bpf: lsm: Implement attach, detach and execution

JITed BPF programs are dynamically attached to the LSM hooks using BPF trampolines. The trampoline prologue generates code to handle conversion of the signature of the hook to the appropriate BPF context. The allocated trampoline programs are attached to the nop functions initialized as LSM hooks. BPF_PROG_TYPE_LSM programs must have a GPL compatible license and and need CAP_SYS_ADMIN (required for loading eBPF programs). Upon attachment: * A BPF fexit trampoline is used for LSM hooks with a void return type. * A BPF fmod_ret trampoline is used for LSM hooks which return an int. The attached programs can override the return value of the bpf LSM hook to indicate a MAC Policy decision.

KP Singh committed 6 years ago

Commit 9e4e01d1 parent 9d3fdea6 files · +116 −27Browse files

Unified · Split

6 files

include/linux/bpf_lsm.h +11 −0
kernel/bpf/bpf_lsm.c +23 −0
kernel/bpf/btf.c +15 −1
kernel/bpf/syscall.c +39 −18
kernel/bpf/trampoline.c +13 −4
kernel/bpf/verifier.c +15 −4

include/linux/bpf_lsm.h+11−0

@@ -17,6 +17,17 @@ · 16 unmodified lines
17	#include <linux/lsm_hook_defs.h>	17	#include <linux/lsm_hook_defs.h>
18	#undef LSM_HOOK	18	#undef LSM_HOOK
19		19
		20	int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
		21	const struct bpf_prog *prog);
		22
		23	#else /* !CONFIG_BPF_LSM */
		24
		25	static inline int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
		26	const struct bpf_prog *prog)
		27	{
		28	return -EOPNOTSUPP;
		29	}
		30
20	#endif /* CONFIG_BPF_LSM */	31	#endif /* CONFIG_BPF_LSM */
21		32
22	#endif /* _LINUX_BPF_LSM_H */	33	#endif /* _LINUX_BPF_LSM_H */

kernel/bpf/bpf_lsm.c+23−0

@@ -9,6 +9,8 @@ · 8 unmodified lines
9	#include <linux/btf.h>	9	#include <linux/btf.h>
10	#include <linux/lsm_hooks.h>	10	#include <linux/lsm_hooks.h>
11	#include <linux/bpf_lsm.h>	11	#include <linux/bpf_lsm.h>
		12	#include <linux/kallsyms.h>
		13	#include <linux/bpf_verifier.h>
12		14
13	/* For every LSM hook that allows attachment of BPF programs, declare a nop	15	/* For every LSM hook that allows attachment of BPF programs, declare a nop
14	* function where a BPF program can be attached.	16	* function where a BPF program can be attached.
@@ -22,6 +24,27 @@ noinline RET bpf_lsm_##NAME(__VA_ARGS__) \ · 7 unmodified lines
22	#include <linux/lsm_hook_defs.h>	24	#include <linux/lsm_hook_defs.h>
23	#undef LSM_HOOK	25	#undef LSM_HOOK
24		26
		27	#define BPF_LSM_SYM_PREFX "bpf_lsm_"
		28
		29	int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
		30	const struct bpf_prog *prog)
		31	{
		32	if (!prog->gpl_compatible) {
		33	bpf_log(vlog,
		34	"LSM programs must have a GPL compatible license\n");
		35	return -EINVAL;
		36	}
		37
		38	if (strncmp(BPF_LSM_SYM_PREFX, prog->aux->attach_func_name,
		39	sizeof(BPF_LSM_SYM_PREFX) - 1)) {
		40	bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n",
		41	prog->aux->attach_btf_id, prog->aux->attach_func_name);
		42	return -EINVAL;
		43	}
		44
		45	return 0;
		46	}
		47
25	const struct bpf_prog_ops lsm_prog_ops = {	48	const struct bpf_prog_ops lsm_prog_ops = {
26	};	49	};
27		50

kernel/bpf/btf.c+15−1

@@ -3710,7 +3710,21 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, · 3709 unmodified lines
3710	}	3710	}
3711		3711
3712	if (arg == nr_args) {	3712	if (arg == nr_args) {
3713	if (prog->expected_attach_type == BPF_TRACE_FEXIT) {	3713	if (prog->expected_attach_type == BPF_TRACE_FEXIT \|\|
		3714	prog->expected_attach_type == BPF_LSM_MAC) {
		3715	/* When LSM programs are attached to void LSM hooks
		3716	* they use FEXIT trampolines and when attached to
		3717	* int LSM hooks, they use MODIFY_RETURN trampolines.
		3718	*
		3719	* While the LSM programs are BPF_MODIFY_RETURN-like
		3720	* the check:
		3721	*
		3722	* if (ret_type != 'int')
		3723	* return -EINVAL;
		3724	*
		3725	* is _not_ done here. This is still safe as LSM hooks
		3726	* have only void and int return types.
		3727	*/
3714	if (!t)	3728	if (!t)
3715	return true;	3729	return true;
3716	t = btf_type_by_id(btf, t->type);	3730	t = btf_type_by_id(btf, t->type);

kernel/bpf/syscall.c+39−18

 #include <linux/nospec.h>
 #include <linux/audit.h>
 #include <uapi/linux/btf.h>
+#include <linux/bpf_lsm.h>
 #define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \
 			  (map)->map_type == BPF_MAP_TYPE_CGROUP_ARRAY || \
 		switch (prog_type) {
 		case BPF_PROG_TYPE_TRACING:
+		case BPF_PROG_TYPE_LSM:
 		case BPF_PROG_TYPE_STRUCT_OPS:
 		case BPF_PROG_TYPE_EXT:
 			break;
 	struct file *link_file;
 	int link_fd, err;
-	if (prog->expected_attach_type != BPF_TRACE_FENTRY &&
+	switch (prog->type) {
-	    prog->expected_attach_type != BPF_TRACE_FEXIT &&
+	case BPF_PROG_TYPE_TRACING:
-	    prog->expected_attach_type != BPF_MODIFY_RETURN &&
+		if (prog->expected_attach_type != BPF_TRACE_FENTRY &&
-	    prog->type != BPF_PROG_TYPE_EXT) {
+		    prog->expected_attach_type != BPF_TRACE_FEXIT &&
+		    prog->expected_attach_type != BPF_MODIFY_RETURN) {
+			err = -EINVAL;
+			goto out_put_prog;
+		}
+		break;
+	case BPF_PROG_TYPE_EXT:
+		if (prog->expected_attach_type != 0) {
+			err = -EINVAL;
+			goto out_put_prog;
+		}
+		break;
+	case BPF_PROG_TYPE_LSM:
+		if (prog->expected_attach_type != BPF_LSM_MAC) {
+			err = -EINVAL;
+			goto out_put_prog;
+		}
+		break;
+	default:
 		err = -EINVAL;
 		goto out_put_prog;
 	}
 	if (IS_ERR(prog))
 		return PTR_ERR(prog);
-	if (prog->type != BPF_PROG_TYPE_RAW_TRACEPOINT &&
+	switch (prog->type) {
-	    prog->type != BPF_PROG_TYPE_TRACING &&
+	case BPF_PROG_TYPE_TRACING:
-	    prog->type != BPF_PROG_TYPE_EXT &&
+	case BPF_PROG_TYPE_EXT:
-	    prog->type != BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE) {
+	case BPF_PROG_TYPE_LSM:
-		err = -EINVAL;
-		goto out_put_prog;
-	}
-	if (prog->type == BPF_PROG_TYPE_TRACING ||
-	    prog->type == BPF_PROG_TYPE_EXT) {
 		if (attr->raw_tracepoint.name) {
 			/* The attach point for this category of programs
 			 * should be specified via btf_id during program load.
 			err = -EINVAL;
 			goto out_put_prog;
 		}
-		if (prog->expected_attach_type == BPF_TRACE_RAW_TP)
+		if (prog->type == BPF_PROG_TYPE_TRACING &&
+		    prog->expected_attach_type == BPF_TRACE_RAW_TP) {
 			tp_name = prog->aux->attach_func_name;
-		else
+			break;
-			return bpf_tracing_prog_attach(prog);
+		}
-	} else {
+		return bpf_tracing_prog_attach(prog);
+	case BPF_PROG_TYPE_RAW_TRACEPOINT:
+	case BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE:
 		if (strncpy_from_user(buf,
 				      u64_to_user_ptr(attr->raw_tracepoint.name),
 				      sizeof(buf) - 1) < 0) {
 		}
 		buf[sizeof(buf) - 1] = 0;
 		tp_name = buf;
+		break;
+	default:
+		err = -EINVAL;
+		goto out_put_prog;
 	}
 	btp = bpf_get_raw_tracepoint(tp_name);

kernel/bpf/trampoline.c+13−4

 #include <linux/ftrace.h>
 #include <linux/rbtree_latch.h>
 #include <linux/perf_event.h>
+#include <linux/btf.h>
 /* dummy _ops. The verifier will operate on target program's ops. */
 const struct bpf_verifier_ops bpf_extension_verifier_ops = {
 	return err;
 }
-static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(enum bpf_attach_type t)
+static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog)
 {
-	switch (t) {
+	switch (prog->expected_attach_type) {
 	case BPF_TRACE_FENTRY:
 		return BPF_TRAMP_FENTRY;
 	case BPF_MODIFY_RETURN:
 		return BPF_TRAMP_MODIFY_RETURN;
 	case BPF_TRACE_FEXIT:
 		return BPF_TRAMP_FEXIT;
+	case BPF_LSM_MAC:
+		if (!prog->aux->attach_func_proto->type)
+			/* The function returns void, we cannot modify its
+			 * return value.
+			 */
+			return BPF_TRAMP_FEXIT;
+		else
+			return BPF_TRAMP_MODIFY_RETURN;
 	default:
 		return BPF_TRAMP_REPLACE;
 	}
 	int cnt;
 	tr = prog->aux->trampoline;
-	kind = bpf_attach_type_to_tramp(prog->expected_attach_type);
+	kind = bpf_attach_type_to_tramp(prog);
 	mutex_lock(&tr->mutex);
 	if (tr->extension_prog) {
 		/* cannot attach fentry/fexit if extension prog is attached.
 	int err;
 	tr = prog->aux->trampoline;
-	kind = bpf_attach_type_to_tramp(prog->expected_attach_type);
+	kind = bpf_attach_type_to_tramp(prog);
 	mutex_lock(&tr->mutex);
 	if (kind == BPF_TRAMP_REPLACE) {
 		WARN_ON_ONCE(!tr->extension_prog);

kernel/bpf/verifier.c+15−4

 #include <linux/perf_event.h>
 #include <linux/ctype.h>
 #include <linux/error-injection.h>
+#include <linux/bpf_lsm.h>
 #include "disasm.h"
 	struct tnum range = tnum_range(0, 1);
 	int err;
-	/* The struct_ops func-ptr's return type could be "void" */
+	/* LSM and struct_ops func-ptr's return type could be "void" */
-	if (env->prog->type == BPF_PROG_TYPE_STRUCT_OPS &&
+	if ((env->prog->type == BPF_PROG_TYPE_STRUCT_OPS ||
+	     env->prog->type == BPF_PROG_TYPE_LSM) &&
 	    !prog->aux->attach_func_proto->type)
 		return 0;
 	if (prog->type == BPF_PROG_TYPE_STRUCT_OPS)
 		return check_struct_ops_btf_id(env);
-	if (prog->type != BPF_PROG_TYPE_TRACING && !prog_extension)
+	if (prog->type != BPF_PROG_TYPE_TRACING &&
+	    prog->type != BPF_PROG_TYPE_LSM &&
+	    !prog_extension)
 		return 0;
 	if (!btf_id) {
 			return -EINVAL;
 		/* fallthrough */
 	case BPF_MODIFY_RETURN:
+	case BPF_LSM_MAC:
 	case BPF_TRACE_FENTRY:
 	case BPF_TRACE_FEXIT:
+		prog->aux->attach_func_name = tname;
+		if (prog->type == BPF_PROG_TYPE_LSM) {
+			ret = bpf_lsm_verify_prog(&env->log, prog);
+			if (ret < 0)
+				return ret;
+		}
 		if (!btf_type_is_func(t)) {
 			verbose(env, "attach_btf_id %u is not a function\n",
 				btf_id);
 		tr = bpf_trampoline_lookup(key);
 		if (!tr)
 			return -ENOMEM;
-		prog->aux->attach_func_name = tname;
 		/* t is either vmlinux type or another program's type */
 		prog->aux->attach_func_proto = t;
 		mutex_lock(&tr->mutex);