projects/linux·blob master · refs

262 lines · 6.7 KiB

1// SPDX-License-Identifier: GPL-2.0
2#include <linux/bpf.h>
3#include <linux/vmalloc.h>
4#include <linux/file.h>
5#include <linux/fs.h>
6#include <linux/kernel.h>
7#include <linux/idr.h>
8#include <linux/namei.h>
9#include <linux/user_namespace.h>
10#include <linux/security.h>
11
12static bool bpf_ns_capable(struct user_namespace *ns, int cap)
13{
14 return ns_capable(ns, cap) || (cap != CAP_SYS_ADMIN && ns_capable(ns, CAP_SYS_ADMIN));
15}
16
17bool bpf_token_capable(const struct bpf_token *token, int cap)
18{
19 struct user_namespace *userns;
20
21 /* BPF token allows ns_capable() level of capabilities */
22 userns = token ? token->userns : &init_user_ns;
23 if (!bpf_ns_capable(userns, cap))
24 return false;
25 if (token && security_bpf_token_capable(token, cap) < 0)
26 return false;
27 return true;
28}
29
30void bpf_token_inc(struct bpf_token *token)
31{
32 atomic64_inc(&token->refcnt);
33}
34
35static void bpf_token_free(struct bpf_token *token)
36{
37 security_bpf_token_free(token);
38 put_user_ns(token->userns);
39 kfree(token);
40}
41
42static void bpf_token_put_deferred(struct work_struct *work)
43{
44 struct bpf_token *token = container_of(work, struct bpf_token, work);
45
46 bpf_token_free(token);
47}
48
49void bpf_token_put(struct bpf_token *token)
50{
51 if (!token)
52 return;
53
54 if (!atomic64_dec_and_test(&token->refcnt))
55 return;
56
57 INIT_WORK(&token->work, bpf_token_put_deferred);
58 schedule_work(&token->work);
59}
60
61static int bpf_token_release(struct inode *inode, struct file *filp)
62{
63 struct bpf_token *token = filp->private_data;
64
65 bpf_token_put(token);
66 return 0;
67}
68
69static void bpf_token_show_fdinfo(struct seq_file *m, struct file *filp)
70{
71 struct bpf_token *token = filp->private_data;
72 u64 mask;
73
74 BUILD_BUG_ON(__MAX_BPF_CMD >= 64);
75 mask = BIT_ULL(__MAX_BPF_CMD) - 1;
76 if ((token->allowed_cmds & mask) == mask)
77 seq_printf(m, "allowed_cmds:\tany\n");
78 else
79 seq_printf(m, "allowed_cmds:\t0x%llx\n", token->allowed_cmds);
80
81 BUILD_BUG_ON(__MAX_BPF_MAP_TYPE >= 64);
82 mask = BIT_ULL(__MAX_BPF_MAP_TYPE) - 1;
83 if ((token->allowed_maps & mask) == mask)
84 seq_printf(m, "allowed_maps:\tany\n");
85 else
86 seq_printf(m, "allowed_maps:\t0x%llx\n", token->allowed_maps);
87
88 BUILD_BUG_ON(__MAX_BPF_PROG_TYPE >= 64);
89 mask = BIT_ULL(__MAX_BPF_PROG_TYPE) - 1;
90 if ((token->allowed_progs & mask) == mask)
91 seq_printf(m, "allowed_progs:\tany\n");
92 else
93 seq_printf(m, "allowed_progs:\t0x%llx\n", token->allowed_progs);
94
95 BUILD_BUG_ON(__MAX_BPF_ATTACH_TYPE >= 64);
96 mask = BIT_ULL(__MAX_BPF_ATTACH_TYPE) - 1;
97 if ((token->allowed_attachs & mask) == mask)
98 seq_printf(m, "allowed_attachs:\tany\n");
99 else
100 seq_printf(m, "allowed_attachs:\t0x%llx\n", token->allowed_attachs);
101}
102
103#define BPF_TOKEN_INODE_NAME "bpf-token"
104
105static const struct inode_operations bpf_token_iops = { };
106
107const struct file_operations bpf_token_fops = {
108 .release = bpf_token_release,
109 .show_fdinfo = bpf_token_show_fdinfo,
110};
111
112int bpf_token_create(union bpf_attr *attr)
113{
114 struct bpf_token *token __free(kfree) = NULL;
115 struct bpf_mount_opts *mnt_opts;
116 struct user_namespace *userns;
117 struct inode *inode;
118 CLASS(fd, f)(attr->token_create.bpffs_fd);
119 struct path path;
120 struct super_block *sb;
121 umode_t mode;
122 int err;
123
124 if (fd_empty(f))
125 return -EBADF;
126
127 path = fd_file(f)->f_path;
128 sb = path.dentry->d_sb;
129
130 if (path.dentry != sb->s_root)
131 return -EINVAL;
132 if (sb->s_op != &bpf_super_ops)
133 return -EINVAL;
134 err = path_permission(&path, MAY_ACCESS);
135 if (err)
136 return err;
137
138 userns = sb->s_user_ns;
139 /*
140 * Enforce that creators of BPF tokens are in the same user
141 * namespace as the BPF FS instance. This makes reasoning about
142 * permissions a lot easier and we can always relax this later.
143 */
144 if (current_user_ns() != userns)
145 return -EPERM;
146 if (!ns_capable(userns, CAP_BPF))
147 return -EPERM;
148
149 /* Creating BPF token in init_user_ns doesn't make much sense. */
150 if (current_user_ns() == &init_user_ns)
151 return -EOPNOTSUPP;
152
153 mnt_opts = sb->s_fs_info;
154 if (mnt_opts->delegate_cmds == 0 &&
155 mnt_opts->delegate_maps == 0 &&
156 mnt_opts->delegate_progs == 0 &&
157 mnt_opts->delegate_attachs == 0)
158 return -ENOENT; /* no BPF token delegation is set up */
159
160 mode = S_IFREG | ((S_IRUSR | S_IWUSR) & ~current_umask());
161 inode = bpf_get_inode(sb, NULL, mode);
162 if (IS_ERR(inode))
163 return PTR_ERR(inode);
164
165 inode->i_op = &bpf_token_iops;
166 inode->i_fop = &bpf_token_fops;
167 clear_nlink(inode); /* make sure it is unlinked */
168
169 FD_PREPARE(fdf, O_CLOEXEC,
170 alloc_file_pseudo(inode, path.mnt, BPF_TOKEN_INODE_NAME,
171 O_RDWR, &bpf_token_fops));
172 if (fdf->fd < 0)
173 return fdf->fd;
174
175 token = kzalloc_obj(*token, GFP_USER);
176 if (!token)
177 return -ENOMEM;
178
179 atomic64_set(&token->refcnt, 1);
180
181 /* remember bpffs owning userns for future ns_capable() checks. */
182 token->userns = userns;
183 token->allowed_cmds = mnt_opts->delegate_cmds;
184 token->allowed_maps = mnt_opts->delegate_maps;
185 token->allowed_progs = mnt_opts->delegate_progs;
186 token->allowed_attachs = mnt_opts->delegate_attachs;
187
188 err = security_bpf_token_create(token, attr, &path);
189 if (err)
190 return err;
191
192 get_user_ns(token->userns);
193 fdf->file->private_data = no_free_ptr(token);
194 return fd_publish(fdf);
195}
196
197int bpf_token_get_info_by_fd(struct bpf_token *token,
198 const union bpf_attr *attr,
199 union bpf_attr __user *uattr)
200{
201 struct bpf_token_info __user *uinfo = u64_to_user_ptr(attr->info.info);
202 struct bpf_token_info info;
203 u32 info_len = attr->info.info_len;
204
205 info_len = min_t(u32, info_len, sizeof(info));
206 memset(&info, 0, sizeof(info));
207
208 info.allowed_cmds = token->allowed_cmds;
209 info.allowed_maps = token->allowed_maps;
210 info.allowed_progs = token->allowed_progs;
211 info.allowed_attachs = token->allowed_attachs;
212
213 if (copy_to_user(uinfo, &info, info_len) ||
214 put_user(info_len, &uattr->info.info_len))
215 return -EFAULT;
216
217 return 0;
218}
219
220struct bpf_token *bpf_token_get_from_fd(u32 ufd)
221{
222 CLASS(fd, f)(ufd);
223 struct bpf_token *token;
224
225 if (fd_empty(f))
226 return ERR_PTR(-EBADF);
227 if (fd_file(f)->f_op != &bpf_token_fops)
228 return ERR_PTR(-EINVAL);
229
230 token = fd_file(f)->private_data;
231 bpf_token_inc(token);
232
233 return token;
234}
235
236bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
237{
238 if (!token)
239 return false;
240 if (!(token->allowed_cmds & BIT_ULL(cmd)))
241 return false;
242 return security_bpf_token_cmd(token, cmd) == 0;
243}
244
245bool bpf_token_allow_map_type(const struct bpf_token *token, enum bpf_map_type type)
246{
247 if (!token || type >= __MAX_BPF_MAP_TYPE)
248 return false;
249
250 return token->allowed_maps & BIT_ULL(type);
251}
252
253bool bpf_token_allow_prog_type(const struct bpf_token *token,
254 enum bpf_prog_type prog_type,
255 enum bpf_attach_type attach_type)
256{
257 if (!token || prog_type >= __MAX_BPF_PROG_TYPE || attach_type >= __MAX_BPF_ATTACH_TYPE)
258 return false;
259
260 return (token->allowed_progs & BIT_ULL(prog_type)) &&
261 (token->allowed_attachs & BIT_ULL(attach_type));
262}