lkml.org 
[lkml]   [2020]   [Mar]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH bpf-next v5 1/7] bpf: Introduce BPF_PROG_TYPE_LSM
    Date
    From: KP Singh <kpsingh@google.com>

    Introduce types and configs for bpf programs that can be attached to
    LSM hooks. The programs can be enabled by the config option
    CONFIG_BPF_LSM.

    Signed-off-by: KP Singh <kpsingh@google.com>
    Reviewed-by: Brendan Jackman <jackmanb@google.com>
    Reviewed-by: Florent Revest <revest@google.com>
    Reviewed-by: Thomas Garnier <thgarnie@google.com>
    ---
    MAINTAINERS | 1 +
    include/linux/bpf.h | 3 +++
    include/linux/bpf_types.h | 4 ++++
    include/uapi/linux/bpf.h | 2 ++
    init/Kconfig | 10 ++++++++++
    kernel/bpf/Makefile | 1 +
    kernel/bpf/bpf_lsm.c | 17 +++++++++++++++++
    kernel/trace/bpf_trace.c | 12 ++++++------
    tools/include/uapi/linux/bpf.h | 2 ++
    tools/lib/bpf/libbpf_probes.c | 1 +
    10 files changed, 47 insertions(+), 6 deletions(-)
    create mode 100644 kernel/bpf/bpf_lsm.c

    diff --git a/MAINTAINERS b/MAINTAINERS
    index 5dbee41045bc..3197fe9256b2 100644
    --- a/MAINTAINERS
    +++ b/MAINTAINERS
    @@ -3147,6 +3147,7 @@ R: Martin KaFai Lau <kafai@fb.com>
    R: Song Liu <songliubraving@fb.com>
    R: Yonghong Song <yhs@fb.com>
    R: Andrii Nakryiko <andriin@fb.com>
    +R: KP Singh <kpsingh@chromium.org>
    L: netdev@vger.kernel.org
    L: bpf@vger.kernel.org
    T: git git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
    diff --git a/include/linux/bpf.h b/include/linux/bpf.h
    index bdb981c204fa..af81ec7b783c 100644
    --- a/include/linux/bpf.h
    +++ b/include/linux/bpf.h
    @@ -1513,6 +1513,9 @@ extern const struct bpf_func_proto bpf_tcp_sock_proto;
    extern const struct bpf_func_proto bpf_jiffies64_proto;
    extern const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto;

    +const struct bpf_func_proto *bpf_tracing_func_proto(
    + enum bpf_func_id func_id, const struct bpf_prog *prog);
    +
    /* Shared helpers among cBPF and eBPF. */
    void bpf_user_rnd_init_once(void);
    u64 bpf_user_rnd_u32(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
    diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h
    index c81d4ece79a4..ba0c2d56f8a3 100644
    --- a/include/linux/bpf_types.h
    +++ b/include/linux/bpf_types.h
    @@ -70,6 +70,10 @@ BPF_PROG_TYPE(BPF_PROG_TYPE_STRUCT_OPS, bpf_struct_ops,
    void *, void *)
    BPF_PROG_TYPE(BPF_PROG_TYPE_EXT, bpf_extension,
    void *, void *)
    +#ifdef CONFIG_BPF_LSM
    +BPF_PROG_TYPE(BPF_PROG_TYPE_LSM, lsm,
    + void *, void *)
    +#endif /* CONFIG_BPF_LSM */
    #endif

    BPF_MAP_TYPE(BPF_MAP_TYPE_ARRAY, array_map_ops)
    diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
    index 5d01c5c7e598..9f2673c58788 100644
    --- a/include/uapi/linux/bpf.h
    +++ b/include/uapi/linux/bpf.h
    @@ -181,6 +181,7 @@ enum bpf_prog_type {
    BPF_PROG_TYPE_TRACING,
    BPF_PROG_TYPE_STRUCT_OPS,
    BPF_PROG_TYPE_EXT,
    + BPF_PROG_TYPE_LSM,
    };

    enum bpf_attach_type {
    @@ -211,6 +212,7 @@ enum bpf_attach_type {
    BPF_TRACE_FENTRY,
    BPF_TRACE_FEXIT,
    BPF_MODIFY_RETURN,
    + BPF_LSM_MAC,
    __MAX_BPF_ATTACH_TYPE
    };

    diff --git a/init/Kconfig b/init/Kconfig
    index 20a6ac33761c..b2c9a833bc58 100644
    --- a/init/Kconfig
    +++ b/init/Kconfig
    @@ -1616,6 +1616,16 @@ config KALLSYMS_BASE_RELATIVE
    # end of the "standard kernel features (expert users)" menu

    # syscall, maps, verifier
    +
    +config BPF_LSM
    + bool "LSM Instrumentation with BPF"
    + depends on BPF_SYSCALL
    + help
    + Enables instrumentation of the security hooks with eBPF programs for
    + implementing dynamic MAC and Audit Policies.
    +
    + If you are unsure how to answer this question, answer N.
    +
    config BPF_SYSCALL
    bool "Enable bpf() system call"
    select BPF
    diff --git a/kernel/bpf/Makefile b/kernel/bpf/Makefile
    index 046ce5d98033..f2d7be596966 100644
    --- a/kernel/bpf/Makefile
    +++ b/kernel/bpf/Makefile
    @@ -29,4 +29,5 @@ obj-$(CONFIG_DEBUG_INFO_BTF) += sysfs_btf.o
    endif
    ifeq ($(CONFIG_BPF_JIT),y)
    obj-$(CONFIG_BPF_SYSCALL) += bpf_struct_ops.o
    +obj-${CONFIG_BPF_LSM} += bpf_lsm.o
    endif
    diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
    new file mode 100644
    index 000000000000..82875039ca90
    --- /dev/null
    +++ b/kernel/bpf/bpf_lsm.c
    @@ -0,0 +1,17 @@
    +// SPDX-License-Identifier: GPL-2.0
    +
    +/*
    + * Copyright (C) 2020 Google LLC.
    + */
    +
    +#include <linux/filter.h>
    +#include <linux/bpf.h>
    +#include <linux/btf.h>
    +
    +const struct bpf_prog_ops lsm_prog_ops = {
    +};
    +
    +const struct bpf_verifier_ops lsm_verifier_ops = {
    + .get_func_proto = bpf_tracing_func_proto,
    + .is_valid_access = btf_ctx_access,
    +};
    diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
    index e619eedb5919..37ffceab608f 100644
    --- a/kernel/trace/bpf_trace.c
    +++ b/kernel/trace/bpf_trace.c
    @@ -779,8 +779,8 @@ static const struct bpf_func_proto bpf_send_signal_thread_proto = {
    .arg1_type = ARG_ANYTHING,
    };

    -static const struct bpf_func_proto *
    -tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
    +const struct bpf_func_proto *
    +bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
    {
    switch (func_id) {
    case BPF_FUNC_map_lookup_elem:
    @@ -865,7 +865,7 @@ kprobe_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
    return &bpf_override_return_proto;
    #endif
    default:
    - return tracing_func_proto(func_id, prog);
    + return bpf_tracing_func_proto(func_id, prog);
    }
    }

    @@ -975,7 +975,7 @@ tp_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
    case BPF_FUNC_get_stack:
    return &bpf_get_stack_proto_tp;
    default:
    - return tracing_func_proto(func_id, prog);
    + return bpf_tracing_func_proto(func_id, prog);
    }
    }

    @@ -1082,7 +1082,7 @@ pe_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
    case BPF_FUNC_read_branch_records:
    return &bpf_read_branch_records_proto;
    default:
    - return tracing_func_proto(func_id, prog);
    + return bpf_tracing_func_proto(func_id, prog);
    }
    }

    @@ -1210,7 +1210,7 @@ raw_tp_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
    case BPF_FUNC_get_stack:
    return &bpf_get_stack_proto_raw_tp;
    default:
    - return tracing_func_proto(func_id, prog);
    + return bpf_tracing_func_proto(func_id, prog);
    }
    }

    diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
    index 5d01c5c7e598..9f2673c58788 100644
    --- a/tools/include/uapi/linux/bpf.h
    +++ b/tools/include/uapi/linux/bpf.h
    @@ -181,6 +181,7 @@ enum bpf_prog_type {
    BPF_PROG_TYPE_TRACING,
    BPF_PROG_TYPE_STRUCT_OPS,
    BPF_PROG_TYPE_EXT,
    + BPF_PROG_TYPE_LSM,
    };

    enum bpf_attach_type {
    @@ -211,6 +212,7 @@ enum bpf_attach_type {
    BPF_TRACE_FENTRY,
    BPF_TRACE_FEXIT,
    BPF_MODIFY_RETURN,
    + BPF_LSM_MAC,
    __MAX_BPF_ATTACH_TYPE
    };

    diff --git a/tools/lib/bpf/libbpf_probes.c b/tools/lib/bpf/libbpf_probes.c
    index b782ebef6ac9..2c92059c0c90 100644
    --- a/tools/lib/bpf/libbpf_probes.c
    +++ b/tools/lib/bpf/libbpf_probes.c
    @@ -108,6 +108,7 @@ probe_load(enum bpf_prog_type prog_type, const struct bpf_insn *insns,
    case BPF_PROG_TYPE_TRACING:
    case BPF_PROG_TYPE_STRUCT_OPS:
    case BPF_PROG_TYPE_EXT:
    + case BPF_PROG_TYPE_LSM:
    default:
    break;
    }
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-03-23 17:46    [W:4.083 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site