bpf: lsm: Implement attach, detach and execution

JITed BPF programs are dynamically attached to the LSM hooks using BPF trampolines. The trampoline prologue generates code to handle conversion of the signature of the hook to the appropriate BPF context. The allocated trampoline programs are attached to the nop functions initialized as LSM hooks. BPF_PROG_TYPE_LSM programs must have a GPL compatible license and and need CAP_SYS_ADMIN (required for loading eBPF programs). Upon attachment: * A BPF fexit trampoline is used for LSM hooks with a void return type. * A BPF fmod_ret trampoline is used for LSM hooks which return an int. The attached programs can override the return value of the bpf LSM hook to indicate a MAC Policy decision.

KP Singh committed 6 years ago

Commit 9e4e01d1 parent 9d3fdea6 files · +116 −27Browse files

Showing the changes to include/linux (1 of 6 files). Show all

Unified · Split

include/linux/bpf_lsm.h+11−0

@@ -17,6 +17,17 @@ · 16 unmodified lines
17	#include <linux/lsm_hook_defs.h>	17	#include <linux/lsm_hook_defs.h>
18	#undef LSM_HOOK	18	#undef LSM_HOOK
19		19
		20	int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
		21	const struct bpf_prog *prog);
		22
		23	#else /* !CONFIG_BPF_LSM */
		24
		25	static inline int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
		26	const struct bpf_prog *prog)
		27	{
		28	return -EOPNOTSUPP;
		29	}
		30
20	#endif /* CONFIG_BPF_LSM */	31	#endif /* CONFIG_BPF_LSM */
21		32
22	#endif /* _LINUX_BPF_LSM_H */	33	#endif /* _LINUX_BPF_LSM_H */