From: Stanislav Fomichev <sdf@google.com>
To: netdev@vger.kernel.org, bpf@vger.kernel.org
Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
Stanislav Fomichev <sdf@google.com>
Subject: [PATCH bpf-next v6 06/10] bpf: allow writing to a subset of sock fields from lsm progtype
Date: Fri, 29 Apr 2022 14:15:36 -0700 [thread overview]
Message-ID: <20220429211540.715151-7-sdf@google.com> (raw)
In-Reply-To: <20220429211540.715151-1-sdf@google.com>
For now, allow only the obvious ones, like sk_priority and sk_mark.
Signed-off-by: Stanislav Fomichev <sdf@google.com>
---
kernel/bpf/bpf_lsm.c | 58 +++++++++++++++++++++++++++++++++++++++++++
kernel/bpf/verifier.c | 3 ++-
2 files changed, 60 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
index 1079c747e061..64406d39e861 100644
--- a/kernel/bpf/bpf_lsm.c
+++ b/kernel/bpf/bpf_lsm.c
@@ -302,7 +302,65 @@ bool bpf_lsm_is_sleepable_hook(u32 btf_id)
const struct bpf_prog_ops lsm_prog_ops = {
};
+static int lsm_btf_struct_access(struct bpf_verifier_log *log,
+ const struct btf *btf,
+ const struct btf_type *t, int off,
+ int size, enum bpf_access_type atype,
+ u32 *next_btf_id,
+ enum bpf_type_flag *flag)
+{
+ const struct btf_type *sock_type;
+ struct btf *btf_vmlinux;
+ s32 type_id;
+ size_t end;
+
+ if (atype == BPF_READ)
+ return btf_struct_access(log, btf, t, off, size, atype, next_btf_id,
+ flag);
+
+ btf_vmlinux = bpf_get_btf_vmlinux();
+ if (!btf_vmlinux) {
+ bpf_log(log, "no vmlinux btf\n");
+ return -EOPNOTSUPP;
+ }
+
+ type_id = btf_find_by_name_kind(btf_vmlinux, "sock", BTF_KIND_STRUCT);
+ if (type_id < 0) {
+ bpf_log(log, "'struct sock' not found in vmlinux btf\n");
+ return -EINVAL;
+ }
+
+ sock_type = btf_type_by_id(btf_vmlinux, type_id);
+
+ if (t != sock_type) {
+ bpf_log(log, "only 'struct sock' writes are supported\n");
+ return -EACCES;
+ }
+
+ switch (off) {
+ case bpf_ctx_range(struct sock, sk_priority):
+ end = offsetofend(struct sock, sk_priority);
+ break;
+ case bpf_ctx_range(struct sock, sk_mark):
+ end = offsetofend(struct sock, sk_mark);
+ break;
+ default:
+ bpf_log(log, "no write support to 'struct sock' at off %d\n", off);
+ return -EACCES;
+ }
+
+ if (off + size > end) {
+ bpf_log(log,
+ "write access at off %d with size %d beyond the member of 'struct sock' ended at %zu\n",
+ off, size, end);
+ return -EACCES;
+ }
+
+ return NOT_INIT;
+}
+
const struct bpf_verifier_ops lsm_verifier_ops = {
.get_func_proto = bpf_lsm_func_proto,
.is_valid_access = btf_ctx_access,
+ .btf_struct_access = lsm_btf_struct_access,
};
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 99703d96c579..2ada6fd48638 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -13130,7 +13130,8 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
insn->code = BPF_LDX | BPF_PROBE_MEM |
BPF_SIZE((insn)->code);
env->prog->aux->num_exentries++;
- } else if (resolve_prog_type(env->prog) != BPF_PROG_TYPE_STRUCT_OPS) {
+ } else if (resolve_prog_type(env->prog) != BPF_PROG_TYPE_STRUCT_OPS &&
+ resolve_prog_type(env->prog) != BPF_PROG_TYPE_LSM) {
verbose(env, "Writes through BTF pointers are not allowed\n");
return -EINVAL;
}
--
2.36.0.464.gb9c8b46e94-goog
next prev parent reply other threads:[~2022-04-29 21:16 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-29 21:15 [PATCH bpf-next v6 00/10] bpf: cgroup_sock lsm flavor Stanislav Fomichev
2022-04-29 21:15 ` [PATCH bpf-next v6 01/10] bpf: add bpf_func_t and trampoline helpers Stanislav Fomichev
2022-04-29 21:15 ` [PATCH bpf-next v6 02/10] bpf: convert cgroup_bpf.progs to hlist Stanislav Fomichev
2022-05-18 15:16 ` Jakub Sitnicki
2022-04-29 21:15 ` [PATCH bpf-next v6 03/10] bpf: per-cgroup lsm flavor Stanislav Fomichev
2022-05-06 23:02 ` Martin KaFai Lau
2022-05-09 23:38 ` Stanislav Fomichev
2022-05-10 7:13 ` Martin KaFai Lau
2022-05-10 17:30 ` Stanislav Fomichev
2022-05-10 19:18 ` Martin KaFai Lau
2022-05-10 21:14 ` Stanislav Fomichev
2022-05-09 21:51 ` Andrii Nakryiko
2022-05-09 23:38 ` Stanislav Fomichev
2022-04-29 21:15 ` [PATCH bpf-next v6 04/10] bpf: minimize number of allocated lsm slots per program Stanislav Fomichev
2022-05-10 5:05 ` Alexei Starovoitov
2022-05-10 17:31 ` sdf
2022-05-12 4:07 ` Alexei Starovoitov
2022-04-29 21:15 ` [PATCH bpf-next v6 05/10] bpf: implement BPF_PROG_QUERY for BPF_LSM_CGROUP Stanislav Fomichev
2022-05-07 0:12 ` Martin KaFai Lau
2022-05-09 23:38 ` Stanislav Fomichev
2022-05-09 21:49 ` Andrii Nakryiko
2022-05-09 23:38 ` Stanislav Fomichev
2022-04-29 21:15 ` Stanislav Fomichev [this message]
2022-04-29 21:15 ` [PATCH bpf-next v6 07/10] libbpf: add lsm_cgoup_sock type Stanislav Fomichev
2022-04-29 21:15 ` [PATCH bpf-next v6 08/10] bpftool: implement cgroup tree for BPF_LSM_CGROUP Stanislav Fomichev
2022-04-29 21:15 ` [PATCH bpf-next v6 09/10] selftests/bpf: lsm_cgroup functional test Stanislav Fomichev
2022-04-29 21:15 ` [PATCH bpf-next v6 10/10] selftests/bpf: verify lsm_cgroup struct sock access Stanislav Fomichev
2022-05-09 21:54 ` Andrii Nakryiko
2022-05-09 23:38 ` Stanislav Fomichev
2022-05-09 23:43 ` Andrii Nakryiko
2022-05-10 17:31 ` Stanislav Fomichev
2022-05-12 3:37 ` Andrii Nakryiko
2022-05-12 17:11 ` Stanislav Fomichev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220429211540.715151-7-sdf@google.com \
--to=sdf@google.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).