Commit 21c7063f authored by Xu Kuohai's avatar Xu Kuohai Committed by Andrii Nakryiko

bpf, lsm: Add disabled BPF LSM hook list

Add a disabled hooks list for BPF LSM. progs being attached to the
listed hooks will be rejected by the verifier.
Suggested-by: default avatarKP Singh <kpsingh@kernel.org>
Signed-off-by: default avatarXu Kuohai <xukuohai@huawei.com>
Link: https://lore.kernel.org/r/20240719110059.797546-2-xukuohai@huaweicloud.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
parent e2854bc3
...@@ -36,6 +36,24 @@ BTF_SET_START(bpf_lsm_hooks) ...@@ -36,6 +36,24 @@ BTF_SET_START(bpf_lsm_hooks)
#undef LSM_HOOK #undef LSM_HOOK
BTF_SET_END(bpf_lsm_hooks) BTF_SET_END(bpf_lsm_hooks)
BTF_SET_START(bpf_lsm_disabled_hooks)
BTF_ID(func, bpf_lsm_vm_enough_memory)
BTF_ID(func, bpf_lsm_inode_need_killpriv)
BTF_ID(func, bpf_lsm_inode_getsecurity)
BTF_ID(func, bpf_lsm_inode_listsecurity)
BTF_ID(func, bpf_lsm_inode_copy_up_xattr)
BTF_ID(func, bpf_lsm_getselfattr)
BTF_ID(func, bpf_lsm_getprocattr)
BTF_ID(func, bpf_lsm_setprocattr)
#ifdef CONFIG_KEYS
BTF_ID(func, bpf_lsm_key_getsecurity)
#endif
#ifdef CONFIG_AUDIT
BTF_ID(func, bpf_lsm_audit_rule_match)
#endif
BTF_ID(func, bpf_lsm_ismaclabel)
BTF_SET_END(bpf_lsm_disabled_hooks)
/* List of LSM hooks that should operate on 'current' cgroup regardless /* List of LSM hooks that should operate on 'current' cgroup regardless
* of function signature. * of function signature.
*/ */
...@@ -97,15 +115,24 @@ void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, ...@@ -97,15 +115,24 @@ void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog,
int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
const struct bpf_prog *prog) const struct bpf_prog *prog)
{ {
u32 btf_id = prog->aux->attach_btf_id;
const char *func_name = prog->aux->attach_func_name;
if (!prog->gpl_compatible) { if (!prog->gpl_compatible) {
bpf_log(vlog, bpf_log(vlog,
"LSM programs must have a GPL compatible license\n"); "LSM programs must have a GPL compatible license\n");
return -EINVAL; return -EINVAL;
} }
if (!btf_id_set_contains(&bpf_lsm_hooks, prog->aux->attach_btf_id)) { if (btf_id_set_contains(&bpf_lsm_disabled_hooks, btf_id)) {
bpf_log(vlog, "attach_btf_id %u points to disabled hook %s\n",
btf_id, func_name);
return -EINVAL;
}
if (!btf_id_set_contains(&bpf_lsm_hooks, btf_id)) {
bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n", bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n",
prog->aux->attach_btf_id, prog->aux->attach_func_name); btf_id, func_name);
return -EINVAL; return -EINVAL;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment