1 | // SPDX-License-Identifier: GPL-2.0 |
2 | |
3 | /* |
4 | * Copyright (C) 2020 Google LLC. |
5 | */ |
6 | |
7 | #include <linux/filter.h> |
8 | #include <linux/bpf.h> |
9 | #include <linux/btf.h> |
10 | #include <linux/binfmts.h> |
11 | #include <linux/lsm_hooks.h> |
12 | #include <linux/bpf_lsm.h> |
13 | #include <linux/kallsyms.h> |
14 | #include <linux/bpf_verifier.h> |
15 | #include <net/bpf_sk_storage.h> |
16 | #include <linux/bpf_local_storage.h> |
17 | #include <linux/btf_ids.h> |
18 | #include <linux/ima.h> |
19 | #include <linux/bpf-cgroup.h> |
20 | |
21 | /* For every LSM hook that allows attachment of BPF programs, declare a nop |
22 | * function where a BPF program can be attached. |
23 | */ |
24 | #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ |
25 | noinline RET bpf_lsm_##NAME(__VA_ARGS__) \ |
26 | { \ |
27 | return DEFAULT; \ |
28 | } |
29 | |
30 | #include <linux/lsm_hook_defs.h> |
31 | #undef LSM_HOOK |
32 | |
33 | #define LSM_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME) |
34 | BTF_SET_START(bpf_lsm_hooks) |
35 | #include <linux/lsm_hook_defs.h> |
36 | #undef LSM_HOOK |
37 | BTF_SET_END(bpf_lsm_hooks) |
38 | |
39 | /* List of LSM hooks that should operate on 'current' cgroup regardless |
40 | * of function signature. |
41 | */ |
42 | BTF_SET_START(bpf_lsm_current_hooks) |
43 | /* operate on freshly allocated sk without any cgroup association */ |
44 | #ifdef CONFIG_SECURITY_NETWORK |
45 | BTF_ID(func, bpf_lsm_sk_alloc_security) |
46 | BTF_ID(func, bpf_lsm_sk_free_security) |
47 | #endif |
48 | BTF_SET_END(bpf_lsm_current_hooks) |
49 | |
50 | /* List of LSM hooks that trigger while the socket is properly locked. |
51 | */ |
52 | BTF_SET_START(bpf_lsm_locked_sockopt_hooks) |
53 | #ifdef CONFIG_SECURITY_NETWORK |
54 | BTF_ID(func, bpf_lsm_sock_graft) |
55 | BTF_ID(func, bpf_lsm_inet_csk_clone) |
56 | BTF_ID(func, bpf_lsm_inet_conn_established) |
57 | #endif |
58 | BTF_SET_END(bpf_lsm_locked_sockopt_hooks) |
59 | |
60 | /* List of LSM hooks that trigger while the socket is _not_ locked, |
61 | * but it's ok to call bpf_{g,s}etsockopt because the socket is still |
62 | * in the early init phase. |
63 | */ |
64 | BTF_SET_START(bpf_lsm_unlocked_sockopt_hooks) |
65 | #ifdef CONFIG_SECURITY_NETWORK |
66 | BTF_ID(func, bpf_lsm_socket_post_create) |
67 | BTF_ID(func, bpf_lsm_socket_socketpair) |
68 | #endif |
69 | BTF_SET_END(bpf_lsm_unlocked_sockopt_hooks) |
70 | |
71 | #ifdef CONFIG_CGROUP_BPF |
72 | void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, |
73 | bpf_func_t *bpf_func) |
74 | { |
75 | const struct btf_param *args __maybe_unused; |
76 | |
77 | if (btf_type_vlen(t: prog->aux->attach_func_proto) < 1 || |
78 | btf_id_set_contains(set: &bpf_lsm_current_hooks, |
79 | id: prog->aux->attach_btf_id)) { |
80 | *bpf_func = __cgroup_bpf_run_lsm_current; |
81 | return; |
82 | } |
83 | |
84 | #ifdef CONFIG_NET |
85 | args = btf_params(t: prog->aux->attach_func_proto); |
86 | |
87 | if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCKET]) |
88 | *bpf_func = __cgroup_bpf_run_lsm_socket; |
89 | else if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCK]) |
90 | *bpf_func = __cgroup_bpf_run_lsm_sock; |
91 | else |
92 | #endif |
93 | *bpf_func = __cgroup_bpf_run_lsm_current; |
94 | } |
95 | #endif |
96 | |
97 | int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, |
98 | const struct bpf_prog *prog) |
99 | { |
100 | if (!prog->gpl_compatible) { |
101 | bpf_log(log: vlog, |
102 | fmt: "LSM programs must have a GPL compatible license\n" ); |
103 | return -EINVAL; |
104 | } |
105 | |
106 | if (!btf_id_set_contains(set: &bpf_lsm_hooks, id: prog->aux->attach_btf_id)) { |
107 | bpf_log(log: vlog, fmt: "attach_btf_id %u points to wrong type name %s\n" , |
108 | prog->aux->attach_btf_id, prog->aux->attach_func_name); |
109 | return -EINVAL; |
110 | } |
111 | |
112 | return 0; |
113 | } |
114 | |
115 | /* Mask for all the currently supported BPRM option flags */ |
116 | #define BPF_F_BRPM_OPTS_MASK BPF_F_BPRM_SECUREEXEC |
117 | |
118 | BPF_CALL_2(bpf_bprm_opts_set, struct linux_binprm *, bprm, u64, flags) |
119 | { |
120 | if (flags & ~BPF_F_BRPM_OPTS_MASK) |
121 | return -EINVAL; |
122 | |
123 | bprm->secureexec = (flags & BPF_F_BPRM_SECUREEXEC); |
124 | return 0; |
125 | } |
126 | |
127 | BTF_ID_LIST_SINGLE(bpf_bprm_opts_set_btf_ids, struct, linux_binprm) |
128 | |
129 | static const struct bpf_func_proto bpf_bprm_opts_set_proto = { |
130 | .func = bpf_bprm_opts_set, |
131 | .gpl_only = false, |
132 | .ret_type = RET_INTEGER, |
133 | .arg1_type = ARG_PTR_TO_BTF_ID, |
134 | .arg1_btf_id = &bpf_bprm_opts_set_btf_ids[0], |
135 | .arg2_type = ARG_ANYTHING, |
136 | }; |
137 | |
138 | BPF_CALL_3(bpf_ima_inode_hash, struct inode *, inode, void *, dst, u32, size) |
139 | { |
140 | return ima_inode_hash(inode, buf: dst, buf_size: size); |
141 | } |
142 | |
143 | static bool bpf_ima_inode_hash_allowed(const struct bpf_prog *prog) |
144 | { |
145 | return bpf_lsm_is_sleepable_hook(btf_id: prog->aux->attach_btf_id); |
146 | } |
147 | |
148 | BTF_ID_LIST_SINGLE(bpf_ima_inode_hash_btf_ids, struct, inode) |
149 | |
150 | static const struct bpf_func_proto bpf_ima_inode_hash_proto = { |
151 | .func = bpf_ima_inode_hash, |
152 | .gpl_only = false, |
153 | .might_sleep = true, |
154 | .ret_type = RET_INTEGER, |
155 | .arg1_type = ARG_PTR_TO_BTF_ID, |
156 | .arg1_btf_id = &bpf_ima_inode_hash_btf_ids[0], |
157 | .arg2_type = ARG_PTR_TO_UNINIT_MEM, |
158 | .arg3_type = ARG_CONST_SIZE, |
159 | .allowed = bpf_ima_inode_hash_allowed, |
160 | }; |
161 | |
162 | BPF_CALL_3(bpf_ima_file_hash, struct file *, file, void *, dst, u32, size) |
163 | { |
164 | return ima_file_hash(file, buf: dst, buf_size: size); |
165 | } |
166 | |
167 | BTF_ID_LIST_SINGLE(bpf_ima_file_hash_btf_ids, struct, file) |
168 | |
169 | static const struct bpf_func_proto bpf_ima_file_hash_proto = { |
170 | .func = bpf_ima_file_hash, |
171 | .gpl_only = false, |
172 | .might_sleep = true, |
173 | .ret_type = RET_INTEGER, |
174 | .arg1_type = ARG_PTR_TO_BTF_ID, |
175 | .arg1_btf_id = &bpf_ima_file_hash_btf_ids[0], |
176 | .arg2_type = ARG_PTR_TO_UNINIT_MEM, |
177 | .arg3_type = ARG_CONST_SIZE, |
178 | .allowed = bpf_ima_inode_hash_allowed, |
179 | }; |
180 | |
181 | BPF_CALL_1(bpf_get_attach_cookie, void *, ctx) |
182 | { |
183 | struct bpf_trace_run_ctx *run_ctx; |
184 | |
185 | run_ctx = container_of(current->bpf_ctx, struct bpf_trace_run_ctx, run_ctx); |
186 | return run_ctx->bpf_cookie; |
187 | } |
188 | |
189 | static const struct bpf_func_proto bpf_get_attach_cookie_proto = { |
190 | .func = bpf_get_attach_cookie, |
191 | .gpl_only = false, |
192 | .ret_type = RET_INTEGER, |
193 | .arg1_type = ARG_PTR_TO_CTX, |
194 | }; |
195 | |
196 | static const struct bpf_func_proto * |
197 | bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) |
198 | { |
199 | const struct bpf_func_proto *func_proto; |
200 | |
201 | if (prog->expected_attach_type == BPF_LSM_CGROUP) { |
202 | func_proto = cgroup_common_func_proto(func_id, prog); |
203 | if (func_proto) |
204 | return func_proto; |
205 | } |
206 | |
207 | switch (func_id) { |
208 | case BPF_FUNC_inode_storage_get: |
209 | return &bpf_inode_storage_get_proto; |
210 | case BPF_FUNC_inode_storage_delete: |
211 | return &bpf_inode_storage_delete_proto; |
212 | #ifdef CONFIG_NET |
213 | case BPF_FUNC_sk_storage_get: |
214 | return &bpf_sk_storage_get_proto; |
215 | case BPF_FUNC_sk_storage_delete: |
216 | return &bpf_sk_storage_delete_proto; |
217 | #endif /* CONFIG_NET */ |
218 | case BPF_FUNC_spin_lock: |
219 | return &bpf_spin_lock_proto; |
220 | case BPF_FUNC_spin_unlock: |
221 | return &bpf_spin_unlock_proto; |
222 | case BPF_FUNC_bprm_opts_set: |
223 | return &bpf_bprm_opts_set_proto; |
224 | case BPF_FUNC_ima_inode_hash: |
225 | return &bpf_ima_inode_hash_proto; |
226 | case BPF_FUNC_ima_file_hash: |
227 | return &bpf_ima_file_hash_proto; |
228 | case BPF_FUNC_get_attach_cookie: |
229 | return bpf_prog_has_trampoline(prog) ? &bpf_get_attach_cookie_proto : NULL; |
230 | #ifdef CONFIG_NET |
231 | case BPF_FUNC_setsockopt: |
232 | if (prog->expected_attach_type != BPF_LSM_CGROUP) |
233 | return NULL; |
234 | if (btf_id_set_contains(set: &bpf_lsm_locked_sockopt_hooks, |
235 | id: prog->aux->attach_btf_id)) |
236 | return &bpf_sk_setsockopt_proto; |
237 | if (btf_id_set_contains(set: &bpf_lsm_unlocked_sockopt_hooks, |
238 | id: prog->aux->attach_btf_id)) |
239 | return &bpf_unlocked_sk_setsockopt_proto; |
240 | return NULL; |
241 | case BPF_FUNC_getsockopt: |
242 | if (prog->expected_attach_type != BPF_LSM_CGROUP) |
243 | return NULL; |
244 | if (btf_id_set_contains(set: &bpf_lsm_locked_sockopt_hooks, |
245 | id: prog->aux->attach_btf_id)) |
246 | return &bpf_sk_getsockopt_proto; |
247 | if (btf_id_set_contains(set: &bpf_lsm_unlocked_sockopt_hooks, |
248 | id: prog->aux->attach_btf_id)) |
249 | return &bpf_unlocked_sk_getsockopt_proto; |
250 | return NULL; |
251 | #endif |
252 | default: |
253 | return tracing_prog_func_proto(func_id, prog); |
254 | } |
255 | } |
256 | |
257 | /* The set of hooks which are called without pagefaults disabled and are allowed |
258 | * to "sleep" and thus can be used for sleepable BPF programs. |
259 | */ |
260 | BTF_SET_START(sleepable_lsm_hooks) |
261 | BTF_ID(func, bpf_lsm_bpf) |
262 | BTF_ID(func, bpf_lsm_bpf_map) |
263 | BTF_ID(func, bpf_lsm_bpf_map_create) |
264 | BTF_ID(func, bpf_lsm_bpf_map_free) |
265 | BTF_ID(func, bpf_lsm_bpf_prog) |
266 | BTF_ID(func, bpf_lsm_bpf_prog_load) |
267 | BTF_ID(func, bpf_lsm_bpf_prog_free) |
268 | BTF_ID(func, bpf_lsm_bpf_token_create) |
269 | BTF_ID(func, bpf_lsm_bpf_token_free) |
270 | BTF_ID(func, bpf_lsm_bpf_token_cmd) |
271 | BTF_ID(func, bpf_lsm_bpf_token_capable) |
272 | BTF_ID(func, bpf_lsm_bprm_check_security) |
273 | BTF_ID(func, bpf_lsm_bprm_committed_creds) |
274 | BTF_ID(func, bpf_lsm_bprm_committing_creds) |
275 | BTF_ID(func, bpf_lsm_bprm_creds_for_exec) |
276 | BTF_ID(func, bpf_lsm_bprm_creds_from_file) |
277 | BTF_ID(func, bpf_lsm_capget) |
278 | BTF_ID(func, bpf_lsm_capset) |
279 | BTF_ID(func, bpf_lsm_cred_prepare) |
280 | BTF_ID(func, bpf_lsm_file_ioctl) |
281 | BTF_ID(func, bpf_lsm_file_lock) |
282 | BTF_ID(func, bpf_lsm_file_open) |
283 | BTF_ID(func, bpf_lsm_file_receive) |
284 | |
285 | BTF_ID(func, bpf_lsm_inode_create) |
286 | BTF_ID(func, bpf_lsm_inode_free_security) |
287 | BTF_ID(func, bpf_lsm_inode_getattr) |
288 | BTF_ID(func, bpf_lsm_inode_getxattr) |
289 | BTF_ID(func, bpf_lsm_inode_mknod) |
290 | BTF_ID(func, bpf_lsm_inode_need_killpriv) |
291 | BTF_ID(func, bpf_lsm_inode_post_setxattr) |
292 | BTF_ID(func, bpf_lsm_inode_readlink) |
293 | BTF_ID(func, bpf_lsm_inode_rename) |
294 | BTF_ID(func, bpf_lsm_inode_rmdir) |
295 | BTF_ID(func, bpf_lsm_inode_setattr) |
296 | BTF_ID(func, bpf_lsm_inode_setxattr) |
297 | BTF_ID(func, bpf_lsm_inode_symlink) |
298 | BTF_ID(func, bpf_lsm_inode_unlink) |
299 | BTF_ID(func, bpf_lsm_kernel_module_request) |
300 | BTF_ID(func, bpf_lsm_kernel_read_file) |
301 | BTF_ID(func, bpf_lsm_kernfs_init_security) |
302 | |
303 | #ifdef CONFIG_SECURITY_PATH |
304 | BTF_ID(func, bpf_lsm_path_unlink) |
305 | BTF_ID(func, bpf_lsm_path_mkdir) |
306 | BTF_ID(func, bpf_lsm_path_rmdir) |
307 | BTF_ID(func, bpf_lsm_path_truncate) |
308 | BTF_ID(func, bpf_lsm_path_symlink) |
309 | BTF_ID(func, bpf_lsm_path_link) |
310 | BTF_ID(func, bpf_lsm_path_rename) |
311 | BTF_ID(func, bpf_lsm_path_chmod) |
312 | BTF_ID(func, bpf_lsm_path_chown) |
313 | #endif /* CONFIG_SECURITY_PATH */ |
314 | |
315 | #ifdef CONFIG_KEYS |
316 | BTF_ID(func, bpf_lsm_key_free) |
317 | #endif /* CONFIG_KEYS */ |
318 | |
319 | BTF_ID(func, bpf_lsm_mmap_file) |
320 | BTF_ID(func, bpf_lsm_netlink_send) |
321 | BTF_ID(func, bpf_lsm_path_notify) |
322 | BTF_ID(func, bpf_lsm_release_secctx) |
323 | BTF_ID(func, bpf_lsm_sb_alloc_security) |
324 | BTF_ID(func, bpf_lsm_sb_eat_lsm_opts) |
325 | BTF_ID(func, bpf_lsm_sb_kern_mount) |
326 | BTF_ID(func, bpf_lsm_sb_mount) |
327 | BTF_ID(func, bpf_lsm_sb_remount) |
328 | BTF_ID(func, bpf_lsm_sb_set_mnt_opts) |
329 | BTF_ID(func, bpf_lsm_sb_show_options) |
330 | BTF_ID(func, bpf_lsm_sb_statfs) |
331 | BTF_ID(func, bpf_lsm_sb_umount) |
332 | BTF_ID(func, bpf_lsm_settime) |
333 | |
334 | #ifdef CONFIG_SECURITY_NETWORK |
335 | BTF_ID(func, bpf_lsm_inet_conn_established) |
336 | |
337 | BTF_ID(func, bpf_lsm_socket_accept) |
338 | BTF_ID(func, bpf_lsm_socket_bind) |
339 | BTF_ID(func, bpf_lsm_socket_connect) |
340 | BTF_ID(func, bpf_lsm_socket_create) |
341 | BTF_ID(func, bpf_lsm_socket_getpeername) |
342 | BTF_ID(func, bpf_lsm_socket_getpeersec_dgram) |
343 | BTF_ID(func, bpf_lsm_socket_getsockname) |
344 | BTF_ID(func, bpf_lsm_socket_getsockopt) |
345 | BTF_ID(func, bpf_lsm_socket_listen) |
346 | BTF_ID(func, bpf_lsm_socket_post_create) |
347 | BTF_ID(func, bpf_lsm_socket_recvmsg) |
348 | BTF_ID(func, bpf_lsm_socket_sendmsg) |
349 | BTF_ID(func, bpf_lsm_socket_shutdown) |
350 | BTF_ID(func, bpf_lsm_socket_socketpair) |
351 | #endif /* CONFIG_SECURITY_NETWORK */ |
352 | |
353 | BTF_ID(func, bpf_lsm_syslog) |
354 | BTF_ID(func, bpf_lsm_task_alloc) |
355 | BTF_ID(func, bpf_lsm_current_getsecid_subj) |
356 | BTF_ID(func, bpf_lsm_task_getsecid_obj) |
357 | BTF_ID(func, bpf_lsm_task_prctl) |
358 | BTF_ID(func, bpf_lsm_task_setscheduler) |
359 | BTF_ID(func, bpf_lsm_task_to_inode) |
360 | BTF_ID(func, bpf_lsm_userns_create) |
361 | BTF_SET_END(sleepable_lsm_hooks) |
362 | |
363 | BTF_SET_START(untrusted_lsm_hooks) |
364 | BTF_ID(func, bpf_lsm_bpf_map_free) |
365 | BTF_ID(func, bpf_lsm_bpf_prog_free) |
366 | BTF_ID(func, bpf_lsm_file_alloc_security) |
367 | BTF_ID(func, bpf_lsm_file_free_security) |
368 | #ifdef CONFIG_SECURITY_NETWORK |
369 | BTF_ID(func, bpf_lsm_sk_alloc_security) |
370 | BTF_ID(func, bpf_lsm_sk_free_security) |
371 | #endif /* CONFIG_SECURITY_NETWORK */ |
372 | BTF_ID(func, bpf_lsm_task_free) |
373 | BTF_SET_END(untrusted_lsm_hooks) |
374 | |
375 | bool bpf_lsm_is_sleepable_hook(u32 btf_id) |
376 | { |
377 | return btf_id_set_contains(set: &sleepable_lsm_hooks, id: btf_id); |
378 | } |
379 | |
380 | bool bpf_lsm_is_trusted(const struct bpf_prog *prog) |
381 | { |
382 | return !btf_id_set_contains(set: &untrusted_lsm_hooks, id: prog->aux->attach_btf_id); |
383 | } |
384 | |
385 | const struct bpf_prog_ops lsm_prog_ops = { |
386 | }; |
387 | |
388 | const struct bpf_verifier_ops lsm_verifier_ops = { |
389 | .get_func_proto = bpf_lsm_func_proto, |
390 | .is_valid_access = btf_ctx_access, |
391 | }; |
392 | |