| Message ID | 20230814-devcg_guard-v1-3-654971ab88b1@aisec.fraunhofer.de (mailing list archive) |
|---|---|
| State | RFC |
| Headers | show |
| Series | bpf: cgroup device guard for non-initial user namespace | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch, async |
| bpf/vmtest-bpf-next-PR | pending | PR summary |
| bpf/vmtest-bpf-next-VM_Test-1 | success | Logs for ShellCheck |
| bpf/vmtest-bpf-next-VM_Test-2 | success | Logs for build for aarch64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-4 | success | Logs for build for x86_64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-5 | success | Logs for build for x86_64 with llvm-16 |
| bpf/vmtest-bpf-next-VM_Test-6 | success | Logs for set-matrix |
| bpf/vmtest-bpf-next-VM_Test-3 | success | Logs for build for s390x with gcc |
| bpf/vmtest-bpf-next-VM_Test-7 | success | Logs for test_maps on aarch64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-8 | pending | Logs for test_maps on s390x with gcc |
| bpf/vmtest-bpf-next-VM_Test-9 | success | Logs for test_maps on x86_64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-10 | success | Logs for test_maps on x86_64 with llvm-16 |
| bpf/vmtest-bpf-next-VM_Test-11 | success | Logs for test_progs on aarch64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-12 | pending | Logs for test_progs on s390x with gcc |
| bpf/vmtest-bpf-next-VM_Test-13 | success | Logs for test_progs on x86_64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-14 | success | Logs for test_progs on x86_64 with llvm-16 |
| bpf/vmtest-bpf-next-VM_Test-15 | success | Logs for test_progs_no_alu32 on aarch64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-16 | pending | Logs for test_progs_no_alu32 on s390x with gcc |
| bpf/vmtest-bpf-next-VM_Test-17 | success | Logs for test_progs_no_alu32 on x86_64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-18 | success | Logs for test_progs_no_alu32 on x86_64 with llvm-16 |
| bpf/vmtest-bpf-next-VM_Test-19 | success | Logs for test_progs_no_alu32_parallel on aarch64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-20 | success | Logs for test_progs_no_alu32_parallel on x86_64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-21 | success | Logs for test_progs_no_alu32_parallel on x86_64 with llvm-16 |
| bpf/vmtest-bpf-next-VM_Test-22 | success | Logs for test_progs_parallel on aarch64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-23 | success | Logs for test_progs_parallel on x86_64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-24 | success | Logs for test_progs_parallel on x86_64 with llvm-16 |
| bpf/vmtest-bpf-next-VM_Test-25 | success | Logs for test_verifier on aarch64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-26 | success | Logs for test_verifier on s390x with gcc |
| bpf/vmtest-bpf-next-VM_Test-27 | success | Logs for test_verifier on x86_64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-28 | success | Logs for test_verifier on x86_64 with llvm-16 |
| bpf/vmtest-bpf-next-VM_Test-29 | success | Logs for veristat |
diff --git a/include/linux/device_cgroup.h b/include/linux/device_cgroup.h index d02f32b7514e..00c0748b6a8d 100644 --- a/include/linux/device_cgroup.h +++ b/include/linux/device_cgroup.h @@ -65,3 +65,10 @@ static inline int devcgroup_inode_permission(struct inode *inode, int mask) static inline int devcgroup_inode_mknod(int mode, dev_t dev) { return 0; } #endif + +#ifdef CONFIG_CGROUP_BPF +bool devcgroup_task_is_guarded(struct task_struct *task); +#else +static inline bool devcgroup_task_is_guarded(struct task_struct *task) +{ return false; } +#endif /* CONFIG_CGROUP_BPF */ diff --git a/security/device_cgroup.c b/security/device_cgroup.c index dc4df7475081..95200a3d0b63 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -874,3 +874,13 @@ int devcgroup_check_permission(short type, u32 major, u32 minor, short access) } EXPORT_SYMBOL(devcgroup_check_permission); #endif /* defined(CONFIG_CGROUP_DEVICE) || defined(CONFIG_CGROUP_BPF) */ + +#ifdef CONFIG_CGROUP_BPF + +bool devcgroup_task_is_guarded(struct task_struct *task) +{ + return (cgroup_bpf_enabled(CGROUP_DEVICE) && + cgroup_bpf_device_guard_enabled(task)); +} +EXPORT_SYMBOL(devcgroup_task_is_guarded); +#endif /* CONFIG_CGROUP_BPF */
Export the bpf based cgroup guard through device_cgroup to others. Thus, devcgroup_task_is_guarded() could be used by subsystems which already make use of device_cgroup features, such as fs/namei. Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de> --- include/linux/device_cgroup.h | 7 +++++++ security/device_cgroup.c | 10 ++++++++++ 2 files changed, 17 insertions(+)