1 // SPDX-License-Identifier: GPL-2.0
2
3 /*
4 * Copyright (C) 2020 Google LLC.
5 */
6
7 #include <linux/filter.h>
8 #include <linux/bpf.h>
9 #include <linux/btf.h>
10 #include <linux/binfmts.h>
11 #include <linux/lsm_hooks.h>
12 #include <linux/bpf_lsm.h>
13 #include <linux/kallsyms.h>
14 #include <linux/bpf_verifier.h>
15 #include <net/bpf_sk_storage.h>
16 #include <linux/bpf_local_storage.h>
17 #include <linux/btf_ids.h>
18 #include <linux/ima.h>
19
20 /* For every LSM hook that allows attachment of BPF programs, declare a nop
21 * function where a BPF program can be attached.
22 */
23 #define LSM_HOOK(RET, DEFAULT, NAME, ...) \
24 noinline RET bpf_lsm_##NAME(__VA_ARGS__) \
25 { \
26 return DEFAULT; \
27 }
28
29 #include <linux/lsm_hook_defs.h>
30 #undef LSM_HOOK
31
32 #define LSM_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME)
33 BTF_SET_START(bpf_lsm_hooks)
34 #include <linux/lsm_hook_defs.h>
35 #undef LSM_HOOK
BTF_SET_END(bpf_lsm_hooks)36 BTF_SET_END(bpf_lsm_hooks)
37
38 int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
39 const struct bpf_prog *prog)
40 {
41 if (!prog->gpl_compatible) {
42 bpf_log(vlog,
43 "LSM programs must have a GPL compatible license\n");
44 return -EINVAL;
45 }
46
47 if (!btf_id_set_contains(&bpf_lsm_hooks, prog->aux->attach_btf_id)) {
48 bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n",
49 prog->aux->attach_btf_id, prog->aux->attach_func_name);
50 return -EINVAL;
51 }
52
53 return 0;
54 }
55
56 /* Mask for all the currently supported BPRM option flags */
57 #define BPF_F_BRPM_OPTS_MASK BPF_F_BPRM_SECUREEXEC
58
BPF_CALL_2(bpf_bprm_opts_set,struct linux_binprm *,bprm,u64,flags)59 BPF_CALL_2(bpf_bprm_opts_set, struct linux_binprm *, bprm, u64, flags)
60 {
61 if (flags & ~BPF_F_BRPM_OPTS_MASK)
62 return -EINVAL;
63
64 bprm->secureexec = (flags & BPF_F_BPRM_SECUREEXEC);
65 return 0;
66 }
67
68 BTF_ID_LIST_SINGLE(bpf_bprm_opts_set_btf_ids, struct, linux_binprm)
69
70 static const struct bpf_func_proto bpf_bprm_opts_set_proto = {
71 .func = bpf_bprm_opts_set,
72 .gpl_only = false,
73 .ret_type = RET_INTEGER,
74 .arg1_type = ARG_PTR_TO_BTF_ID,
75 .arg1_btf_id = &bpf_bprm_opts_set_btf_ids[0],
76 .arg2_type = ARG_ANYTHING,
77 };
78
BPF_CALL_3(bpf_ima_inode_hash,struct inode *,inode,void *,dst,u32,size)79 BPF_CALL_3(bpf_ima_inode_hash, struct inode *, inode, void *, dst, u32, size)
80 {
81 return ima_inode_hash(inode, dst, size);
82 }
83
bpf_ima_inode_hash_allowed(const struct bpf_prog * prog)84 static bool bpf_ima_inode_hash_allowed(const struct bpf_prog *prog)
85 {
86 return bpf_lsm_is_sleepable_hook(prog->aux->attach_btf_id);
87 }
88
89 BTF_ID_LIST_SINGLE(bpf_ima_inode_hash_btf_ids, struct, inode)
90
91 static const struct bpf_func_proto bpf_ima_inode_hash_proto = {
92 .func = bpf_ima_inode_hash,
93 .gpl_only = false,
94 .ret_type = RET_INTEGER,
95 .arg1_type = ARG_PTR_TO_BTF_ID,
96 .arg1_btf_id = &bpf_ima_inode_hash_btf_ids[0],
97 .arg2_type = ARG_PTR_TO_UNINIT_MEM,
98 .arg3_type = ARG_CONST_SIZE,
99 .allowed = bpf_ima_inode_hash_allowed,
100 };
101
102 static const struct bpf_func_proto *
bpf_lsm_func_proto(enum bpf_func_id func_id,const struct bpf_prog * prog)103 bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
104 {
105 switch (func_id) {
106 case BPF_FUNC_inode_storage_get:
107 return &bpf_inode_storage_get_proto;
108 case BPF_FUNC_inode_storage_delete:
109 return &bpf_inode_storage_delete_proto;
110 #ifdef CONFIG_NET
111 case BPF_FUNC_sk_storage_get:
112 return &bpf_sk_storage_get_proto;
113 case BPF_FUNC_sk_storage_delete:
114 return &bpf_sk_storage_delete_proto;
115 #endif /* CONFIG_NET */
116 case BPF_FUNC_spin_lock:
117 return &bpf_spin_lock_proto;
118 case BPF_FUNC_spin_unlock:
119 return &bpf_spin_unlock_proto;
120 case BPF_FUNC_bprm_opts_set:
121 return &bpf_bprm_opts_set_proto;
122 case BPF_FUNC_ima_inode_hash:
123 return prog->aux->sleepable ? &bpf_ima_inode_hash_proto : NULL;
124 default:
125 return tracing_prog_func_proto(func_id, prog);
126 }
127 }
128
129 /* The set of hooks which are called without pagefaults disabled and are allowed
130 * to "sleep" and thus can be used for sleepable BPF programs.
131 */
132 BTF_SET_START(sleepable_lsm_hooks)
BTF_ID(func,bpf_lsm_bpf)133 BTF_ID(func, bpf_lsm_bpf)
134 BTF_ID(func, bpf_lsm_bpf_map)
135 BTF_ID(func, bpf_lsm_bpf_map_alloc_security)
136 BTF_ID(func, bpf_lsm_bpf_map_free_security)
137 BTF_ID(func, bpf_lsm_bpf_prog)
138 BTF_ID(func, bpf_lsm_bprm_check_security)
139 BTF_ID(func, bpf_lsm_bprm_committed_creds)
140 BTF_ID(func, bpf_lsm_bprm_committing_creds)
141 BTF_ID(func, bpf_lsm_bprm_creds_for_exec)
142 BTF_ID(func, bpf_lsm_bprm_creds_from_file)
143 BTF_ID(func, bpf_lsm_capget)
144 BTF_ID(func, bpf_lsm_capset)
145 BTF_ID(func, bpf_lsm_cred_prepare)
146 BTF_ID(func, bpf_lsm_file_ioctl)
147 BTF_ID(func, bpf_lsm_file_lock)
148 BTF_ID(func, bpf_lsm_file_open)
149 BTF_ID(func, bpf_lsm_file_receive)
150
151 #ifdef CONFIG_SECURITY_NETWORK
152 BTF_ID(func, bpf_lsm_inet_conn_established)
153 #endif /* CONFIG_SECURITY_NETWORK */
154
155 BTF_ID(func, bpf_lsm_inode_create)
156 BTF_ID(func, bpf_lsm_inode_free_security)
157 BTF_ID(func, bpf_lsm_inode_getattr)
158 BTF_ID(func, bpf_lsm_inode_getxattr)
159 BTF_ID(func, bpf_lsm_inode_mknod)
160 BTF_ID(func, bpf_lsm_inode_need_killpriv)
161 BTF_ID(func, bpf_lsm_inode_post_setxattr)
162 BTF_ID(func, bpf_lsm_inode_readlink)
163 BTF_ID(func, bpf_lsm_inode_rename)
164 BTF_ID(func, bpf_lsm_inode_rmdir)
165 BTF_ID(func, bpf_lsm_inode_setattr)
166 BTF_ID(func, bpf_lsm_inode_setxattr)
167 BTF_ID(func, bpf_lsm_inode_symlink)
168 BTF_ID(func, bpf_lsm_inode_unlink)
169 BTF_ID(func, bpf_lsm_kernel_module_request)
170 BTF_ID(func, bpf_lsm_kernfs_init_security)
171
172 #ifdef CONFIG_KEYS
173 BTF_ID(func, bpf_lsm_key_free)
174 #endif /* CONFIG_KEYS */
175
176 BTF_ID(func, bpf_lsm_mmap_file)
177 BTF_ID(func, bpf_lsm_netlink_send)
178 BTF_ID(func, bpf_lsm_path_notify)
179 BTF_ID(func, bpf_lsm_release_secctx)
180 BTF_ID(func, bpf_lsm_sb_alloc_security)
181 BTF_ID(func, bpf_lsm_sb_eat_lsm_opts)
182 BTF_ID(func, bpf_lsm_sb_kern_mount)
183 BTF_ID(func, bpf_lsm_sb_mount)
184 BTF_ID(func, bpf_lsm_sb_remount)
185 BTF_ID(func, bpf_lsm_sb_set_mnt_opts)
186 BTF_ID(func, bpf_lsm_sb_show_options)
187 BTF_ID(func, bpf_lsm_sb_statfs)
188 BTF_ID(func, bpf_lsm_sb_umount)
189 BTF_ID(func, bpf_lsm_settime)
190
191 #ifdef CONFIG_SECURITY_NETWORK
192 BTF_ID(func, bpf_lsm_socket_accept)
193 BTF_ID(func, bpf_lsm_socket_bind)
194 BTF_ID(func, bpf_lsm_socket_connect)
195 BTF_ID(func, bpf_lsm_socket_create)
196 BTF_ID(func, bpf_lsm_socket_getpeername)
197 BTF_ID(func, bpf_lsm_socket_getpeersec_dgram)
198 BTF_ID(func, bpf_lsm_socket_getsockname)
199 BTF_ID(func, bpf_lsm_socket_getsockopt)
200 BTF_ID(func, bpf_lsm_socket_listen)
201 BTF_ID(func, bpf_lsm_socket_post_create)
202 BTF_ID(func, bpf_lsm_socket_recvmsg)
203 BTF_ID(func, bpf_lsm_socket_sendmsg)
204 BTF_ID(func, bpf_lsm_socket_shutdown)
205 BTF_ID(func, bpf_lsm_socket_socketpair)
206 #endif /* CONFIG_SECURITY_NETWORK */
207
208 BTF_ID(func, bpf_lsm_syslog)
209 BTF_ID(func, bpf_lsm_task_alloc)
210 BTF_ID(func, bpf_lsm_task_getsecid_subj)
211 BTF_ID(func, bpf_lsm_task_getsecid_obj)
212 BTF_ID(func, bpf_lsm_task_prctl)
213 BTF_ID(func, bpf_lsm_task_setscheduler)
214 BTF_ID(func, bpf_lsm_task_to_inode)
215 BTF_SET_END(sleepable_lsm_hooks)
216
217 bool bpf_lsm_is_sleepable_hook(u32 btf_id)
218 {
219 return btf_id_set_contains(&sleepable_lsm_hooks, btf_id);
220 }
221
222 const struct bpf_prog_ops lsm_prog_ops = {
223 };
224
225 const struct bpf_verifier_ops lsm_verifier_ops = {
226 .get_func_proto = bpf_lsm_func_proto,
227 .is_valid_access = btf_ctx_access,
228 };
229