[PATCH bpf-next 0/7] Add new way to add BPF LSM hooks

[Anton Protopopov <a.s.protopopov@gmail.com>]

The BPF LSM programs are allowed to attach to LSM hooks. This enables
operators to mitigate known bugs without a need to reboot or livepatch
machines.  BPF has shown very useful to create such runtime policies.
However, many APIs and parts of kernel aren't covered by existing LSM
hooks and this would be beneficial to extend the coverage.

To simplify the process of adding new hooks this patch series enables
BPF to attach policy programs to hooks defined outside of the
official LSM list.

One of the reasons to add a new mechanism is that in order to add a
new LSM hook an implementation, at least one in-kernel LSM must be
added, such as SELinux or AppArmor, and BPF is specifically not
considered as a reference implementation [1].  This is, however, not
feasible for the use cases and capabilities covered by BPF LSMs,
which are not directly comparable to those of traditional LSMs.

This series introduces several initial hooks as a starting point for
adding further networking and non-networking hooks. The selection of
these hooks is guided by clusters of CVEs published by the kernel
numbering authority.

The series consists of the following patches:

  Patch 1 adds a new mechanism to add hooks. (It is deliberately
  made as simple as possible.)

  Patch 2 adds a new BPF hook for generic netlink.

  Patch 3 adds new BPF hooks for the ethtool APIs: generic netlink
  family and ioctl.

  The rest of patches add corresponding selftests.

(The series applies to bpf-next. Two net-next-related patches adding
actual hooks are accompanied by BPF selftests, so it looks like
bpf-next also might be the right destination.)

Links:

  [1] Linux Security Module Subsystem Readme,
      https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm.git/tree/README.md

Anton Protopopov (7):
  bpf: Allow BPF LSM programs to attach to more hooks
  net, bpf: Add a generic netlink hook on msg_rcv
  net, bpf: Add bpf hooks for ethtool control path
  selftests/bpf: Extract some helpers from tests to the netlink library
  selftests/bpf: Add netdevsim helper library
  selftests/bpf: Add tests for the generic netlink BPF hook
  selftests/bpf: Add tests for BPF ethtool hooks

 MAINTAINERS                                   |   1 +
 include/linux/bpf_lsm.h                       |  14 +
 include/linux/bpf_lsm_hook_defs.h             |  18 +
 kernel/bpf/bpf_lsm.c                          |   2 +
 net/ethtool/cabletest.c                       |   6 +
 net/ethtool/features.c                        |   3 +
 net/ethtool/ioctl.c                           |   5 +
 net/ethtool/module.c                          |   3 +
 net/ethtool/netlink.c                         |  17 +-
 net/ethtool/netlink.h                         |  25 ++
 net/ethtool/rss.c                             |  10 +
 net/ethtool/tsinfo.c                          |  13 +
 net/ethtool/tunnels.c                         |  14 +
 net/netlink/genetlink.c                       |   6 +
 tools/testing/selftests/bpf/Makefile          |   1 +
 tools/testing/selftests/bpf/config            |   1 +
 .../testing/selftests/bpf/netdevsim_helpers.c | 176 ++++++++++
 .../testing/selftests/bpf/netdevsim_helpers.h |   9 +
 tools/testing/selftests/bpf/netlink_helpers.c | 176 ++++++++++
 tools/testing/selftests/bpf/netlink_helpers.h |  12 +
 .../selftests/bpf/prog_tests/ethtool_lsm.c    | 330 ++++++++++++++++++
 .../selftests/bpf/prog_tests/genl_lsm.c       | 242 +++++++++++++
 .../selftests/bpf/prog_tests/test_bpf_smc.c   | 160 ++-------
 .../testing/selftests/bpf/progs/ethtool_lsm.c | 168 +++++++++
 tools/testing/selftests/bpf/progs/genl_lsm.c  |  58 +++
 25 files changed, 1345 insertions(+), 125 deletions(-)
 create mode 100644 include/linux/bpf_lsm_hook_defs.h
 create mode 100644 tools/testing/selftests/bpf/netdevsim_helpers.c
 create mode 100644 tools/testing/selftests/bpf/netdevsim_helpers.h
 create mode 100644 tools/testing/selftests/bpf/prog_tests/ethtool_lsm.c
 create mode 100644 tools/testing/selftests/bpf/prog_tests/genl_lsm.c
 create mode 100644 tools/testing/selftests/bpf/progs/ethtool_lsm.c
 create mode 100644 tools/testing/selftests/bpf/progs/genl_lsm.c

-- 
2.43.0