From: Jiri Olsa <olsajiri@gmail.com>
To: Andrii Nakryiko <andrii@kernel.org>
Cc: bpf@vger.kernel.org, netdev@vger.kernel.org,
linux-fsdevel@vger.kernel.org,
linux-security-module@vger.kernel.org, keescook@chromium.org,
brauner@kernel.org, lennart@poettering.net, kernel-team@meta.com,
sargun@sargun.me
Subject: Re: [PATCH v6 bpf-next 04/13] bpf: add BPF token support to BPF_MAP_CREATE command
Date: Tue, 10 Oct 2023 10:35:48 +0200 [thread overview]
Message-ID: <ZSUM5A+dJHptbRSx@krava> (raw)
In-Reply-To: <20230927225809.2049655-5-andrii@kernel.org>
On Wed, Sep 27, 2023 at 03:58:00PM -0700, Andrii Nakryiko wrote:
SNIP
> -#define BPF_MAP_CREATE_LAST_FIELD map_extra
> +#define BPF_MAP_CREATE_LAST_FIELD map_token_fd
> /* called via syscall */
> static int map_create(union bpf_attr *attr)
> {
> const struct bpf_map_ops *ops;
> + struct bpf_token *token = NULL;
> int numa_node = bpf_map_attr_numa_node(attr);
> u32 map_type = attr->map_type;
> struct bpf_map *map;
> @@ -1157,14 +1158,32 @@ static int map_create(union bpf_attr *attr)
> if (!ops->map_mem_usage)
> return -EINVAL;
>
> + if (attr->map_token_fd) {
> + token = bpf_token_get_from_fd(attr->map_token_fd);
> + if (IS_ERR(token))
> + return PTR_ERR(token);
> +
> + /* if current token doesn't grant map creation permissions,
> + * then we can't use this token, so ignore it and rely on
> + * system-wide capabilities checks
> + */
> + if (!bpf_token_allow_cmd(token, BPF_MAP_CREATE) ||
> + !bpf_token_allow_map_type(token, attr->map_type)) {
> + bpf_token_put(token);
> + token = NULL;
> + }
> + }
> +
> + err = -EPERM;
> +
> /* Intent here is for unprivileged_bpf_disabled to block BPF map
> * creation for unprivileged users; other actions depend
> * on fd availability and access to bpffs, so are dependent on
> * object creation success. Even with unprivileged BPF disabled,
> * capability checks are still carried out.
> */
> - if (sysctl_unprivileged_bpf_disabled && !bpf_capable())
> - return -EPERM;
> + if (sysctl_unprivileged_bpf_disabled && !bpf_token_capable(token, CAP_BPF))
> + goto put_token;
>
> /* check privileged map type permissions */
> switch (map_type) {
> @@ -1197,25 +1216,27 @@ static int map_create(union bpf_attr *attr)
> case BPF_MAP_TYPE_LRU_PERCPU_HASH:
> case BPF_MAP_TYPE_STRUCT_OPS:
> case BPF_MAP_TYPE_CPUMAP:
> - if (!bpf_capable())
> - return -EPERM;
> + if (!bpf_token_capable(token, CAP_BPF))
> + goto put_token;
> break;
> case BPF_MAP_TYPE_SOCKMAP:
> case BPF_MAP_TYPE_SOCKHASH:
> case BPF_MAP_TYPE_DEVMAP:
> case BPF_MAP_TYPE_DEVMAP_HASH:
> case BPF_MAP_TYPE_XSKMAP:
> - if (!bpf_net_capable())
> - return -EPERM;
> + if (!bpf_token_capable(token, CAP_NET_ADMIN))
> + goto put_token;
> break;
> default:
> WARN(1, "unsupported map type %d", map_type);
> - return -EPERM;
> + goto put_token;
> }
>
> map = ops->map_alloc(attr);
> - if (IS_ERR(map))
> - return PTR_ERR(map);
> + if (IS_ERR(map)) {
> + err = PTR_ERR(map);
> + goto put_token;
> + }
> map->ops = ops;
> map->map_type = map_type;
>
> @@ -1252,7 +1273,7 @@ static int map_create(union bpf_attr *attr)
> map->btf = btf;
>
> if (attr->btf_value_type_id) {
> - err = map_check_btf(map, btf, attr->btf_key_type_id,
> + err = map_check_btf(map, token, btf, attr->btf_key_type_id,
> attr->btf_value_type_id);
> if (err)
> goto free_map;
I might be missing something, but should we call bpf_token_put(token)
on non-error path as well? probably after bpf_map_save_memcg call
jirka
> @@ -1293,6 +1314,8 @@ static int map_create(union bpf_attr *attr)
> free_map:
> btf_put(map->btf);
> map->ops->map_free(map);
> +put_token:
> + bpf_token_put(token);
> return err;
> }
>
SNIP
next prev parent reply other threads:[~2023-10-10 8:35 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-27 22:57 [PATCH v6 bpf-next 00/13] BPF token and BPF FS-based delegation Andrii Nakryiko
2023-09-27 22:57 ` [PATCH v6 bpf-next 01/13] bpf: align CAP_NET_ADMIN checks with bpf_capable() approach Andrii Nakryiko
2023-09-27 22:57 ` [PATCH v6 bpf-next 02/13] bpf: add BPF token delegation mount options to BPF FS Andrii Nakryiko
2023-10-10 7:08 ` Hou Tao
2023-10-12 0:30 ` Andrii Nakryiko
2023-09-27 22:57 ` [PATCH v6 bpf-next 03/13] bpf: introduce BPF token object Andrii Nakryiko
2023-10-11 1:17 ` [PATCH v6 3/13] " Paul Moore
2023-10-12 0:31 ` Andrii Nakryiko
2023-10-12 21:48 ` Andrii Nakryiko
2023-10-12 23:43 ` Paul Moore
2023-10-12 23:51 ` Andrii Nakryiko
2023-10-12 23:18 ` Paul Moore
2023-10-12 23:45 ` Andrii Nakryiko
2023-10-11 2:35 ` [PATCH v6 bpf-next 03/13] " Hou Tao
2023-10-12 0:31 ` Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 04/13] bpf: add BPF token support to BPF_MAP_CREATE command Andrii Nakryiko
2023-10-10 8:35 ` Jiri Olsa [this message]
2023-10-12 0:30 ` Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 05/13] bpf: add BPF token support to BPF_BTF_LOAD command Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 06/13] bpf: add BPF token support to BPF_PROG_LOAD command Andrii Nakryiko
2023-10-11 1:17 ` [PATCH v6 6/13] " Paul Moore
2023-10-12 0:31 ` Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 07/13] bpf: take into account BPF token when fetching helper protos Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 08/13] bpf: consistenly use BPF token throughout BPF verifier logic Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 09/13] libbpf: add bpf_token_create() API Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 10/13] libbpf: add BPF token support to bpf_map_create() API Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 11/13] libbpf: add BPF token support to bpf_btf_load() API Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 12/13] libbpf: add BPF token support to bpf_prog_load() API Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 13/13] selftests/bpf: add BPF token-enabled tests Andrii Nakryiko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZSUM5A+dJHptbRSx@krava \
--to=olsajiri@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=brauner@kernel.org \
--cc=keescook@chromium.org \
--cc=kernel-team@meta.com \
--cc=lennart@poettering.net \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=sargun@sargun.me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.