1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2024 Google LLC. */
3
4 #include <linux/binfmt_misc.h>
5 #include <linux/bpf.h>
6 #include <linux/bpf_lsm.h>
7 #include <linux/btf.h>
8 #include <linux/btf_ids.h>
9 #include <linux/dcache.h>
10 #include <linux/fs.h>
11 #include <linux/fsnotify.h>
12 #include <linux/file.h>
13 #include <linux/kernfs.h>
14 #include <linux/mm.h>
15 #include <linux/net.h>
16 #include <linux/xattr.h>
17
18 __bpf_kfunc_start_defs();
19
20 /**
21 * bpf_get_task_exe_file - get a reference on the exe_file struct file member of
22 * the mm_struct that is nested within the supplied
23 * task_struct
24 * @task: task_struct of which the nested mm_struct exe_file member to get a
25 * reference on
26 *
27 * Get a reference on the exe_file struct file member field of the mm_struct
28 * nested within the supplied *task*. The referenced file pointer acquired by
29 * this BPF kfunc must be released using bpf_put_file(). Failing to call
30 * bpf_put_file() on the returned referenced struct file pointer that has been
31 * acquired by this BPF kfunc will result in the BPF program being rejected by
32 * the BPF verifier.
33 *
34 * This BPF kfunc may only be called from BPF LSM programs.
35 *
36 * Internally, this BPF kfunc leans on get_task_exe_file(), such that calling
37 * bpf_get_task_exe_file() would be analogous to calling get_task_exe_file()
38 * directly in kernel context.
39 *
40 * Return: A referenced struct file pointer to the exe_file member of the
41 * mm_struct that is nested within the supplied *task*. On error, NULL is
42 * returned.
43 */
bpf_get_task_exe_file(struct task_struct * task)44 __bpf_kfunc struct file *bpf_get_task_exe_file(struct task_struct *task)
45 {
46 return get_task_exe_file(task);
47 }
48
49 /**
50 * bpf_put_file - put a reference on the supplied file
51 * @file: file to put a reference on
52 *
53 * Put a reference on the supplied *file*. Only referenced file pointers may be
54 * passed to this BPF kfunc. Attempting to pass an unreferenced file pointer, or
55 * any other arbitrary pointer for that matter, will result in the BPF program
56 * being rejected by the BPF verifier.
57 *
58 * This BPF kfunc may only be called from BPF LSM programs.
59 */
bpf_put_file(struct file * file)60 __bpf_kfunc void bpf_put_file(struct file *file)
61 {
62 fput(file);
63 }
64
65 /**
66 * bpf_path_d_path - resolve the pathname for the supplied path
67 * @path: path to resolve the pathname for
68 * @buf: buffer to return the resolved pathname in
69 * @buf__sz: length of the supplied buffer
70 *
71 * Resolve the pathname for the supplied *path* and store it in *buf*. This BPF
72 * kfunc is the safer variant of the legacy bpf_d_path() helper and should be
73 * used in place of bpf_d_path() whenever possible.
74 *
75 * This BPF kfunc may only be called from BPF LSM programs.
76 *
77 * Return: A positive integer corresponding to the length of the resolved
78 * pathname in *buf*, including the NUL termination character. On error, a
79 * negative integer is returned.
80 */
bpf_path_d_path(const struct path * path,char * buf,size_t buf__sz)81 __bpf_kfunc int bpf_path_d_path(const struct path *path, char *buf, size_t buf__sz)
82 {
83 int len;
84 char *ret;
85
86 if (!buf__sz)
87 return -EINVAL;
88
89 ret = d_path(path, buf, buf__sz);
90 if (IS_ERR(ret))
91 return PTR_ERR(ret);
92
93 len = buf + buf__sz - ret;
94 memmove(buf, ret, len);
95 return len;
96 }
97
match_security_bpf_prefix(const char * name__str)98 static bool match_security_bpf_prefix(const char *name__str)
99 {
100 return !strncmp(name__str, XATTR_NAME_BPF_LSM, XATTR_NAME_BPF_LSM_LEN);
101 }
102
bpf_xattr_read_permission(const char * name,struct inode * inode)103 static int bpf_xattr_read_permission(const char *name, struct inode *inode)
104 {
105 if (!inode)
106 return -EINVAL;
107
108 /* Allow reading xattr with user. and security.bpf. prefix */
109 if (strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) &&
110 !match_security_bpf_prefix(name))
111 return -EPERM;
112
113 return inode_permission(&nop_mnt_idmap, inode, MAY_READ);
114 }
115
116 /**
117 * bpf_get_dentry_xattr - get xattr of a dentry
118 * @dentry: dentry to get xattr from
119 * @name__str: name of the xattr
120 * @value_p: output buffer of the xattr value
121 *
122 * Get xattr *name__str* of *dentry* and store the output in *value_ptr*.
123 *
124 * For security reasons, only *name__str* with prefixes "user." or
125 * "security.bpf." are allowed.
126 *
127 * Return: length of the xattr value on success, a negative value on error.
128 */
bpf_get_dentry_xattr(struct dentry * dentry,const char * name__str,struct bpf_dynptr * value_p)129 __bpf_kfunc int bpf_get_dentry_xattr(struct dentry *dentry, const char *name__str,
130 struct bpf_dynptr *value_p)
131 {
132 struct bpf_dynptr_kern *value_ptr = (struct bpf_dynptr_kern *)value_p;
133 struct inode *inode = d_inode(dentry);
134 u32 value_len;
135 void *value;
136 int ret;
137
138 value_len = __bpf_dynptr_size(value_ptr);
139 value = __bpf_dynptr_data_rw(value_ptr, value_len);
140 if (!value)
141 return -EINVAL;
142
143 ret = bpf_xattr_read_permission(name__str, inode);
144 if (ret)
145 return ret;
146 return __vfs_getxattr(dentry, inode, name__str, value, value_len);
147 }
148
149 /**
150 * bpf_get_file_xattr - get xattr of a file
151 * @file: file to get xattr from
152 * @name__str: name of the xattr
153 * @value_p: output buffer of the xattr value
154 *
155 * Get xattr *name__str* of *file* and store the output in *value_ptr*.
156 *
157 * For security reasons, only *name__str* with prefixes "user." or
158 * "security.bpf." are allowed.
159 *
160 * Return: length of the xattr value on success, a negative value on error.
161 */
bpf_get_file_xattr(struct file * file,const char * name__str,struct bpf_dynptr * value_p)162 __bpf_kfunc int bpf_get_file_xattr(struct file *file, const char *name__str,
163 struct bpf_dynptr *value_p)
164 {
165 struct dentry *dentry;
166
167 dentry = file_dentry(file);
168 return bpf_get_dentry_xattr(dentry, name__str, value_p);
169 }
170
171 __bpf_kfunc_end_defs();
172
bpf_xattr_write_permission(const char * name,struct inode * inode)173 static int bpf_xattr_write_permission(const char *name, struct inode *inode)
174 {
175 if (!inode)
176 return -EINVAL;
177
178 /* Only allow setting and removing security.bpf. xattrs */
179 if (!match_security_bpf_prefix(name))
180 return -EPERM;
181
182 return inode_permission(&nop_mnt_idmap, inode, MAY_WRITE);
183 }
184
185 /**
186 * bpf_set_dentry_xattr_locked - set a xattr of a dentry
187 * @dentry: dentry to get xattr from
188 * @name__str: name of the xattr
189 * @value_p: xattr value
190 * @flags: flags to pass into filesystem operations
191 *
192 * Set xattr *name__str* of *dentry* to the value in *value_ptr*.
193 *
194 * For security reasons, only *name__str* with prefix "security.bpf."
195 * is allowed.
196 *
197 * The caller already locked dentry->d_inode.
198 *
199 * Return: 0 on success, a negative value on error.
200 */
bpf_set_dentry_xattr_locked(struct dentry * dentry,const char * name__str,const struct bpf_dynptr * value_p,int flags)201 int bpf_set_dentry_xattr_locked(struct dentry *dentry, const char *name__str,
202 const struct bpf_dynptr *value_p, int flags)
203 {
204
205 const struct bpf_dynptr_kern *value_ptr = (struct bpf_dynptr_kern *)value_p;
206 struct inode *inode = d_inode(dentry);
207 const void *value;
208 u32 value_len;
209 int ret;
210
211 value_len = __bpf_dynptr_size(value_ptr);
212 value = __bpf_dynptr_data(value_ptr, value_len);
213 if (!value)
214 return -EINVAL;
215
216 ret = bpf_xattr_write_permission(name__str, inode);
217 if (ret)
218 return ret;
219
220 ret = __vfs_setxattr(&nop_mnt_idmap, dentry, inode, name__str,
221 value, value_len, flags);
222 if (!ret) {
223 fsnotify_xattr(dentry);
224
225 /* This xattr is set by BPF LSM, so we do not call
226 * security_inode_post_setxattr. Otherwise, we would
227 * risk deadlocks by calling back to the same kfunc.
228 *
229 * This is the same as security_inode_setsecurity().
230 */
231 }
232 return ret;
233 }
234
235 /**
236 * bpf_remove_dentry_xattr_locked - remove a xattr of a dentry
237 * @dentry: dentry to get xattr from
238 * @name__str: name of the xattr
239 *
240 * Rmove xattr *name__str* of *dentry*.
241 *
242 * For security reasons, only *name__str* with prefix "security.bpf."
243 * is allowed.
244 *
245 * The caller already locked dentry->d_inode.
246 *
247 * Return: 0 on success, a negative value on error.
248 */
bpf_remove_dentry_xattr_locked(struct dentry * dentry,const char * name__str)249 int bpf_remove_dentry_xattr_locked(struct dentry *dentry, const char *name__str)
250 {
251 struct inode *inode = d_inode(dentry);
252 int ret;
253
254 ret = bpf_xattr_write_permission(name__str, inode);
255 if (ret)
256 return ret;
257
258 ret = __vfs_removexattr(&nop_mnt_idmap, dentry, name__str);
259 if (!ret) {
260 fsnotify_xattr(dentry);
261
262 /* This xattr is removed by BPF LSM, so we do not call
263 * security_inode_post_removexattr. Otherwise, we would
264 * risk deadlocks by calling back to the same kfunc.
265 */
266 }
267 return ret;
268 }
269
270 __bpf_kfunc_start_defs();
271
272 /**
273 * bpf_set_dentry_xattr - set a xattr of a dentry
274 * @dentry: dentry to get xattr from
275 * @name__str: name of the xattr
276 * @value_p: xattr value
277 * @flags: flags to pass into filesystem operations
278 *
279 * Set xattr *name__str* of *dentry* to the value in *value_ptr*.
280 *
281 * For security reasons, only *name__str* with prefix "security.bpf."
282 * is allowed.
283 *
284 * The caller has not locked dentry->d_inode.
285 *
286 * Return: 0 on success, a negative value on error.
287 */
bpf_set_dentry_xattr(struct dentry * dentry,const char * name__str,const struct bpf_dynptr * value_p,int flags)288 __bpf_kfunc int bpf_set_dentry_xattr(struct dentry *dentry, const char *name__str,
289 const struct bpf_dynptr *value_p, int flags)
290 {
291 struct inode *inode = d_inode(dentry);
292 int ret;
293
294 if (!inode)
295 return -EINVAL;
296
297 inode_lock(inode);
298 ret = bpf_set_dentry_xattr_locked(dentry, name__str, value_p, flags);
299 inode_unlock(inode);
300 return ret;
301 }
302
303 /**
304 * bpf_remove_dentry_xattr - remove a xattr of a dentry
305 * @dentry: dentry to get xattr from
306 * @name__str: name of the xattr
307 *
308 * Rmove xattr *name__str* of *dentry*.
309 *
310 * For security reasons, only *name__str* with prefix "security.bpf."
311 * is allowed.
312 *
313 * The caller has not locked dentry->d_inode.
314 *
315 * Return: 0 on success, a negative value on error.
316 */
bpf_remove_dentry_xattr(struct dentry * dentry,const char * name__str)317 __bpf_kfunc int bpf_remove_dentry_xattr(struct dentry *dentry, const char *name__str)
318 {
319 struct inode *inode = d_inode(dentry);
320 int ret;
321
322 if (!inode)
323 return -EINVAL;
324
325 inode_lock(inode);
326 ret = bpf_remove_dentry_xattr_locked(dentry, name__str);
327 inode_unlock(inode);
328 return ret;
329 }
330
331 #ifdef CONFIG_CGROUPS
332 /**
333 * bpf_cgroup_read_xattr - read xattr of a cgroup's node in cgroupfs
334 * @cgroup: cgroup to get xattr from
335 * @name__str: name of the xattr
336 * @value_p: output buffer of the xattr value
337 *
338 * Get xattr *name__str* of *cgroup* and store the output in *value_ptr*.
339 *
340 * For security reasons, only *name__str* with prefix "user." is allowed.
341 *
342 * Return: length of the xattr value on success, a negative value on error.
343 */
bpf_cgroup_read_xattr(struct cgroup * cgroup,const char * name__str,struct bpf_dynptr * value_p)344 __bpf_kfunc int bpf_cgroup_read_xattr(struct cgroup *cgroup, const char *name__str,
345 struct bpf_dynptr *value_p)
346 {
347 struct bpf_dynptr_kern *value_ptr = (struct bpf_dynptr_kern *)value_p;
348 u32 value_len;
349 void *value;
350
351 /* Only allow reading "user.*" xattrs */
352 if (strncmp(name__str, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
353 return -EPERM;
354
355 value_len = __bpf_dynptr_size(value_ptr);
356 value = __bpf_dynptr_data_rw(value_ptr, value_len);
357 if (!value)
358 return -EINVAL;
359
360 return kernfs_xattr_get(cgroup->kn, name__str, value, value_len);
361 }
362 #endif /* CONFIG_CGROUPS */
363
364 #ifdef CONFIG_NET
365 /**
366 * bpf_sock_read_xattr - read xattr of a socket's inode in sockfs
367 * @sock: socket to get xattr from
368 * @name__str: name of the xattr
369 * @value_p: output buffer of the xattr value
370 *
371 * Get xattr *name__str* of *sock* and store the output in *value_p*.
372 *
373 * For security reasons, only *name__str* with prefix "user." is allowed.
374 *
375 * Return: length of the xattr value on success, a negative value on error.
376 */
bpf_sock_read_xattr(struct socket * sock,const char * name__str,struct bpf_dynptr * value_p)377 __bpf_kfunc int bpf_sock_read_xattr(struct socket *sock, const char *name__str,
378 struct bpf_dynptr *value_p)
379 {
380 struct bpf_dynptr_kern *value_ptr = (struct bpf_dynptr_kern *)value_p;
381 u32 value_len;
382 void *value;
383
384 /* Only allow reading "user.*" xattrs */
385 if (strncmp(name__str, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
386 return -EPERM;
387
388 value_len = __bpf_dynptr_size(value_ptr);
389 value = __bpf_dynptr_data_rw(value_ptr, value_len);
390 if (!value)
391 return -EINVAL;
392
393 return sock_read_xattr(sock, name__str, value, value_len);
394 }
395 #endif /* CONFIG_NET */
396
397 /**
398 * bpf_real_data_inode - get the real inode hosting a file's data
399 * @file: file to resolve
400 *
401 * Resolve @file to the inode that hosts its data. For a regular file on a
402 * union/overlay filesystem this is the underlying (upper or lower) inode that
403 * stores the data, not the overlay inode.
404 *
405 * Data resolution only applies to regular files. For a non-regular file (e.g.
406 * a device node, fifo or socket) on a union/overlay filesystem the overlay
407 * inode itself is returned; for any file on a non-union filesystem the inode
408 * attached to @file is returned.
409 *
410 * Return: The inode hosting @file's data, or NULL.
411 */
bpf_real_data_inode(struct file * file)412 __bpf_kfunc struct inode *bpf_real_data_inode(struct file *file)
413 {
414 return d_real_inode(file_dentry(file));
415 }
416
417 __bpf_kfunc_end_defs();
418
419 BTF_KFUNCS_START(bpf_fs_kfunc_set_ids)
420 BTF_ID_FLAGS(func, bpf_get_task_exe_file, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func,bpf_put_file,KF_RELEASE)421 BTF_ID_FLAGS(func, bpf_put_file, KF_RELEASE)
422 BTF_ID_FLAGS(func, bpf_path_d_path)
423 BTF_ID_FLAGS(func, bpf_get_dentry_xattr, KF_SLEEPABLE)
424 BTF_ID_FLAGS(func, bpf_get_file_xattr, KF_SLEEPABLE)
425 BTF_ID_FLAGS(func, bpf_set_dentry_xattr, KF_SLEEPABLE)
426 BTF_ID_FLAGS(func, bpf_remove_dentry_xattr, KF_SLEEPABLE)
427 BTF_ID_FLAGS(func, bpf_real_data_inode, KF_SLEEPABLE | KF_RET_NULL)
428 #ifdef CONFIG_NET
429 BTF_ID_FLAGS(func, bpf_sock_read_xattr, KF_RCU)
430 #endif
431 BTF_KFUNCS_END(bpf_fs_kfunc_set_ids)
432
433 /* Side-effecting kfuncs that stay exclusive to LSM programs. */
434 BTF_SET_START(bpf_fs_kfunc_lsm_only_ids)
435 BTF_ID(func, bpf_set_dentry_xattr)
436 BTF_ID(func, bpf_remove_dentry_xattr)
437 BTF_SET_END(bpf_fs_kfunc_lsm_only_ids)
438
439 static int bpf_fs_kfuncs_filter(const struct bpf_prog *prog, u32 kfunc_id)
440 {
441 if (!btf_id_set8_contains(&bpf_fs_kfunc_set_ids, kfunc_id))
442 return 0;
443 if (prog->type == BPF_PROG_TYPE_LSM)
444 return 0;
445 if (prog->type != BPF_PROG_TYPE_STRUCT_OPS)
446 return -EACCES;
447 /* ->st_ops is unset during the cfg pass; enforced once it is set. */
448 if (!prog->aux->st_ops)
449 return 0;
450 if (bpf_prog_is_binfmt_misc_ops(prog) &&
451 !btf_id_set_contains(&bpf_fs_kfunc_lsm_only_ids, kfunc_id))
452 return 0;
453 return -EACCES;
454 }
455
456 /* bpf_[set|remove]_dentry_xattr.* hooks have KF_SLEEPABLE, so they are only
457 * available to sleepable hooks with dentry arguments.
458 *
459 * Setting and removing xattr requires exclusive lock on dentry->d_inode.
460 * Some hooks already locked d_inode, while some hooks have not locked
461 * d_inode. Therefore, we need different kfuncs for different hooks.
462 * Specifically, hooks in the following list (d_inode_locked_hooks)
463 * should call bpf_[set|remove]_dentry_xattr_locked; while other hooks
464 * should call bpf_[set|remove]_dentry_xattr.
465 */
466 BTF_SET_START(d_inode_locked_hooks)
BTF_ID(func,bpf_lsm_inode_post_removexattr)467 BTF_ID(func, bpf_lsm_inode_post_removexattr)
468 BTF_ID(func, bpf_lsm_inode_post_setattr)
469 BTF_ID(func, bpf_lsm_inode_post_setxattr)
470 BTF_ID(func, bpf_lsm_inode_removexattr)
471 BTF_ID(func, bpf_lsm_inode_rmdir)
472 BTF_ID(func, bpf_lsm_inode_setattr)
473 BTF_ID(func, bpf_lsm_inode_setxattr)
474 BTF_ID(func, bpf_lsm_inode_unlink)
475 #ifdef CONFIG_SECURITY_PATH
476 BTF_ID(func, bpf_lsm_path_unlink)
477 BTF_ID(func, bpf_lsm_path_rmdir)
478 #endif /* CONFIG_SECURITY_PATH */
479 BTF_SET_END(d_inode_locked_hooks)
480
481 bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog)
482 {
483 return btf_id_set_contains(&d_inode_locked_hooks, prog->aux->attach_btf_id);
484 }
485
486 static const struct btf_kfunc_id_set bpf_fs_kfunc_set = {
487 .owner = THIS_MODULE,
488 .set = &bpf_fs_kfunc_set_ids,
489 .filter = bpf_fs_kfuncs_filter,
490 };
491
bpf_fs_kfuncs_init(void)492 static int __init bpf_fs_kfuncs_init(void)
493 {
494 int ret;
495
496 ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_LSM, &bpf_fs_kfunc_set);
497 if (ret || !IS_ENABLED(CONFIG_BINFMT_MISC_BPF))
498 return ret;
499 return register_btf_kfunc_id_set(BPF_PROG_TYPE_STRUCT_OPS,
500 &bpf_fs_kfunc_set);
501 }
502
503 late_initcall(bpf_fs_kfuncs_init);
504