tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0
2
3/*
4 * Copyright (C) 2020 Google LLC.
5 */
6
7#include <linux/filter.h>
8#include <linux/bpf.h>
9#include <linux/btf.h>
10#include <linux/binfmts.h>
11#include <linux/lsm_hooks.h>
12#include <linux/bpf_lsm.h>
13#include <linux/kallsyms.h>
14#include <linux/bpf_verifier.h>
15#include <net/bpf_sk_storage.h>
16#include <linux/bpf_local_storage.h>
17#include <linux/btf_ids.h>
18#include <linux/ima.h>
19
20/* For every LSM hook that allows attachment of BPF programs, declare a nop
21 * function where a BPF program can be attached.
22 */
23#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
24noinline RET bpf_lsm_##NAME(__VA_ARGS__) \
25{ \
26 return DEFAULT; \
27}
28
29#include <linux/lsm_hook_defs.h>
30#undef LSM_HOOK
31
32#define LSM_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME)
33BTF_SET_START(bpf_lsm_hooks)
34#include <linux/lsm_hook_defs.h>
35#undef LSM_HOOK
36BTF_SET_END(bpf_lsm_hooks)
37
38int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
39 const struct bpf_prog *prog)
40{
41 if (!prog->gpl_compatible) {
42 bpf_log(vlog,
43 "LSM programs must have a GPL compatible license\n");
44 return -EINVAL;
45 }
46
47 if (!btf_id_set_contains(&bpf_lsm_hooks, prog->aux->attach_btf_id)) {
48 bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n",
49 prog->aux->attach_btf_id, prog->aux->attach_func_name);
50 return -EINVAL;
51 }
52
53 return 0;
54}
55
56/* Mask for all the currently supported BPRM option flags */
57#define BPF_F_BRPM_OPTS_MASK BPF_F_BPRM_SECUREEXEC
58
59BPF_CALL_2(bpf_bprm_opts_set, struct linux_binprm *, bprm, u64, flags)
60{
61 if (flags & ~BPF_F_BRPM_OPTS_MASK)
62 return -EINVAL;
63
64 bprm->secureexec = (flags & BPF_F_BPRM_SECUREEXEC);
65 return 0;
66}
67
68BTF_ID_LIST_SINGLE(bpf_bprm_opts_set_btf_ids, struct, linux_binprm)
69
70static const struct bpf_func_proto bpf_bprm_opts_set_proto = {
71 .func = bpf_bprm_opts_set,
72 .gpl_only = false,
73 .ret_type = RET_INTEGER,
74 .arg1_type = ARG_PTR_TO_BTF_ID,
75 .arg1_btf_id = &bpf_bprm_opts_set_btf_ids[0],
76 .arg2_type = ARG_ANYTHING,
77};
78
79BPF_CALL_3(bpf_ima_inode_hash, struct inode *, inode, void *, dst, u32, size)
80{
81 return ima_inode_hash(inode, dst, size);
82}
83
84static bool bpf_ima_inode_hash_allowed(const struct bpf_prog *prog)
85{
86 return bpf_lsm_is_sleepable_hook(prog->aux->attach_btf_id);
87}
88
89BTF_ID_LIST_SINGLE(bpf_ima_inode_hash_btf_ids, struct, inode)
90
91static const struct bpf_func_proto bpf_ima_inode_hash_proto = {
92 .func = bpf_ima_inode_hash,
93 .gpl_only = false,
94 .ret_type = RET_INTEGER,
95 .arg1_type = ARG_PTR_TO_BTF_ID,
96 .arg1_btf_id = &bpf_ima_inode_hash_btf_ids[0],
97 .arg2_type = ARG_PTR_TO_UNINIT_MEM,
98 .arg3_type = ARG_CONST_SIZE,
99 .allowed = bpf_ima_inode_hash_allowed,
100};
101
102BPF_CALL_3(bpf_ima_file_hash, struct file *, file, void *, dst, u32, size)
103{
104 return ima_file_hash(file, dst, size);
105}
106
107BTF_ID_LIST_SINGLE(bpf_ima_file_hash_btf_ids, struct, file)
108
109static const struct bpf_func_proto bpf_ima_file_hash_proto = {
110 .func = bpf_ima_file_hash,
111 .gpl_only = false,
112 .ret_type = RET_INTEGER,
113 .arg1_type = ARG_PTR_TO_BTF_ID,
114 .arg1_btf_id = &bpf_ima_file_hash_btf_ids[0],
115 .arg2_type = ARG_PTR_TO_UNINIT_MEM,
116 .arg3_type = ARG_CONST_SIZE,
117 .allowed = bpf_ima_inode_hash_allowed,
118};
119
120static const struct bpf_func_proto *
121bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
122{
123 switch (func_id) {
124 case BPF_FUNC_inode_storage_get:
125 return &bpf_inode_storage_get_proto;
126 case BPF_FUNC_inode_storage_delete:
127 return &bpf_inode_storage_delete_proto;
128#ifdef CONFIG_NET
129 case BPF_FUNC_sk_storage_get:
130 return &bpf_sk_storage_get_proto;
131 case BPF_FUNC_sk_storage_delete:
132 return &bpf_sk_storage_delete_proto;
133#endif /* CONFIG_NET */
134 case BPF_FUNC_spin_lock:
135 return &bpf_spin_lock_proto;
136 case BPF_FUNC_spin_unlock:
137 return &bpf_spin_unlock_proto;
138 case BPF_FUNC_bprm_opts_set:
139 return &bpf_bprm_opts_set_proto;
140 case BPF_FUNC_ima_inode_hash:
141 return prog->aux->sleepable ? &bpf_ima_inode_hash_proto : NULL;
142 case BPF_FUNC_ima_file_hash:
143 return prog->aux->sleepable ? &bpf_ima_file_hash_proto : NULL;
144 default:
145 return tracing_prog_func_proto(func_id, prog);
146 }
147}
148
149/* The set of hooks which are called without pagefaults disabled and are allowed
150 * to "sleep" and thus can be used for sleepable BPF programs.
151 */
152BTF_SET_START(sleepable_lsm_hooks)
153BTF_ID(func, bpf_lsm_bpf)
154BTF_ID(func, bpf_lsm_bpf_map)
155BTF_ID(func, bpf_lsm_bpf_map_alloc_security)
156BTF_ID(func, bpf_lsm_bpf_map_free_security)
157BTF_ID(func, bpf_lsm_bpf_prog)
158BTF_ID(func, bpf_lsm_bprm_check_security)
159BTF_ID(func, bpf_lsm_bprm_committed_creds)
160BTF_ID(func, bpf_lsm_bprm_committing_creds)
161BTF_ID(func, bpf_lsm_bprm_creds_for_exec)
162BTF_ID(func, bpf_lsm_bprm_creds_from_file)
163BTF_ID(func, bpf_lsm_capget)
164BTF_ID(func, bpf_lsm_capset)
165BTF_ID(func, bpf_lsm_cred_prepare)
166BTF_ID(func, bpf_lsm_file_ioctl)
167BTF_ID(func, bpf_lsm_file_lock)
168BTF_ID(func, bpf_lsm_file_open)
169BTF_ID(func, bpf_lsm_file_receive)
170
171#ifdef CONFIG_SECURITY_NETWORK
172BTF_ID(func, bpf_lsm_inet_conn_established)
173#endif /* CONFIG_SECURITY_NETWORK */
174
175BTF_ID(func, bpf_lsm_inode_create)
176BTF_ID(func, bpf_lsm_inode_free_security)
177BTF_ID(func, bpf_lsm_inode_getattr)
178BTF_ID(func, bpf_lsm_inode_getxattr)
179BTF_ID(func, bpf_lsm_inode_mknod)
180BTF_ID(func, bpf_lsm_inode_need_killpriv)
181BTF_ID(func, bpf_lsm_inode_post_setxattr)
182BTF_ID(func, bpf_lsm_inode_readlink)
183BTF_ID(func, bpf_lsm_inode_rename)
184BTF_ID(func, bpf_lsm_inode_rmdir)
185BTF_ID(func, bpf_lsm_inode_setattr)
186BTF_ID(func, bpf_lsm_inode_setxattr)
187BTF_ID(func, bpf_lsm_inode_symlink)
188BTF_ID(func, bpf_lsm_inode_unlink)
189BTF_ID(func, bpf_lsm_kernel_module_request)
190BTF_ID(func, bpf_lsm_kernel_read_file)
191BTF_ID(func, bpf_lsm_kernfs_init_security)
192
193#ifdef CONFIG_KEYS
194BTF_ID(func, bpf_lsm_key_free)
195#endif /* CONFIG_KEYS */
196
197BTF_ID(func, bpf_lsm_mmap_file)
198BTF_ID(func, bpf_lsm_netlink_send)
199BTF_ID(func, bpf_lsm_path_notify)
200BTF_ID(func, bpf_lsm_release_secctx)
201BTF_ID(func, bpf_lsm_sb_alloc_security)
202BTF_ID(func, bpf_lsm_sb_eat_lsm_opts)
203BTF_ID(func, bpf_lsm_sb_kern_mount)
204BTF_ID(func, bpf_lsm_sb_mount)
205BTF_ID(func, bpf_lsm_sb_remount)
206BTF_ID(func, bpf_lsm_sb_set_mnt_opts)
207BTF_ID(func, bpf_lsm_sb_show_options)
208BTF_ID(func, bpf_lsm_sb_statfs)
209BTF_ID(func, bpf_lsm_sb_umount)
210BTF_ID(func, bpf_lsm_settime)
211
212#ifdef CONFIG_SECURITY_NETWORK
213BTF_ID(func, bpf_lsm_socket_accept)
214BTF_ID(func, bpf_lsm_socket_bind)
215BTF_ID(func, bpf_lsm_socket_connect)
216BTF_ID(func, bpf_lsm_socket_create)
217BTF_ID(func, bpf_lsm_socket_getpeername)
218BTF_ID(func, bpf_lsm_socket_getpeersec_dgram)
219BTF_ID(func, bpf_lsm_socket_getsockname)
220BTF_ID(func, bpf_lsm_socket_getsockopt)
221BTF_ID(func, bpf_lsm_socket_listen)
222BTF_ID(func, bpf_lsm_socket_post_create)
223BTF_ID(func, bpf_lsm_socket_recvmsg)
224BTF_ID(func, bpf_lsm_socket_sendmsg)
225BTF_ID(func, bpf_lsm_socket_shutdown)
226BTF_ID(func, bpf_lsm_socket_socketpair)
227#endif /* CONFIG_SECURITY_NETWORK */
228
229BTF_ID(func, bpf_lsm_syslog)
230BTF_ID(func, bpf_lsm_task_alloc)
231BTF_ID(func, bpf_lsm_current_getsecid_subj)
232BTF_ID(func, bpf_lsm_task_getsecid_obj)
233BTF_ID(func, bpf_lsm_task_prctl)
234BTF_ID(func, bpf_lsm_task_setscheduler)
235BTF_ID(func, bpf_lsm_task_to_inode)
236BTF_SET_END(sleepable_lsm_hooks)
237
238bool bpf_lsm_is_sleepable_hook(u32 btf_id)
239{
240 return btf_id_set_contains(&sleepable_lsm_hooks, btf_id);
241}
242
243const struct bpf_prog_ops lsm_prog_ops = {
244};
245
246const struct bpf_verifier_ops lsm_verifier_ops = {
247 .get_func_proto = bpf_lsm_func_proto,
248 .is_valid_access = btf_ctx_access,
249};