From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 37C6DC43331 for ; Mon, 23 Mar 2020 20:19:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 05F5420714 for ; Mon, 23 Mar 2020 20:19:11 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MuGyBhSE" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726643AbgCWUTH (ORCPT ); Mon, 23 Mar 2020 16:19:07 -0400 Received: from mail-qk1-f195.google.com ([209.85.222.195]:33236 "EHLO mail-qk1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725830AbgCWUTH (ORCPT ); Mon, 23 Mar 2020 16:19:07 -0400 Received: by mail-qk1-f195.google.com with SMTP id v7so7269900qkc.0; Mon, 23 Mar 2020 13:19:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=TZ+ZwfTMYYsGD6syPZhmYKv+gyxadYlXHYerkec/Prc=; b=MuGyBhSE7OGl8aZJaCuWgDEd5sIIQ085S1F5HqBLnJoCv13/Zxds8/CWAFZYTt8/9J S840MrwKl0aeLkDA8pfk7R5jAyjYojOp6foFlae/XPQZf5nLwd/5/q5iHYxyAEFUKWeZ /je1mmdRsTf0C2Ype/Ht09cqC9bE3WSU9+MS/GjSn8uYJVF6PvDEsem6wh7+W9EPTH0i fbqQ97VnVOYnp0XQ9JUq6P72J+8z2r7IDsoNvUj2edBPIIzcVVItedYbKP/GoatZxyag olGaneNwEWpjfjuk46k39KmpbnhieLBIA2xrZRFhDLcKiu7nLamj7QtNpYXHIqbodcXa rX3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=TZ+ZwfTMYYsGD6syPZhmYKv+gyxadYlXHYerkec/Prc=; b=IrgZVHZaQ90htltCOkZ2lhTQkLVp6e0H/mL6kbtEga+BmHCagvSv/AZgjRLqq+hcAn ruTBPAKoirHAH7nU6AGcFLoTwNVjR3Vt0AnOjIOx6Y5k4D8RAM1LTFEgMeordsEmekX7 PxwIhkZraSfDfg49BP3EnYYBZo5vrQ6QtOKAI0znwVV0PYKNqrAf9gj9vDdWLkNYxYNE qKDzpJmF0bcaAKKScHBvx+tQpPVTmYRw8eQb1VoyEwQLvYbKI7NjwUz8bijZU2esiODJ ptDsoXYEWze5/DE5gnsBYy5xc4ECjrEvXi1Ye0GNNhSUEms+EfhO18UzdWvMWkxR3shw g4IA== X-Gm-Message-State: ANhLgQ0ps0HKX6jROyTCyD5i3H09Td1eiyds/LzNcHcvC7+kDd2npzkj e3tEwSUERNK8e7d3Wj2ghTevwxE1BNYCZvVWYSo= X-Google-Smtp-Source: ADFU+vsHBUxL6es42p14wjLjJwEUAXo+ilHYJpl09AVNoQ6QYphYryIlVRToeHqmy7Gxz1bQ/1tZVVgMcOW5Vfq5RYo= X-Received: by 2002:a37:e40d:: with SMTP id y13mr22599759qkf.39.1584994744820; Mon, 23 Mar 2020 13:19:04 -0700 (PDT) MIME-Version: 1.0 References: <20200323164415.12943-1-kpsingh@chromium.org> <20200323164415.12943-5-kpsingh@chromium.org> In-Reply-To: <20200323164415.12943-5-kpsingh@chromium.org> From: Andrii Nakryiko Date: Mon, 23 Mar 2020 13:18:54 -0700 Message-ID: Subject: Re: [PATCH bpf-next v5 4/7] bpf: lsm: Implement attach, detach and execution To: KP Singh Cc: open list , bpf , linux-security-module@vger.kernel.org, Brendan Jackman , Florent Revest , Alexei Starovoitov , Daniel Borkmann , James Morris , Kees Cook , Paul Turner , Jann Horn , Florent Revest , Brendan Jackman , Greg Kroah-Hartman Content-Type: text/plain; charset="UTF-8" Sender: bpf-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org On Mon, Mar 23, 2020 at 9:45 AM KP Singh wrote: > > From: KP Singh > > JITed BPF programs are dynamically attached to the LSM hooks > using BPF trampolines. The trampoline prologue generates code to handle > conversion of the signature of the hook to the appropriate BPF context. > > The allocated trampoline programs are attached to the nop functions > initialized as LSM hooks. > > BPF_PROG_TYPE_LSM programs must have a GPL compatible license and > and need CAP_SYS_ADMIN (required for loading eBPF programs). > > Upon attachment: > > * A BPF fexit trampoline is used for LSM hooks with a void return type. > * A BPF fmod_ret trampoline is used for LSM hooks which return an > int. The attached programs can override the return value of the > bpf LSM hook to indicate a MAC Policy decision. > > Signed-off-by: KP Singh > Reviewed-by: Brendan Jackman > Reviewed-by: Florent Revest > --- > include/linux/bpf.h | 4 ++++ > include/linux/bpf_lsm.h | 11 +++++++++++ > kernel/bpf/bpf_lsm.c | 29 +++++++++++++++++++++++++++++ > kernel/bpf/btf.c | 9 ++++++++- > kernel/bpf/syscall.c | 26 ++++++++++++++++++++++---- > kernel/bpf/trampoline.c | 17 +++++++++++++---- > kernel/bpf/verifier.c | 19 +++++++++++++++---- > 7 files changed, 102 insertions(+), 13 deletions(-) > [...] > > +#define BPF_LSM_SYM_PREFX "bpf_lsm_" > + > +int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, > + const struct bpf_prog *prog) > +{ > + /* Only CAP_MAC_ADMIN users are allowed to make changes to LSM hooks > + */ > + if (!capable(CAP_MAC_ADMIN)) > + return -EPERM; > + > + if (!prog->gpl_compatible) { > + bpf_log(vlog, > + "LSM programs must have a GPL compatible license\n"); > + return -EINVAL; > + } > + > + if (strncmp(BPF_LSM_SYM_PREFX, prog->aux->attach_func_name, > + strlen(BPF_LSM_SYM_PREFX))) { sizeof(BPF_LSM_SYM_PREFIX) - 1? > + bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n", > + prog->aux->attach_btf_id, prog->aux->attach_func_name); > + return -EINVAL; > + } > + > + return 0; > +} > + [...] > @@ -2367,10 +2369,24 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog) > struct file *link_file; > int link_fd, err; > > - if (prog->expected_attach_type != BPF_TRACE_FENTRY && > - prog->expected_attach_type != BPF_TRACE_FEXIT && > - prog->expected_attach_type != BPF_MODIFY_RETURN && > - prog->type != BPF_PROG_TYPE_EXT) { > + switch (prog->type) { > + case BPF_PROG_TYPE_TRACING: > + if (prog->expected_attach_type != BPF_TRACE_FENTRY && > + prog->expected_attach_type != BPF_TRACE_FEXIT && > + prog->expected_attach_type != BPF_MODIFY_RETURN) { > + err = -EINVAL; > + goto out_put_prog; > + } > + break; > + case BPF_PROG_TYPE_EXT: It looks like an omission that we don't enforce expected_attach_type to be 0 here. Should we fix it until it's too late? > + break; > + case BPF_PROG_TYPE_LSM: > + if (prog->expected_attach_type != BPF_LSM_MAC) { > + err = -EINVAL; > + goto out_put_prog; > + } > + break; > + default: > err = -EINVAL; > goto out_put_prog; > } > @@ -2452,12 +2468,14 @@ static int bpf_raw_tracepoint_open(const union bpf_attr *attr) > if (prog->type != BPF_PROG_TYPE_RAW_TRACEPOINT && > prog->type != BPF_PROG_TYPE_TRACING && > prog->type != BPF_PROG_TYPE_EXT && > + prog->type != BPF_PROG_TYPE_LSM && > prog->type != BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE) { > err = -EINVAL; > goto out_put_prog; > } > > if (prog->type == BPF_PROG_TYPE_TRACING || > + prog->type == BPF_PROG_TYPE_LSM || > prog->type == BPF_PROG_TYPE_EXT) { can you please refactor this into a nicer explicit switch instead of combination of if/elses? > if (attr->raw_tracepoint.name) { > /* The attach point for this category of programs > diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c > index f30bca2a4d01..9be85aa4ec5f 100644 > --- a/kernel/bpf/trampoline.c > +++ b/kernel/bpf/trampoline.c > @@ -6,6 +6,7 @@ > #include > #include > #include > +#include > [...]