From: KP Singh <kpsingh@chromium.org>
To: Andrii Nakryiko <andrii.nakryiko@gmail.com>
Cc: open list <linux-kernel@vger.kernel.org>,
bpf <bpf@vger.kernel.org>,
linux-security-module@vger.kernel.org,
Brendan Jackman <jackmanb@google.com>,
Florent Revest <revest@google.com>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
James Morris <jmorris@namei.org>,
Kees Cook <keescook@chromium.org>, Paul Turner <pjt@google.com>,
Jann Horn <jannh@google.com>,
Florent Revest <revest@chromium.org>,
Brendan Jackman <jackmanb@chromium.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: Re: [PATCH bpf-next v5 4/7] bpf: lsm: Implement attach, detach and execution
Date: Tue, 24 Mar 2020 20:00:45 +0100 [thread overview]
Message-ID: <20200324190045.GA1891@chromium.org> (raw)
In-Reply-To: <CAEf4BzaceUCEw+-s9EM3rvz+KbLrvBbUfa5e0CSbtkOytF+RsQ@mail.gmail.com>
On 23-Mär 13:18, Andrii Nakryiko wrote:
> On Mon, Mar 23, 2020 at 9:45 AM KP Singh <kpsingh@chromium.org> wrote:
> >
> > From: KP Singh <kpsingh@google.com>
> >
> > JITed BPF programs are dynamically attached to the LSM hooks
> > using BPF trampolines. The trampoline prologue generates code to handle
> > conversion of the signature of the hook to the appropriate BPF context.
> >
> > The allocated trampoline programs are attached to the nop functions
> > initialized as LSM hooks.
> >
> > BPF_PROG_TYPE_LSM programs must have a GPL compatible license and
> > and need CAP_SYS_ADMIN (required for loading eBPF programs).
> >
> > Upon attachment:
> >
> > * A BPF fexit trampoline is used for LSM hooks with a void return type.
> > * A BPF fmod_ret trampoline is used for LSM hooks which return an
> > int. The attached programs can override the return value of the
> > bpf LSM hook to indicate a MAC Policy decision.
> >
> > Signed-off-by: KP Singh <kpsingh@google.com>
> > Reviewed-by: Brendan Jackman <jackmanb@google.com>
> > Reviewed-by: Florent Revest <revest@google.com>
> > ---
> > include/linux/bpf.h | 4 ++++
> > include/linux/bpf_lsm.h | 11 +++++++++++
> > kernel/bpf/bpf_lsm.c | 29 +++++++++++++++++++++++++++++
> > kernel/bpf/btf.c | 9 ++++++++-
> > kernel/bpf/syscall.c | 26 ++++++++++++++++++++++----
> > kernel/bpf/trampoline.c | 17 +++++++++++++----
> > kernel/bpf/verifier.c | 19 +++++++++++++++----
> > 7 files changed, 102 insertions(+), 13 deletions(-)
> >
>
> [...]
>
> >
> > +#define BPF_LSM_SYM_PREFX "bpf_lsm_"
> > +
> > +int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
> > + const struct bpf_prog *prog)
> > +{
> > + /* Only CAP_MAC_ADMIN users are allowed to make changes to LSM hooks
> > + */
> > + if (!capable(CAP_MAC_ADMIN))
> > + return -EPERM;
> > +
> > + if (!prog->gpl_compatible) {
> > + bpf_log(vlog,
> > + "LSM programs must have a GPL compatible license\n");
> > + return -EINVAL;
> > + }
> > +
> > + if (strncmp(BPF_LSM_SYM_PREFX, prog->aux->attach_func_name,
> > + strlen(BPF_LSM_SYM_PREFX))) {
>
> sizeof(BPF_LSM_SYM_PREFIX) - 1?
Thanks, done.
>
> > + bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n",
> > + prog->aux->attach_btf_id, prog->aux->attach_func_name);
> > + return -EINVAL;
> > + }
> > +
> > + return 0;
> > +}
> > +
>
> [...]
>
> > @@ -2367,10 +2369,24 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog)
> > struct file *link_file;
> > int link_fd, err;
> >
> > - if (prog->expected_attach_type != BPF_TRACE_FENTRY &&
> > - prog->expected_attach_type != BPF_TRACE_FEXIT &&
> > - prog->expected_attach_type != BPF_MODIFY_RETURN &&
> > - prog->type != BPF_PROG_TYPE_EXT) {
> > + switch (prog->type) {
> > + case BPF_PROG_TYPE_TRACING:
> > + if (prog->expected_attach_type != BPF_TRACE_FENTRY &&
> > + prog->expected_attach_type != BPF_TRACE_FEXIT &&
> > + prog->expected_attach_type != BPF_MODIFY_RETURN) {
> > + err = -EINVAL;
> > + goto out_put_prog;
> > + }
> > + break;
> > + case BPF_PROG_TYPE_EXT:
>
> It looks like an omission that we don't enforce expected_attach_type
> to be 0 here. Should we fix it until it's too late?
Done.
>
> > + break;
> > + case BPF_PROG_TYPE_LSM:
> > + if (prog->expected_attach_type != BPF_LSM_MAC) {
> > + err = -EINVAL;
> > + goto out_put_prog;
> > + }
> > + break;
> > + default:
> > err = -EINVAL;
> > goto out_put_prog;
> > }
> > @@ -2452,12 +2468,14 @@ static int bpf_raw_tracepoint_open(const union bpf_attr *attr)
> > if (prog->type != BPF_PROG_TYPE_RAW_TRACEPOINT &&
> > prog->type != BPF_PROG_TYPE_TRACING &&
> > prog->type != BPF_PROG_TYPE_EXT &&
> > + prog->type != BPF_PROG_TYPE_LSM &&
> > prog->type != BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE) {
> > err = -EINVAL;
> > goto out_put_prog;
> > }
> >
> > if (prog->type == BPF_PROG_TYPE_TRACING ||
> > + prog->type == BPF_PROG_TYPE_LSM ||
> > prog->type == BPF_PROG_TYPE_EXT) {
>
>
> can you please refactor this into a nicer explicit switch instead of
> combination of if/elses?
Done.
- KP
>
> > if (attr->raw_tracepoint.name) {
> > /* The attach point for this category of programs
> > diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> > index f30bca2a4d01..9be85aa4ec5f 100644
> > --- a/kernel/bpf/trampoline.c
> > +++ b/kernel/bpf/trampoline.c
> > @@ -6,6 +6,7 @@
> > #include <linux/ftrace.h>
> > #include <linux/rbtree_latch.h>
> > #include <linux/perf_event.h>
> > +#include <linux/btf.h>
> >
>
> [...]
next prev parent reply other threads:[~2020-03-24 19:00 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-23 16:44 [PATCH bpf-next v5 0/8] MAC and Audit policy using eBPF (KRSI) KP Singh
2020-03-23 16:44 ` [PATCH bpf-next v5 1/7] bpf: Introduce BPF_PROG_TYPE_LSM KP Singh
2020-03-23 19:02 ` Yonghong Song
2020-03-23 16:44 ` [PATCH bpf-next v5 2/7] security: Refactor declaration of LSM hooks KP Singh
2020-03-23 19:33 ` Kees Cook
2020-03-23 19:56 ` Andrii Nakryiko
2020-03-24 16:06 ` KP Singh
2020-03-23 16:44 ` [PATCH bpf-next v5 3/7] bpf: lsm: provide attachment points for BPF LSM programs KP Singh
2020-03-23 19:04 ` Yonghong Song
2020-03-23 19:33 ` Kees Cook
2020-03-23 19:59 ` Andrii Nakryiko
2020-03-24 10:39 ` KP Singh
2020-03-24 16:12 ` KP Singh
2020-03-24 21:26 ` Andrii Nakryiko
2020-03-24 22:39 ` KP Singh
2020-03-23 16:44 ` [PATCH bpf-next v5 4/7] bpf: lsm: Implement attach, detach and execution KP Singh
2020-03-23 19:16 ` Yonghong Song
2020-03-23 19:44 ` KP Singh
2020-03-23 20:18 ` Andrii Nakryiko
2020-03-24 19:00 ` KP Singh [this message]
2020-03-24 14:35 ` Stephen Smalley
2020-03-24 14:50 ` KP Singh
2020-03-24 14:58 ` Stephen Smalley
2020-03-24 16:25 ` Casey Schaufler
2020-03-24 17:49 ` Stephen Smalley
2020-03-24 18:01 ` Kees Cook
2020-03-24 18:06 ` KP Singh
2020-03-24 18:21 ` Stephen Smalley
2020-03-24 18:27 ` KP Singh
2020-03-24 18:31 ` KP Singh
2020-03-24 18:34 ` Kees Cook
2020-03-24 18:33 ` Kees Cook
2020-03-23 16:44 ` [PATCH bpf-next v5 5/7] bpf: lsm: Initialize the BPF LSM hooks KP Singh
2020-03-23 19:44 ` Kees Cook
2020-03-23 19:47 ` KP Singh
2020-03-23 20:21 ` Andrii Nakryiko
2020-03-23 20:47 ` Casey Schaufler
2020-03-23 21:44 ` Kees Cook
2020-03-24 1:13 ` Casey Schaufler
2020-03-24 1:52 ` KP Singh
2020-03-24 14:37 ` Stephen Smalley
2020-03-24 14:42 ` KP Singh
2020-03-24 14:51 ` Stephen Smalley
2020-03-24 14:51 ` KP Singh
2020-03-24 17:57 ` Kees Cook
2020-03-23 16:44 ` [PATCH bpf-next v5 6/7] tools/libbpf: Add support for BPF_PROG_TYPE_LSM KP Singh
2020-03-23 19:21 ` Yonghong Song
2020-03-23 20:25 ` Andrii Nakryiko
2020-03-24 1:57 ` KP Singh
2020-03-23 16:44 ` [PATCH bpf-next v5 7/7] bpf: lsm: Add selftests " KP Singh
2020-03-23 20:04 ` Yonghong Song
2020-03-24 20:04 ` KP Singh
2020-03-24 23:54 ` Andrii Nakryiko
2020-03-25 0:36 ` KP Singh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200324190045.GA1891@chromium.org \
--to=kpsingh@chromium.org \
--cc=andrii.nakryiko@gmail.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=gregkh@linuxfoundation.org \
--cc=jackmanb@chromium.org \
--cc=jackmanb@google.com \
--cc=jannh@google.com \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=pjt@google.com \
--cc=revest@chromium.org \
--cc=revest@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).