sk-filter: Add ability to lock a socket filter program

While a privileged program can open a raw socket, attach some restrictive filter and drop its privileges (or send the socket to an unprivileged program through some Unix socket), the filter can still be removed or modified by the unprivileged program. This commit adds a socket option to lock the filter (SO_LOCK_FILTER) preventing any modification of a socket filter program. This is similar to OpenBSD BIOCLOCK ioctl on bpf sockets, except even root is not allowed change/drop the filter. The state of the lock can be read with getsockopt(). No error is triggered if the state is not changed. -EPERM is returned when a user tries to remove the lock or to change/remove the filter while the lock is active. The check is done directly in sk_attach_filter() and sk_detach_filter() and does not affect only setsockopt() syscall.

Vincent Bernat committed 13 years ago

Commit d59577b1 parent 5bd30d319 files · +53 −2Browse files

Unified · Split

19 files

Documentation/networking/filter.txt +9 −2
arch/alpha/include/uapi/asm/socket.h +1 −0
arch/avr32/include/uapi/asm/socket.h +2 −0
arch/cris/include/uapi/asm/socket.h +2 −0
arch/frv/include/uapi/asm/socket.h +2 −0
arch/h8300/include/uapi/asm/socket.h +2 −0
arch/ia64/include/uapi/asm/socket.h +2 −0
arch/m32r/include/uapi/asm/socket.h +2 −0
arch/mips/include/uapi/asm/socket.h +1 −0
arch/mn10300/include/uapi/asm/socket.h +2 −0
arch/parisc/include/uapi/asm/socket.h +1 −0
arch/powerpc/include/uapi/asm/socket.h +2 −0
arch/s390/include/uapi/asm/socket.h +2 −0
arch/sparc/include/uapi/asm/socket.h +1 −0
arch/xtensa/include/uapi/asm/socket.h +2 −0
include/net/sock.h +1 −0
include/uapi/asm-generic/socket.h +2 −0
net/core/filter.c +6 −0
net/core/sock.c +11 −0

Documentation/networking/filter.txt+9−2

@@ -17,12 +17,12 @@ creating filters. · 16 unmodified lines
17	17
18	18	LSF is much simpler than BPF. One does not have to worry about
19	19	devices or anything like that. You simply create your filter
20		−code, send it to the kernel via the SO_ATTACH_FILTER ioctl and
	20	+code, send it to the kernel via the SO_ATTACH_FILTER option and
21	21	if your filter code passes the kernel check on it, you then
22	22	immediately begin filtering data on that socket.
23	23
24	24	You can also detach filters from your socket via the
25		−SO_DETACH_FILTER ioctl. This will probably not be used much
	25	+SO_DETACH_FILTER option. This will probably not be used much
26	26	since when you close a socket that has a filter on it the
27	27	filter is automagically removed. The other less common case
28	28	may be adding a different filter on the same socket where you had another
@@ -31,12 +31,19 @@ the old one and placing your new one in its place, assuming your · 2 unmodified lines
31	31	filter has passed the checks, otherwise if it fails the old filter
32	32	will remain on that socket.
33	33
	34	+SO_LOCK_FILTER option allows to lock the filter attached to a
	35	+socket. Once set, a filter cannot be removed or changed. This allows
	36	+one process to setup a socket, attach a filter, lock it then drop
	37	+privileges and be assured that the filter will be kept until the
	38	+socket is closed.
	39	+
34	40	Examples
35	41	========
36	42
37	43	Ioctls-
38	44	setsockopt(sockfd, SOL_SOCKET, SO_ATTACH_FILTER, &Filter, sizeof(Filter));
39	45	setsockopt(sockfd, SOL_SOCKET, SO_DETACH_FILTER, &value, sizeof(value));
	46	+setsockopt(sockfd, SOL_SOCKET, SO_LOCK_FILTER, &value, sizeof(value));
40	47
41	48	See the BSD bpf.4 manpage and the BSD Packet Filter paper written by
42	49	Steven McCanne and Van Jacobson of Lawrence Berkeley Laboratory.

arch/alpha/include/uapi/asm/socket.h+1−0

@@ -77,5 +77,6 @@ · 76 unmodified lines
77	77	/* Instruct lower device to use last 4-bytes of skb data as FCS */
78	78	#define SO_NOFCS 43
79	79
	80	+#define SO_LOCK_FILTER 44
80	81
81	82	#endif /* _UAPI_ASM_SOCKET_H */

arch/avr32/include/uapi/asm/socket.h+2−0

@@ -70,4 +70,6 @@ · 69 unmodified lines
70	70	/* Instruct lower device to use last 4-bytes of skb data as FCS */
71	71	#define SO_NOFCS 43
72	72
	73	+#define SO_LOCK_FILTER 44
	74	+
73	75	#endif /* __ASM_AVR32_SOCKET_H */

arch/cris/include/uapi/asm/socket.h+2−0

@@ -72,6 +72,8 @@ · 71 unmodified lines
72	72	/* Instruct lower device to use last 4-bytes of skb data as FCS */
73	73	#define SO_NOFCS 43
74	74
	75	+#define SO_LOCK_FILTER 44
	76	+
75	77	#endif /* _ASM_SOCKET_H */
76	78
77	79

arch/frv/include/uapi/asm/socket.h+2−0

@@ -70,5 +70,7 @@ · 69 unmodified lines
70	70	/* Instruct lower device to use last 4-bytes of skb data as FCS */
71	71	#define SO_NOFCS 43
72	72
	73	+#define SO_LOCK_FILTER 44
	74	+
73	75	#endif /* _ASM_SOCKET_H */
74	76

arch/h8300/include/uapi/asm/socket.h+2−0

@@ -70,4 +70,6 @@ · 69 unmodified lines
70	70	/* Instruct lower device to use last 4-bytes of skb data as FCS */
71	71	#define SO_NOFCS 43
72	72
	73	+#define SO_LOCK_FILTER 44
	74	+
73	75	#endif /* _ASM_SOCKET_H */

arch/ia64/include/uapi/asm/socket.h+2−0

@@ -79,4 +79,6 @@ · 78 unmodified lines
79	79	/* Instruct lower device to use last 4-bytes of skb data as FCS */
80	80	#define SO_NOFCS 43
81	81
	82	+#define SO_LOCK_FILTER 44
	83	+
82	84	#endif /* _ASM_IA64_SOCKET_H */

arch/m32r/include/uapi/asm/socket.h+2−0

@@ -70,4 +70,6 @@ · 69 unmodified lines
70	70	/* Instruct lower device to use last 4-bytes of skb data as FCS */
71	71	#define SO_NOFCS 43
72	72
	73	+#define SO_LOCK_FILTER 44
	74	+
73	75	#endif /* _ASM_M32R_SOCKET_H */

arch/mips/include/uapi/asm/socket.h+1−0

@@ -90,5 +90,6 @@ To add: #define SO_REUSEPORT 0x0200 /* Allow local address and port reuse. */ · 89 unmodified lines
90	90	/* Instruct lower device to use last 4-bytes of skb data as FCS */
91	91	#define SO_NOFCS 43
92	92
	93	+#define SO_LOCK_FILTER 44
93	94
94	95	#endif /* _UAPI_ASM_SOCKET_H */

arch/mn10300/include/uapi/asm/socket.h+2−0

@@ -70,4 +70,6 @@ · 69 unmodified lines
70	70	/* Instruct lower device to use last 4-bytes of skb data as FCS */
71	71	#define SO_NOFCS 43
72	72
	73	+#define SO_LOCK_FILTER 44
	74	+
73	75	#endif /* _ASM_SOCKET_H */

arch/parisc/include/uapi/asm/socket.h+1−0

@@ -69,6 +69,7 @@ · 68 unmodified lines
69	69	/* Instruct lower device to use last 4-bytes of skb data as FCS */
70	70	#define SO_NOFCS 0x4024
71	71
	72	+#define SO_LOCK_FILTER 0x4025
72	73
73	74	/* O_NONBLOCK clashes with the bits used for socket types. Therefore we
74	75	* have to define SOCK_NONBLOCK to a different value here.

arch/powerpc/include/uapi/asm/socket.h+2−0

@@ -77,4 +77,6 @@ · 76 unmodified lines
77	77	/* Instruct lower device to use last 4-bytes of skb data as FCS */
78	78	#define SO_NOFCS 43
79	79
	80	+#define SO_LOCK_FILTER 44
	81	+
80	82	#endif /* _ASM_POWERPC_SOCKET_H */

arch/s390/include/uapi/asm/socket.h+2−0

@@ -76,4 +76,6 @@ · 75 unmodified lines
76	76	/* Instruct lower device to use last 4-bytes of skb data as FCS */
77	77	#define SO_NOFCS 43
78	78
	79	+#define SO_LOCK_FILTER 44
	80	+
79	81	#endif /* _ASM_SOCKET_H */

arch/sparc/include/uapi/asm/socket.h+1−0

@@ -66,6 +66,7 @@ · 65 unmodified lines
66	66	/* Instruct lower device to use last 4-bytes of skb data as FCS */
67	67	#define SO_NOFCS 0x0027
68	68
	69	+#define SO_LOCK_FILTER 0x0028
69	70
70	71	/* Security levels - as per NRL IPv6 - don't actually do anything */
71	72	#define SO_SECURITY_AUTHENTICATION 0x5001

arch/xtensa/include/uapi/asm/socket.h+2−0

@@ -81,4 +81,6 @@ · 80 unmodified lines
81	81	/* Instruct lower device to use last 4-bytes of skb data as FCS */
82	82	#define SO_NOFCS 43
83	83
	84	+#define SO_LOCK_FILTER 44
	85	+
84	86	#endif /* _XTENSA_SOCKET_H */

include/net/sock.h+1−0

@@ -664,6 +664,7 @@ enum sock_flags { · 663 unmodified lines
664	664	* Will use last 4 bytes of packet sent from
665	665	* user-space instead.
666	666	*/
	667	+ SOCK_FILTER_LOCKED, /* Filter cannot be changed anymore */
667	668	};
668	669
669	670	static inline void sock_copy_flags(struct sock nsk, struct sock osk)

include/uapi/asm-generic/socket.h+2−0

@@ -73,4 +73,6 @@ · 72 unmodified lines
73	73	/* Instruct lower device to use last 4-bytes of skb data as FCS */
74	74	#define SO_NOFCS 43
75	75
	76	+#define SO_LOCK_FILTER 44
	77	+
76	78	#endif /* __ASM_GENERIC_SOCKET_H */

net/core/filter.c+6−0

@@ -721,6 +721,9 @@ int sk_attach_filter(struct sock_fprog fprog, struct sock sk) · 720 unmodified lines
721	721	unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
722	722	int err;
723	723
	724	+ if (sock_flag(sk, SOCK_FILTER_LOCKED))
	725	+ return -EPERM;
	726	+
724	727	/* Make sure new filter is there and in the right amounts. */
725	728	if (fprog->filter == NULL)
726	729	return -EINVAL;
@@ -757,6 +760,9 @@ int sk_detach_filter(struct sock *sk) · 30 unmodified lines
757	760	int ret = -ENOENT;
758	761	struct sk_filter *filter;
759	762
	763	+ if (sock_flag(sk, SOCK_FILTER_LOCKED))
	764	+ return -EPERM;
	765	+
760	766	filter = rcu_dereference_protected(sk->sk_filter,
761	767	sock_owned_by_user(sk));
762	768	if (filter) {

net/core/sock.c+11−0

@@ -861,6 +861,13 @@ set_rcvbuf: · 860 unmodified lines
861	861	ret = sk_detach_filter(sk);
862	862	break;
863	863
	864	+ case SO_LOCK_FILTER:
	865	+ if (sock_flag(sk, SOCK_FILTER_LOCKED) && !valbool)
	866	+ ret = -EPERM;
	867	+ else
	868	+ sock_valbool_flag(sk, SOCK_FILTER_LOCKED, valbool);
	869	+ break;
	870	+
864	871	case SO_PASSSEC:
865	872	if (valbool)
866	873	set_bit(SOCK_PASSSEC, &sock->flags);
@@ -1140,6 +1147,10 @@ int sock_getsockopt(struct socket *sock, int level, int optname, · 273 unmodified lines
1140	1147
1141	1148	goto lenout;
1142	1149
	1150	+ case SO_LOCK_FILTER:
	1151	+ v.val = sock_flag(sk, SOCK_FILTER_LOCKED);
	1152	+ break;
	1153	+
1143	1154	default:
1144	1155	return -ENOPROTOOPT;
1145	1156	}

sk-filter: Add ability to lock a socket filter program

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code