kernel/bpf/bpf_lsm.c

0001 // SPDX-License-Identifier: GPL-2.0
0002
0003 /*
0004  * Copyright (C) 2020 Google LLC.
0005  */
0006
0007 #include <linux/filter.h>
0008 #include <linux/bpf.h>
0009 #include <linux/btf.h>
0010 #include <linux/binfmts.h>
0011 #include <linux/lsm_hooks.h>
0012 #include <linux/bpf_lsm.h>
0013 #include <linux/kallsyms.h>
0014 #include <linux/bpf_verifier.h>
0015 #include <net/bpf_sk_storage.h>
0016 #include <linux/bpf_local_storage.h>
0017 #include <linux/btf_ids.h>
0018 #include <linux/ima.h>
0019 #include <linux/bpf-cgroup.h>
0020
0021 /* For every LSM hook that allows attachment of BPF programs, declare a nop
0022  * function where a BPF program can be attached.
0023  */
0024 #define LSM_HOOK(RET, DEFAULT, NAME, ...)   \
0025 noinline RET bpf_lsm_##NAME(__VA_ARGS__)    \
0026 {                       \
0027     return DEFAULT;             \
0028 }
0029
0030 #include <linux/lsm_hook_defs.h>
0031 #undef LSM_HOOK
0032
0033 #define LSM_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME)
0034 BTF_SET_START(bpf_lsm_hooks)
0035 #include <linux/lsm_hook_defs.h>
0036 #undef LSM_HOOK
0037 BTF_SET_END(bpf_lsm_hooks)
0038
0039 /* List of LSM hooks that should operate on 'current' cgroup regardless
0040  * of function signature.
0041  */
0042 BTF_SET_START(bpf_lsm_current_hooks)
0043 /* operate on freshly allocated sk without any cgroup association */
0044 BTF_ID(func, bpf_lsm_sk_alloc_security)
0045 BTF_ID(func, bpf_lsm_sk_free_security)
0046 BTF_SET_END(bpf_lsm_current_hooks)
0047
0048 /* List of LSM hooks that trigger while the socket is properly locked.
0049  */
0050 BTF_SET_START(bpf_lsm_locked_sockopt_hooks)
0051 BTF_ID(func, bpf_lsm_socket_sock_rcv_skb)
0052 BTF_ID(func, bpf_lsm_sock_graft)
0053 BTF_ID(func, bpf_lsm_inet_csk_clone)
0054 BTF_ID(func, bpf_lsm_inet_conn_established)
0055 BTF_SET_END(bpf_lsm_locked_sockopt_hooks)
0056
0057 /* List of LSM hooks that trigger while the socket is _not_ locked,
0058  * but it's ok to call bpf_{g,s}etsockopt because the socket is still
0059  * in the early init phase.
0060  */
0061 BTF_SET_START(bpf_lsm_unlocked_sockopt_hooks)
0062 BTF_ID(func, bpf_lsm_socket_post_create)
0063 BTF_ID(func, bpf_lsm_socket_socketpair)
0064 BTF_SET_END(bpf_lsm_unlocked_sockopt_hooks)
0065
0066 #ifdef CONFIG_CGROUP_BPF
0067 void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog,
0068                  bpf_func_t *bpf_func)
0069 {
0070     const struct btf_param *args __maybe_unused;
0071
0072     if (btf_type_vlen(prog->aux->attach_func_proto) < 1 ||
0073         btf_id_set_contains(&bpf_lsm_current_hooks,
0074                 prog->aux->attach_btf_id)) {
0075         *bpf_func = __cgroup_bpf_run_lsm_current;
0076         return;
0077     }
0078
0079 #ifdef CONFIG_NET
0080     args = btf_params(prog->aux->attach_func_proto);
0081
0082     if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCKET])
0083         *bpf_func = __cgroup_bpf_run_lsm_socket;
0084     else if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCK])
0085         *bpf_func = __cgroup_bpf_run_lsm_sock;
0086     else
0087 #endif
0088         *bpf_func = __cgroup_bpf_run_lsm_current;
0089 }
0090 #endif
0091
0092 int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
0093             const struct bpf_prog *prog)
0094 {
0095     if (!prog->gpl_compatible) {
0096         bpf_log(vlog,
0097             "LSM programs must have a GPL compatible license\n");
0098         return -EINVAL;
0099     }
0100
0101     if (!btf_id_set_contains(&bpf_lsm_hooks, prog->aux->attach_btf_id)) {
0102         bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n",
0103             prog->aux->attach_btf_id, prog->aux->attach_func_name);
0104         return -EINVAL;
0105     }
0106
0107     return 0;
0108 }
0109
0110 /* Mask for all the currently supported BPRM option flags */
0111 #define BPF_F_BRPM_OPTS_MASK    BPF_F_BPRM_SECUREEXEC
0112
0113 BPF_CALL_2(bpf_bprm_opts_set, struct linux_binprm *, bprm, u64, flags)
0114 {
0115     if (flags & ~BPF_F_BRPM_OPTS_MASK)
0116         return -EINVAL;
0117
0118     bprm->secureexec = (flags & BPF_F_BPRM_SECUREEXEC);
0119     return 0;
0120 }
0121
0122 BTF_ID_LIST_SINGLE(bpf_bprm_opts_set_btf_ids, struct, linux_binprm)
0123
0124 static const struct bpf_func_proto bpf_bprm_opts_set_proto = {
0125     .func       = bpf_bprm_opts_set,
0126     .gpl_only   = false,
0127     .ret_type   = RET_INTEGER,
0128     .arg1_type  = ARG_PTR_TO_BTF_ID,
0129     .arg1_btf_id    = &bpf_bprm_opts_set_btf_ids[0],
0130     .arg2_type  = ARG_ANYTHING,
0131 };
0132
0133 BPF_CALL_3(bpf_ima_inode_hash, struct inode *, inode, void *, dst, u32, size)
0134 {
0135     return ima_inode_hash(inode, dst, size);
0136 }
0137
0138 static bool bpf_ima_inode_hash_allowed(const struct bpf_prog *prog)
0139 {
0140     return bpf_lsm_is_sleepable_hook(prog->aux->attach_btf_id);
0141 }
0142
0143 BTF_ID_LIST_SINGLE(bpf_ima_inode_hash_btf_ids, struct, inode)
0144
0145 static const struct bpf_func_proto bpf_ima_inode_hash_proto = {
0146     .func       = bpf_ima_inode_hash,
0147     .gpl_only   = false,
0148     .ret_type   = RET_INTEGER,
0149     .arg1_type  = ARG_PTR_TO_BTF_ID,
0150     .arg1_btf_id    = &bpf_ima_inode_hash_btf_ids[0],
0151     .arg2_type  = ARG_PTR_TO_UNINIT_MEM,
0152     .arg3_type  = ARG_CONST_SIZE,
0153     .allowed    = bpf_ima_inode_hash_allowed,
0154 };
0155
0156 BPF_CALL_3(bpf_ima_file_hash, struct file *, file, void *, dst, u32, size)
0157 {
0158     return ima_file_hash(file, dst, size);
0159 }
0160
0161 BTF_ID_LIST_SINGLE(bpf_ima_file_hash_btf_ids, struct, file)
0162
0163 static const struct bpf_func_proto bpf_ima_file_hash_proto = {
0164     .func       = bpf_ima_file_hash,
0165     .gpl_only   = false,
0166     .ret_type   = RET_INTEGER,
0167     .arg1_type  = ARG_PTR_TO_BTF_ID,
0168     .arg1_btf_id    = &bpf_ima_file_hash_btf_ids[0],
0169     .arg2_type  = ARG_PTR_TO_UNINIT_MEM,
0170     .arg3_type  = ARG_CONST_SIZE,
0171     .allowed    = bpf_ima_inode_hash_allowed,
0172 };
0173
0174 BPF_CALL_1(bpf_get_attach_cookie, void *, ctx)
0175 {
0176     struct bpf_trace_run_ctx *run_ctx;
0177
0178     run_ctx = container_of(current->bpf_ctx, struct bpf_trace_run_ctx, run_ctx);
0179     return run_ctx->bpf_cookie;
0180 }
0181
0182 static const struct bpf_func_proto bpf_get_attach_cookie_proto = {
0183     .func       = bpf_get_attach_cookie,
0184     .gpl_only   = false,
0185     .ret_type   = RET_INTEGER,
0186     .arg1_type  = ARG_PTR_TO_CTX,
0187 };
0188
0189 static const struct bpf_func_proto *
0190 bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
0191 {
0192     switch (func_id) {
0193     case BPF_FUNC_inode_storage_get:
0194         return &bpf_inode_storage_get_proto;
0195     case BPF_FUNC_inode_storage_delete:
0196         return &bpf_inode_storage_delete_proto;
0197 #ifdef CONFIG_NET
0198     case BPF_FUNC_sk_storage_get:
0199         return &bpf_sk_storage_get_proto;
0200     case BPF_FUNC_sk_storage_delete:
0201         return &bpf_sk_storage_delete_proto;
0202 #endif /* CONFIG_NET */
0203     case BPF_FUNC_spin_lock:
0204         return &bpf_spin_lock_proto;
0205     case BPF_FUNC_spin_unlock:
0206         return &bpf_spin_unlock_proto;
0207     case BPF_FUNC_bprm_opts_set:
0208         return &bpf_bprm_opts_set_proto;
0209     case BPF_FUNC_ima_inode_hash:
0210         return prog->aux->sleepable ? &bpf_ima_inode_hash_proto : NULL;
0211     case BPF_FUNC_ima_file_hash:
0212         return prog->aux->sleepable ? &bpf_ima_file_hash_proto : NULL;
0213     case BPF_FUNC_get_attach_cookie:
0214         return bpf_prog_has_trampoline(prog) ? &bpf_get_attach_cookie_proto : NULL;
0215     case BPF_FUNC_get_local_storage:
0216         return prog->expected_attach_type == BPF_LSM_CGROUP ?
0217             &bpf_get_local_storage_proto : NULL;
0218     case BPF_FUNC_set_retval:
0219         return prog->expected_attach_type == BPF_LSM_CGROUP ?
0220             &bpf_set_retval_proto : NULL;
0221     case BPF_FUNC_get_retval:
0222         return prog->expected_attach_type == BPF_LSM_CGROUP ?
0223             &bpf_get_retval_proto : NULL;
0224 #ifdef CONFIG_NET
0225     case BPF_FUNC_setsockopt:
0226         if (prog->expected_attach_type != BPF_LSM_CGROUP)
0227             return NULL;
0228         if (btf_id_set_contains(&bpf_lsm_locked_sockopt_hooks,
0229                     prog->aux->attach_btf_id))
0230             return &bpf_sk_setsockopt_proto;
0231         if (btf_id_set_contains(&bpf_lsm_unlocked_sockopt_hooks,
0232                     prog->aux->attach_btf_id))
0233             return &bpf_unlocked_sk_setsockopt_proto;
0234         return NULL;
0235     case BPF_FUNC_getsockopt:
0236         if (prog->expected_attach_type != BPF_LSM_CGROUP)
0237             return NULL;
0238         if (btf_id_set_contains(&bpf_lsm_locked_sockopt_hooks,
0239                     prog->aux->attach_btf_id))
0240             return &bpf_sk_getsockopt_proto;
0241         if (btf_id_set_contains(&bpf_lsm_unlocked_sockopt_hooks,
0242                     prog->aux->attach_btf_id))
0243             return &bpf_unlocked_sk_getsockopt_proto;
0244         return NULL;
0245 #endif
0246     default:
0247         return tracing_prog_func_proto(func_id, prog);
0248     }
0249 }
0250
0251 /* The set of hooks which are called without pagefaults disabled and are allowed
0252  * to "sleep" and thus can be used for sleepable BPF programs.
0253  */
0254 BTF_SET_START(sleepable_lsm_hooks)
0255 BTF_ID(func, bpf_lsm_bpf)
0256 BTF_ID(func, bpf_lsm_bpf_map)
0257 BTF_ID(func, bpf_lsm_bpf_map_alloc_security)
0258 BTF_ID(func, bpf_lsm_bpf_map_free_security)
0259 BTF_ID(func, bpf_lsm_bpf_prog)
0260 BTF_ID(func, bpf_lsm_bprm_check_security)
0261 BTF_ID(func, bpf_lsm_bprm_committed_creds)
0262 BTF_ID(func, bpf_lsm_bprm_committing_creds)
0263 BTF_ID(func, bpf_lsm_bprm_creds_for_exec)
0264 BTF_ID(func, bpf_lsm_bprm_creds_from_file)
0265 BTF_ID(func, bpf_lsm_capget)
0266 BTF_ID(func, bpf_lsm_capset)
0267 BTF_ID(func, bpf_lsm_cred_prepare)
0268 BTF_ID(func, bpf_lsm_file_ioctl)
0269 BTF_ID(func, bpf_lsm_file_lock)
0270 BTF_ID(func, bpf_lsm_file_open)
0271 BTF_ID(func, bpf_lsm_file_receive)
0272
0273 #ifdef CONFIG_SECURITY_NETWORK
0274 BTF_ID(func, bpf_lsm_inet_conn_established)
0275 #endif /* CONFIG_SECURITY_NETWORK */
0276
0277 BTF_ID(func, bpf_lsm_inode_create)
0278 BTF_ID(func, bpf_lsm_inode_free_security)
0279 BTF_ID(func, bpf_lsm_inode_getattr)
0280 BTF_ID(func, bpf_lsm_inode_getxattr)
0281 BTF_ID(func, bpf_lsm_inode_mknod)
0282 BTF_ID(func, bpf_lsm_inode_need_killpriv)
0283 BTF_ID(func, bpf_lsm_inode_post_setxattr)
0284 BTF_ID(func, bpf_lsm_inode_readlink)
0285 BTF_ID(func, bpf_lsm_inode_rename)
0286 BTF_ID(func, bpf_lsm_inode_rmdir)
0287 BTF_ID(func, bpf_lsm_inode_setattr)
0288 BTF_ID(func, bpf_lsm_inode_setxattr)
0289 BTF_ID(func, bpf_lsm_inode_symlink)
0290 BTF_ID(func, bpf_lsm_inode_unlink)
0291 BTF_ID(func, bpf_lsm_kernel_module_request)
0292 BTF_ID(func, bpf_lsm_kernel_read_file)
0293 BTF_ID(func, bpf_lsm_kernfs_init_security)
0294
0295 #ifdef CONFIG_KEYS
0296 BTF_ID(func, bpf_lsm_key_free)
0297 #endif /* CONFIG_KEYS */
0298
0299 BTF_ID(func, bpf_lsm_mmap_file)
0300 BTF_ID(func, bpf_lsm_netlink_send)
0301 BTF_ID(func, bpf_lsm_path_notify)
0302 BTF_ID(func, bpf_lsm_release_secctx)
0303 BTF_ID(func, bpf_lsm_sb_alloc_security)
0304 BTF_ID(func, bpf_lsm_sb_eat_lsm_opts)
0305 BTF_ID(func, bpf_lsm_sb_kern_mount)
0306 BTF_ID(func, bpf_lsm_sb_mount)
0307 BTF_ID(func, bpf_lsm_sb_remount)
0308 BTF_ID(func, bpf_lsm_sb_set_mnt_opts)
0309 BTF_ID(func, bpf_lsm_sb_show_options)
0310 BTF_ID(func, bpf_lsm_sb_statfs)
0311 BTF_ID(func, bpf_lsm_sb_umount)
0312 BTF_ID(func, bpf_lsm_settime)
0313
0314 #ifdef CONFIG_SECURITY_NETWORK
0315 BTF_ID(func, bpf_lsm_socket_accept)
0316 BTF_ID(func, bpf_lsm_socket_bind)
0317 BTF_ID(func, bpf_lsm_socket_connect)
0318 BTF_ID(func, bpf_lsm_socket_create)
0319 BTF_ID(func, bpf_lsm_socket_getpeername)
0320 BTF_ID(func, bpf_lsm_socket_getpeersec_dgram)
0321 BTF_ID(func, bpf_lsm_socket_getsockname)
0322 BTF_ID(func, bpf_lsm_socket_getsockopt)
0323 BTF_ID(func, bpf_lsm_socket_listen)
0324 BTF_ID(func, bpf_lsm_socket_post_create)
0325 BTF_ID(func, bpf_lsm_socket_recvmsg)
0326 BTF_ID(func, bpf_lsm_socket_sendmsg)
0327 BTF_ID(func, bpf_lsm_socket_shutdown)
0328 BTF_ID(func, bpf_lsm_socket_socketpair)
0329 #endif /* CONFIG_SECURITY_NETWORK */
0330
0331 BTF_ID(func, bpf_lsm_syslog)
0332 BTF_ID(func, bpf_lsm_task_alloc)
0333 BTF_ID(func, bpf_lsm_current_getsecid_subj)
0334 BTF_ID(func, bpf_lsm_task_getsecid_obj)
0335 BTF_ID(func, bpf_lsm_task_prctl)
0336 BTF_ID(func, bpf_lsm_task_setscheduler)
0337 BTF_ID(func, bpf_lsm_task_to_inode)
0338 BTF_SET_END(sleepable_lsm_hooks)
0339
0340 bool bpf_lsm_is_sleepable_hook(u32 btf_id)
0341 {
0342     return btf_id_set_contains(&sleepable_lsm_hooks, btf_id);
0343 }
0344
0345 const struct bpf_prog_ops lsm_prog_ops = {
0346 };
0347
0348 const struct bpf_verifier_ops lsm_verifier_ops = {
0349     .get_func_proto = bpf_lsm_func_proto,
0350     .is_valid_access = btf_ctx_access,
0351 };