Commit | Line | Data |
---|---|---|
fc611f47 KS |
1 | // SPDX-License-Identifier: GPL-2.0 |
2 | ||
3 | /* | |
4 | * Copyright (C) 2020 Google LLC. | |
5 | */ | |
6 | ||
7 | #include <linux/filter.h> | |
8 | #include <linux/bpf.h> | |
9 | #include <linux/btf.h> | |
3f6719c7 | 10 | #include <linux/binfmts.h> |
9d3fdea7 KS |
11 | #include <linux/lsm_hooks.h> |
12 | #include <linux/bpf_lsm.h> | |
9e4e01df KS |
13 | #include <linux/kallsyms.h> |
14 | #include <linux/bpf_verifier.h> | |
30897832 KS |
15 | #include <net/bpf_sk_storage.h> |
16 | #include <linux/bpf_local_storage.h> | |
6f64e477 | 17 | #include <linux/btf_ids.h> |
27672f0d | 18 | #include <linux/ima.h> |
69fd337a | 19 | #include <linux/bpf-cgroup.h> |
9d3fdea7 KS |
20 | |
21 | /* For every LSM hook that allows attachment of BPF programs, declare a nop | |
22 | * function where a BPF program can be attached. | |
23 | */ | |
24 | #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ | |
25 | noinline RET bpf_lsm_##NAME(__VA_ARGS__) \ | |
26 | { \ | |
27 | return DEFAULT; \ | |
28 | } | |
29 | ||
30 | #include <linux/lsm_hook_defs.h> | |
31 | #undef LSM_HOOK | |
fc611f47 | 32 | |
6f64e477 KS |
33 | #define LSM_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME) |
34 | BTF_SET_START(bpf_lsm_hooks) | |
35 | #include <linux/lsm_hook_defs.h> | |
36 | #undef LSM_HOOK | |
37 | BTF_SET_END(bpf_lsm_hooks) | |
9e4e01df | 38 | |
69fd337a SF |
39 | /* List of LSM hooks that should operate on 'current' cgroup regardless |
40 | * of function signature. | |
41 | */ | |
42 | BTF_SET_START(bpf_lsm_current_hooks) | |
43 | /* operate on freshly allocated sk without any cgroup association */ | |
ef331a8d | 44 | #ifdef CONFIG_SECURITY_NETWORK |
69fd337a SF |
45 | BTF_ID(func, bpf_lsm_sk_alloc_security) |
46 | BTF_ID(func, bpf_lsm_sk_free_security) | |
ef331a8d | 47 | #endif |
69fd337a SF |
48 | BTF_SET_END(bpf_lsm_current_hooks) |
49 | ||
9113d7e4 SF |
50 | /* List of LSM hooks that trigger while the socket is properly locked. |
51 | */ | |
52 | BTF_SET_START(bpf_lsm_locked_sockopt_hooks) | |
ef331a8d | 53 | #ifdef CONFIG_SECURITY_NETWORK |
9113d7e4 SF |
54 | BTF_ID(func, bpf_lsm_sock_graft) |
55 | BTF_ID(func, bpf_lsm_inet_csk_clone) | |
56 | BTF_ID(func, bpf_lsm_inet_conn_established) | |
ef331a8d | 57 | #endif |
9113d7e4 SF |
58 | BTF_SET_END(bpf_lsm_locked_sockopt_hooks) |
59 | ||
60 | /* List of LSM hooks that trigger while the socket is _not_ locked, | |
61 | * but it's ok to call bpf_{g,s}etsockopt because the socket is still | |
62 | * in the early init phase. | |
63 | */ | |
64 | BTF_SET_START(bpf_lsm_unlocked_sockopt_hooks) | |
ef331a8d | 65 | #ifdef CONFIG_SECURITY_NETWORK |
9113d7e4 SF |
66 | BTF_ID(func, bpf_lsm_socket_post_create) |
67 | BTF_ID(func, bpf_lsm_socket_socketpair) | |
ef331a8d | 68 | #endif |
9113d7e4 SF |
69 | BTF_SET_END(bpf_lsm_unlocked_sockopt_hooks) |
70 | ||
3908fcdd | 71 | #ifdef CONFIG_CGROUP_BPF |
69fd337a SF |
72 | void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, |
73 | bpf_func_t *bpf_func) | |
74 | { | |
3908fcdd | 75 | const struct btf_param *args __maybe_unused; |
69fd337a SF |
76 | |
77 | if (btf_type_vlen(prog->aux->attach_func_proto) < 1 || | |
78 | btf_id_set_contains(&bpf_lsm_current_hooks, | |
79 | prog->aux->attach_btf_id)) { | |
80 | *bpf_func = __cgroup_bpf_run_lsm_current; | |
81 | return; | |
82 | } | |
83 | ||
3908fcdd | 84 | #ifdef CONFIG_NET |
69fd337a SF |
85 | args = btf_params(prog->aux->attach_func_proto); |
86 | ||
69fd337a SF |
87 | if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCKET]) |
88 | *bpf_func = __cgroup_bpf_run_lsm_socket; | |
89 | else if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCK]) | |
90 | *bpf_func = __cgroup_bpf_run_lsm_sock; | |
91 | else | |
92 | #endif | |
93 | *bpf_func = __cgroup_bpf_run_lsm_current; | |
94 | } | |
3908fcdd | 95 | #endif |
69fd337a | 96 | |
9e4e01df KS |
97 | int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, |
98 | const struct bpf_prog *prog) | |
99 | { | |
100 | if (!prog->gpl_compatible) { | |
101 | bpf_log(vlog, | |
102 | "LSM programs must have a GPL compatible license\n"); | |
103 | return -EINVAL; | |
104 | } | |
105 | ||
6f64e477 | 106 | if (!btf_id_set_contains(&bpf_lsm_hooks, prog->aux->attach_btf_id)) { |
9e4e01df KS |
107 | bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n", |
108 | prog->aux->attach_btf_id, prog->aux->attach_func_name); | |
109 | return -EINVAL; | |
110 | } | |
111 | ||
112 | return 0; | |
113 | } | |
114 | ||
3f6719c7 KS |
115 | /* Mask for all the currently supported BPRM option flags */ |
116 | #define BPF_F_BRPM_OPTS_MASK BPF_F_BPRM_SECUREEXEC | |
117 | ||
118 | BPF_CALL_2(bpf_bprm_opts_set, struct linux_binprm *, bprm, u64, flags) | |
119 | { | |
120 | if (flags & ~BPF_F_BRPM_OPTS_MASK) | |
121 | return -EINVAL; | |
122 | ||
123 | bprm->secureexec = (flags & BPF_F_BPRM_SECUREEXEC); | |
124 | return 0; | |
125 | } | |
126 | ||
127 | BTF_ID_LIST_SINGLE(bpf_bprm_opts_set_btf_ids, struct, linux_binprm) | |
128 | ||
e2c69f3a | 129 | static const struct bpf_func_proto bpf_bprm_opts_set_proto = { |
3f6719c7 KS |
130 | .func = bpf_bprm_opts_set, |
131 | .gpl_only = false, | |
132 | .ret_type = RET_INTEGER, | |
133 | .arg1_type = ARG_PTR_TO_BTF_ID, | |
134 | .arg1_btf_id = &bpf_bprm_opts_set_btf_ids[0], | |
135 | .arg2_type = ARG_ANYTHING, | |
136 | }; | |
137 | ||
27672f0d KS |
138 | BPF_CALL_3(bpf_ima_inode_hash, struct inode *, inode, void *, dst, u32, size) |
139 | { | |
140 | return ima_inode_hash(inode, dst, size); | |
141 | } | |
142 | ||
143 | static bool bpf_ima_inode_hash_allowed(const struct bpf_prog *prog) | |
144 | { | |
145 | return bpf_lsm_is_sleepable_hook(prog->aux->attach_btf_id); | |
146 | } | |
147 | ||
148 | BTF_ID_LIST_SINGLE(bpf_ima_inode_hash_btf_ids, struct, inode) | |
149 | ||
e2c69f3a | 150 | static const struct bpf_func_proto bpf_ima_inode_hash_proto = { |
27672f0d KS |
151 | .func = bpf_ima_inode_hash, |
152 | .gpl_only = false, | |
01685c5b | 153 | .might_sleep = true, |
27672f0d KS |
154 | .ret_type = RET_INTEGER, |
155 | .arg1_type = ARG_PTR_TO_BTF_ID, | |
156 | .arg1_btf_id = &bpf_ima_inode_hash_btf_ids[0], | |
157 | .arg2_type = ARG_PTR_TO_UNINIT_MEM, | |
158 | .arg3_type = ARG_CONST_SIZE, | |
159 | .allowed = bpf_ima_inode_hash_allowed, | |
160 | }; | |
161 | ||
174b1694 RS |
162 | BPF_CALL_3(bpf_ima_file_hash, struct file *, file, void *, dst, u32, size) |
163 | { | |
164 | return ima_file_hash(file, dst, size); | |
165 | } | |
166 | ||
167 | BTF_ID_LIST_SINGLE(bpf_ima_file_hash_btf_ids, struct, file) | |
168 | ||
169 | static const struct bpf_func_proto bpf_ima_file_hash_proto = { | |
170 | .func = bpf_ima_file_hash, | |
171 | .gpl_only = false, | |
01685c5b | 172 | .might_sleep = true, |
174b1694 RS |
173 | .ret_type = RET_INTEGER, |
174 | .arg1_type = ARG_PTR_TO_BTF_ID, | |
175 | .arg1_btf_id = &bpf_ima_file_hash_btf_ids[0], | |
176 | .arg2_type = ARG_PTR_TO_UNINIT_MEM, | |
177 | .arg3_type = ARG_CONST_SIZE, | |
178 | .allowed = bpf_ima_inode_hash_allowed, | |
179 | }; | |
180 | ||
2fcc8241 KFL |
181 | BPF_CALL_1(bpf_get_attach_cookie, void *, ctx) |
182 | { | |
183 | struct bpf_trace_run_ctx *run_ctx; | |
184 | ||
185 | run_ctx = container_of(current->bpf_ctx, struct bpf_trace_run_ctx, run_ctx); | |
186 | return run_ctx->bpf_cookie; | |
187 | } | |
188 | ||
189 | static const struct bpf_func_proto bpf_get_attach_cookie_proto = { | |
190 | .func = bpf_get_attach_cookie, | |
191 | .gpl_only = false, | |
192 | .ret_type = RET_INTEGER, | |
193 | .arg1_type = ARG_PTR_TO_CTX, | |
194 | }; | |
195 | ||
30897832 KS |
196 | static const struct bpf_func_proto * |
197 | bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) | |
198 | { | |
bed89185 SF |
199 | const struct bpf_func_proto *func_proto; |
200 | ||
201 | if (prog->expected_attach_type == BPF_LSM_CGROUP) { | |
202 | func_proto = cgroup_common_func_proto(func_id, prog); | |
203 | if (func_proto) | |
204 | return func_proto; | |
205 | } | |
206 | ||
30897832 KS |
207 | switch (func_id) { |
208 | case BPF_FUNC_inode_storage_get: | |
209 | return &bpf_inode_storage_get_proto; | |
210 | case BPF_FUNC_inode_storage_delete: | |
211 | return &bpf_inode_storage_delete_proto; | |
5c9d706f | 212 | #ifdef CONFIG_NET |
30897832 | 213 | case BPF_FUNC_sk_storage_get: |
592a3498 | 214 | return &bpf_sk_storage_get_proto; |
30897832 | 215 | case BPF_FUNC_sk_storage_delete: |
592a3498 | 216 | return &bpf_sk_storage_delete_proto; |
5c9d706f | 217 | #endif /* CONFIG_NET */ |
9e7a4d98 KS |
218 | case BPF_FUNC_spin_lock: |
219 | return &bpf_spin_lock_proto; | |
220 | case BPF_FUNC_spin_unlock: | |
221 | return &bpf_spin_unlock_proto; | |
3f6719c7 KS |
222 | case BPF_FUNC_bprm_opts_set: |
223 | return &bpf_bprm_opts_set_proto; | |
27672f0d | 224 | case BPF_FUNC_ima_inode_hash: |
01685c5b | 225 | return &bpf_ima_inode_hash_proto; |
174b1694 | 226 | case BPF_FUNC_ima_file_hash: |
01685c5b | 227 | return &bpf_ima_file_hash_proto; |
2fcc8241 KFL |
228 | case BPF_FUNC_get_attach_cookie: |
229 | return bpf_prog_has_trampoline(prog) ? &bpf_get_attach_cookie_proto : NULL; | |
3908fcdd | 230 | #ifdef CONFIG_NET |
9113d7e4 SF |
231 | case BPF_FUNC_setsockopt: |
232 | if (prog->expected_attach_type != BPF_LSM_CGROUP) | |
233 | return NULL; | |
234 | if (btf_id_set_contains(&bpf_lsm_locked_sockopt_hooks, | |
235 | prog->aux->attach_btf_id)) | |
236 | return &bpf_sk_setsockopt_proto; | |
237 | if (btf_id_set_contains(&bpf_lsm_unlocked_sockopt_hooks, | |
238 | prog->aux->attach_btf_id)) | |
239 | return &bpf_unlocked_sk_setsockopt_proto; | |
240 | return NULL; | |
241 | case BPF_FUNC_getsockopt: | |
242 | if (prog->expected_attach_type != BPF_LSM_CGROUP) | |
243 | return NULL; | |
244 | if (btf_id_set_contains(&bpf_lsm_locked_sockopt_hooks, | |
245 | prog->aux->attach_btf_id)) | |
246 | return &bpf_sk_getsockopt_proto; | |
247 | if (btf_id_set_contains(&bpf_lsm_unlocked_sockopt_hooks, | |
248 | prog->aux->attach_btf_id)) | |
249 | return &bpf_unlocked_sk_getsockopt_proto; | |
250 | return NULL; | |
3908fcdd | 251 | #endif |
30897832 KS |
252 | default: |
253 | return tracing_prog_func_proto(func_id, prog); | |
254 | } | |
255 | } | |
256 | ||
423f1610 | 257 | /* The set of hooks which are called without pagefaults disabled and are allowed |
712b78c6 | 258 | * to "sleep" and thus can be used for sleepable BPF programs. |
423f1610 KS |
259 | */ |
260 | BTF_SET_START(sleepable_lsm_hooks) | |
261 | BTF_ID(func, bpf_lsm_bpf) | |
262 | BTF_ID(func, bpf_lsm_bpf_map) | |
263 | BTF_ID(func, bpf_lsm_bpf_map_alloc_security) | |
264 | BTF_ID(func, bpf_lsm_bpf_map_free_security) | |
265 | BTF_ID(func, bpf_lsm_bpf_prog) | |
266 | BTF_ID(func, bpf_lsm_bprm_check_security) | |
267 | BTF_ID(func, bpf_lsm_bprm_committed_creds) | |
268 | BTF_ID(func, bpf_lsm_bprm_committing_creds) | |
269 | BTF_ID(func, bpf_lsm_bprm_creds_for_exec) | |
270 | BTF_ID(func, bpf_lsm_bprm_creds_from_file) | |
271 | BTF_ID(func, bpf_lsm_capget) | |
272 | BTF_ID(func, bpf_lsm_capset) | |
273 | BTF_ID(func, bpf_lsm_cred_prepare) | |
274 | BTF_ID(func, bpf_lsm_file_ioctl) | |
275 | BTF_ID(func, bpf_lsm_file_lock) | |
276 | BTF_ID(func, bpf_lsm_file_open) | |
277 | BTF_ID(func, bpf_lsm_file_receive) | |
78031381 MY |
278 | |
279 | #ifdef CONFIG_SECURITY_NETWORK | |
423f1610 | 280 | BTF_ID(func, bpf_lsm_inet_conn_established) |
78031381 MY |
281 | #endif /* CONFIG_SECURITY_NETWORK */ |
282 | ||
423f1610 KS |
283 | BTF_ID(func, bpf_lsm_inode_create) |
284 | BTF_ID(func, bpf_lsm_inode_free_security) | |
285 | BTF_ID(func, bpf_lsm_inode_getattr) | |
286 | BTF_ID(func, bpf_lsm_inode_getxattr) | |
287 | BTF_ID(func, bpf_lsm_inode_mknod) | |
288 | BTF_ID(func, bpf_lsm_inode_need_killpriv) | |
289 | BTF_ID(func, bpf_lsm_inode_post_setxattr) | |
290 | BTF_ID(func, bpf_lsm_inode_readlink) | |
291 | BTF_ID(func, bpf_lsm_inode_rename) | |
292 | BTF_ID(func, bpf_lsm_inode_rmdir) | |
293 | BTF_ID(func, bpf_lsm_inode_setattr) | |
294 | BTF_ID(func, bpf_lsm_inode_setxattr) | |
295 | BTF_ID(func, bpf_lsm_inode_symlink) | |
296 | BTF_ID(func, bpf_lsm_inode_unlink) | |
297 | BTF_ID(func, bpf_lsm_kernel_module_request) | |
df6b3039 | 298 | BTF_ID(func, bpf_lsm_kernel_read_file) |
423f1610 | 299 | BTF_ID(func, bpf_lsm_kernfs_init_security) |
78031381 MY |
300 | |
301 | #ifdef CONFIG_KEYS | |
423f1610 | 302 | BTF_ID(func, bpf_lsm_key_free) |
78031381 MY |
303 | #endif /* CONFIG_KEYS */ |
304 | ||
423f1610 KS |
305 | BTF_ID(func, bpf_lsm_mmap_file) |
306 | BTF_ID(func, bpf_lsm_netlink_send) | |
307 | BTF_ID(func, bpf_lsm_path_notify) | |
308 | BTF_ID(func, bpf_lsm_release_secctx) | |
309 | BTF_ID(func, bpf_lsm_sb_alloc_security) | |
310 | BTF_ID(func, bpf_lsm_sb_eat_lsm_opts) | |
311 | BTF_ID(func, bpf_lsm_sb_kern_mount) | |
312 | BTF_ID(func, bpf_lsm_sb_mount) | |
313 | BTF_ID(func, bpf_lsm_sb_remount) | |
314 | BTF_ID(func, bpf_lsm_sb_set_mnt_opts) | |
315 | BTF_ID(func, bpf_lsm_sb_show_options) | |
316 | BTF_ID(func, bpf_lsm_sb_statfs) | |
317 | BTF_ID(func, bpf_lsm_sb_umount) | |
318 | BTF_ID(func, bpf_lsm_settime) | |
78031381 MY |
319 | |
320 | #ifdef CONFIG_SECURITY_NETWORK | |
423f1610 KS |
321 | BTF_ID(func, bpf_lsm_socket_accept) |
322 | BTF_ID(func, bpf_lsm_socket_bind) | |
323 | BTF_ID(func, bpf_lsm_socket_connect) | |
324 | BTF_ID(func, bpf_lsm_socket_create) | |
325 | BTF_ID(func, bpf_lsm_socket_getpeername) | |
326 | BTF_ID(func, bpf_lsm_socket_getpeersec_dgram) | |
327 | BTF_ID(func, bpf_lsm_socket_getsockname) | |
328 | BTF_ID(func, bpf_lsm_socket_getsockopt) | |
329 | BTF_ID(func, bpf_lsm_socket_listen) | |
330 | BTF_ID(func, bpf_lsm_socket_post_create) | |
331 | BTF_ID(func, bpf_lsm_socket_recvmsg) | |
332 | BTF_ID(func, bpf_lsm_socket_sendmsg) | |
333 | BTF_ID(func, bpf_lsm_socket_shutdown) | |
334 | BTF_ID(func, bpf_lsm_socket_socketpair) | |
78031381 MY |
335 | #endif /* CONFIG_SECURITY_NETWORK */ |
336 | ||
423f1610 KS |
337 | BTF_ID(func, bpf_lsm_syslog) |
338 | BTF_ID(func, bpf_lsm_task_alloc) | |
63ee956f | 339 | BTF_ID(func, bpf_lsm_current_getsecid_subj) |
4ebd7651 | 340 | BTF_ID(func, bpf_lsm_task_getsecid_obj) |
423f1610 KS |
341 | BTF_ID(func, bpf_lsm_task_prctl) |
342 | BTF_ID(func, bpf_lsm_task_setscheduler) | |
343 | BTF_ID(func, bpf_lsm_task_to_inode) | |
401e64b3 | 344 | BTF_ID(func, bpf_lsm_userns_create) |
423f1610 KS |
345 | BTF_SET_END(sleepable_lsm_hooks) |
346 | ||
c0c852dd YS |
347 | BTF_SET_START(untrusted_lsm_hooks) |
348 | BTF_ID(func, bpf_lsm_bpf_map_free_security) | |
349 | BTF_ID(func, bpf_lsm_bpf_prog_alloc_security) | |
350 | BTF_ID(func, bpf_lsm_bpf_prog_free_security) | |
351 | BTF_ID(func, bpf_lsm_file_alloc_security) | |
352 | BTF_ID(func, bpf_lsm_file_free_security) | |
cc074822 | 353 | #ifdef CONFIG_SECURITY_NETWORK |
c0c852dd YS |
354 | BTF_ID(func, bpf_lsm_sk_alloc_security) |
355 | BTF_ID(func, bpf_lsm_sk_free_security) | |
cc074822 | 356 | #endif /* CONFIG_SECURITY_NETWORK */ |
c0c852dd YS |
357 | BTF_ID(func, bpf_lsm_task_free) |
358 | BTF_SET_END(untrusted_lsm_hooks) | |
359 | ||
423f1610 KS |
360 | bool bpf_lsm_is_sleepable_hook(u32 btf_id) |
361 | { | |
362 | return btf_id_set_contains(&sleepable_lsm_hooks, btf_id); | |
363 | } | |
364 | ||
c0c852dd YS |
365 | bool bpf_lsm_is_trusted(const struct bpf_prog *prog) |
366 | { | |
367 | return !btf_id_set_contains(&untrusted_lsm_hooks, prog->aux->attach_btf_id); | |
368 | } | |
369 | ||
fc611f47 KS |
370 | const struct bpf_prog_ops lsm_prog_ops = { |
371 | }; | |
372 | ||
373 | const struct bpf_verifier_ops lsm_verifier_ops = { | |
30897832 | 374 | .get_func_proto = bpf_lsm_func_proto, |
fc611f47 KS |
375 | .is_valid_access = btf_ctx_access, |
376 | }; |