[v8,bpf-next,02/18] bpf: add BPF token delegation mount options to BPF FS

Add few new mount options to BPF FS that allow to specify that a given
BPF FS instance allows creation of BPF token (added in the next patch),
and what sort of operations are allowed under BPF token. As such, we get
4 new mount options, each is a bit mask
  - `delegate_cmds` allow to specify which bpf() syscall commands are
    allowed with BPF token derived from this BPF FS instance;
  - if BPF_MAP_CREATE command is allowed, `delegate_maps` specifies
    a set of allowable BPF map types that could be created with BPF token;
  - if BPF_PROG_LOAD command is allowed, `delegate_progs` specifies
    a set of allowable BPF program types that could be loaded with BPF token;
  - if BPF_PROG_LOAD command is allowed, `delegate_attachs` specifies
    a set of allowable BPF program attach types that could be loaded with
    BPF token; delegate_progs and delegate_attachs are meant to be used
    together, as full BPF program type is, in general, determined
    through both program type and program attach type.

Currently, these mount options accept the following forms of values:
  - a special value "any", that enables all possible values of a given
  bit set;
  - numeric value (decimal or hexadecimal, determined by kernel
  automatically) that specifies a bit mask value directly;
  - all the values for a given mount option are combined, if specified
  multiple times. E.g., `mount -t bpf nodev /path/to/mount -o
  delegate_maps=0x1 -o delegate_maps=0x2` will result in a combined 0x3
  mask.

Ideally, more convenient (for humans) symbolic form derived from
corresponding UAPI enums would be accepted (e.g., `-o
delegate_progs=kprobe|tracepoint`) and I intend to implement this, but
it requires a bunch of UAPI header churn, so I postponed it until this
feature lands upstream or at least there is a definite consensus that
this feature is acceptable and is going to make it, just to minimize
amount of wasted effort and not increase amount of non-essential code to
be reviewed.

Attentive reader will notice that BPF FS is now marked as
FS_USERNS_MOUNT, which theoretically makes it mountable inside non-init
user namespace as long as the process has sufficient *namespaced*
capabilities within that user namespace. But in reality we still
restrict BPF FS to be mountable only by processes with CAP_SYS_ADMIN *in
init userns* (extra check in bpf_fill_super()). FS_USERNS_MOUNT is added
to allow creating BPF FS context object (i.e., fsopen("bpf")) from
inside unprivileged process inside non-init userns, to capture that
userns as the owning userns. It will still be required to pass this
context object back to privileged process to instantiate and mount it.

This manipulation is important, because capturing non-init userns as the
owning userns of BPF FS instance (super block) allows to use that userns
to constraint BPF token to that userns later on (see next patch). So
creating BPF FS with delegation inside unprivileged userns will restrict
derived BPF token objects to only "work" inside that intended userns,
making it scoped to a intended "container".

There is a set of selftests at the end of the patch set that simulates
this sequence of steps and validates that everything works as intended.
But careful review is requested to make sure there are no missed gaps in
the implementation and testing.

All this is based on suggestions and discussions with Christian Brauner
([0]), to the best of my ability to follow all the implications.

  [0] https://lore.kernel.org/bpf/20230704-hochverdient-lehne-eeb9eeef785e@brauner/

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---
 include/linux/bpf.h | 10 ++++++
 kernel/bpf/inode.c  | 88 +++++++++++++++++++++++++++++++++++++++------
 2 files changed, 88 insertions(+), 10 deletions(-)

Message ID	20231016180220.3866105-3-andrii@kernel.org (mailing list archive)
State	Superseded
Delegated to:	Paul Moore
Headers	show Return-Path: <linux-security-module-owner@vger.kernel.org> From: Andrii Nakryiko <andrii@kernel.org> To: <bpf@vger.kernel.org>, <netdev@vger.kernel.org> CC: <linux-fsdevel@vger.kernel.org>, <linux-security-module@vger.kernel.org>, <keescook@chromium.org>, <brauner@kernel.org>, <lennart@poettering.net>, <kernel-team@meta.com>, <sargun@sargun.me> Subject: [PATCH v8 bpf-next 02/18] bpf: add BPF token delegation mount options to BPF FS Date: Mon, 16 Oct 2023 11:02:04 -0700 Message-ID: <20231016180220.3866105-3-andrii@kernel.org> In-Reply-To: <20231016180220.3866105-1-andrii@kernel.org> References: <20231016180220.3866105-1-andrii@kernel.org> Content-Type: text/plain Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 Precedence: bulk
Series	BPF token and BPF FS-based delegation \| expand [v8,bpf-next,00/18] BPF token and BPF FS-based delegation [v8,bpf-next,01/18] bpf: align CAP_NET_ADMIN checks with bpf_capable() approach [v8,bpf-next,02/18] bpf: add BPF token delegation mount options to BPF FS [v8,bpf-next,03/18] bpf: introduce BPF token object [v8,bpf-next,04/18] bpf: add BPF token support to BPF_MAP_CREATE command [v8,bpf-next,05/18] bpf: add BPF token support to BPF_BTF_LOAD command [v8,bpf-next,06/18] bpf: add BPF token support to BPF_PROG_LOAD command [v8,bpf-next,07/18] bpf: take into account BPF token when fetching helper protos [v8,bpf-next,08/18] bpf: consistenly use BPF token throughout BPF verifier logic [v8,bpf-next,09/18] bpf,lsm: refactor bpf_prog_alloc/bpf_prog_free LSM hooks [v8,bpf-next,10/18] bpf,lsm: refactor bpf_map_alloc/bpf_map_free LSM hooks [v8,bpf-next,11/18] bpf,lsm: add BPF token LSM hooks [v8,bpf-next,12/18] libbpf: add bpf_token_create() API [v8,bpf-next,13/18] selftests/bpf: fix test_maps' use of bpf_map_create_opts [v8,bpf-next,14/18] libbpf: add BPF token support to bpf_map_create() API [v8,bpf-next,15/18] libbpf: add BPF token support to bpf_btf_load() API [v8,bpf-next,16/18] libbpf: add BPF token support to bpf_prog_load() API [v8,bpf-next,17/18] selftests/bpf: add BPF token-enabled tests [v8,bpf-next,18/18] bpf,selinux: allocate bpf_security_struct per BPF token

[v8,bpf-next,02/18] bpf: add BPF token delegation mount options to BPF FS

Commit Message

Patch