LSM hooks.
> Loading and attachment of BPF programs requires CAP_SYS_ADMIN.
>
> The new LSM registers nop functions (bpf_lsm_<hook_name>) as LSM hook
> callbacks. Their purpose is to provide a definite point where BPF
> programs can be attached as BPF_TRAMP_MODIFY_RETURN trampoline programs
> for hooks that return an int, and BPF_TRAMP_FEXIT trampoline programs
> for void LSM hooks.
I have two systems (a NUC and a qemu VM) that fail to boot if I enable
the BPF LSM without enabling SELinux first. Anything I might be missing
or are you able to trigger it too?
For instance, the following additional cmdline args: "lsm.debug=1
lsm="capability,apparmor,bpf" results in:
[ 1.251889] Call Trace:
[ 1.252344] dump_stack+0x57/0x7a
[ 1.252951] panic+0xe6/0x2a4
[ 1.253497] ? printk+0x43/0x45
[ 1.254075] mount_block_root+0x30c/0x31b
[ 1.254798] mount_root+0x78/0x7b
[ 1.255417] prepare_namespace+0x13a/0x16b
[ 1.256168] kernel_init_freeable+0x210/0x222
[ 1.257021] ? rest_init+0xa5/0xa5
[ 1.257639] kernel_init+0x9/0xfb
[ 1.258074] ret_from_fork+0x35/0x40
[ 1.258885] Kernel Offset: 0x11000000 from 0xffffffff81000000
(relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 1.264046] ---[ end Kernel panic - not syncing: VFS: Unable to mount
root fs on unknown-block(253,3)
Taking out "bpf" or adding "selinux" before it boots OK. I've tried
with both 5.7-rc2 and -rc3.
LSM logs:
[ 0.267219] LSM: Security Framework initializing
[ 0.267844] LSM: first ordering: capability (enabled)
[ 0.267870] LSM: cmdline ignored: capability
[ 0.268869] LSM: cmdline ordering: apparmor (enabled)
[ 0.269508] LSM: cmdline ordering: bpf (enabled)
[ 0.269869] LSM: cmdline disabled: selinux
[ 0.270377] LSM: cmdline disabled: integrity
[ 0.270869] LSM: exclusive chosen: apparmor
[ 0.271869] LSM: cred blob size = 8
[ 0.272354] LSM: file blob size = 24
[ 0.272869] LSM: inode blob size = 0
[ 0.273362] LSM: ipc blob size = 0
[ 0.273869] LSM: msg_msg blob size = 0
[ 0.274352] LSM: task blob size = 32
[ 0.274873] LSM: initializing capability
[ 0.275381] LSM: initializing apparmor
[ 0.275880] AppArmor: AppArmor initialized
[ 0.276437] LSM: initializing bpf
[ 0.276871] LSM support for eBPF active
-- Regards, Mikko
next prev parent reply other threads:[~2020-04-29 12:31 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-29 0:43 [PATCH bpf-next v9 0/8] MAC and Audit policy using eBPF (KRSI) KP Singh
2020-03-29 0:43 ` [PATCH bpf-next v9 1/8] bpf: Introduce BPF_PROG_TYPE_LSM KP Singh
2020-03-29 0:43 ` [PATCH bpf-next v9 2/8] security: Refactor declaration of LSM hooks KP Singh
2020-03-29 0:43 ` [PATCH bpf-next v9 3/8] bpf: lsm: provide attachment points for BPF LSM programs KP Singh
2020-03-29 0:43 ` [PATCH bpf-next v9 4/8] bpf: lsm: Implement attach, detach and execution KP Singh
2020-03-29 0:43 ` [PATCH bpf-next v9 5/8] bpf: lsm: Initialize the BPF LSM hooks KP Singh
2020-03-29 0:43 ` [PATCH bpf-next v9 6/8] tools/libbpf: Add support for BPF_PROG_TYPE_LSM KP Singh
2020-03-29 0:43 ` [PATCH bpf-next v9 7/8] bpf: lsm: Add selftests " KP Singh
2020-04-02 0:09 ` Alexei Starovoitov
2020-04-02 4:03 ` KP Singh
2020-04-02 4:30 ` Alexei Starovoitov
2020-04-02 5:15 ` Jann Horn
2020-04-02 11:53 ` KP Singh
2020-04-02 14:38 ` Jann Horn
2020-04-02 14:40 ` KP Singh
2020-04-02 15:57 ` Alexei Starovoitov
2020-03-29 0:43 ` [PATCH bpf-next v9 8/8] bpf: lsm: Add Documentation KP Singh
2020-03-29 23:46 ` [PATCH bpf-next v9 0/8] MAC and Audit policy using eBPF (KRSI) Daniel Borkmann
2020-04-29 12:31 ` Mikko Ylinen [this message]
2020-04-29 12:34 ` KP Singh
2020-04-29 12:45 ` Mikko Ylinen
2020-04-29 16:17 ` KP Singh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0165887d-e9d0-c03e-18b9-72e74a0cbd59@linux.intel.com \
--to=mikko.ylinen@linux.intel.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=gregkh@linuxfoundation.org \
--cc=jackmanb@chromium.org \
--cc=jannh@google.com \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=kpsingh@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=pjt@google.com \
--cc=revest@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).