History

sk-filter: Add ability to lock a socket filter program

While a privileged program can open a raw socket, attach some restrictive filter and drop its privileges (or send the socket to an unprivileged program through some Unix socket), the filter can still be removed or modified by the unprivileged program. This commit adds a socket option to lock the filter (SO_LOCK_FILTER) preventing any modification of a socket filter program. This is similar to OpenBSD BIOCLOCK ioctl on bpf sockets, except even root is not allowed change/drop the filter. The state of the lock can be read with getsockopt(). No error is triggered if the state is not changed. -EPERM is returned when a user tries to remove the lock or to change/remove the filter while the lock is active. The check is done directly in sk_attach_filter() and sk_detach_filter() and does not affect only setsockopt() syscall.

Vincent Bernat committed 13 years ago

Commit d59577b1 parent 5bd30d319 files · +53 −2Browse files

Unified · Split

19 files
  1. Documentation/networking/filter.txt +9 −2
  2. arch/alpha/include/uapi/asm/socket.h +1 −0
  3. arch/avr32/include/uapi/asm/socket.h +2 −0
  4. arch/cris/include/uapi/asm/socket.h +2 −0
  5. arch/frv/include/uapi/asm/socket.h +2 −0
  6. arch/h8300/include/uapi/asm/socket.h +2 −0
  7. arch/ia64/include/uapi/asm/socket.h +2 −0
  8. arch/m32r/include/uapi/asm/socket.h +2 −0
  9. arch/mips/include/uapi/asm/socket.h +1 −0
  10. arch/mn10300/include/uapi/asm/socket.h +2 −0
  11. arch/parisc/include/uapi/asm/socket.h +1 −0
  12. arch/powerpc/include/uapi/asm/socket.h +2 −0
  13. arch/s390/include/uapi/asm/socket.h +2 −0
  14. arch/sparc/include/uapi/asm/socket.h +1 −0
  15. arch/xtensa/include/uapi/asm/socket.h +2 −0
  16. include/net/sock.h +1 −0
  17. include/uapi/asm-generic/socket.h +2 −0
  18. net/core/filter.c +6 −0
  19. net/core/sock.c +11 −0
Documentation/networking/filter.txt+9−2
@@ -17,12 +17,12 @@ creating filters. · 16 unmodified lines
17 17
18LSF is much simpler than BPF. One does not have to worry about18LSF is much simpler than BPF. One does not have to worry about
19devices or anything like that. You simply create your filter19devices or anything like that. You simply create your filter
20code, send it to the kernel via the SO_ATTACH_FILTER ioctl and20code, send it to the kernel via the SO_ATTACH_FILTER option and
21if your filter code passes the kernel check on it, you then21if your filter code passes the kernel check on it, you then
22immediately begin filtering data on that socket.22immediately begin filtering data on that socket.
23 23
24You can also detach filters from your socket via the24You can also detach filters from your socket via the
25SO_DETACH_FILTER ioctl. This will probably not be used much25SO_DETACH_FILTER option. This will probably not be used much
26since when you close a socket that has a filter on it the26since when you close a socket that has a filter on it the
27filter is automagically removed. The other less common case27filter is automagically removed. The other less common case
28may be adding a different filter on the same socket where you had another28may be adding a different filter on the same socket where you had another
@@ -31,12 +31,19 @@ the old one and placing your new one in its place, assuming your · 2 unmodified lines
31filter has passed the checks, otherwise if it fails the old filter31filter has passed the checks, otherwise if it fails the old filter
32will remain on that socket.32will remain on that socket.
33 33
34SO_LOCK_FILTER option allows to lock the filter attached to a
35socket. Once set, a filter cannot be removed or changed. This allows
36one process to setup a socket, attach a filter, lock it then drop
37privileges and be assured that the filter will be kept until the
38socket is closed.
39
34Examples40Examples
35========41========
36 42
37Ioctls-43Ioctls-
38setsockopt(sockfd, SOL_SOCKET, SO_ATTACH_FILTER, &Filter, sizeof(Filter));44setsockopt(sockfd, SOL_SOCKET, SO_ATTACH_FILTER, &Filter, sizeof(Filter));
39setsockopt(sockfd, SOL_SOCKET, SO_DETACH_FILTER, &value, sizeof(value));45setsockopt(sockfd, SOL_SOCKET, SO_DETACH_FILTER, &value, sizeof(value));
46setsockopt(sockfd, SOL_SOCKET, SO_LOCK_FILTER, &value, sizeof(value));
40 47
41See the BSD bpf.4 manpage and the BSD Packet Filter paper written by48See the BSD bpf.4 manpage and the BSD Packet Filter paper written by
42Steven McCanne and Van Jacobson of Lawrence Berkeley Laboratory.49Steven McCanne and Van Jacobson of Lawrence Berkeley Laboratory.
arch/alpha/include/uapi/asm/socket.h+1−0
@@ -77,5 +77,6 @@ · 76 unmodified lines
77/* Instruct lower device to use last 4-bytes of skb data as FCS */77/* Instruct lower device to use last 4-bytes of skb data as FCS */
78#define SO_NOFCS 4378#define SO_NOFCS 43
79 79
80#define SO_LOCK_FILTER 44
80 81
81#endif /* _UAPI_ASM_SOCKET_H */82#endif /* _UAPI_ASM_SOCKET_H */
arch/avr32/include/uapi/asm/socket.h+2−0
@@ -70,4 +70,6 @@ · 69 unmodified lines
70/* Instruct lower device to use last 4-bytes of skb data as FCS */70/* Instruct lower device to use last 4-bytes of skb data as FCS */
71#define SO_NOFCS 4371#define SO_NOFCS 43
72 72
73#define SO_LOCK_FILTER 44
74
73#endif /* __ASM_AVR32_SOCKET_H */75#endif /* __ASM_AVR32_SOCKET_H */
arch/cris/include/uapi/asm/socket.h+2−0
@@ -72,6 +72,8 @@ · 71 unmodified lines
72/* Instruct lower device to use last 4-bytes of skb data as FCS */72/* Instruct lower device to use last 4-bytes of skb data as FCS */
73#define SO_NOFCS 4373#define SO_NOFCS 43
74 74
75#define SO_LOCK_FILTER 44
76
75#endif /* _ASM_SOCKET_H */77#endif /* _ASM_SOCKET_H */
76 78
77 79
arch/frv/include/uapi/asm/socket.h+2−0
@@ -70,5 +70,7 @@ · 69 unmodified lines
70/* Instruct lower device to use last 4-bytes of skb data as FCS */70/* Instruct lower device to use last 4-bytes of skb data as FCS */
71#define SO_NOFCS 4371#define SO_NOFCS 43
72 72
73#define SO_LOCK_FILTER 44
74
73#endif /* _ASM_SOCKET_H */75#endif /* _ASM_SOCKET_H */
74 76
arch/h8300/include/uapi/asm/socket.h+2−0
@@ -70,4 +70,6 @@ · 69 unmodified lines
70/* Instruct lower device to use last 4-bytes of skb data as FCS */70/* Instruct lower device to use last 4-bytes of skb data as FCS */
71#define SO_NOFCS 4371#define SO_NOFCS 43
72 72
73#define SO_LOCK_FILTER 44
74
73#endif /* _ASM_SOCKET_H */75#endif /* _ASM_SOCKET_H */
arch/ia64/include/uapi/asm/socket.h+2−0
@@ -79,4 +79,6 @@ · 78 unmodified lines
79/* Instruct lower device to use last 4-bytes of skb data as FCS */79/* Instruct lower device to use last 4-bytes of skb data as FCS */
80#define SO_NOFCS 4380#define SO_NOFCS 43
81 81
82#define SO_LOCK_FILTER 44
83
82#endif /* _ASM_IA64_SOCKET_H */84#endif /* _ASM_IA64_SOCKET_H */
arch/m32r/include/uapi/asm/socket.h+2−0
@@ -70,4 +70,6 @@ · 69 unmodified lines
70/* Instruct lower device to use last 4-bytes of skb data as FCS */70/* Instruct lower device to use last 4-bytes of skb data as FCS */
71#define SO_NOFCS 4371#define SO_NOFCS 43
72 72
73#define SO_LOCK_FILTER 44
74
73#endif /* _ASM_M32R_SOCKET_H */75#endif /* _ASM_M32R_SOCKET_H */
arch/mips/include/uapi/asm/socket.h+1−0
@@ -90,5 +90,6 @@ To add: #define SO_REUSEPORT 0x0200 /* Allow local address and port reuse. */ · 89 unmodified lines
90/* Instruct lower device to use last 4-bytes of skb data as FCS */90/* Instruct lower device to use last 4-bytes of skb data as FCS */
91#define SO_NOFCS 4391#define SO_NOFCS 43
92 92
93#define SO_LOCK_FILTER 44
93 94
94#endif /* _UAPI_ASM_SOCKET_H */95#endif /* _UAPI_ASM_SOCKET_H */
arch/mn10300/include/uapi/asm/socket.h+2−0
@@ -70,4 +70,6 @@ · 69 unmodified lines
70/* Instruct lower device to use last 4-bytes of skb data as FCS */70/* Instruct lower device to use last 4-bytes of skb data as FCS */
71#define SO_NOFCS 4371#define SO_NOFCS 43
72 72
73#define SO_LOCK_FILTER 44
74
73#endif /* _ASM_SOCKET_H */75#endif /* _ASM_SOCKET_H */
arch/parisc/include/uapi/asm/socket.h+1−0
@@ -69,6 +69,7 @@ · 68 unmodified lines
69/* Instruct lower device to use last 4-bytes of skb data as FCS */69/* Instruct lower device to use last 4-bytes of skb data as FCS */
70#define SO_NOFCS 0x402470#define SO_NOFCS 0x4024
71 71
72#define SO_LOCK_FILTER 0x4025
72 73
73/* O_NONBLOCK clashes with the bits used for socket types. Therefore we74/* O_NONBLOCK clashes with the bits used for socket types. Therefore we
74 * have to define SOCK_NONBLOCK to a different value here.75 * have to define SOCK_NONBLOCK to a different value here.
arch/powerpc/include/uapi/asm/socket.h+2−0
@@ -77,4 +77,6 @@ · 76 unmodified lines
77/* Instruct lower device to use last 4-bytes of skb data as FCS */77/* Instruct lower device to use last 4-bytes of skb data as FCS */
78#define SO_NOFCS 4378#define SO_NOFCS 43
79 79
80#define SO_LOCK_FILTER 44
81
80#endif /* _ASM_POWERPC_SOCKET_H */82#endif /* _ASM_POWERPC_SOCKET_H */
arch/s390/include/uapi/asm/socket.h+2−0
@@ -76,4 +76,6 @@ · 75 unmodified lines
76/* Instruct lower device to use last 4-bytes of skb data as FCS */76/* Instruct lower device to use last 4-bytes of skb data as FCS */
77#define SO_NOFCS 4377#define SO_NOFCS 43
78 78
79#define SO_LOCK_FILTER 44
80
79#endif /* _ASM_SOCKET_H */81#endif /* _ASM_SOCKET_H */
arch/sparc/include/uapi/asm/socket.h+1−0
@@ -66,6 +66,7 @@ · 65 unmodified lines
66/* Instruct lower device to use last 4-bytes of skb data as FCS */66/* Instruct lower device to use last 4-bytes of skb data as FCS */
67#define SO_NOFCS 0x002767#define SO_NOFCS 0x0027
68 68
69#define SO_LOCK_FILTER 0x0028
69 70
70/* Security levels - as per NRL IPv6 - don't actually do anything */71/* Security levels - as per NRL IPv6 - don't actually do anything */
71#define SO_SECURITY_AUTHENTICATION 0x500172#define SO_SECURITY_AUTHENTICATION 0x5001
arch/xtensa/include/uapi/asm/socket.h+2−0
@@ -81,4 +81,6 @@ · 80 unmodified lines
81/* Instruct lower device to use last 4-bytes of skb data as FCS */81/* Instruct lower device to use last 4-bytes of skb data as FCS */
82#define SO_NOFCS 4382#define SO_NOFCS 43
83 83
84#define SO_LOCK_FILTER 44
85
84#endif /* _XTENSA_SOCKET_H */86#endif /* _XTENSA_SOCKET_H */
include/net/sock.h+1−0
@@ -664,6 +664,7 @@ enum sock_flags { · 663 unmodified lines
664 * Will use last 4 bytes of packet sent from664 * Will use last 4 bytes of packet sent from
665 * user-space instead.665 * user-space instead.
666 */666 */
667 SOCK_FILTER_LOCKED, /* Filter cannot be changed anymore */
667};668};
668 669
669static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)670static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)
include/uapi/asm-generic/socket.h+2−0
@@ -73,4 +73,6 @@ · 72 unmodified lines
73/* Instruct lower device to use last 4-bytes of skb data as FCS */73/* Instruct lower device to use last 4-bytes of skb data as FCS */
74#define SO_NOFCS 4374#define SO_NOFCS 43
75 75
76#define SO_LOCK_FILTER 44
77
76#endif /* __ASM_GENERIC_SOCKET_H */78#endif /* __ASM_GENERIC_SOCKET_H */
net/core/filter.c+6−0
@@ -721,6 +721,9 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) · 720 unmodified lines
721 unsigned int fsize = sizeof(struct sock_filter) * fprog->len;721 unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
722 int err;722 int err;
723 723
724 if (sock_flag(sk, SOCK_FILTER_LOCKED))
725 return -EPERM;
726
724 /* Make sure new filter is there and in the right amounts. */727 /* Make sure new filter is there and in the right amounts. */
725 if (fprog->filter == NULL)728 if (fprog->filter == NULL)
726 return -EINVAL;729 return -EINVAL;
@@ -757,6 +760,9 @@ int sk_detach_filter(struct sock *sk) · 30 unmodified lines
757 int ret = -ENOENT;760 int ret = -ENOENT;
758 struct sk_filter *filter;761 struct sk_filter *filter;
759 762
763 if (sock_flag(sk, SOCK_FILTER_LOCKED))
764 return -EPERM;
765
760 filter = rcu_dereference_protected(sk->sk_filter,766 filter = rcu_dereference_protected(sk->sk_filter,
761 sock_owned_by_user(sk));767 sock_owned_by_user(sk));
762 if (filter) {768 if (filter) {
net/core/sock.c+11−0
@@ -861,6 +861,13 @@ set_rcvbuf: · 860 unmodified lines
861 ret = sk_detach_filter(sk);861 ret = sk_detach_filter(sk);
862 break;862 break;
863 863
864 case SO_LOCK_FILTER:
865 if (sock_flag(sk, SOCK_FILTER_LOCKED) && !valbool)
866 ret = -EPERM;
867 else
868 sock_valbool_flag(sk, SOCK_FILTER_LOCKED, valbool);
869 break;
870
864 case SO_PASSSEC:871 case SO_PASSSEC:
865 if (valbool)872 if (valbool)
866 set_bit(SOCK_PASSSEC, &sock->flags);873 set_bit(SOCK_PASSSEC, &sock->flags);
@@ -1140,6 +1147,10 @@ int sock_getsockopt(struct socket *sock, int level, int optname, · 273 unmodified lines
1140 1147
1141 goto lenout;1148 goto lenout;
1142 1149
1150 case SO_LOCK_FILTER:
1151 v.val = sock_flag(sk, SOCK_FILTER_LOCKED);
1152 break;
1153
1143 default:1154 default:
1144 return -ENOPROTOOPT;1155 return -ENOPROTOOPT;
1145 }1156 }

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t