Something went wrong. Try again.
(I'm so sorry!) Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464// SPDX-License-Identifier: GPL-2.0-only/* * BPF-backed binary type handlers for binfmt_misc. * * A handler is a struct binfmt_misc_ops struct_ops map. Loading and * registering it makes the handler available under its name in the user * namespace it was registered in. A binfmt_misc 'B' entry activates it: * * echo ':entry:B::::<handler-name>:' > <binfmt_misc>/register * * The entry can bind the interpreters the handler may run its binaries * with, each opened by the write that binds it and selected by name per * exec. An entry registered with 'D' is not matchable yet, which is what * leaves it open to being given them: * * echo ':entry:B::::<handler-name>:D' > <binfmt_misc>/register * echo '+<name> <path>' > <binfmt_misc>/entry * echo 1 > <binfmt_misc>/entry */
#include <linux/binfmt_misc.h>#include <linux/binfmts.h>#include <linux/bpf.h>#include <linux/bpf_verifier.h>#include <linux/btf.h>#include <linux/btf_ids.h>#include <linux/cred.h>#include <linux/file.h>#include <linux/fs.h>#include <linux/init.h>#include <linux/limits.h>#include <linux/slab.h>#include <linux/spinlock.h>#include <linux/string.h>#include <linux/user_namespace.h>
struct bm_bpf_ops_reg { struct list_head list; const struct binfmt_misc_ops *ops; struct bpf_link *link; struct user_namespace *user_ns;};
static DEFINE_SPINLOCK(bm_bpf_ops_lock);static LIST_HEAD(bm_bpf_ops_list);
static struct bpf_struct_ops bpf_binfmt_misc_ops;
static struct bm_bpf_ops_reg *bm_bpf_ops_find(const struct user_namespace *user_ns, const char *name){ struct bm_bpf_ops_reg *reg;
lockdep_assert_held(&bm_bpf_ops_lock);
list_for_each_entry(reg, &bm_bpf_ops_list, list) { if (reg->user_ns == user_ns && !strcmp(reg->ops->name, name)) return reg; } return NULL;}
/** * binfmt_misc_get_ops - look up a bpf binary type handler by name * @user_ns: user namespace of the binfmt_misc instance * @name: name the handler was registered under * * Look for a handler named @name registered in @user_ns. A handler is not * inherited from ancestor user namespaces: an entry can only name a handler * registered in the same user namespace as its instance. The returned handler * stays callable until binfmt_misc_put_ops() even if the backing struct_ops * map is detached or deleted in the meantime. * * Return: the handler on success, NULL on failure */const struct binfmt_misc_ops *binfmt_misc_get_ops(struct user_namespace *user_ns, const char *name){ struct bm_bpf_ops_reg *reg;
guard(spinlock)(&bm_bpf_ops_lock);
reg = bm_bpf_ops_find(user_ns, name); if (!reg) return NULL; if (!bpf_struct_ops_get(reg->ops)) return NULL; return reg->ops;}
void binfmt_misc_put_ops(const struct binfmt_misc_ops *ops){ bpf_struct_ops_put(ops);}
bool bpf_prog_is_binfmt_misc_ops(const struct bpf_prog *prog){ return prog->type == BPF_PROG_TYPE_STRUCT_OPS && prog->aux->st_ops == &bpf_binfmt_misc_ops;}
/* * Replace the staged interpreter selection: naming a path drops a bound * file, selecting a bound interpreter carries its file along. */static void bm_bpf_stage_selection(struct linux_binprm *bprm, char *path, struct file *f){ if (bprm->bpf_interp_file) fput(bprm->bpf_interp_file); kfree(bprm->bpf_interp); bprm->bpf_interp = path; bprm->bpf_interp_file = f;}
__bpf_kfunc_start_defs();
/** * bpf_binprm_set_interp - select the interpreter for the current exec * @bprm: binary that is being executed * @path: absolute path to the interpreter * @path__sz: size of the @path buffer, including the terminating NUL * * To be called from the load program of a struct binfmt_misc_ops handler * before returning zero; the verifier rejects the call from any other * program, including the handler's own match program. The path is opened * with the credentials of the task doing the exec after the program * returns. Calling it again replaces the selection, as does selecting an * interpreter the entry bound with bpf_binprm_select_interp(). * * Return: 0 on success, a negative errno on failure */__bpf_kfunc int bpf_binprm_set_interp(struct linux_binprm *bprm, const char *path, size_t path__sz){ size_t len; char *interp;
if (!path__sz) return -EINVAL; len = strnlen(path, path__sz); if (len == path__sz) return -EINVAL; if (len >= PATH_MAX) return -ENAMETOOLONG;
interp = kmemdup_nul(path, len, GFP_KERNEL); if (!interp) return -ENOMEM;
/* * The program may pass memory that is written to while this runs, * so check the private copy and not the buffer it was made from. */ if (interp[0] != '/') { kfree(interp); return -EINVAL; }
bm_bpf_stage_selection(bprm, interp, NULL); return 0;}
/** * bpf_binprm_select_interp - run this exec under an interpreter the entry bound * @bprm: binary that is being executed * @name: name the interpreter was registered under * @name__sz: size of the @name buffer, including the terminating NUL * * To be called from the load program of a struct binfmt_misc_ops handler * instead of bpf_binprm_set_interp(). It selects one of the interpreters * the matched entry was registered with, each of which was opened once when * the entry was registered. Nothing is resolved at exec time, so no * filesystem view can redirect the interpreter. * * The interpreter runs under the path the entry registered it under. * Calling it again replaces the selection. * * Return: 0 on success, -ENOENT if the matched entry bound no interpreter * of that name, a negative errno on failure */__bpf_kfunc int bpf_binprm_select_interp(struct linux_binprm *bprm, const char *name, size_t name__sz){ const struct binfmt_misc_interp *interp; char buf[BINFMT_MISC_INTERP_NAME_MAX + 1]; size_t len; char *path;
if (!name__sz) return -EINVAL; len = strnlen(name, name__sz); if (len == name__sz || !len) return -EINVAL; /* No entry binds a longer name, so it cannot be found. */ if (len > BINFMT_MISC_INTERP_NAME_MAX) return -ENOENT;
/* * The program may pass memory that is written to while this runs, * so look the name up in a private copy and check that instead. */ memcpy(buf, name, len); buf[len] = '\0'; if (!buf[0]) return -EINVAL;
interp = binfmt_misc_find_interp(bprm->bpf_interps, buf); if (!interp) return -ENOENT;
path = kstrdup(interp->path, GFP_KERNEL); if (!path) return -ENOMEM;
bm_bpf_stage_selection(bprm, path, get_file(interp->file)); return 0;}
/** * bpf_binprm_set_interp_arg - set a single argument for the interpreter * @bprm: binary that is being executed * @arg: argument to pass to the interpreter * @arg__sz: size of the @arg buffer, including the terminating NUL * * To be called from the load program of a struct binfmt_misc_ops handler. The * argument is passed to the interpreter ahead of the binary, mirroring the * single optional argument of a #! interpreter line. Calling it again * replaces the argument. * * Return: 0 on success, a negative errno on failure */__bpf_kfunc int bpf_binprm_set_interp_arg(struct linux_binprm *bprm, const char *arg, size_t arg__sz){ size_t len; char *val;
if (!arg__sz) return -EINVAL; len = strnlen(arg, arg__sz); if (len == arg__sz) return -EINVAL; if (!len) return -EINVAL;
val = kmemdup_nul(arg, len, GFP_KERNEL); if (!val) return -ENOMEM;
/* * The program may pass memory that is written to while this runs, * so check the private copy and not the buffer it was made from. */ if (!val[0]) { kfree(val); return -EINVAL; }
kfree(bprm->bpf_interp_arg); bprm->bpf_interp_arg = val; return 0;}
/** * bpf_binprm_set_flags - choose the interpreter invocation flags for this exec * @bprm: binary that is being executed * @flags: an OR of enum bpf_binprm_flags values * * To be called from the load program of a struct binfmt_misc_ops handler. It * decides per exec what a static entry fixes at registration with the P, C, * O, T and L flags: BPF_BINPRM_PRESERVE_ARGV0 keeps the caller's argv[0], * BPF_BINPRM_CREDENTIALS computes credentials from the binary, and * BPF_BINPRM_EXECFD hands the binary to the interpreter through AT_EXECFD. * BPF_BINPRM_TRANSPARENT additionally leaves the argument vector untouched, * making the exec look like a direct execution of the binary. * BPF_BINPRM_LOADER substitutes the interpreter for the binary's PT_INTERP * and runs the binary as a native exec; it excludes every other flag. * Calling it again replaces the flags, passing zero clears them again. * * Return: 0 on success, -EINVAL if @flags contains an unknown bit or an * invalid combination */__bpf_kfunc int bpf_binprm_set_flags(struct linux_binprm *bprm, enum bpf_binprm_flags flags){ if (flags & ~(BPF_BINPRM_PRESERVE_ARGV0 | BPF_BINPRM_CREDENTIALS | BPF_BINPRM_EXECFD | BPF_BINPRM_TRANSPARENT | BPF_BINPRM_LOADER)) return -EINVAL;
/* Loader substitution is a native exec: no splice, execfd or creds work. */ if ((flags & BPF_BINPRM_LOADER) && (flags & ~BPF_BINPRM_LOADER)) return -EINVAL;
/* Transparency preserves the whole argv, argv[0] included. */ if ((flags & BPF_BINPRM_TRANSPARENT) && (flags & BPF_BINPRM_PRESERVE_ARGV0)) return -EINVAL;
bprm->bpf_flags = flags; return 0;}
__bpf_kfunc_end_defs();
BTF_KFUNCS_START(bm_bpf_kfunc_ids)BTF_ID_FLAGS(func, bpf_binprm_set_interp, KF_SLEEPABLE)BTF_ID_FLAGS(func, bpf_binprm_select_interp, KF_SLEEPABLE)BTF_ID_FLAGS(func, bpf_binprm_set_interp_arg, KF_SLEEPABLE)BTF_ID_FLAGS(func, bpf_binprm_set_flags, KF_SLEEPABLE)BTF_KFUNCS_END(bm_bpf_kfunc_ids)
static int bm_bpf_kfunc_filter(const struct bpf_prog *prog, u32 kfunc_id){ if (!btf_id_set8_contains(&bm_bpf_kfunc_ids, kfunc_id)) return 0; if (prog->type != BPF_PROG_TYPE_STRUCT_OPS) return -EACCES; /* ->st_ops is unset during the cfg pass; enforced once it is set. */ if (!prog->aux->st_ops) return 0; /* Only the load program decides how a binary is run. */ if (bpf_prog_is_binfmt_misc_ops(prog) && prog->aux->attach_st_ops_member_off == offsetof(struct binfmt_misc_ops, load)) return 0; return -EACCES;}
static const struct btf_kfunc_id_set bm_bpf_kfunc_set = { .owner = THIS_MODULE, .set = &bm_bpf_kfunc_ids, .filter = bm_bpf_kfunc_filter,};
static bool bm_bpf_ops__match(struct linux_binprm *bprm){ return false;}
static int bm_bpf_ops__load(struct linux_binprm *bprm){ return 0;}
static struct binfmt_misc_ops bm_bpf_ops_stubs = { .match = bm_bpf_ops__match, .load = bm_bpf_ops__load,};
static int bm_bpf_init(struct btf *btf){ return register_btf_kfunc_id_set(BPF_PROG_TYPE_STRUCT_OPS, &bm_bpf_kfunc_set);}
static int bm_bpf_check_member(const struct btf_type *t, const struct btf_member *member, const struct bpf_prog *prog){ u32 moff = __btf_member_bit_offset(t, member) / 8;
switch (moff) { case offsetof(struct binfmt_misc_ops, match): case offsetof(struct binfmt_misc_ops, load): /* Reliable file reads at exec time require sleeping. */ if (!prog->sleepable) return -EINVAL; break; } return 0;}
static int bm_bpf_init_member(const struct btf_type *t, const struct btf_member *member, void *kdata, const void *udata){ const struct binfmt_misc_ops *uops = udata; struct binfmt_misc_ops *ops = kdata; u32 moff = __btf_member_bit_offset(t, member) / 8;
switch (moff) { case offsetof(struct binfmt_misc_ops, name): if (bpf_obj_name_cpy(ops->name, uops->name, sizeof(ops->name)) <= 0) return -EINVAL; return 1; } return 0;}
static int bm_bpf_validate(void *kdata){ struct binfmt_misc_ops *ops = kdata;
if (!ops->match || !ops->load) return -EINVAL; return 0;}
static int bm_bpf_reg(void *kdata, struct bpf_link *link){ struct binfmt_misc_ops *ops = kdata; struct bm_bpf_ops_reg *reg;
reg = kzalloc_obj(*reg, GFP_KERNEL_ACCOUNT); if (!reg) return -ENOMEM;
reg->ops = ops; reg->link = link; reg->user_ns = get_user_ns(current_user_ns());
guard(spinlock)(&bm_bpf_ops_lock);
if (bm_bpf_ops_find(reg->user_ns, ops->name)) { put_user_ns(reg->user_ns); kfree(reg); return -EEXIST; }
list_add(®->list, &bm_bpf_ops_list); return 0;}
static void bm_bpf_unreg(void *kdata, struct bpf_link *link){ struct bm_bpf_ops_reg *reg;
guard(spinlock)(&bm_bpf_ops_lock);
list_for_each_entry(reg, &bm_bpf_ops_list, list) { if (reg->ops == kdata && reg->link == link) { list_del(®->list); put_user_ns(reg->user_ns); kfree(reg); return; } }}
static const struct bpf_verifier_ops bm_bpf_verifier_ops = { .get_func_proto = bpf_base_func_proto, .is_valid_access = bpf_tracing_btf_ctx_access,};
static struct bpf_struct_ops bpf_binfmt_misc_ops = { .verifier_ops = &bm_bpf_verifier_ops, .init = bm_bpf_init, .check_member = bm_bpf_check_member, .init_member = bm_bpf_init_member, .validate = bm_bpf_validate, .reg = bm_bpf_reg, .unreg = bm_bpf_unreg, .cfi_stubs = &bm_bpf_ops_stubs, .name = "binfmt_misc_ops", .owner = THIS_MODULE,};
static int __init bm_bpf_struct_ops_init(void){ return register_bpf_struct_ops(&bpf_binfmt_misc_ops, binfmt_misc_ops);}late_initcall(bm_bpf_struct_ops_init);