bpf: Introduce BPF_PROG_TYPE_LSM

Introduce types and configs for bpf programs that can be attached to
LSM hooks. The programs can be enabled by the config option
CONFIG_BPF_LSM.

Signed-off-by: KP Singh <kpsingh@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Brendan Jackman <jackmanb@google.com>
Reviewed-by: Florent Revest <revest@google.com>
Reviewed-by: Thomas Garnier <thgarnie@google.com>
Acked-by: Yonghong Song <yhs@fb.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Acked-by: James Morris <jamorris@linux.microsoft.com>
Link: https://lore.kernel.org/bpf/20200329004356.27286-2-kpsingh@chromium.org

diff --git a/MAINTAINERS b/MAINTAINERS
index 5dbee41045bc62fb986cb1ae61630cbab0e8519d..3197fe9256b2465c6f5cb2f61f1ddba00a087b05 100644 (file)
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3147,6 +3147,7 @@ R:        Martin KaFai Lau <kafai@fb.com>
 R:     Song Liu <songliubraving@fb.com>
 R:     Yonghong Song <yhs@fb.com>
 R:     Andrii Nakryiko <andriin@fb.com>
+R:     KP Singh <kpsingh@chromium.org>
 L:     netdev@vger.kernel.org
 L:     bpf@vger.kernel.org
 T:     git git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 372708eeaecdd9b375eaec6d7d92c04729845158..3bde59a8453b506ea245e6c62379744d32e0b173 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1515,6 +1515,9 @@ extern const struct bpf_func_proto bpf_tcp_sock_proto;
 extern const struct bpf_func_proto bpf_jiffies64_proto;
 extern const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto;
 
+const struct bpf_func_proto *bpf_tracing_func_proto(
+       enum bpf_func_id func_id, const struct bpf_prog *prog);
+
 /* Shared helpers among cBPF and eBPF. */
 void bpf_user_rnd_init_once(void);
 u64 bpf_user_rnd_u32(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);

diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h
index c81d4ece79a499d92a2b38276943f10c91821327..ba0c2d56f8a323ade0e95bfcfe6901ce77b3a05f 100644 (file)
--- a/include/linux/bpf_types.h
+++ b/include/linux/bpf_types.h
@@ -70,6 +70,10 @@ BPF_PROG_TYPE(BPF_PROG_TYPE_STRUCT_OPS, bpf_struct_ops,
              void *, void *)
 BPF_PROG_TYPE(BPF_PROG_TYPE_EXT, bpf_extension,
              void *, void *)
+#ifdef CONFIG_BPF_LSM
+BPF_PROG_TYPE(BPF_PROG_TYPE_LSM, lsm,
+              void *, void *)
+#endif /* CONFIG_BPF_LSM */
 #endif
 
 BPF_MAP_TYPE(BPF_MAP_TYPE_ARRAY, array_map_ops)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 222ba11966e3274ff414a2b0b51d52c027dad52f..f1fbc36f58d329e4ca4993eefbb49fae6d49118e 100644 (file)
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -181,6 +181,7 @@ enum bpf_prog_type {
        BPF_PROG_TYPE_TRACING,
        BPF_PROG_TYPE_STRUCT_OPS,
        BPF_PROG_TYPE_EXT,
+       BPF_PROG_TYPE_LSM,
 };
 
 enum bpf_attach_type {
@@ -211,6 +212,7 @@ enum bpf_attach_type {
        BPF_TRACE_FENTRY,
        BPF_TRACE_FEXIT,
        BPF_MODIFY_RETURN,
+       BPF_LSM_MAC,
        __MAX_BPF_ATTACH_TYPE
 };
 

diff --git a/init/Kconfig b/init/Kconfig
index 20a6ac33761c98a6bb7466d5ec1a5e476b1eddda..deae572d1927afaac3c164396980600de1d64b41 100644 (file)
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1616,6 +1616,18 @@ config KALLSYMS_BASE_RELATIVE
 # end of the "standard kernel features (expert users)" menu
 
 # syscall, maps, verifier
+
+config BPF_LSM
+       bool "LSM Instrumentation with BPF"
+       depends on BPF_SYSCALL
+       depends on SECURITY
+       depends on BPF_JIT
+       help
+         Enables instrumentation of the security hooks with eBPF programs for
+         implementing dynamic MAC and Audit Policies.
+
+         If you are unsure how to answer this question, answer N.
+
 config BPF_SYSCALL
        bool "Enable bpf() system call"
        select BPF

diff --git a/kernel/bpf/Makefile b/kernel/bpf/Makefile
index 046ce5d980331cbc4407e82b95fa25ddf45c7e9b..f2d7be596966eb3e889ba2cb6834d8e091fabe99 100644 (file)
--- a/kernel/bpf/Makefile
+++ b/kernel/bpf/Makefile
@@ -29,4 +29,5 @@ obj-$(CONFIG_DEBUG_INFO_BTF) += sysfs_btf.o
 endif
 ifeq ($(CONFIG_BPF_JIT),y)
 obj-$(CONFIG_BPF_SYSCALL) += bpf_struct_ops.o
+obj-${CONFIG_BPF_LSM} += bpf_lsm.o
 endif

diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
new file mode 100644 (file)
index 0000000..8287503
--- /dev/null
+++ b/kernel/bpf/bpf_lsm.c
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (C) 2020 Google LLC.
+ */
+
+#include <linux/filter.h>
+#include <linux/bpf.h>
+#include <linux/btf.h>
+
+const struct bpf_prog_ops lsm_prog_ops = {
+};
+
+const struct bpf_verifier_ops lsm_verifier_ops = {
+       .get_func_proto = bpf_tracing_func_proto,
+       .is_valid_access = btf_ctx_access,
+};

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index e619eedb591915997d93393a58d30d1aa2914952..37ffceab608f64767b0f10a86782d080688d5c05 100644 (file)
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -779,8 +779,8 @@ static const struct bpf_func_proto bpf_send_signal_thread_proto = {
        .arg1_type      = ARG_ANYTHING,
 };
 
-static const struct bpf_func_proto *
-tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
+const struct bpf_func_proto *
+bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
        switch (func_id) {
        case BPF_FUNC_map_lookup_elem:
@@ -865,7 +865,7 @@ kprobe_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
                return &bpf_override_return_proto;
 #endif
        default:
-               return tracing_func_proto(func_id, prog);
+               return bpf_tracing_func_proto(func_id, prog);
        }
 }
 
@@ -975,7 +975,7 @@ tp_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_get_stack:
                return &bpf_get_stack_proto_tp;
        default:
-               return tracing_func_proto(func_id, prog);
+               return bpf_tracing_func_proto(func_id, prog);
        }
 }
 
@@ -1082,7 +1082,7 @@ pe_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_read_branch_records:
                return &bpf_read_branch_records_proto;
        default:
-               return tracing_func_proto(func_id, prog);
+               return bpf_tracing_func_proto(func_id, prog);
        }
 }
 
@@ -1210,7 +1210,7 @@ raw_tp_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_get_stack:
                return &bpf_get_stack_proto_raw_tp;
        default:
-               return tracing_func_proto(func_id, prog);
+               return bpf_tracing_func_proto(func_id, prog);
        }
 }
 

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 222ba11966e3274ff414a2b0b51d52c027dad52f..f1fbc36f58d329e4ca4993eefbb49fae6d49118e 100644 (file)
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -181,6 +181,7 @@ enum bpf_prog_type {
        BPF_PROG_TYPE_TRACING,
        BPF_PROG_TYPE_STRUCT_OPS,
        BPF_PROG_TYPE_EXT,
+       BPF_PROG_TYPE_LSM,
 };
 
 enum bpf_attach_type {
@@ -211,6 +212,7 @@ enum bpf_attach_type {
        BPF_TRACE_FENTRY,
        BPF_TRACE_FEXIT,
        BPF_MODIFY_RETURN,
+       BPF_LSM_MAC,
        __MAX_BPF_ATTACH_TYPE
 };
 

diff --git a/tools/lib/bpf/libbpf_probes.c b/tools/lib/bpf/libbpf_probes.c
index b782ebef6ac9265269ab47db41b3584b1ef326ba..2c92059c0c90be791694ff54b9483230b248c337 100644 (file)
--- a/tools/lib/bpf/libbpf_probes.c
+++ b/tools/lib/bpf/libbpf_probes.c
@@ -108,6 +108,7 @@ probe_load(enum bpf_prog_type prog_type, const struct bpf_insn *insns,
        case BPF_PROG_TYPE_TRACING:
        case BPF_PROG_TYPE_STRUCT_OPS:
        case BPF_PROG_TYPE_EXT:
+       case BPF_PROG_TYPE_LSM:
        default:
                break;
        }