From patchwork Tue Jun 21 20:46:38 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: KP Singh X-Patchwork-Id: 12889761 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C7CCC433EF for ; Tue, 21 Jun 2022 20:46:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353136AbiFUUqx (ORCPT ); Tue, 21 Jun 2022 16:46:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43886 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352430AbiFUUqw (ORCPT ); Tue, 21 Jun 2022 16:46:52 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1F78723BC4 for ; Tue, 21 Jun 2022 13:46:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D0BFAB81B01 for ; Tue, 21 Jun 2022 20:46:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3D869C341C7; Tue, 21 Jun 2022 20:46:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1655844409; bh=0sz9cN1XmOO/ZvIT4AWqxdHy7X13KQiUBPBhOXErjEk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CkRcP0xcDNVdTPpXLd6PqcXbJHXR6a7ak+ZDGRh5kM7H0HkcI3YWHULX5ddvXnE55 ICwWcB4sHTQuUyxRRPk33Tex6PM2oD+oISdUoMjm5L/orqjNvY67QUAL+4LqYhxS54 l7+UeB+gGBrlg4EcHQaxc2fIbZ8Adp25F4KN/W5HQVCpJaa1IlCN8+y4F93s/Vyp1W BsV4MLS0XGiYykY/YOFwXMiLtXlN9kU/znYQlJRROyIMHVvXIZlfxOGcx96dO51abH bkqY/zL0DUzKNbJZEvhPLu2eEPqp24bVjvABx8LBPLPhU7kVw+ARZdyUTKz7YMz+56 njYxRL3ebiUkA== From: KP Singh To: bpf@vger.kernel.org Cc: KP Singh , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Benjamin Tissoires , Yosry Ahmed Subject: [PATCH v3 bpf-next 1/5] btf: Add a new kfunc set which allows to mark a function to be sleepable Date: Tue, 21 Jun 2022 20:46:38 +0000 Message-Id: <20220621204642.2891979-2-kpsingh@kernel.org> X-Mailer: git-send-email 2.37.0.rc0.104.g0611611a94-goog In-Reply-To: <20220621204642.2891979-1-kpsingh@kernel.org> References: <20220621204642.2891979-1-kpsingh@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net From: Benjamin Tissoires This allows to declare a kfunc as sleepable and prevents its use in a non sleepable program. Acked-by: KP Singh Signed-off-by: Benjamin Tissoires Signed-off-by: KP Singh --- include/linux/btf.h | 2 ++ kernel/bpf/btf.c | 12 ++++++++++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/include/linux/btf.h b/include/linux/btf.h index 1bfed7fa0428..6e7517573d9e 100644 --- a/include/linux/btf.h +++ b/include/linux/btf.h @@ -18,6 +18,7 @@ enum btf_kfunc_type { BTF_KFUNC_TYPE_RELEASE, BTF_KFUNC_TYPE_RET_NULL, BTF_KFUNC_TYPE_KPTR_ACQUIRE, + BTF_KFUNC_TYPE_SLEEPABLE, BTF_KFUNC_TYPE_MAX, }; @@ -37,6 +38,7 @@ struct btf_kfunc_id_set { struct btf_id_set *release_set; struct btf_id_set *ret_null_set; struct btf_id_set *kptr_acquire_set; + struct btf_id_set *sleepable_set; }; struct btf_id_set *sets[BTF_KFUNC_TYPE_MAX]; }; diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index f08037c31dd7..668ecf61649b 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -6171,7 +6171,7 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, struct bpf_verifier_log *log = &env->log; u32 i, nargs, ref_id, ref_obj_id = 0; bool is_kfunc = btf_is_kernel(btf); - bool rel = false, kptr_get = false; + bool rel = false, kptr_get = false, sleepable = false; const char *func_name, *ref_tname; const struct btf_type *t, *ref_t; const struct btf_param *args; @@ -6202,9 +6202,10 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, } if (is_kfunc) { - /* Only kfunc can be release func */ rel = btf_kfunc_id_set_contains(btf, resolve_prog_type(env->prog), BTF_KFUNC_TYPE_RELEASE, func_id); + sleepable = btf_kfunc_id_set_contains(btf, resolve_prog_type(env->prog), + BTF_KFUNC_TYPE_SLEEPABLE, func_id); kptr_get = btf_kfunc_id_set_contains(btf, resolve_prog_type(env->prog), BTF_KFUNC_TYPE_KPTR_ACQUIRE, func_id); } @@ -6404,6 +6405,13 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, func_name); return -EINVAL; } + + if (sleepable && !env->prog->aux->sleepable) { + bpf_log(log, "kernel function %s is sleepable but the program is not\n", + func_name); + return -EINVAL; + } + /* returns argument register number > 0 in case of reference release kfunc */ return rel ? ref_regno : 0; } From patchwork Tue Jun 21 20:46:39 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: KP Singh X-Patchwork-Id: 12889763 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44C6ACCA482 for ; Tue, 21 Jun 2022 20:46:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352430AbiFUUq4 (ORCPT ); Tue, 21 Jun 2022 16:46:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43906 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353351AbiFUUqy (ORCPT ); Tue, 21 Jun 2022 16:46:54 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E731A23BC4 for ; Tue, 21 Jun 2022 13:46:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A3298B81B22 for ; Tue, 21 Jun 2022 20:46:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 10657C341C6; Tue, 21 Jun 2022 20:46:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1655844411; bh=b1YeOq+ZBW326gTSk4aSA666NsJVmpTBYO7ZUTRYLcY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oP3P/NNuVNs0tvrSKDf2ZOvvQpTNtxp0OLzDUNHcRjG7X/tnIuA+bRhkQCHEJ+Yt7 Y7abCP9LghYCnw8EU7Q/E9X12zdQJQMf5/VLzu3jL0qV10H/yDQBtfUm7DEk+rRhyo 0KCpT/h5nlJNXJAwYn9a6pxHOQOzeO+IebvF3kH2cRW4FJIRrNfqY98B31p4FJRklb 21/kNxrklOkNk+5lpAV+L1ZmL3T/UoSAGspIzT7qpwMtyqy3G2XMX7W6OWoNID/fkG d81KkquwAs8d0IDFaUdVmrumKupg056fIcGgmU48pZC5axzDrEjV9h2QhiNdWQiJck rtvbPXeQ8YmjA== From: KP Singh To: bpf@vger.kernel.org Cc: KP Singh , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Benjamin Tissoires , Yosry Ahmed Subject: [PATCH v3 bpf-next 2/5] bpf: kfunc support for ARG_PTR_TO_CONST_STR Date: Tue, 21 Jun 2022 20:46:39 +0000 Message-Id: <20220621204642.2891979-3-kpsingh@kernel.org> X-Mailer: git-send-email 2.37.0.rc0.104.g0611611a94-goog In-Reply-To: <20220621204642.2891979-1-kpsingh@kernel.org> References: <20220621204642.2891979-1-kpsingh@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net kfuncs can handle pointers to memory when the next argument is the size of the memory that can be read and verify these as ARG_CONST_SIZE_OR_ZERO Similarly add support for string constants (const char *) and verify it similar to ARG_PTR_TO_CONST_STR. Signed-off-by: KP Singh --- include/linux/bpf_verifier.h | 2 + kernel/bpf/btf.c | 26 +++++++++++ kernel/bpf/verifier.c | 89 +++++++++++++++++++++--------------- 3 files changed, 79 insertions(+), 38 deletions(-) diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 3930c963fa67..60d490354397 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -548,6 +548,8 @@ int check_kfunc_mem_size_reg(struct bpf_verifier_env *env, struct bpf_reg_state u32 regno); int check_mem_reg(struct bpf_verifier_env *env, struct bpf_reg_state *reg, u32 regno, u32 mem_size); +int check_const_str(struct bpf_verifier_env *env, + const struct bpf_reg_state *reg, int regno); /* this lives here instead of in bpf.h because it needs to dereference tgt_prog */ static inline u64 bpf_trampoline_compute_key(const struct bpf_prog *tgt_prog, diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 668ecf61649b..6608e8a0c5ca 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -6162,6 +6162,23 @@ static bool is_kfunc_arg_mem_size(const struct btf *btf, return true; } +static bool btf_param_is_const_str_ptr(const struct btf *btf, + const struct btf_param *param) +{ + const struct btf_type *t; + + t = btf_type_by_id(btf, param->type); + if (!btf_type_is_ptr(t)) + return false; + + t = btf_type_by_id(btf, t->type); + if (!(BTF_INFO_KIND(t->info) == BTF_KIND_CONST)) + return false; + + t = btf_type_skip_modifiers(btf, t->type, NULL); + return !strcmp(btf_name_by_offset(btf, t->name_off), "char"); +} + static int btf_check_func_arg_match(struct bpf_verifier_env *env, const struct btf *btf, u32 func_id, struct bpf_reg_state *regs, @@ -6344,6 +6361,7 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, } else if (ptr_to_mem_ok) { const struct btf_type *resolve_ret; u32 type_size; + int err; if (is_kfunc) { bool arg_mem_size = i + 1 < nargs && is_kfunc_arg_mem_size(btf, &args[i + 1], ®s[regno + 1]); @@ -6354,6 +6372,14 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, * When arg_mem_size is true, the pointer can be * void *. */ + if (btf_param_is_const_str_ptr(btf, &args[i])) { + err = check_const_str(env, reg, regno); + if (err < 0) + return err; + i++; + continue; + } + if (!btf_type_is_scalar(ref_t) && !__btf_type_is_scalar_struct(log, btf, ref_t, 0) && (arg_mem_size ? !btf_type_is_void(ref_t) : 1)) { diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 2859901ffbe3..7ac501122df0 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5840,6 +5840,56 @@ static u32 stack_slot_get_id(struct bpf_verifier_env *env, struct bpf_reg_state return state->stack[spi].spilled_ptr.id; } +int check_const_str(struct bpf_verifier_env *env, + const struct bpf_reg_state *reg, int regno) +{ + struct bpf_map *map; + int map_off; + u64 map_addr; + char *str_ptr; + int err; + + if (reg->type != PTR_TO_MAP_VALUE) + return -EACCES; + + map = reg->map_ptr; + if (!bpf_map_is_rdonly(map)) { + verbose(env, "R%d does not point to a readonly map'\n", regno); + return -EACCES; + } + + if (!tnum_is_const(reg->var_off)) { + verbose(env, "R%d is not a constant address'\n", regno); + return -EACCES; + } + + if (!map->ops->map_direct_value_addr) { + verbose(env, + "no direct value access support for this map type\n"); + return -EACCES; + } + + err = check_map_access(env, regno, reg->off, map->value_size - reg->off, + false, ACCESS_HELPER); + if (err) + return err; + + map_off = reg->off + reg->var_off.value; + err = map->ops->map_direct_value_addr(map, &map_addr, map_off); + if (err) { + verbose(env, "direct value access on string failed\n"); + return err; + } + + str_ptr = (char *)(long)(map_addr); + if (!strnchr(str_ptr + map_off, map->value_size - map_off, 0)) { + verbose(env, "string is not zero-terminated\n"); + return -EINVAL; + } + + return 0; +} + static int check_func_arg(struct bpf_verifier_env *env, u32 arg, struct bpf_call_arg_meta *meta, const struct bpf_func_proto *fn) @@ -6074,44 +6124,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, return err; err = check_ptr_alignment(env, reg, 0, size, true); } else if (arg_type == ARG_PTR_TO_CONST_STR) { - struct bpf_map *map = reg->map_ptr; - int map_off; - u64 map_addr; - char *str_ptr; - - if (!bpf_map_is_rdonly(map)) { - verbose(env, "R%d does not point to a readonly map'\n", regno); - return -EACCES; - } - - if (!tnum_is_const(reg->var_off)) { - verbose(env, "R%d is not a constant address'\n", regno); - return -EACCES; - } - - if (!map->ops->map_direct_value_addr) { - verbose(env, "no direct value access support for this map type\n"); - return -EACCES; - } - - err = check_map_access(env, regno, reg->off, - map->value_size - reg->off, false, - ACCESS_HELPER); - if (err) - return err; - - map_off = reg->off + reg->var_off.value; - err = map->ops->map_direct_value_addr(map, &map_addr, map_off); - if (err) { - verbose(env, "direct value access on string failed\n"); - return err; - } - - str_ptr = (char *)(long)(map_addr); - if (!strnchr(str_ptr + map_off, map->value_size - map_off, 0)) { - verbose(env, "string is not zero-terminated\n"); - return -EINVAL; - } + err = check_const_str(env, reg, regno); } else if (arg_type == ARG_PTR_TO_KPTR) { if (process_kptr_func(env, regno, meta)) return -EACCES; From patchwork Tue Jun 21 20:46:40 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: KP Singh X-Patchwork-Id: 12889762 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C15B5C43334 for ; Tue, 21 Jun 2022 20:46:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353838AbiFUUqz (ORCPT ); Tue, 21 Jun 2022 16:46:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43904 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352430AbiFUUqy (ORCPT ); Tue, 21 Jun 2022 16:46:54 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 53EFA24BFD for ; Tue, 21 Jun 2022 13:46:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E3F6D61857 for ; Tue, 21 Jun 2022 20:46:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D6E02C341C5; Tue, 21 Jun 2022 20:46:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1655844413; bh=bELpyDwJmv34Yo/vC1UO2hSQqFCVOmUFIBnXz30WfLA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WV4kv5Db/CEgR/oDnQpRFVqe03yvrlu3BwwpQhLe0QaI+J9jt/G1zqVjVGvwRxXcy COK/SmMQ4otzgNyD6cAUDqltLWB2G4ehUsW++ZYFo6IADPOHT78r8s+Au2FYNUuyH4 4K1Nm0gq9HheCGQpy7FAn7A4O02dwKbLixgocmsnarx9WU8UEwPY7zpXBRlq9f2Mpo Qzj50UzYiQDtLUGCGtxXUG+13cTOdxB5Us161R73T4mMdAZCF+dzldfyMztSAw5gh7 rtbjdpuW0nBY/0e2BuAAM22cdykqb6d8LjbkL8myVR7FfdTKlimHCToT51upIzUaZO qYhO95g1sPEjA== From: KP Singh To: bpf@vger.kernel.org Cc: KP Singh , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Benjamin Tissoires , Yosry Ahmed Subject: [PATCH v3 bpf-next 3/5] bpf: Allow kfuncs to be used in LSM programs Date: Tue, 21 Jun 2022 20:46:40 +0000 Message-Id: <20220621204642.2891979-4-kpsingh@kernel.org> X-Mailer: git-send-email 2.37.0.rc0.104.g0611611a94-goog In-Reply-To: <20220621204642.2891979-1-kpsingh@kernel.org> References: <20220621204642.2891979-1-kpsingh@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net In preparation for the addition of bpf_getxattr kfunc. Signed-off-by: KP Singh --- kernel/bpf/btf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 6608e8a0c5ca..c48566dc86fe 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -7261,6 +7261,7 @@ static int bpf_prog_type_to_kfunc_hook(enum bpf_prog_type prog_type) case BPF_PROG_TYPE_STRUCT_OPS: return BTF_KFUNC_HOOK_STRUCT_OPS; case BPF_PROG_TYPE_TRACING: + case BPF_PROG_TYPE_LSM: return BTF_KFUNC_HOOK_TRACING; case BPF_PROG_TYPE_SYSCALL: return BTF_KFUNC_HOOK_SYSCALL; From patchwork Tue Jun 21 20:46:41 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: KP Singh X-Patchwork-Id: 12889764 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1FAE6CCA473 for ; Tue, 21 Jun 2022 20:46:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354006AbiFUUq5 (ORCPT ); Tue, 21 Jun 2022 16:46:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43944 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354156AbiFUUq4 (ORCPT ); Tue, 21 Jun 2022 16:46:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 206842B1A1 for ; Tue, 21 Jun 2022 13:46:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B162B6185A for ; Tue, 21 Jun 2022 20:46:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B3FC4C341CC; Tue, 21 Jun 2022 20:46:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1655844415; bh=5ZMi3z6QKbQw0Q9J7MHsWauSOb4XqeY0Org1meXj0iM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PYcDSolRNuDvcV7tchH7BXc9fiI/uOHjUySAzVmjxQ1BeP7x5xQXad63srAANXrgi AMv969IWFDhu+ZpLKiCDFOFfnrUz6oLPd6ubwe9dnlOcRidquXGpRN49hrieD0zR+h MvQBXZ+7FzZAWtNyoHbc+a42vucGtMqsbx0xOGf9ZODz2d4Ol2xWWlafZRp01gp9L+ 1YnMHBRl1U7vxWATy1QUjRzhYVQ3+ZnGm8htWWOI+xNYXUC75IP7URXwQF89h2WRQL U06ei4TwLuSSoa7UNyPHkFSuvQuO0M/waUkT6mQ/hYpgK1BLy08wVfF0rqN8npNh8g pr8IkynXM+VMw== From: KP Singh To: bpf@vger.kernel.org Cc: KP Singh , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Benjamin Tissoires , Yosry Ahmed Subject: [PATCH v3 bpf-next 4/5] bpf: Add a bpf_getxattr kfunc Date: Tue, 21 Jun 2022 20:46:41 +0000 Message-Id: <20220621204642.2891979-5-kpsingh@kernel.org> X-Mailer: git-send-email 2.37.0.rc0.104.g0611611a94-goog In-Reply-To: <20220621204642.2891979-1-kpsingh@kernel.org> References: <20220621204642.2891979-1-kpsingh@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net LSMs like SELinux store security state in xattrs. bpf_getxattr enables BPF LSM to implement similar functionality. In combination with bpf_local_storage, xattrs can be used to develop more complex security policies. This kfunc wraps around __vfs_getxattr which can sleep and is, therefore, limited to sleepable programs using the newly added sleepable_set for kfuncs. Signed-off-by: KP Singh --- kernel/trace/bpf_trace.c | 42 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 4be976cf7d63..210e29bd0cbb 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -20,6 +20,7 @@ #include #include #include +#include #include @@ -1181,6 +1182,47 @@ static const struct bpf_func_proto bpf_get_func_arg_cnt_proto = { .arg1_type = ARG_PTR_TO_CTX, }; +__diag_push(); +__diag_ignore_all("-Wmissing-prototypes", + "kfuncs which will be used in BPF programs"); + +noinline __weak ssize_t bpf_getxattr(struct dentry *dentry, struct inode *inode, + const char *name, void *value, int size) +{ + return __vfs_getxattr(dentry, inode, name, value, size); +} + +__diag_pop(); + +BTF_SET_START(bpf_trace_kfunc_ids) +BTF_ID(func, bpf_getxattr) +BTF_SET_END(bpf_trace_kfunc_ids) + +BTF_SET_START(bpf_trace_sleepable_kfunc_ids) +BTF_ID(func, bpf_getxattr) +BTF_SET_END(bpf_trace_sleepable_kfunc_ids) + +static const struct btf_kfunc_id_set bpf_trace_kfunc_set = { + .owner = THIS_MODULE, + .check_set = &bpf_trace_kfunc_ids, + .sleepable_set = &bpf_trace_sleepable_kfunc_ids, +}; + +static int __init bpf_trace_kfunc_init(void) +{ + int ret; + + ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_TRACING, + &bpf_trace_kfunc_set); + if (!ret) + return ret; + + return register_btf_kfunc_id_set(BPF_PROG_TYPE_LSM, + &bpf_trace_kfunc_set); + +} +late_initcall(bpf_trace_kfunc_init); + static const struct bpf_func_proto * bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) { From patchwork Tue Jun 21 20:46:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: KP Singh X-Patchwork-Id: 12889765 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8766FC433EF for ; Tue, 21 Jun 2022 20:47:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354153AbiFUUq6 (ORCPT ); Tue, 21 Jun 2022 16:46:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43984 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353351AbiFUUq6 (ORCPT ); Tue, 21 Jun 2022 16:46:58 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E30E72A26F for ; Tue, 21 Jun 2022 13:46:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 80CFD6185A for ; Tue, 21 Jun 2022 20:46:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 85B7AC341C4; Tue, 21 Jun 2022 20:46:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1655844416; bh=0LgVkL1ldA/mk8/nk4zJk2Opn3AP379tvwspSLDBYjI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=T9SHqXsiITJJd/FqE9FcXh0RlIkoyN9oVfMn7gzWRzjOxBYxiieKgRh3WNoz9kUHq t20qetBM2X2gi86OAI29MdFuC63Xa1sxumMWzfG5prBk5LhK2aIMj0EqLUe44BJD5A KgTkzvz+WcRFsJfk5A4aYuGMfZ9ICz5fxCoLL7Gc9Q7YjY4yyv1vObK/mUOCW/gQA+ fE2XnTd+376Y2UgCGUTENeb0ga/Fi5dgdUhyKw6/NrgZhok7zudNPf2nVs9i/DV3zx 1PNOXWcOIRPhSCalBjql53xv0ltu2mtoTANlIr4/+UH8ETAf+zJAeQ1kaMwMFPU04O fUNhBPokSmXkg== From: KP Singh To: bpf@vger.kernel.org Cc: KP Singh , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Benjamin Tissoires , Yosry Ahmed Subject: [PATCH v3 bpf-next 5/5] bpf/selftests: Add a selftest for bpf_getxattr Date: Tue, 21 Jun 2022 20:46:42 +0000 Message-Id: <20220621204642.2891979-6-kpsingh@kernel.org> X-Mailer: git-send-email 2.37.0.rc0.104.g0611611a94-goog In-Reply-To: <20220621204642.2891979-1-kpsingh@kernel.org> References: <20220621204642.2891979-1-kpsingh@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net A simple test that adds an xattr on a copied /bin/ls and reads it back when the copied ls is executed. Signed-off-by: KP Singh --- .../testing/selftests/bpf/prog_tests/xattr.c | 58 +++++++++++++++++++ tools/testing/selftests/bpf/progs/xattr.c | 37 ++++++++++++ 2 files changed, 95 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/xattr.c create mode 100644 tools/testing/selftests/bpf/progs/xattr.c diff --git a/tools/testing/selftests/bpf/prog_tests/xattr.c b/tools/testing/selftests/bpf/prog_tests/xattr.c new file mode 100644 index 000000000000..442b6c1aed0e --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/xattr.c @@ -0,0 +1,58 @@ +// SPDX-License-Identifier: GPL-2.0 + +/* + * Copyright 2022 Google LLC. + */ + +#include +#include +#include "xattr.skel.h" + +#define XATTR_NAME "security.bpf" +#define XATTR_VALUE "test_progs" + +static unsigned int duration; + +void test_xattr(void) +{ + struct xattr *skel = NULL; + char tmp_dir_path[] = "/tmp/xattrXXXXXX"; + char tmp_exec_path[64]; + char cmd[256]; + int err; + + if (CHECK(!mkdtemp(tmp_dir_path), "mkdtemp", + "unable to create tmpdir: %d\n", errno)) + goto close_prog; + + snprintf(tmp_exec_path, sizeof(tmp_exec_path), "%s/copy_of_ls", + tmp_dir_path); + snprintf(cmd, sizeof(cmd), "cp /bin/ls %s", tmp_exec_path); + if (CHECK_FAIL(system(cmd))) + goto close_prog_rmdir; + + if (CHECK(setxattr(tmp_exec_path, XATTR_NAME, XATTR_VALUE, + sizeof(XATTR_VALUE), 0), + "setxattr", "unable to setxattr: %d", errno)) + goto close_prog_rmdir; + + skel = xattr__open_and_load(); + if (!ASSERT_OK_PTR(skel, "skel_load")) + goto close_prog_rmdir; + + err = xattr__attach(skel); + if (!ASSERT_OK(err, "xattr__attach failed")) + goto close_prog_rmdir; + + snprintf(cmd, sizeof(cmd), "%s -l", tmp_exec_path); + if (CHECK_FAIL(system(cmd))) + goto close_prog_rmdir; + + ASSERT_EQ(skel->bss->result, 1, "xattr result"); + +close_prog_rmdir: + snprintf(cmd, sizeof(cmd), "rm -rf %s", tmp_dir_path); + system(cmd); +close_prog: + xattr__destroy(skel); +} diff --git a/tools/testing/selftests/bpf/progs/xattr.c b/tools/testing/selftests/bpf/progs/xattr.c new file mode 100644 index 000000000000..ccc078fb8ebd --- /dev/null +++ b/tools/testing/selftests/bpf/progs/xattr.c @@ -0,0 +1,37 @@ +// SPDX-License-Identifier: GPL-2.0 + +/* + * Copyright 2022 Google LLC. + */ + +#include "vmlinux.h" +#include +#include + +char _license[] SEC("license") = "GPL"; + +#define XATTR_NAME "security.bpf" +#define XATTR_VALUE "test_progs" + +__u64 result = 0; + +extern ssize_t bpf_getxattr(struct dentry *dentry, struct inode *inode, + const char *name, void *value, int size) __ksym; + +SEC("lsm.s/bprm_committed_creds") +void BPF_PROG(bprm_cc, struct linux_binprm *bprm) +{ + struct task_struct *current = bpf_get_current_task_btf(); + char dir_xattr_value[64] = {0}; + int xattr_sz = 0; + + xattr_sz = bpf_getxattr(bprm->file->f_path.dentry, + bprm->file->f_path.dentry->d_inode, XATTR_NAME, + dir_xattr_value, 64); + + if (xattr_sz <= 0) + return; + + if (!bpf_strncmp(dir_xattr_value, sizeof(XATTR_VALUE), XATTR_VALUE)) + result = 1; +}