projects/linux·blob master · refs

463 lines · 12.9 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * BPF-backed binary type handlers for binfmt_misc.
4 *
5 * A handler is a struct binfmt_misc_ops struct_ops map. Loading and
6 * registering it makes the handler available under its name in the user
7 * namespace it was registered in. A binfmt_misc 'B' entry activates it:
8 *
9 * echo ':entry:B::::<handler-name>:' > <binfmt_misc>/register
10 *
11 * The entry can bind the interpreters the handler may run its binaries
12 * with, each opened by the write that binds it and selected by name per
13 * exec. An entry registered with 'D' is not matchable yet, which is what
14 * leaves it open to being given them:
15 *
16 * echo ':entry:B::::<handler-name>:D' > <binfmt_misc>/register
17 * echo '+<name> <path>' > <binfmt_misc>/entry
18 * echo 1 > <binfmt_misc>/entry
19 */
20
21#include <linux/binfmt_misc.h>
22#include <linux/binfmts.h>
23#include <linux/bpf.h>
24#include <linux/bpf_verifier.h>
25#include <linux/btf.h>
26#include <linux/btf_ids.h>
27#include <linux/cred.h>
28#include <linux/file.h>
29#include <linux/fs.h>
30#include <linux/init.h>
31#include <linux/limits.h>
32#include <linux/slab.h>
33#include <linux/spinlock.h>
34#include <linux/string.h>
35#include <linux/user_namespace.h>
36
37struct bm_bpf_ops_reg {
38 struct list_head list;
39 const struct binfmt_misc_ops *ops;
40 struct bpf_link *link;
41 struct user_namespace *user_ns;
42};
43
44static DEFINE_SPINLOCK(bm_bpf_ops_lock);
45static LIST_HEAD(bm_bpf_ops_list);
46
47static struct bpf_struct_ops bpf_binfmt_misc_ops;
48
49static struct bm_bpf_ops_reg *bm_bpf_ops_find(const struct user_namespace *user_ns,
50 const char *name)
51{
52 struct bm_bpf_ops_reg *reg;
53
54 lockdep_assert_held(&bm_bpf_ops_lock);
55
56 list_for_each_entry(reg, &bm_bpf_ops_list, list) {
57 if (reg->user_ns == user_ns && !strcmp(reg->ops->name, name))
58 return reg;
59 }
60 return NULL;
61}
62
63/**
64 * binfmt_misc_get_ops - look up a bpf binary type handler by name
65 * @user_ns: user namespace of the binfmt_misc instance
66 * @name: name the handler was registered under
67 *
68 * Look for a handler named @name registered in @user_ns. A handler is not
69 * inherited from ancestor user namespaces: an entry can only name a handler
70 * registered in the same user namespace as its instance. The returned handler
71 * stays callable until binfmt_misc_put_ops() even if the backing struct_ops
72 * map is detached or deleted in the meantime.
73 *
74 * Return: the handler on success, NULL on failure
75 */
76const struct binfmt_misc_ops *binfmt_misc_get_ops(struct user_namespace *user_ns,
77 const char *name)
78{
79 struct bm_bpf_ops_reg *reg;
80
81 guard(spinlock)(&bm_bpf_ops_lock);
82
83 reg = bm_bpf_ops_find(user_ns, name);
84 if (!reg)
85 return NULL;
86 if (!bpf_struct_ops_get(reg->ops))
87 return NULL;
88 return reg->ops;
89}
90
91void binfmt_misc_put_ops(const struct binfmt_misc_ops *ops)
92{
93 bpf_struct_ops_put(ops);
94}
95
96bool bpf_prog_is_binfmt_misc_ops(const struct bpf_prog *prog)
97{
98 return prog->type == BPF_PROG_TYPE_STRUCT_OPS &&
99 prog->aux->st_ops == &bpf_binfmt_misc_ops;
100}
101
102/*
103 * Replace the staged interpreter selection: naming a path drops a bound
104 * file, selecting a bound interpreter carries its file along.
105 */
106static void bm_bpf_stage_selection(struct linux_binprm *bprm, char *path,
107 struct file *f)
108{
109 if (bprm->bpf_interp_file)
110 fput(bprm->bpf_interp_file);
111 kfree(bprm->bpf_interp);
112 bprm->bpf_interp = path;
113 bprm->bpf_interp_file = f;
114}
115
116__bpf_kfunc_start_defs();
117
118/**
119 * bpf_binprm_set_interp - select the interpreter for the current exec
120 * @bprm: binary that is being executed
121 * @path: absolute path to the interpreter
122 * @path__sz: size of the @path buffer, including the terminating NUL
123 *
124 * To be called from the load program of a struct binfmt_misc_ops handler
125 * before returning zero; the verifier rejects the call from any other
126 * program, including the handler's own match program. The path is opened
127 * with the credentials of the task doing the exec after the program
128 * returns. Calling it again replaces the selection, as does selecting an
129 * interpreter the entry bound with bpf_binprm_select_interp().
130 *
131 * Return: 0 on success, a negative errno on failure
132 */
133__bpf_kfunc int bpf_binprm_set_interp(struct linux_binprm *bprm,
134 const char *path, size_t path__sz)
135{
136 size_t len;
137 char *interp;
138
139 if (!path__sz)
140 return -EINVAL;
141 len = strnlen(path, path__sz);
142 if (len == path__sz)
143 return -EINVAL;
144 if (len >= PATH_MAX)
145 return -ENAMETOOLONG;
146
147 interp = kmemdup_nul(path, len, GFP_KERNEL);
148 if (!interp)
149 return -ENOMEM;
150
151 /*
152 * The program may pass memory that is written to while this runs,
153 * so check the private copy and not the buffer it was made from.
154 */
155 if (interp[0] != '/') {
156 kfree(interp);
157 return -EINVAL;
158 }
159
160 bm_bpf_stage_selection(bprm, interp, NULL);
161 return 0;
162}
163
164/**
165 * bpf_binprm_select_interp - run this exec under an interpreter the entry bound
166 * @bprm: binary that is being executed
167 * @name: name the interpreter was registered under
168 * @name__sz: size of the @name buffer, including the terminating NUL
169 *
170 * To be called from the load program of a struct binfmt_misc_ops handler
171 * instead of bpf_binprm_set_interp(). It selects one of the interpreters
172 * the matched entry was registered with, each of which was opened once when
173 * the entry was registered. Nothing is resolved at exec time, so no
174 * filesystem view can redirect the interpreter.
175 *
176 * The interpreter runs under the path the entry registered it under.
177 * Calling it again replaces the selection.
178 *
179 * Return: 0 on success, -ENOENT if the matched entry bound no interpreter
180 * of that name, a negative errno on failure
181 */
182__bpf_kfunc int bpf_binprm_select_interp(struct linux_binprm *bprm,
183 const char *name, size_t name__sz)
184{
185 const struct binfmt_misc_interp *interp;
186 char buf[BINFMT_MISC_INTERP_NAME_MAX + 1];
187 size_t len;
188 char *path;
189
190 if (!name__sz)
191 return -EINVAL;
192 len = strnlen(name, name__sz);
193 if (len == name__sz || !len)
194 return -EINVAL;
195 /* No entry binds a longer name, so it cannot be found. */
196 if (len > BINFMT_MISC_INTERP_NAME_MAX)
197 return -ENOENT;
198
199 /*
200 * The program may pass memory that is written to while this runs,
201 * so look the name up in a private copy and check that instead.
202 */
203 memcpy(buf, name, len);
204 buf[len] = '\0';
205 if (!buf[0])
206 return -EINVAL;
207
208 interp = binfmt_misc_find_interp(bprm->bpf_interps, buf);
209 if (!interp)
210 return -ENOENT;
211
212 path = kstrdup(interp->path, GFP_KERNEL);
213 if (!path)
214 return -ENOMEM;
215
216 bm_bpf_stage_selection(bprm, path, get_file(interp->file));
217 return 0;
218}
219
220/**
221 * bpf_binprm_set_interp_arg - set a single argument for the interpreter
222 * @bprm: binary that is being executed
223 * @arg: argument to pass to the interpreter
224 * @arg__sz: size of the @arg buffer, including the terminating NUL
225 *
226 * To be called from the load program of a struct binfmt_misc_ops handler. The
227 * argument is passed to the interpreter ahead of the binary, mirroring the
228 * single optional argument of a #! interpreter line. Calling it again
229 * replaces the argument.
230 *
231 * Return: 0 on success, a negative errno on failure
232 */
233__bpf_kfunc int bpf_binprm_set_interp_arg(struct linux_binprm *bprm,
234 const char *arg, size_t arg__sz)
235{
236 size_t len;
237 char *val;
238
239 if (!arg__sz)
240 return -EINVAL;
241 len = strnlen(arg, arg__sz);
242 if (len == arg__sz)
243 return -EINVAL;
244 if (!len)
245 return -EINVAL;
246
247 val = kmemdup_nul(arg, len, GFP_KERNEL);
248 if (!val)
249 return -ENOMEM;
250
251 /*
252 * The program may pass memory that is written to while this runs,
253 * so check the private copy and not the buffer it was made from.
254 */
255 if (!val[0]) {
256 kfree(val);
257 return -EINVAL;
258 }
259
260 kfree(bprm->bpf_interp_arg);
261 bprm->bpf_interp_arg = val;
262 return 0;
263}
264
265/**
266 * bpf_binprm_set_flags - choose the interpreter invocation flags for this exec
267 * @bprm: binary that is being executed
268 * @flags: an OR of enum bpf_binprm_flags values
269 *
270 * To be called from the load program of a struct binfmt_misc_ops handler. It
271 * decides per exec what a static entry fixes at registration with the P, C,
272 * O, T and L flags: BPF_BINPRM_PRESERVE_ARGV0 keeps the caller's argv[0],
273 * BPF_BINPRM_CREDENTIALS computes credentials from the binary, and
274 * BPF_BINPRM_EXECFD hands the binary to the interpreter through AT_EXECFD.
275 * BPF_BINPRM_TRANSPARENT additionally leaves the argument vector untouched,
276 * making the exec look like a direct execution of the binary.
277 * BPF_BINPRM_LOADER substitutes the interpreter for the binary's PT_INTERP
278 * and runs the binary as a native exec; it excludes every other flag.
279 * Calling it again replaces the flags, passing zero clears them again.
280 *
281 * Return: 0 on success, -EINVAL if @flags contains an unknown bit or an
282 * invalid combination
283 */
284__bpf_kfunc int bpf_binprm_set_flags(struct linux_binprm *bprm,
285 enum bpf_binprm_flags flags)
286{
287 if (flags & ~(BPF_BINPRM_PRESERVE_ARGV0 | BPF_BINPRM_CREDENTIALS |
288 BPF_BINPRM_EXECFD | BPF_BINPRM_TRANSPARENT |
289 BPF_BINPRM_LOADER))
290 return -EINVAL;
291
292 /* Loader substitution is a native exec: no splice, execfd or creds work. */
293 if ((flags & BPF_BINPRM_LOADER) && (flags & ~BPF_BINPRM_LOADER))
294 return -EINVAL;
295
296 /* Transparency preserves the whole argv, argv[0] included. */
297 if ((flags & BPF_BINPRM_TRANSPARENT) && (flags & BPF_BINPRM_PRESERVE_ARGV0))
298 return -EINVAL;
299
300 bprm->bpf_flags = flags;
301 return 0;
302}
303
304__bpf_kfunc_end_defs();
305
306BTF_KFUNCS_START(bm_bpf_kfunc_ids)
307BTF_ID_FLAGS(func, bpf_binprm_set_interp, KF_SLEEPABLE)
308BTF_ID_FLAGS(func, bpf_binprm_select_interp, KF_SLEEPABLE)
309BTF_ID_FLAGS(func, bpf_binprm_set_interp_arg, KF_SLEEPABLE)
310BTF_ID_FLAGS(func, bpf_binprm_set_flags, KF_SLEEPABLE)
311BTF_KFUNCS_END(bm_bpf_kfunc_ids)
312
313static int bm_bpf_kfunc_filter(const struct bpf_prog *prog, u32 kfunc_id)
314{
315 if (!btf_id_set8_contains(&bm_bpf_kfunc_ids, kfunc_id))
316 return 0;
317 if (prog->type != BPF_PROG_TYPE_STRUCT_OPS)
318 return -EACCES;
319 /* ->st_ops is unset during the cfg pass; enforced once it is set. */
320 if (!prog->aux->st_ops)
321 return 0;
322 /* Only the load program decides how a binary is run. */
323 if (bpf_prog_is_binfmt_misc_ops(prog) &&
324 prog->aux->attach_st_ops_member_off == offsetof(struct binfmt_misc_ops, load))
325 return 0;
326 return -EACCES;
327}
328
329static const struct btf_kfunc_id_set bm_bpf_kfunc_set = {
330 .owner = THIS_MODULE,
331 .set = &bm_bpf_kfunc_ids,
332 .filter = bm_bpf_kfunc_filter,
333};
334
335static bool bm_bpf_ops__match(struct linux_binprm *bprm)
336{
337 return false;
338}
339
340static int bm_bpf_ops__load(struct linux_binprm *bprm)
341{
342 return 0;
343}
344
345static struct binfmt_misc_ops bm_bpf_ops_stubs = {
346 .match = bm_bpf_ops__match,
347 .load = bm_bpf_ops__load,
348};
349
350static int bm_bpf_init(struct btf *btf)
351{
352 return register_btf_kfunc_id_set(BPF_PROG_TYPE_STRUCT_OPS,
353 &bm_bpf_kfunc_set);
354}
355
356static int bm_bpf_check_member(const struct btf_type *t,
357 const struct btf_member *member,
358 const struct bpf_prog *prog)
359{
360 u32 moff = __btf_member_bit_offset(t, member) / 8;
361
362 switch (moff) {
363 case offsetof(struct binfmt_misc_ops, match):
364 case offsetof(struct binfmt_misc_ops, load):
365 /* Reliable file reads at exec time require sleeping. */
366 if (!prog->sleepable)
367 return -EINVAL;
368 break;
369 }
370 return 0;
371}
372
373static int bm_bpf_init_member(const struct btf_type *t,
374 const struct btf_member *member,
375 void *kdata, const void *udata)
376{
377 const struct binfmt_misc_ops *uops = udata;
378 struct binfmt_misc_ops *ops = kdata;
379 u32 moff = __btf_member_bit_offset(t, member) / 8;
380
381 switch (moff) {
382 case offsetof(struct binfmt_misc_ops, name):
383 if (bpf_obj_name_cpy(ops->name, uops->name,
384 sizeof(ops->name)) <= 0)
385 return -EINVAL;
386 return 1;
387 }
388 return 0;
389}
390
391static int bm_bpf_validate(void *kdata)
392{
393 struct binfmt_misc_ops *ops = kdata;
394
395 if (!ops->match || !ops->load)
396 return -EINVAL;
397 return 0;
398}
399
400static int bm_bpf_reg(void *kdata, struct bpf_link *link)
401{
402 struct binfmt_misc_ops *ops = kdata;
403 struct bm_bpf_ops_reg *reg;
404
405 reg = kzalloc_obj(*reg, GFP_KERNEL_ACCOUNT);
406 if (!reg)
407 return -ENOMEM;
408
409 reg->ops = ops;
410 reg->link = link;
411 reg->user_ns = get_user_ns(current_user_ns());
412
413 guard(spinlock)(&bm_bpf_ops_lock);
414
415 if (bm_bpf_ops_find(reg->user_ns, ops->name)) {
416 put_user_ns(reg->user_ns);
417 kfree(reg);
418 return -EEXIST;
419 }
420
421 list_add(&reg->list, &bm_bpf_ops_list);
422 return 0;
423}
424
425static void bm_bpf_unreg(void *kdata, struct bpf_link *link)
426{
427 struct bm_bpf_ops_reg *reg;
428
429 guard(spinlock)(&bm_bpf_ops_lock);
430
431 list_for_each_entry(reg, &bm_bpf_ops_list, list) {
432 if (reg->ops == kdata && reg->link == link) {
433 list_del(&reg->list);
434 put_user_ns(reg->user_ns);
435 kfree(reg);
436 return;
437 }
438 }
439}
440
441static const struct bpf_verifier_ops bm_bpf_verifier_ops = {
442 .get_func_proto = bpf_base_func_proto,
443 .is_valid_access = bpf_tracing_btf_ctx_access,
444};
445
446static struct bpf_struct_ops bpf_binfmt_misc_ops = {
447 .verifier_ops = &bm_bpf_verifier_ops,
448 .init = bm_bpf_init,
449 .check_member = bm_bpf_check_member,
450 .init_member = bm_bpf_init_member,
451 .validate = bm_bpf_validate,
452 .reg = bm_bpf_reg,
453 .unreg = bm_bpf_unreg,
454 .cfi_stubs = &bm_bpf_ops_stubs,
455 .name = "binfmt_misc_ops",
456 .owner = THIS_MODULE,
457};
458
459static int __init bm_bpf_struct_ops_init(void)
460{
461 return register_bpf_struct_ops(&bpf_binfmt_misc_ops, binfmt_misc_ops);
462}
463late_initcall(bm_bpf_struct_ops_init);