From: KP Singh <kpsingh@chromium.org> To: linux-kernel@vger.kernel.org, bpf@vger.kernel.org, linux-security-module@vger.kernel.org Cc: "Alexei Starovoitov" <ast@kernel.org>, "Daniel Borkmann" <daniel@iogearbox.net>, "James Morris" <jmorris@namei.org>, "Kees Cook" <keescook@chromium.org>, "Thomas Garnier" <thgarnie@chromium.org>, "Michael Halcrow" <mhalcrow@google.com>, "Paul Turner" <pjt@google.com>, "Brendan Gregg" <brendan.d.gregg@gmail.com>, "Jann Horn" <jannh@google.com>, "Matthew Garrett" <mjg59@google.com>, "Christian Brauner" <christian@brauner.io>, "Mickaël Salaün" <mic@digikod.net>, "Florent Revest" <revest@chromium.org>, "Martin KaFai Lau" <kafai@fb.com>, "Song Liu" <songliubraving@fb.com>, "Yonghong Song" <yhs@fb.com>, "Serge E. Hallyn" <serge@hallyn.com>, "Mauro Carvalho Chehab" <mchehab+samsung@kernel.org>, "David S. Miller" <davem@davemloft.net>, "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>, "Nicolas Ferre" <nicolas.ferre@microchip.com>, "Stanislav Fomichev" <sdf@google.com>, "Quentin Monnet" <quentin.monnet@netronome.com>, "Andrey Ignatov" <rdna@fb.com>, "Joe Stringer" <joe@wand.net.nz> Subject: [RFC v1 05/14] krsi: Initialize KRSI hooks and create files in securityfs Date: Tue, 10 Sep 2019 13:55:18 +0200 [thread overview] Message-ID: <20190910115527.5235-6-kpsingh@chromium.org> (raw) In-Reply-To: <20190910115527.5235-1-kpsingh@chromium.org> From: KP Singh <kpsingh@google.com> The LSM creates files in securityfs for each hook registered with the LSM. /sys/kernel/security/bpf/<h_name> The initialization of the hooks is done collectively in an internal header "hooks.h" which results in: * Creation of a file for the hook in the securityfs. * Allocation of a krsi_hook data structure which stores a pointer to the dentry of the newly created file in securityfs. * A pointer to the krsi_hook data structure is stored in the private d_fsdata of dentry of the file created in securityFS. These files will later be used to specify an attachment target during BPF_PROG_LOAD. Signed-off-by: KP Singh <kpsingh@google.com> --- security/krsi/Makefile | 4 +- security/krsi/include/hooks.h | 21 ++++++++ security/krsi/include/krsi_fs.h | 19 +++++++ security/krsi/include/krsi_init.h | 45 ++++++++++++++++ security/krsi/krsi.c | 16 +++++- security/krsi/krsi_fs.c | 88 +++++++++++++++++++++++++++++++ 6 files changed, 191 insertions(+), 2 deletions(-) create mode 100644 security/krsi/include/hooks.h create mode 100644 security/krsi/include/krsi_fs.h create mode 100644 security/krsi/include/krsi_init.h create mode 100644 security/krsi/krsi_fs.c diff --git a/security/krsi/Makefile b/security/krsi/Makefile index 660cc1f422fd..4586241f16e1 100644 --- a/security/krsi/Makefile +++ b/security/krsi/Makefile @@ -1 +1,3 @@ -obj-$(CONFIG_SECURITY_KRSI) := krsi.o ops.o +obj-$(CONFIG_SECURITY_KRSI) := krsi.o krsi_fs.o ops.o + +ccflags-y := -I$(srctree)/security/krsi -I$(srctree)/security/krsi/include diff --git a/security/krsi/include/hooks.h b/security/krsi/include/hooks.h new file mode 100644 index 000000000000..e070c452b5de --- /dev/null +++ b/security/krsi/include/hooks.h @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +/* + * The hooks for the KRSI LSM are declared in this file. + * + * This header MUST NOT be included directly and should + * be only used to initialize the hooks lists. + * + * Format: + * + * KRSI_HOOK_INIT(TYPE, NAME, LSM_HOOK, KRSI_HOOK_FN) + * + * KRSI adds one layer of indirection between the name of the hook and the name + * it exposes to the userspace in Security FS to prevent the userspace from + * breaking in case the name of the hook changes in the kernel or if there's + * another LSM hook that maps better to the represented security behaviour. + */ +KRSI_HOOK_INIT(PROCESS_EXECUTION, + process_execution, + bprm_check_security, + krsi_process_execution) diff --git a/security/krsi/include/krsi_fs.h b/security/krsi/include/krsi_fs.h new file mode 100644 index 000000000000..38134661d8d6 --- /dev/null +++ b/security/krsi/include/krsi_fs.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +#ifndef _KRSI_FS_H +#define _KRSI_FS_H + +#include <linux/bpf.h> +#include <linux/fs.h> +#include <linux/types.h> + +bool is_krsi_hook_file(struct file *f); + +/* + * The name of the directory created in securityfs + * + * /sys/kernel/security/<dir_name> + */ +#define KRSI_SFS_NAME "krsi" + +#endif /* _KRSI_FS_H */ diff --git a/security/krsi/include/krsi_init.h b/security/krsi/include/krsi_init.h new file mode 100644 index 000000000000..68755182a031 --- /dev/null +++ b/security/krsi/include/krsi_init.h @@ -0,0 +1,45 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +#ifndef _KRSI_INIT_H +#define _KRSI_INIT_H + +#include "krsi_fs.h" + +enum krsi_hook_type { + PROCESS_EXECUTION, + __MAX_KRSI_HOOK_TYPE, /* delimiter */ +}; + +extern int krsi_fs_initialized; +/* + * The LSM creates one file per hook. + * + * A pointer to krsi_hook data structure is stored in the + * private fsdata of the dentry of the per-hook file created + * in securityfs. + */ +struct krsi_hook { + /* + * The name of the security hook, a file with this name will be created + * in the securityfs. + */ + const char *name; + /* + * The type of the LSM hook, the LSM uses this to index the list of the + * hooks to run the eBPF programs that may have been attached. + */ + enum krsi_hook_type h_type; + /* + * The dentry of the file created in securityfs. + */ + struct dentry *h_dentry; +}; + +extern struct krsi_hook krsi_hooks_list[]; + +#define krsi_for_each_hook(hook) \ + for ((hook) = &krsi_hooks_list[0]; \ + (hook) < &krsi_hooks_list[__MAX_KRSI_HOOK_TYPE]; \ + (hook)++) + +#endif /* _KRSI_INIT_H */ diff --git a/security/krsi/krsi.c b/security/krsi/krsi.c index 9ce4f56fb78d..77d7e2f91172 100644 --- a/security/krsi/krsi.c +++ b/security/krsi/krsi.c @@ -2,13 +2,27 @@ #include <linux/lsm_hooks.h> +#include "krsi_init.h" + +struct krsi_hook krsi_hooks_list[] = { + #define KRSI_HOOK_INIT(TYPE, NAME, H, I) \ + [TYPE] = { \ + .h_type = TYPE, \ + .name = #NAME, \ + }, + #include "hooks.h" + #undef KRSI_HOOK_INIT +}; + static int krsi_process_execution(struct linux_binprm *bprm) { return 0; } static struct security_hook_list krsi_hooks[] __lsm_ro_after_init = { - LSM_HOOK_INIT(bprm_check_security, krsi_process_execution), + #define KRSI_HOOK_INIT(T, N, HOOK, IMPL) LSM_HOOK_INIT(HOOK, IMPL), + #include "hooks.h" + #undef KRSI_HOOK_INIT }; static int __init krsi_init(void) diff --git a/security/krsi/krsi_fs.c b/security/krsi/krsi_fs.c new file mode 100644 index 000000000000..604f826cee5c --- /dev/null +++ b/security/krsi/krsi_fs.c @@ -0,0 +1,88 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/err.h> +#include <linux/init.h> +#include <linux/file.h> +#include <linux/fs.h> +#include <linux/types.h> +#include <linux/security.h> + +#include "krsi_fs.h" +#include "krsi_init.h" + +extern struct krsi_hook krsi_hooks_list[]; + +static struct dentry *krsi_dir; + +static const struct file_operations krsi_hook_ops = { + .llseek = generic_file_llseek, +}; + +int krsi_fs_initialized; + +bool is_krsi_hook_file(struct file *f) +{ + return f->f_op == &krsi_hook_ops; +} + +static void __init krsi_free_hook(struct krsi_hook *h) +{ + securityfs_remove(h->h_dentry); + h->h_dentry = NULL; +} + +static int __init krsi_init_hook(struct krsi_hook *h, struct dentry *parent) +{ + struct dentry *h_dentry; + int ret; + + h_dentry = securityfs_create_file(h->name, 0600, parent, + NULL, &krsi_hook_ops); + + if (IS_ERR(h_dentry)) + return PTR_ERR(h_dentry); + h_dentry->d_fsdata = h; + h->h_dentry = h_dentry; + return 0; + +error: + securityfs_remove(h_dentry); + return ret; +} + +static int __init krsi_fs_init(void) +{ + + struct krsi_hook *hook; + int ret; + + krsi_dir = securityfs_create_dir(KRSI_SFS_NAME, NULL); + if (IS_ERR(krsi_dir)) { + ret = PTR_ERR(krsi_dir); + pr_err("Unable to create krsi sysfs dir: %d\n", ret); + krsi_dir = NULL; + return ret; + } + + /* + * If there is an error in initializing a hook, the initialization + * logic makes sure that it has been freed, but this means that + * cleanup should be called for all the other hooks. The cleanup + * logic handles uninitialized data. + */ + krsi_for_each_hook(hook) { + ret = krsi_init_hook(hook, krsi_dir); + if (ret < 0) + goto error; + } + + krsi_fs_initialized = 1; + return 0; +error: + krsi_for_each_hook(hook) + krsi_free_hook(hook); + securityfs_remove(krsi_dir); + return ret; +} + +late_initcall(krsi_fs_init); -- 2.20.1
next prev parent reply other threads:[~2019-09-10 11:56 UTC|newest] Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-09-10 11:55 [RFC v1 00/14] Kernel Runtime Security Instrumentation KP Singh 2019-09-10 11:55 ` [RFC v1 01/14] krsi: Add a skeleton and config options for the KRSI LSM KP Singh 2019-09-10 11:55 ` [RFC v1 02/14] krsi: Introduce types for KRSI eBPF KP Singh 2019-09-10 11:55 ` [RFC v1 03/14] bpf: krsi: sync BPF UAPI header with tools KP Singh 2019-09-10 11:55 ` [RFC v1 04/14] krsi: Add support in libbpf for BPF_PROG_TYPE_KRSI KP Singh 2019-09-14 16:09 ` Yonghong Song 2019-09-10 11:55 ` KP Singh [this message] 2019-09-14 16:26 ` [RFC v1 05/14] krsi: Initialize KRSI hooks and create files in securityfs Yonghong Song 2019-09-10 11:55 ` [RFC v1 06/14] krsi: Implement eBPF operations, attachment and execution KP Singh 2019-09-14 16:56 ` Yonghong Song 2019-09-15 0:37 ` Yonghong Song 2019-09-10 11:55 ` [RFC v1 07/14] krsi: Check for premissions on eBPF attachment KP Singh 2019-09-10 11:55 ` [RFC v1 08/14] krsi: Show attached program names in hook read handler KP Singh 2019-09-10 11:55 ` [RFC v1 09/14] krsi: Add a helper function for bpf_perf_event_output KP Singh 2019-09-14 18:23 ` Yonghong Song 2019-09-10 11:55 ` [RFC v1 10/14] krsi: Handle attachment of the same program KP Singh 2019-09-10 11:55 ` [RFC v1 11/14] krsi: Pin argument pages in bprm_check_security hook KP Singh 2019-09-10 11:55 ` [RFC v1 12/14] krsi: Add an eBPF helper function to get the value of an env variable KP Singh 2019-09-15 0:16 ` Yonghong Song 2019-09-16 13:00 ` KP Singh 2019-09-17 16:58 ` Yonghong Song 2019-09-17 19:36 ` KP Singh 2019-09-10 11:55 ` [RFC v1 13/14] krsi: Provide an example to read and log environment variables KP Singh 2019-09-15 0:24 ` Yonghong Song 2019-09-10 11:55 ` [RFC v1 14/14] krsi: Pin arg pages only when needed KP Singh 2019-09-15 0:33 ` Yonghong Song 2019-09-15 1:40 ` KP Singh 2019-09-15 19:45 ` Yonghong Song
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190910115527.5235-6-kpsingh@chromium.org \ --to=kpsingh@chromium.org \ --cc=ast@kernel.org \ --cc=bpf@vger.kernel.org \ --cc=brendan.d.gregg@gmail.com \ --cc=christian@brauner.io \ --cc=daniel@iogearbox.net \ --cc=davem@davemloft.net \ --cc=gregkh@linuxfoundation.org \ --cc=jannh@google.com \ --cc=jmorris@namei.org \ --cc=joe@wand.net.nz \ --cc=kafai@fb.com \ --cc=keescook@chromium.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=mchehab+samsung@kernel.org \ --cc=mhalcrow@google.com \ --cc=mic@digikod.net \ --cc=mjg59@google.com \ --cc=nicolas.ferre@microchip.com \ --cc=pjt@google.com \ --cc=quentin.monnet@netronome.com \ --cc=rdna@fb.com \ --cc=revest@chromium.org \ --cc=sdf@google.com \ --cc=serge@hallyn.com \ --cc=songliubraving@fb.com \ --cc=thgarnie@chromium.org \ --cc=yhs@fb.com \ --subject='Re: [RFC v1 05/14] krsi: Initialize KRSI hooks and create files in securityfs' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).