1 // SPDX-License-Identifier: GPL-2.0
2
3 /*
4 * Copyright (C) 2020 Google LLC.
5 */
6
7 #include <linux/filter.h>
8 #include <linux/bpf.h>
9 #include <linux/btf.h>
10 #include <linux/binfmts.h>
11 #include <linux/lsm_hooks.h>
12 #include <linux/bpf_lsm.h>
13 #include <linux/kallsyms.h>
14 #include <net/bpf_sk_storage.h>
15 #include <linux/bpf_local_storage.h>
16 #include <linux/btf_ids.h>
17 #include <linux/ima.h>
18 #include <linux/bpf-cgroup.h>
19
20 /* For every LSM hook that allows attachment of BPF programs, declare a nop
21 * function where a BPF program can be attached. Notably, we qualify each with
22 * weak linkage such that strong overrides can be implemented if need be.
23 */
24 #define LSM_HOOK(RET, DEFAULT, NAME, ...) \
25 __weak noinline RET bpf_lsm_##NAME(__VA_ARGS__) \
26 { \
27 return DEFAULT; \
28 }
29
30 #include <linux/lsm_hook_defs.h>
31 #undef LSM_HOOK
32
33 #define LSM_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME)
34 BTF_SET_START(bpf_lsm_hooks)
35 #include <linux/lsm_hook_defs.h>
36 #undef LSM_HOOK
BTF_SET_END(bpf_lsm_hooks)37 BTF_SET_END(bpf_lsm_hooks)
38
39 BTF_SET_START(bpf_lsm_disabled_hooks)
40 BTF_ID(func, bpf_lsm_vm_enough_memory)
41 BTF_ID(func, bpf_lsm_inode_need_killpriv)
42 BTF_ID(func, bpf_lsm_inode_getsecurity)
43 BTF_ID(func, bpf_lsm_inode_listsecurity)
44 BTF_ID(func, bpf_lsm_inode_copy_up_xattr)
45 BTF_ID(func, bpf_lsm_getselfattr)
46 BTF_ID(func, bpf_lsm_getprocattr)
47 BTF_ID(func, bpf_lsm_setprocattr)
48 #ifdef CONFIG_KEYS
49 BTF_ID(func, bpf_lsm_key_getsecurity)
50 #endif
51 #ifdef CONFIG_AUDIT
52 BTF_ID(func, bpf_lsm_audit_rule_match)
53 #endif
54 #ifdef CONFIG_SECURITY_NETWORK_XFRM
55 BTF_ID(func, bpf_lsm_xfrm_decode_session)
56 #endif
57 BTF_ID(func, bpf_lsm_ismaclabel)
58 BTF_ID(func, bpf_lsm_file_alloc_security)
59 BTF_SET_END(bpf_lsm_disabled_hooks)
60
61 /* List of LSM hooks that should operate on 'current' cgroup regardless
62 * of function signature.
63 */
64 BTF_SET_START(bpf_lsm_current_hooks)
65 /* operate on freshly allocated sk without any cgroup association */
66 #ifdef CONFIG_SECURITY_NETWORK
67 BTF_ID(func, bpf_lsm_sk_alloc_security)
68 BTF_ID(func, bpf_lsm_sk_free_security)
69 #endif
70 BTF_SET_END(bpf_lsm_current_hooks)
71
72 /* List of LSM hooks that trigger while the socket is properly locked.
73 */
74 BTF_SET_START(bpf_lsm_locked_sockopt_hooks)
75 #ifdef CONFIG_SECURITY_NETWORK
76 BTF_ID(func, bpf_lsm_sock_graft)
77 BTF_ID(func, bpf_lsm_inet_csk_clone)
78 BTF_ID(func, bpf_lsm_inet_conn_established)
79 #endif
80 BTF_SET_END(bpf_lsm_locked_sockopt_hooks)
81
82 /* List of LSM hooks that trigger while the socket is _not_ locked,
83 * but it's ok to call bpf_{g,s}etsockopt because the socket is still
84 * in the early init phase.
85 */
86 BTF_SET_START(bpf_lsm_unlocked_sockopt_hooks)
87 #ifdef CONFIG_SECURITY_NETWORK
88 BTF_ID(func, bpf_lsm_socket_post_create)
89 BTF_ID(func, bpf_lsm_socket_socketpair)
90 #endif
91 BTF_SET_END(bpf_lsm_unlocked_sockopt_hooks)
92
93 #ifdef CONFIG_CGROUP_BPF
94 void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog,
95 bpf_func_t *bpf_func)
96 {
97 const struct btf_param *args __maybe_unused;
98
99 if (btf_type_vlen(prog->aux->attach_func_proto) < 1 ||
100 btf_id_set_contains(&bpf_lsm_current_hooks,
101 prog->aux->attach_btf_id)) {
102 *bpf_func = __cgroup_bpf_run_lsm_current;
103 return;
104 }
105
106 #ifdef CONFIG_NET
107 args = btf_params(prog->aux->attach_func_proto);
108
109 if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCKET])
110 *bpf_func = __cgroup_bpf_run_lsm_socket;
111 else if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCK])
112 *bpf_func = __cgroup_bpf_run_lsm_sock;
113 else
114 #endif
115 *bpf_func = __cgroup_bpf_run_lsm_current;
116 }
117 #endif
118
bpf_lsm_verify_prog(struct bpf_verifier_log * vlog,const struct bpf_prog * prog)119 int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
120 const struct bpf_prog *prog)
121 {
122 u32 btf_id = prog->aux->attach_btf_id;
123 const char *func_name = prog->aux->attach_func_name;
124
125 if (!prog->gpl_compatible) {
126 bpf_log(vlog,
127 "LSM programs must have a GPL compatible license\n");
128 return -EINVAL;
129 }
130
131 if (btf_id_set_contains(&bpf_lsm_disabled_hooks, btf_id)) {
132 bpf_log(vlog, "attach_btf_id %u points to disabled hook %s\n",
133 btf_id, func_name);
134 return -EINVAL;
135 }
136
137 if (!btf_id_set_contains(&bpf_lsm_hooks, btf_id)) {
138 bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n",
139 btf_id, func_name);
140 return -EINVAL;
141 }
142
143 return 0;
144 }
145
146 /* Mask for all the currently supported BPRM option flags */
147 #define BPF_F_BRPM_OPTS_MASK BPF_F_BPRM_SECUREEXEC
148
BPF_CALL_2(bpf_bprm_opts_set,struct linux_binprm *,bprm,u64,flags)149 BPF_CALL_2(bpf_bprm_opts_set, struct linux_binprm *, bprm, u64, flags)
150 {
151 if (flags & ~BPF_F_BRPM_OPTS_MASK)
152 return -EINVAL;
153
154 bprm->secureexec = (flags & BPF_F_BPRM_SECUREEXEC);
155 return 0;
156 }
157
158 BTF_ID_LIST_SINGLE(bpf_bprm_opts_set_btf_ids, struct, linux_binprm)
159
160 static const struct bpf_func_proto bpf_bprm_opts_set_proto = {
161 .func = bpf_bprm_opts_set,
162 .gpl_only = false,
163 .ret_type = RET_INTEGER,
164 .arg1_type = ARG_PTR_TO_BTF_ID,
165 .arg1_btf_id = &bpf_bprm_opts_set_btf_ids[0],
166 .arg2_type = ARG_ANYTHING,
167 };
168
BPF_CALL_3(bpf_ima_inode_hash,struct inode *,inode,void *,dst,u32,size)169 BPF_CALL_3(bpf_ima_inode_hash, struct inode *, inode, void *, dst, u32, size)
170 {
171 return ima_inode_hash(inode, dst, size);
172 }
173
bpf_ima_inode_hash_allowed(const struct bpf_prog * prog)174 static bool bpf_ima_inode_hash_allowed(const struct bpf_prog *prog)
175 {
176 return bpf_lsm_is_sleepable_hook(prog->aux->attach_btf_id);
177 }
178
179 BTF_ID_LIST_SINGLE(bpf_ima_inode_hash_btf_ids, struct, inode)
180
181 static const struct bpf_func_proto bpf_ima_inode_hash_proto = {
182 .func = bpf_ima_inode_hash,
183 .gpl_only = false,
184 .might_sleep = true,
185 .ret_type = RET_INTEGER,
186 .arg1_type = ARG_PTR_TO_BTF_ID,
187 .arg1_btf_id = &bpf_ima_inode_hash_btf_ids[0],
188 .arg2_type = ARG_PTR_TO_UNINIT_MEM,
189 .arg3_type = ARG_MEM_SIZE,
190 .allowed = bpf_ima_inode_hash_allowed,
191 };
192
BPF_CALL_3(bpf_ima_file_hash,struct file *,file,void *,dst,u32,size)193 BPF_CALL_3(bpf_ima_file_hash, struct file *, file, void *, dst, u32, size)
194 {
195 return ima_file_hash(file, dst, size);
196 }
197
198 BTF_ID_LIST_SINGLE(bpf_ima_file_hash_btf_ids, struct, file)
199
200 static const struct bpf_func_proto bpf_ima_file_hash_proto = {
201 .func = bpf_ima_file_hash,
202 .gpl_only = false,
203 .might_sleep = true,
204 .ret_type = RET_INTEGER,
205 .arg1_type = ARG_PTR_TO_BTF_ID,
206 .arg1_btf_id = &bpf_ima_file_hash_btf_ids[0],
207 .arg2_type = ARG_PTR_TO_UNINIT_MEM,
208 .arg3_type = ARG_MEM_SIZE,
209 .allowed = bpf_ima_inode_hash_allowed,
210 };
211
BPF_CALL_1(bpf_get_attach_cookie,void *,ctx)212 BPF_CALL_1(bpf_get_attach_cookie, void *, ctx)
213 {
214 struct bpf_trace_run_ctx *run_ctx;
215
216 run_ctx = container_of(current->bpf_ctx, struct bpf_trace_run_ctx, run_ctx);
217 return run_ctx->bpf_cookie;
218 }
219
220 static const struct bpf_func_proto bpf_get_attach_cookie_proto = {
221 .func = bpf_get_attach_cookie,
222 .gpl_only = false,
223 .ret_type = RET_INTEGER,
224 .arg1_type = ARG_PTR_TO_CTX,
225 };
226
227 static const struct bpf_func_proto *
bpf_lsm_func_proto(enum bpf_func_id func_id,const struct bpf_prog * prog)228 bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
229 {
230 const struct bpf_func_proto *func_proto;
231
232 if (prog->expected_attach_type == BPF_LSM_CGROUP) {
233 func_proto = cgroup_common_func_proto(func_id, prog);
234 if (func_proto)
235 return func_proto;
236 }
237
238 switch (func_id) {
239 case BPF_FUNC_inode_storage_get:
240 return &bpf_inode_storage_get_proto;
241 case BPF_FUNC_inode_storage_delete:
242 return &bpf_inode_storage_delete_proto;
243 #ifdef CONFIG_NET
244 case BPF_FUNC_sk_storage_get:
245 return &bpf_sk_storage_get_proto;
246 case BPF_FUNC_sk_storage_delete:
247 return &bpf_sk_storage_delete_proto;
248 #endif /* CONFIG_NET */
249 case BPF_FUNC_spin_lock:
250 return &bpf_spin_lock_proto;
251 case BPF_FUNC_spin_unlock:
252 return &bpf_spin_unlock_proto;
253 case BPF_FUNC_bprm_opts_set:
254 return &bpf_bprm_opts_set_proto;
255 case BPF_FUNC_ima_inode_hash:
256 return &bpf_ima_inode_hash_proto;
257 case BPF_FUNC_ima_file_hash:
258 return &bpf_ima_file_hash_proto;
259 case BPF_FUNC_get_attach_cookie:
260 return bpf_prog_has_trampoline(prog) ? &bpf_get_attach_cookie_proto : NULL;
261 #ifdef CONFIG_NET
262 case BPF_FUNC_setsockopt:
263 if (prog->expected_attach_type != BPF_LSM_CGROUP)
264 return NULL;
265 if (btf_id_set_contains(&bpf_lsm_locked_sockopt_hooks,
266 prog->aux->attach_btf_id))
267 return &bpf_sk_setsockopt_proto;
268 if (btf_id_set_contains(&bpf_lsm_unlocked_sockopt_hooks,
269 prog->aux->attach_btf_id))
270 return &bpf_unlocked_sk_setsockopt_proto;
271 return NULL;
272 case BPF_FUNC_getsockopt:
273 if (prog->expected_attach_type != BPF_LSM_CGROUP)
274 return NULL;
275 if (btf_id_set_contains(&bpf_lsm_locked_sockopt_hooks,
276 prog->aux->attach_btf_id))
277 return &bpf_sk_getsockopt_proto;
278 if (btf_id_set_contains(&bpf_lsm_unlocked_sockopt_hooks,
279 prog->aux->attach_btf_id))
280 return &bpf_unlocked_sk_getsockopt_proto;
281 return NULL;
282 #endif
283 default:
284 return tracing_prog_func_proto(func_id, prog);
285 }
286 }
287
288 /* The set of hooks which are called without pagefaults disabled and are allowed
289 * to "sleep" and thus can be used for sleepable BPF programs.
290 */
291 BTF_SET_START(sleepable_lsm_hooks)
BTF_ID(func,bpf_lsm_bpf)292 BTF_ID(func, bpf_lsm_bpf)
293 BTF_ID(func, bpf_lsm_bpf_map)
294 BTF_ID(func, bpf_lsm_bpf_map_create)
295 BTF_ID(func, bpf_lsm_bpf_map_free)
296 BTF_ID(func, bpf_lsm_bpf_prog)
297 BTF_ID(func, bpf_lsm_bpf_prog_load)
298 BTF_ID(func, bpf_lsm_bpf_token_create)
299 BTF_ID(func, bpf_lsm_bpf_token_free)
300 BTF_ID(func, bpf_lsm_bpf_token_cmd)
301 BTF_ID(func, bpf_lsm_bpf_token_capable)
302 BTF_ID(func, bpf_lsm_bprm_check_security)
303 BTF_ID(func, bpf_lsm_bprm_committed_creds)
304 BTF_ID(func, bpf_lsm_bprm_committing_creds)
305 BTF_ID(func, bpf_lsm_bprm_creds_for_exec)
306 BTF_ID(func, bpf_lsm_bprm_creds_from_file)
307 BTF_ID(func, bpf_lsm_capget)
308 BTF_ID(func, bpf_lsm_capset)
309 BTF_ID(func, bpf_lsm_cred_prepare)
310 BTF_ID(func, bpf_lsm_file_ioctl)
311 BTF_ID(func, bpf_lsm_file_lock)
312 BTF_ID(func, bpf_lsm_file_open)
313 BTF_ID(func, bpf_lsm_file_post_open)
314 BTF_ID(func, bpf_lsm_file_receive)
315
316 BTF_ID(func, bpf_lsm_inode_create)
317 BTF_ID(func, bpf_lsm_inode_free_security)
318 BTF_ID(func, bpf_lsm_inode_getattr)
319 BTF_ID(func, bpf_lsm_inode_getxattr)
320 BTF_ID(func, bpf_lsm_inode_mknod)
321 BTF_ID(func, bpf_lsm_inode_need_killpriv)
322 BTF_ID(func, bpf_lsm_inode_post_setxattr)
323 BTF_ID(func, bpf_lsm_inode_post_removexattr)
324 BTF_ID(func, bpf_lsm_inode_readlink)
325 BTF_ID(func, bpf_lsm_inode_removexattr)
326 BTF_ID(func, bpf_lsm_inode_rename)
327 BTF_ID(func, bpf_lsm_inode_rmdir)
328 BTF_ID(func, bpf_lsm_inode_setattr)
329 BTF_ID(func, bpf_lsm_inode_setxattr)
330 BTF_ID(func, bpf_lsm_inode_symlink)
331 BTF_ID(func, bpf_lsm_inode_unlink)
332 BTF_ID(func, bpf_lsm_kernel_module_request)
333 BTF_ID(func, bpf_lsm_kernel_read_file)
334 BTF_ID(func, bpf_lsm_kernfs_init_security)
335
336 #ifdef CONFIG_SECURITY_PATH
337 BTF_ID(func, bpf_lsm_path_unlink)
338 BTF_ID(func, bpf_lsm_path_mkdir)
339 BTF_ID(func, bpf_lsm_path_rmdir)
340 BTF_ID(func, bpf_lsm_path_truncate)
341 BTF_ID(func, bpf_lsm_path_symlink)
342 BTF_ID(func, bpf_lsm_path_link)
343 BTF_ID(func, bpf_lsm_path_rename)
344 BTF_ID(func, bpf_lsm_path_chmod)
345 BTF_ID(func, bpf_lsm_path_chown)
346 #endif /* CONFIG_SECURITY_PATH */
347
348 BTF_ID(func, bpf_lsm_mmap_file)
349 BTF_ID(func, bpf_lsm_netlink_send)
350 BTF_ID(func, bpf_lsm_path_notify)
351 BTF_ID(func, bpf_lsm_release_secctx)
352 BTF_ID(func, bpf_lsm_sb_alloc_security)
353 BTF_ID(func, bpf_lsm_sb_eat_lsm_opts)
354 BTF_ID(func, bpf_lsm_sb_kern_mount)
355 BTF_ID(func, bpf_lsm_sb_mount)
356 BTF_ID(func, bpf_lsm_sb_remount)
357 BTF_ID(func, bpf_lsm_sb_set_mnt_opts)
358 BTF_ID(func, bpf_lsm_sb_show_options)
359 BTF_ID(func, bpf_lsm_sb_statfs)
360 BTF_ID(func, bpf_lsm_sb_umount)
361 BTF_ID(func, bpf_lsm_settime)
362
363 #ifdef CONFIG_SECURITY_NETWORK
364 BTF_ID(func, bpf_lsm_socket_accept)
365 BTF_ID(func, bpf_lsm_socket_bind)
366 BTF_ID(func, bpf_lsm_socket_connect)
367 BTF_ID(func, bpf_lsm_socket_create)
368 BTF_ID(func, bpf_lsm_socket_getpeername)
369 BTF_ID(func, bpf_lsm_socket_getpeersec_dgram)
370 BTF_ID(func, bpf_lsm_socket_getsockname)
371 BTF_ID(func, bpf_lsm_socket_getsockopt)
372 BTF_ID(func, bpf_lsm_socket_listen)
373 BTF_ID(func, bpf_lsm_socket_post_create)
374 BTF_ID(func, bpf_lsm_socket_recvmsg)
375 BTF_ID(func, bpf_lsm_socket_sendmsg)
376 BTF_ID(func, bpf_lsm_socket_shutdown)
377 BTF_ID(func, bpf_lsm_socket_socketpair)
378 #endif /* CONFIG_SECURITY_NETWORK */
379
380 BTF_ID(func, bpf_lsm_syslog)
381 BTF_ID(func, bpf_lsm_task_alloc)
382 BTF_ID(func, bpf_lsm_task_prctl)
383 BTF_ID(func, bpf_lsm_task_setscheduler)
384 BTF_ID(func, bpf_lsm_userns_create)
385 BTF_ID(func, bpf_lsm_bdev_alloc_security)
386 BTF_ID(func, bpf_lsm_bdev_setintegrity)
387 BTF_SET_END(sleepable_lsm_hooks)
388
389 BTF_SET_START(untrusted_lsm_hooks)
390 BTF_ID(func, bpf_lsm_bpf_map_free)
391 BTF_ID(func, bpf_lsm_bpf_prog_free)
392 BTF_ID(func, bpf_lsm_file_alloc_security)
393 BTF_ID(func, bpf_lsm_file_free_security)
394 #ifdef CONFIG_SECURITY_NETWORK
395 BTF_ID(func, bpf_lsm_sk_alloc_security)
396 BTF_ID(func, bpf_lsm_sk_free_security)
397 #endif /* CONFIG_SECURITY_NETWORK */
398 BTF_ID(func, bpf_lsm_task_free)
399 BTF_ID(func, bpf_lsm_bdev_alloc_security)
400 BTF_ID(func, bpf_lsm_bdev_free_security)
401 BTF_SET_END(untrusted_lsm_hooks)
402
403 bool bpf_lsm_is_sleepable_hook(u32 btf_id)
404 {
405 return btf_id_set_contains(&sleepable_lsm_hooks, btf_id);
406 }
407
bpf_lsm_is_trusted(const struct bpf_prog * prog)408 bool bpf_lsm_is_trusted(const struct bpf_prog *prog)
409 {
410 return !btf_id_set_contains(&untrusted_lsm_hooks, prog->aux->attach_btf_id);
411 }
412
413 const struct bpf_prog_ops lsm_prog_ops = {
414 };
415
416 const struct bpf_verifier_ops lsm_verifier_ops = {
417 .get_func_proto = bpf_lsm_func_proto,
418 .is_valid_access = btf_ctx_access,
419 };
420
421 /* hooks return 0 or 1 */
422 BTF_SET_START(bool_lsm_hooks)
423 #ifdef CONFIG_SECURITY_NETWORK_XFRM
BTF_ID(func,bpf_lsm_xfrm_state_pol_flow_match)424 BTF_ID(func, bpf_lsm_xfrm_state_pol_flow_match)
425 #endif
426 #ifdef CONFIG_AUDIT
427 BTF_ID(func, bpf_lsm_audit_rule_known)
428 #endif
429 BTF_ID(func, bpf_lsm_inode_xattr_skipcap)
430 BTF_SET_END(bool_lsm_hooks)
431
432 /* hooks returning void */
433 #define LSM_HOOK_void(DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME)
434 #define LSM_HOOK_int(DEFAULT, NAME, ...) /* nothing */
435 #define LSM_HOOK(RET, DEFAULT, NAME, ...) LSM_HOOK_##RET(DEFAULT, NAME, __VA_ARGS__)
436 BTF_SET_START(void_lsm_hooks)
437 #include <linux/lsm_hook_defs.h>
438 #undef LSM_HOOK
439 #undef LSM_HOOK_void
440 #undef LSM_HOOK_int
441 BTF_SET_END(void_lsm_hooks)
442
443 bool bpf_lsm_hook_returns_errno(u32 btf_id)
444 {
445 if (btf_id_set_contains(&bool_lsm_hooks, btf_id))
446 return false;
447 if (btf_id_set_contains(&void_lsm_hooks, btf_id))
448 return false;
449 return true;
450 }
451
bpf_lsm_get_retval_range(const struct bpf_prog * prog,struct bpf_retval_range * retval_range)452 int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
453 struct bpf_retval_range *retval_range)
454 {
455 /* no return value range for void hooks */
456 if (!prog->aux->attach_func_proto->type)
457 return -EINVAL;
458
459 if (btf_id_set_contains(&bool_lsm_hooks, prog->aux->attach_btf_id)) {
460 retval_range->minval = 0;
461 retval_range->maxval = 1;
462 } else {
463 /* All other available LSM hooks, except task_prctl, return 0
464 * on success and negative error code on failure.
465 * To keep things simple, we only allow bpf progs to return 0
466 * or negative errno for task_prctl too.
467 */
468 retval_range->minval = -MAX_ERRNO;
469 retval_range->maxval = 0;
470 }
471 return 0;
472 }
473