Commit | Line | Data |
---|---|---|
fc611f47 KS |
1 | // SPDX-License-Identifier: GPL-2.0 |
2 | ||
3 | /* | |
4 | * Copyright (C) 2020 Google LLC. | |
5 | */ | |
6 | ||
7 | #include <linux/filter.h> | |
8 | #include <linux/bpf.h> | |
9 | #include <linux/btf.h> | |
3f6719c7 | 10 | #include <linux/binfmts.h> |
9d3fdea7 KS |
11 | #include <linux/lsm_hooks.h> |
12 | #include <linux/bpf_lsm.h> | |
9e4e01df KS |
13 | #include <linux/kallsyms.h> |
14 | #include <linux/bpf_verifier.h> | |
30897832 KS |
15 | #include <net/bpf_sk_storage.h> |
16 | #include <linux/bpf_local_storage.h> | |
6f64e477 | 17 | #include <linux/btf_ids.h> |
27672f0d | 18 | #include <linux/ima.h> |
9d3fdea7 KS |
19 | |
20 | /* For every LSM hook that allows attachment of BPF programs, declare a nop | |
21 | * function where a BPF program can be attached. | |
22 | */ | |
23 | #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ | |
24 | noinline RET bpf_lsm_##NAME(__VA_ARGS__) \ | |
25 | { \ | |
26 | return DEFAULT; \ | |
27 | } | |
28 | ||
29 | #include <linux/lsm_hook_defs.h> | |
30 | #undef LSM_HOOK | |
fc611f47 | 31 | |
6f64e477 KS |
32 | #define LSM_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME) |
33 | BTF_SET_START(bpf_lsm_hooks) | |
34 | #include <linux/lsm_hook_defs.h> | |
35 | #undef LSM_HOOK | |
36 | BTF_SET_END(bpf_lsm_hooks) | |
9e4e01df KS |
37 | |
38 | int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, | |
39 | const struct bpf_prog *prog) | |
40 | { | |
41 | if (!prog->gpl_compatible) { | |
42 | bpf_log(vlog, | |
43 | "LSM programs must have a GPL compatible license\n"); | |
44 | return -EINVAL; | |
45 | } | |
46 | ||
6f64e477 | 47 | if (!btf_id_set_contains(&bpf_lsm_hooks, prog->aux->attach_btf_id)) { |
9e4e01df KS |
48 | bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n", |
49 | prog->aux->attach_btf_id, prog->aux->attach_func_name); | |
50 | return -EINVAL; | |
51 | } | |
52 | ||
53 | return 0; | |
54 | } | |
55 | ||
3f6719c7 KS |
56 | /* Mask for all the currently supported BPRM option flags */ |
57 | #define BPF_F_BRPM_OPTS_MASK BPF_F_BPRM_SECUREEXEC | |
58 | ||
59 | BPF_CALL_2(bpf_bprm_opts_set, struct linux_binprm *, bprm, u64, flags) | |
60 | { | |
61 | if (flags & ~BPF_F_BRPM_OPTS_MASK) | |
62 | return -EINVAL; | |
63 | ||
64 | bprm->secureexec = (flags & BPF_F_BPRM_SECUREEXEC); | |
65 | return 0; | |
66 | } | |
67 | ||
68 | BTF_ID_LIST_SINGLE(bpf_bprm_opts_set_btf_ids, struct, linux_binprm) | |
69 | ||
e2c69f3a | 70 | static const struct bpf_func_proto bpf_bprm_opts_set_proto = { |
3f6719c7 KS |
71 | .func = bpf_bprm_opts_set, |
72 | .gpl_only = false, | |
73 | .ret_type = RET_INTEGER, | |
74 | .arg1_type = ARG_PTR_TO_BTF_ID, | |
75 | .arg1_btf_id = &bpf_bprm_opts_set_btf_ids[0], | |
76 | .arg2_type = ARG_ANYTHING, | |
77 | }; | |
78 | ||
27672f0d KS |
79 | BPF_CALL_3(bpf_ima_inode_hash, struct inode *, inode, void *, dst, u32, size) |
80 | { | |
81 | return ima_inode_hash(inode, dst, size); | |
82 | } | |
83 | ||
84 | static bool bpf_ima_inode_hash_allowed(const struct bpf_prog *prog) | |
85 | { | |
86 | return bpf_lsm_is_sleepable_hook(prog->aux->attach_btf_id); | |
87 | } | |
88 | ||
89 | BTF_ID_LIST_SINGLE(bpf_ima_inode_hash_btf_ids, struct, inode) | |
90 | ||
e2c69f3a | 91 | static const struct bpf_func_proto bpf_ima_inode_hash_proto = { |
27672f0d KS |
92 | .func = bpf_ima_inode_hash, |
93 | .gpl_only = false, | |
94 | .ret_type = RET_INTEGER, | |
95 | .arg1_type = ARG_PTR_TO_BTF_ID, | |
96 | .arg1_btf_id = &bpf_ima_inode_hash_btf_ids[0], | |
97 | .arg2_type = ARG_PTR_TO_UNINIT_MEM, | |
98 | .arg3_type = ARG_CONST_SIZE, | |
99 | .allowed = bpf_ima_inode_hash_allowed, | |
100 | }; | |
101 | ||
30897832 KS |
102 | static const struct bpf_func_proto * |
103 | bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) | |
104 | { | |
105 | switch (func_id) { | |
106 | case BPF_FUNC_inode_storage_get: | |
107 | return &bpf_inode_storage_get_proto; | |
108 | case BPF_FUNC_inode_storage_delete: | |
109 | return &bpf_inode_storage_delete_proto; | |
5c9d706f | 110 | #ifdef CONFIG_NET |
30897832 | 111 | case BPF_FUNC_sk_storage_get: |
592a3498 | 112 | return &bpf_sk_storage_get_proto; |
30897832 | 113 | case BPF_FUNC_sk_storage_delete: |
592a3498 | 114 | return &bpf_sk_storage_delete_proto; |
5c9d706f | 115 | #endif /* CONFIG_NET */ |
9e7a4d98 KS |
116 | case BPF_FUNC_spin_lock: |
117 | return &bpf_spin_lock_proto; | |
118 | case BPF_FUNC_spin_unlock: | |
119 | return &bpf_spin_unlock_proto; | |
3f6719c7 KS |
120 | case BPF_FUNC_bprm_opts_set: |
121 | return &bpf_bprm_opts_set_proto; | |
27672f0d KS |
122 | case BPF_FUNC_ima_inode_hash: |
123 | return prog->aux->sleepable ? &bpf_ima_inode_hash_proto : NULL; | |
30897832 KS |
124 | default: |
125 | return tracing_prog_func_proto(func_id, prog); | |
126 | } | |
127 | } | |
128 | ||
423f1610 KS |
129 | /* The set of hooks which are called without pagefaults disabled and are allowed |
130 | * to "sleep" and thus can be used for sleeable BPF programs. | |
131 | */ | |
132 | BTF_SET_START(sleepable_lsm_hooks) | |
133 | BTF_ID(func, bpf_lsm_bpf) | |
134 | BTF_ID(func, bpf_lsm_bpf_map) | |
135 | BTF_ID(func, bpf_lsm_bpf_map_alloc_security) | |
136 | BTF_ID(func, bpf_lsm_bpf_map_free_security) | |
137 | BTF_ID(func, bpf_lsm_bpf_prog) | |
138 | BTF_ID(func, bpf_lsm_bprm_check_security) | |
139 | BTF_ID(func, bpf_lsm_bprm_committed_creds) | |
140 | BTF_ID(func, bpf_lsm_bprm_committing_creds) | |
141 | BTF_ID(func, bpf_lsm_bprm_creds_for_exec) | |
142 | BTF_ID(func, bpf_lsm_bprm_creds_from_file) | |
143 | BTF_ID(func, bpf_lsm_capget) | |
144 | BTF_ID(func, bpf_lsm_capset) | |
145 | BTF_ID(func, bpf_lsm_cred_prepare) | |
146 | BTF_ID(func, bpf_lsm_file_ioctl) | |
147 | BTF_ID(func, bpf_lsm_file_lock) | |
148 | BTF_ID(func, bpf_lsm_file_open) | |
149 | BTF_ID(func, bpf_lsm_file_receive) | |
78031381 MY |
150 | |
151 | #ifdef CONFIG_SECURITY_NETWORK | |
423f1610 | 152 | BTF_ID(func, bpf_lsm_inet_conn_established) |
78031381 MY |
153 | #endif /* CONFIG_SECURITY_NETWORK */ |
154 | ||
423f1610 KS |
155 | BTF_ID(func, bpf_lsm_inode_create) |
156 | BTF_ID(func, bpf_lsm_inode_free_security) | |
157 | BTF_ID(func, bpf_lsm_inode_getattr) | |
158 | BTF_ID(func, bpf_lsm_inode_getxattr) | |
159 | BTF_ID(func, bpf_lsm_inode_mknod) | |
160 | BTF_ID(func, bpf_lsm_inode_need_killpriv) | |
161 | BTF_ID(func, bpf_lsm_inode_post_setxattr) | |
162 | BTF_ID(func, bpf_lsm_inode_readlink) | |
163 | BTF_ID(func, bpf_lsm_inode_rename) | |
164 | BTF_ID(func, bpf_lsm_inode_rmdir) | |
165 | BTF_ID(func, bpf_lsm_inode_setattr) | |
166 | BTF_ID(func, bpf_lsm_inode_setxattr) | |
167 | BTF_ID(func, bpf_lsm_inode_symlink) | |
168 | BTF_ID(func, bpf_lsm_inode_unlink) | |
169 | BTF_ID(func, bpf_lsm_kernel_module_request) | |
170 | BTF_ID(func, bpf_lsm_kernfs_init_security) | |
78031381 MY |
171 | |
172 | #ifdef CONFIG_KEYS | |
423f1610 | 173 | BTF_ID(func, bpf_lsm_key_free) |
78031381 MY |
174 | #endif /* CONFIG_KEYS */ |
175 | ||
423f1610 KS |
176 | BTF_ID(func, bpf_lsm_mmap_file) |
177 | BTF_ID(func, bpf_lsm_netlink_send) | |
178 | BTF_ID(func, bpf_lsm_path_notify) | |
179 | BTF_ID(func, bpf_lsm_release_secctx) | |
180 | BTF_ID(func, bpf_lsm_sb_alloc_security) | |
181 | BTF_ID(func, bpf_lsm_sb_eat_lsm_opts) | |
182 | BTF_ID(func, bpf_lsm_sb_kern_mount) | |
183 | BTF_ID(func, bpf_lsm_sb_mount) | |
184 | BTF_ID(func, bpf_lsm_sb_remount) | |
185 | BTF_ID(func, bpf_lsm_sb_set_mnt_opts) | |
186 | BTF_ID(func, bpf_lsm_sb_show_options) | |
187 | BTF_ID(func, bpf_lsm_sb_statfs) | |
188 | BTF_ID(func, bpf_lsm_sb_umount) | |
189 | BTF_ID(func, bpf_lsm_settime) | |
78031381 MY |
190 | |
191 | #ifdef CONFIG_SECURITY_NETWORK | |
423f1610 KS |
192 | BTF_ID(func, bpf_lsm_socket_accept) |
193 | BTF_ID(func, bpf_lsm_socket_bind) | |
194 | BTF_ID(func, bpf_lsm_socket_connect) | |
195 | BTF_ID(func, bpf_lsm_socket_create) | |
196 | BTF_ID(func, bpf_lsm_socket_getpeername) | |
197 | BTF_ID(func, bpf_lsm_socket_getpeersec_dgram) | |
198 | BTF_ID(func, bpf_lsm_socket_getsockname) | |
199 | BTF_ID(func, bpf_lsm_socket_getsockopt) | |
200 | BTF_ID(func, bpf_lsm_socket_listen) | |
201 | BTF_ID(func, bpf_lsm_socket_post_create) | |
202 | BTF_ID(func, bpf_lsm_socket_recvmsg) | |
203 | BTF_ID(func, bpf_lsm_socket_sendmsg) | |
204 | BTF_ID(func, bpf_lsm_socket_shutdown) | |
205 | BTF_ID(func, bpf_lsm_socket_socketpair) | |
78031381 MY |
206 | #endif /* CONFIG_SECURITY_NETWORK */ |
207 | ||
423f1610 KS |
208 | BTF_ID(func, bpf_lsm_syslog) |
209 | BTF_ID(func, bpf_lsm_task_alloc) | |
4ebd7651 PM |
210 | BTF_ID(func, bpf_lsm_task_getsecid_subj) |
211 | BTF_ID(func, bpf_lsm_task_getsecid_obj) | |
423f1610 KS |
212 | BTF_ID(func, bpf_lsm_task_prctl) |
213 | BTF_ID(func, bpf_lsm_task_setscheduler) | |
214 | BTF_ID(func, bpf_lsm_task_to_inode) | |
215 | BTF_SET_END(sleepable_lsm_hooks) | |
216 | ||
217 | bool bpf_lsm_is_sleepable_hook(u32 btf_id) | |
218 | { | |
219 | return btf_id_set_contains(&sleepable_lsm_hooks, btf_id); | |
220 | } | |
221 | ||
fc611f47 KS |
222 | const struct bpf_prog_ops lsm_prog_ops = { |
223 | }; | |
224 | ||
225 | const struct bpf_verifier_ops lsm_verifier_ops = { | |
30897832 | 226 | .get_func_proto = bpf_lsm_func_proto, |
fc611f47 KS |
227 | .is_valid_access = btf_ctx_access, |
228 | }; |