From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.4 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9855C41621 for ; Tue, 24 Mar 2020 14:50:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 93D8520774 for ; Tue, 24 Mar 2020 14:50:13 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="A9CiRgGu" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727837AbgCXOuN (ORCPT ); Tue, 24 Mar 2020 10:50:13 -0400 Received: from mail-wr1-f67.google.com ([209.85.221.67]:46676 "EHLO mail-wr1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727841AbgCXOuM (ORCPT ); Tue, 24 Mar 2020 10:50:12 -0400 Received: by mail-wr1-f67.google.com with SMTP id j17so18398680wru.13 for ; Tue, 24 Mar 2020 07:50:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:date:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to :user-agent; bh=oGbi1kK4rZ5Jg0cdOf4BlknnOlqmymkgqgzxdZFk9xc=; b=A9CiRgGuc0FzDG8Jea7fRV9it5TL0VjdcTyRfjSQ7U6FCuWl+0j9LmRVYnApg12iUa 2FrYHGgTGEObTGVfsbzvatv/yw//8Y8xyP7ubTh8hHoCVdlpsnSjckPtRjenc1x0QOhd n3PsTLkaVT6G+ohUiS6sU/8kAAkOTJj4oFtkk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:date:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to:user-agent; bh=oGbi1kK4rZ5Jg0cdOf4BlknnOlqmymkgqgzxdZFk9xc=; b=e5WIT+V+HhsNQ+jAB8+PHtIcEp8PPKjImGhBESTKa4AEyxpwsMtBbn8fWFVfQVxJLt HTie65zb2ERMPVQS6OQHlGI2tVAOCYZaUencQqyjoUBnFxM/zPMd67TK/C4nqLk63GjN FR4kZkDILjcCSusBImxjZ3d0jvDVZpyPk5o4LfnSZ6FVPc1c/JMgYlEUNW4jdMK+UR7E 0CH8jm/FbKCmhAQmURpDI0lqW5+oCZvWw7KrGOBlA+J7w/rUSw7Gf0NWXjzpN75OMSkG i4asE5O9iy3kEEA2ZmKxl4qAFvXn/Zs4+tEBXuEd27SA5KrEQtl821cmq2tR3fxggVUy r7RA== X-Gm-Message-State: ANhLgQ0z83E+jRn3pn4z/2EjcdorJ/m3KsnyL9i7qiBpyQOdWTgzs45a RtPpYbInWmbr725CoNV35057Dw== X-Google-Smtp-Source: ADFU+vtsBplmFb4Y6HIsHkRuws6sb8YO/62KkZdxsazEbdRgj7TzX90VeMndzuqAH2a1dHAS+iNnog== X-Received: by 2002:adf:f0c5:: with SMTP id x5mr10031231wro.415.1585061410761; Tue, 24 Mar 2020 07:50:10 -0700 (PDT) Received: from chromium.org (77-56-209-237.dclient.hispeed.ch. [77.56.209.237]) by smtp.gmail.com with ESMTPSA id y7sm6619108wrq.54.2020.03.24.07.50.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 24 Mar 2020 07:50:10 -0700 (PDT) From: KP Singh X-Google-Original-From: KP Singh Date: Tue, 24 Mar 2020 15:50:03 +0100 To: Stephen Smalley Cc: linux-kernel@vger.kernel.org, bpf@vger.kernel.org, LSM List , Brendan Jackman , Florent Revest , Alexei Starovoitov , Daniel Borkmann , James Morris , Kees Cook , Paul Turner , Jann Horn , Florent Revest , Brendan Jackman , Greg Kroah-Hartman , Paul Moore Subject: Re: [PATCH bpf-next v5 4/7] bpf: lsm: Implement attach, detach and execution Message-ID: <20200324145003.GA2685@chromium.org> References: <20200323164415.12943-1-kpsingh@chromium.org> <20200323164415.12943-5-kpsingh@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Sender: bpf-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org On 24-Mär 10:35, Stephen Smalley wrote: > On Mon, Mar 23, 2020 at 12:46 PM KP Singh wrote: > > > > From: KP Singh > > > > JITed BPF programs are dynamically attached to the LSM hooks > > using BPF trampolines. The trampoline prologue generates code to handle > > conversion of the signature of the hook to the appropriate BPF context. > > > > The allocated trampoline programs are attached to the nop functions > > initialized as LSM hooks. > > > > BPF_PROG_TYPE_LSM programs must have a GPL compatible license and > > and need CAP_SYS_ADMIN (required for loading eBPF programs). > > > > Upon attachment: > > > > * A BPF fexit trampoline is used for LSM hooks with a void return type. > > * A BPF fmod_ret trampoline is used for LSM hooks which return an > > int. The attached programs can override the return value of the > > bpf LSM hook to indicate a MAC Policy decision. > > > > Signed-off-by: KP Singh > > Reviewed-by: Brendan Jackman > > Reviewed-by: Florent Revest > > --- > > > diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c > > index 530d137f7a84..2a8131b640b8 100644 > > --- a/kernel/bpf/bpf_lsm.c > > +++ b/kernel/bpf/bpf_lsm.c > > @@ -9,6 +9,9 @@ > > #include > > #include > > #include > > +#include > > +#include > > +#include > > > > /* For every LSM hook that allows attachment of BPF programs, declare a NOP > > * function where a BPF program can be attached as an fexit trampoline. > > @@ -27,6 +30,32 @@ noinline __weak void bpf_lsm_##NAME(__VA_ARGS__) {} > > #include > > #undef LSM_HOOK > > > > +#define BPF_LSM_SYM_PREFX "bpf_lsm_" > > + > > +int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, > > + const struct bpf_prog *prog) > > +{ > > + /* Only CAP_MAC_ADMIN users are allowed to make changes to LSM hooks > > + */ > > + if (!capable(CAP_MAC_ADMIN)) > > + return -EPERM; > > I had asked before, and will ask again: please provide an explicit LSM > hook for mediating whether one can make changes to the LSM hooks. > Neither CAP_MAC_ADMIN nor CAP_SYS_ADMIN suffices to check this for SELinux. What do you think about: int security_check_mutable_hooks(void) Do you have any suggestions on the signature of this hook? Does this hook need to be BPF specific? - KP