projects/linux·blob master · refs

472 lines · 13.8 KiB

1// SPDX-License-Identifier: GPL-2.0
2
3/*
4 * Copyright (C) 2020 Google LLC.
5 */
6
7#include <linux/filter.h>
8#include <linux/bpf.h>
9#include <linux/btf.h>
10#include <linux/binfmts.h>
11#include <linux/lsm_hooks.h>
12#include <linux/bpf_lsm.h>
13#include <linux/kallsyms.h>
14#include <net/bpf_sk_storage.h>
15#include <linux/bpf_local_storage.h>
16#include <linux/btf_ids.h>
17#include <linux/ima.h>
18#include <linux/bpf-cgroup.h>
19
20/* For every LSM hook that allows attachment of BPF programs, declare a nop
21 * function where a BPF program can be attached. Notably, we qualify each with
22 * weak linkage such that strong overrides can be implemented if need be.
23 */
24#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
25__weak noinline RET bpf_lsm_##NAME(__VA_ARGS__) \
26{ \
27 return DEFAULT; \
28}
29
30#include <linux/lsm_hook_defs.h>
31#undef LSM_HOOK
32
33#define LSM_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME)
34BTF_SET_START(bpf_lsm_hooks)
35#include <linux/lsm_hook_defs.h>
36#undef LSM_HOOK
37BTF_SET_END(bpf_lsm_hooks)
38
39BTF_SET_START(bpf_lsm_disabled_hooks)
40BTF_ID(func, bpf_lsm_vm_enough_memory)
41BTF_ID(func, bpf_lsm_inode_need_killpriv)
42BTF_ID(func, bpf_lsm_inode_getsecurity)
43BTF_ID(func, bpf_lsm_inode_listsecurity)
44BTF_ID(func, bpf_lsm_inode_copy_up_xattr)
45BTF_ID(func, bpf_lsm_getselfattr)
46BTF_ID(func, bpf_lsm_getprocattr)
47BTF_ID(func, bpf_lsm_setprocattr)
48#ifdef CONFIG_KEYS
49BTF_ID(func, bpf_lsm_key_getsecurity)
50#endif
51#ifdef CONFIG_AUDIT
52BTF_ID(func, bpf_lsm_audit_rule_match)
53#endif
54#ifdef CONFIG_SECURITY_NETWORK_XFRM
55BTF_ID(func, bpf_lsm_xfrm_decode_session)
56#endif
57BTF_ID(func, bpf_lsm_ismaclabel)
58BTF_ID(func, bpf_lsm_file_alloc_security)
59BTF_SET_END(bpf_lsm_disabled_hooks)
60
61/* List of LSM hooks that should operate on 'current' cgroup regardless
62 * of function signature.
63 */
64BTF_SET_START(bpf_lsm_current_hooks)
65/* operate on freshly allocated sk without any cgroup association */
66#ifdef CONFIG_SECURITY_NETWORK
67BTF_ID(func, bpf_lsm_sk_alloc_security)
68BTF_ID(func, bpf_lsm_sk_free_security)
69#endif
70BTF_SET_END(bpf_lsm_current_hooks)
71
72/* List of LSM hooks that trigger while the socket is properly locked.
73 */
74BTF_SET_START(bpf_lsm_locked_sockopt_hooks)
75#ifdef CONFIG_SECURITY_NETWORK
76BTF_ID(func, bpf_lsm_sock_graft)
77BTF_ID(func, bpf_lsm_inet_csk_clone)
78BTF_ID(func, bpf_lsm_inet_conn_established)
79#endif
80BTF_SET_END(bpf_lsm_locked_sockopt_hooks)
81
82/* List of LSM hooks that trigger while the socket is _not_ locked,
83 * but it's ok to call bpf_{g,s}etsockopt because the socket is still
84 * in the early init phase.
85 */
86BTF_SET_START(bpf_lsm_unlocked_sockopt_hooks)
87#ifdef CONFIG_SECURITY_NETWORK
88BTF_ID(func, bpf_lsm_socket_post_create)
89BTF_ID(func, bpf_lsm_socket_socketpair)
90#endif
91BTF_SET_END(bpf_lsm_unlocked_sockopt_hooks)
92
93#ifdef CONFIG_CGROUP_BPF
94void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog,
95 bpf_func_t *bpf_func)
96{
97 const struct btf_param *args __maybe_unused;
98
99 if (btf_type_vlen(prog->aux->attach_func_proto) < 1 ||
100 btf_id_set_contains(&bpf_lsm_current_hooks,
101 prog->aux->attach_btf_id)) {
102 *bpf_func = __cgroup_bpf_run_lsm_current;
103 return;
104 }
105
106#ifdef CONFIG_NET
107 args = btf_params(prog->aux->attach_func_proto);
108
109 if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCKET])
110 *bpf_func = __cgroup_bpf_run_lsm_socket;
111 else if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCK])
112 *bpf_func = __cgroup_bpf_run_lsm_sock;
113 else
114#endif
115 *bpf_func = __cgroup_bpf_run_lsm_current;
116}
117#endif
118
119int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
120 const struct bpf_prog *prog)
121{
122 u32 btf_id = prog->aux->attach_btf_id;
123 const char *func_name = prog->aux->attach_func_name;
124
125 if (!prog->gpl_compatible) {
126 bpf_log(vlog,
127 "LSM programs must have a GPL compatible license\n");
128 return -EINVAL;
129 }
130
131 if (btf_id_set_contains(&bpf_lsm_disabled_hooks, btf_id)) {
132 bpf_log(vlog, "attach_btf_id %u points to disabled hook %s\n",
133 btf_id, func_name);
134 return -EINVAL;
135 }
136
137 if (!btf_id_set_contains(&bpf_lsm_hooks, btf_id)) {
138 bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n",
139 btf_id, func_name);
140 return -EINVAL;
141 }
142
143 return 0;
144}
145
146/* Mask for all the currently supported BPRM option flags */
147#define BPF_F_BRPM_OPTS_MASK BPF_F_BPRM_SECUREEXEC
148
149BPF_CALL_2(bpf_bprm_opts_set, struct linux_binprm *, bprm, u64, flags)
150{
151 if (flags & ~BPF_F_BRPM_OPTS_MASK)
152 return -EINVAL;
153
154 bprm->secureexec = (flags & BPF_F_BPRM_SECUREEXEC);
155 return 0;
156}
157
158BTF_ID_LIST_SINGLE(bpf_bprm_opts_set_btf_ids, struct, linux_binprm)
159
160static const struct bpf_func_proto bpf_bprm_opts_set_proto = {
161 .func = bpf_bprm_opts_set,
162 .gpl_only = false,
163 .ret_type = RET_INTEGER,
164 .arg1_type = ARG_PTR_TO_BTF_ID,
165 .arg1_btf_id = &bpf_bprm_opts_set_btf_ids[0],
166 .arg2_type = ARG_ANYTHING,
167};
168
169BPF_CALL_3(bpf_ima_inode_hash, struct inode *, inode, void *, dst, u32, size)
170{
171 return ima_inode_hash(inode, dst, size);
172}
173
174static bool bpf_ima_inode_hash_allowed(const struct bpf_prog *prog)
175{
176 return bpf_lsm_is_sleepable_hook(prog->aux->attach_btf_id);
177}
178
179BTF_ID_LIST_SINGLE(bpf_ima_inode_hash_btf_ids, struct, inode)
180
181static const struct bpf_func_proto bpf_ima_inode_hash_proto = {
182 .func = bpf_ima_inode_hash,
183 .gpl_only = false,
184 .might_sleep = true,
185 .ret_type = RET_INTEGER,
186 .arg1_type = ARG_PTR_TO_BTF_ID,
187 .arg1_btf_id = &bpf_ima_inode_hash_btf_ids[0],
188 .arg2_type = ARG_PTR_TO_UNINIT_MEM,
189 .arg3_type = ARG_MEM_SIZE,
190 .allowed = bpf_ima_inode_hash_allowed,
191};
192
193BPF_CALL_3(bpf_ima_file_hash, struct file *, file, void *, dst, u32, size)
194{
195 return ima_file_hash(file, dst, size);
196}
197
198BTF_ID_LIST_SINGLE(bpf_ima_file_hash_btf_ids, struct, file)
199
200static const struct bpf_func_proto bpf_ima_file_hash_proto = {
201 .func = bpf_ima_file_hash,
202 .gpl_only = false,
203 .might_sleep = true,
204 .ret_type = RET_INTEGER,
205 .arg1_type = ARG_PTR_TO_BTF_ID,
206 .arg1_btf_id = &bpf_ima_file_hash_btf_ids[0],
207 .arg2_type = ARG_PTR_TO_UNINIT_MEM,
208 .arg3_type = ARG_MEM_SIZE,
209 .allowed = bpf_ima_inode_hash_allowed,
210};
211
212BPF_CALL_1(bpf_get_attach_cookie, void *, ctx)
213{
214 struct bpf_trace_run_ctx *run_ctx;
215
216 run_ctx = container_of(current->bpf_ctx, struct bpf_trace_run_ctx, run_ctx);
217 return run_ctx->bpf_cookie;
218}
219
220static const struct bpf_func_proto bpf_get_attach_cookie_proto = {
221 .func = bpf_get_attach_cookie,
222 .gpl_only = false,
223 .ret_type = RET_INTEGER,
224 .arg1_type = ARG_PTR_TO_CTX,
225};
226
227static const struct bpf_func_proto *
228bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
229{
230 const struct bpf_func_proto *func_proto;
231
232 if (prog->expected_attach_type == BPF_LSM_CGROUP) {
233 func_proto = cgroup_common_func_proto(func_id, prog);
234 if (func_proto)
235 return func_proto;
236 }
237
238 switch (func_id) {
239 case BPF_FUNC_inode_storage_get:
240 return &bpf_inode_storage_get_proto;
241 case BPF_FUNC_inode_storage_delete:
242 return &bpf_inode_storage_delete_proto;
243#ifdef CONFIG_NET
244 case BPF_FUNC_sk_storage_get:
245 return &bpf_sk_storage_get_proto;
246 case BPF_FUNC_sk_storage_delete:
247 return &bpf_sk_storage_delete_proto;
248#endif /* CONFIG_NET */
249 case BPF_FUNC_spin_lock:
250 return &bpf_spin_lock_proto;
251 case BPF_FUNC_spin_unlock:
252 return &bpf_spin_unlock_proto;
253 case BPF_FUNC_bprm_opts_set:
254 return &bpf_bprm_opts_set_proto;
255 case BPF_FUNC_ima_inode_hash:
256 return &bpf_ima_inode_hash_proto;
257 case BPF_FUNC_ima_file_hash:
258 return &bpf_ima_file_hash_proto;
259 case BPF_FUNC_get_attach_cookie:
260 return bpf_prog_has_trampoline(prog) ? &bpf_get_attach_cookie_proto : NULL;
261#ifdef CONFIG_NET
262 case BPF_FUNC_setsockopt:
263 if (prog->expected_attach_type != BPF_LSM_CGROUP)
264 return NULL;
265 if (btf_id_set_contains(&bpf_lsm_locked_sockopt_hooks,
266 prog->aux->attach_btf_id))
267 return &bpf_sk_setsockopt_proto;
268 if (btf_id_set_contains(&bpf_lsm_unlocked_sockopt_hooks,
269 prog->aux->attach_btf_id))
270 return &bpf_unlocked_sk_setsockopt_proto;
271 return NULL;
272 case BPF_FUNC_getsockopt:
273 if (prog->expected_attach_type != BPF_LSM_CGROUP)
274 return NULL;
275 if (btf_id_set_contains(&bpf_lsm_locked_sockopt_hooks,
276 prog->aux->attach_btf_id))
277 return &bpf_sk_getsockopt_proto;
278 if (btf_id_set_contains(&bpf_lsm_unlocked_sockopt_hooks,
279 prog->aux->attach_btf_id))
280 return &bpf_unlocked_sk_getsockopt_proto;
281 return NULL;
282#endif
283 default:
284 return tracing_prog_func_proto(func_id, prog);
285 }
286}
287
288/* The set of hooks which are called without pagefaults disabled and are allowed
289 * to "sleep" and thus can be used for sleepable BPF programs.
290 */
291BTF_SET_START(sleepable_lsm_hooks)
292BTF_ID(func, bpf_lsm_bpf)
293BTF_ID(func, bpf_lsm_bpf_map)
294BTF_ID(func, bpf_lsm_bpf_map_create)
295BTF_ID(func, bpf_lsm_bpf_map_free)
296BTF_ID(func, bpf_lsm_bpf_prog)
297BTF_ID(func, bpf_lsm_bpf_prog_load)
298BTF_ID(func, bpf_lsm_bpf_token_create)
299BTF_ID(func, bpf_lsm_bpf_token_free)
300BTF_ID(func, bpf_lsm_bpf_token_cmd)
301BTF_ID(func, bpf_lsm_bpf_token_capable)
302BTF_ID(func, bpf_lsm_bprm_check_security)
303BTF_ID(func, bpf_lsm_bprm_committed_creds)
304BTF_ID(func, bpf_lsm_bprm_committing_creds)
305BTF_ID(func, bpf_lsm_bprm_creds_for_exec)
306BTF_ID(func, bpf_lsm_bprm_creds_from_file)
307BTF_ID(func, bpf_lsm_capget)
308BTF_ID(func, bpf_lsm_capset)
309BTF_ID(func, bpf_lsm_cred_prepare)
310BTF_ID(func, bpf_lsm_file_ioctl)
311BTF_ID(func, bpf_lsm_file_lock)
312BTF_ID(func, bpf_lsm_file_open)
313BTF_ID(func, bpf_lsm_file_post_open)
314BTF_ID(func, bpf_lsm_file_receive)
315
316BTF_ID(func, bpf_lsm_inode_create)
317BTF_ID(func, bpf_lsm_inode_free_security)
318BTF_ID(func, bpf_lsm_inode_getattr)
319BTF_ID(func, bpf_lsm_inode_getxattr)
320BTF_ID(func, bpf_lsm_inode_mknod)
321BTF_ID(func, bpf_lsm_inode_need_killpriv)
322BTF_ID(func, bpf_lsm_inode_post_setxattr)
323BTF_ID(func, bpf_lsm_inode_post_removexattr)
324BTF_ID(func, bpf_lsm_inode_readlink)
325BTF_ID(func, bpf_lsm_inode_removexattr)
326BTF_ID(func, bpf_lsm_inode_rename)
327BTF_ID(func, bpf_lsm_inode_rmdir)
328BTF_ID(func, bpf_lsm_inode_setattr)
329BTF_ID(func, bpf_lsm_inode_setxattr)
330BTF_ID(func, bpf_lsm_inode_symlink)
331BTF_ID(func, bpf_lsm_inode_unlink)
332BTF_ID(func, bpf_lsm_kernel_module_request)
333BTF_ID(func, bpf_lsm_kernel_read_file)
334BTF_ID(func, bpf_lsm_kernfs_init_security)
335
336#ifdef CONFIG_SECURITY_PATH
337BTF_ID(func, bpf_lsm_path_unlink)
338BTF_ID(func, bpf_lsm_path_mkdir)
339BTF_ID(func, bpf_lsm_path_rmdir)
340BTF_ID(func, bpf_lsm_path_truncate)
341BTF_ID(func, bpf_lsm_path_symlink)
342BTF_ID(func, bpf_lsm_path_link)
343BTF_ID(func, bpf_lsm_path_rename)
344BTF_ID(func, bpf_lsm_path_chmod)
345BTF_ID(func, bpf_lsm_path_chown)
346#endif /* CONFIG_SECURITY_PATH */
347
348BTF_ID(func, bpf_lsm_mmap_file)
349BTF_ID(func, bpf_lsm_netlink_send)
350BTF_ID(func, bpf_lsm_path_notify)
351BTF_ID(func, bpf_lsm_release_secctx)
352BTF_ID(func, bpf_lsm_sb_alloc_security)
353BTF_ID(func, bpf_lsm_sb_eat_lsm_opts)
354BTF_ID(func, bpf_lsm_sb_kern_mount)
355BTF_ID(func, bpf_lsm_sb_mount)
356BTF_ID(func, bpf_lsm_sb_remount)
357BTF_ID(func, bpf_lsm_sb_set_mnt_opts)
358BTF_ID(func, bpf_lsm_sb_show_options)
359BTF_ID(func, bpf_lsm_sb_statfs)
360BTF_ID(func, bpf_lsm_sb_umount)
361BTF_ID(func, bpf_lsm_settime)
362
363#ifdef CONFIG_SECURITY_NETWORK
364BTF_ID(func, bpf_lsm_socket_accept)
365BTF_ID(func, bpf_lsm_socket_bind)
366BTF_ID(func, bpf_lsm_socket_connect)
367BTF_ID(func, bpf_lsm_socket_create)
368BTF_ID(func, bpf_lsm_socket_getpeername)
369BTF_ID(func, bpf_lsm_socket_getpeersec_dgram)
370BTF_ID(func, bpf_lsm_socket_getsockname)
371BTF_ID(func, bpf_lsm_socket_getsockopt)
372BTF_ID(func, bpf_lsm_socket_listen)
373BTF_ID(func, bpf_lsm_socket_post_create)
374BTF_ID(func, bpf_lsm_socket_recvmsg)
375BTF_ID(func, bpf_lsm_socket_sendmsg)
376BTF_ID(func, bpf_lsm_socket_shutdown)
377BTF_ID(func, bpf_lsm_socket_socketpair)
378#endif /* CONFIG_SECURITY_NETWORK */
379
380BTF_ID(func, bpf_lsm_syslog)
381BTF_ID(func, bpf_lsm_task_alloc)
382BTF_ID(func, bpf_lsm_task_prctl)
383BTF_ID(func, bpf_lsm_task_setscheduler)
384BTF_ID(func, bpf_lsm_userns_create)
385BTF_ID(func, bpf_lsm_bdev_alloc_security)
386BTF_ID(func, bpf_lsm_bdev_setintegrity)
387BTF_SET_END(sleepable_lsm_hooks)
388
389BTF_SET_START(untrusted_lsm_hooks)
390BTF_ID(func, bpf_lsm_bpf_map_free)
391BTF_ID(func, bpf_lsm_bpf_prog_free)
392BTF_ID(func, bpf_lsm_file_alloc_security)
393BTF_ID(func, bpf_lsm_file_free_security)
394#ifdef CONFIG_SECURITY_NETWORK
395BTF_ID(func, bpf_lsm_sk_alloc_security)
396BTF_ID(func, bpf_lsm_sk_free_security)
397#endif /* CONFIG_SECURITY_NETWORK */
398BTF_ID(func, bpf_lsm_task_free)
399BTF_ID(func, bpf_lsm_bdev_alloc_security)
400BTF_ID(func, bpf_lsm_bdev_free_security)
401BTF_SET_END(untrusted_lsm_hooks)
402
403bool bpf_lsm_is_sleepable_hook(u32 btf_id)
404{
405 return btf_id_set_contains(&sleepable_lsm_hooks, btf_id);
406}
407
408bool bpf_lsm_is_trusted(const struct bpf_prog *prog)
409{
410 return !btf_id_set_contains(&untrusted_lsm_hooks, prog->aux->attach_btf_id);
411}
412
413const struct bpf_prog_ops lsm_prog_ops = {
414};
415
416const struct bpf_verifier_ops lsm_verifier_ops = {
417 .get_func_proto = bpf_lsm_func_proto,
418 .is_valid_access = btf_ctx_access,
419};
420
421/* hooks return 0 or 1 */
422BTF_SET_START(bool_lsm_hooks)
423#ifdef CONFIG_SECURITY_NETWORK_XFRM
424BTF_ID(func, bpf_lsm_xfrm_state_pol_flow_match)
425#endif
426#ifdef CONFIG_AUDIT
427BTF_ID(func, bpf_lsm_audit_rule_known)
428#endif
429BTF_ID(func, bpf_lsm_inode_xattr_skipcap)
430BTF_SET_END(bool_lsm_hooks)
431
432/* hooks returning void */
433#define LSM_HOOK_void(DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME)
434#define LSM_HOOK_int(DEFAULT, NAME, ...) /* nothing */
435#define LSM_HOOK(RET, DEFAULT, NAME, ...) LSM_HOOK_##RET(DEFAULT, NAME, __VA_ARGS__)
436BTF_SET_START(void_lsm_hooks)
437#include <linux/lsm_hook_defs.h>
438#undef LSM_HOOK
439#undef LSM_HOOK_void
440#undef LSM_HOOK_int
441BTF_SET_END(void_lsm_hooks)
442
443bool bpf_lsm_hook_returns_errno(u32 btf_id)
444{
445 if (btf_id_set_contains(&bool_lsm_hooks, btf_id))
446 return false;
447 if (btf_id_set_contains(&void_lsm_hooks, btf_id))
448 return false;
449 return true;
450}
451
452int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
453 struct bpf_retval_range *retval_range)
454{
455 /* no return value range for void hooks */
456 if (!prog->aux->attach_func_proto->type)
457 return -EINVAL;
458
459 if (btf_id_set_contains(&bool_lsm_hooks, prog->aux->attach_btf_id)) {
460 retval_range->minval = 0;
461 retval_range->maxval = 1;
462 } else {
463 /* All other available LSM hooks, except task_prctl, return 0
464 * on success and negative error code on failure.
465 * To keep things simple, we only allow bpf progs to return 0
466 * or negative errno for task_prctl too.
467 */
468 retval_range->minval = -MAX_ERRNO;
469 retval_range->maxval = 0;
470 }
471 return 0;
472}