[PATCH bpf-next 0/6] bpf: introduce BPF_CGROUP_FILE_OPEN

Alexei Starovoitov
2018-10-04T02:58:16Z

Hi All,

Similar to networking sandboxing programs and cgroup-v2 based hooks
(BPF_CGROUP_INET_[INGRESS|EGRESS,] BPF_CGROUP_INET[4|6]_[BIND|CONNECT], etc)
introduce basic per-container sandboxing for file access via
new BPF_PROG_TYPE_FILE_FILTER program type that attaches after
security_file_open() LSM hook and works as additional file_open filter.
The new cgroup bpf hook is called BPF_CGROUP_FILE_OPEN.

Just like other cgroup-bpf programs new BPF_PROG_TYPE_FILE_FILTER type
is only available to root.

Use cases:
- disallow certain FS types within containers (fs_magic == CGROUP2_SUPER_MAGIC)
- restrict permissions in particular mount (mnt_id == X && (flags & O_RDWR))
- disallow access to hard linked sensitive files (nlink > 1 && mode == 0700)
- disallow access to world writeable files (mode == 0..7)
- disallow access to given set of files (dev_major == X && dev_minor == Y && inode == Z)

Alexei Starovoitov (6):
bpf: introduce BPF_PROG_TYPE_FILE_FILTER
fs: wire in BPF_CGROUP_FILE_OPEN hook
tools/bpf: sync uapi/bpf.h
trace/bpf: allow %o modifier in bpf_trace_printk
libbpf: support BPF_CGROUP_FILE_OPEN in libbpf
selftests/bpf: add a test for BPF_CGROUP_FILE_OPEN

fs/open.c | 4 +
include/linux/bpf-cgroup.h | 10 +
include/linux/bpf_types.h | 1 +
include/uapi/linux/bpf.h | 28 ++-
kernel/bpf/cgroup.c | 171 ++++++++++++++++++
kernel/bpf/syscall.c | 7 +
kernel/trace/bpf_trace.c | 2 +-
tools/include/uapi/linux/bpf.h | 28 ++-
tools/lib/bpf/libbpf.c | 3 +
tools/testing/selftests/bpf/.gitignore | 1 +
tools/testing/selftests/bpf/Makefile | 6 +-
tools/testing/selftests/bpf/bpf_helpers.h | 2 +
tools/testing/selftests/bpf/test_file_open.c | 154 ++++++++++++++++
.../selftests/bpf/test_file_open_common.h | 13 ++
.../selftests/bpf/test_file_open_kern.c | 48 +++++
15 files changed, 473 insertions(+), 5 deletions(-)
create mode 100644 tools/testing/selftests/bpf/test_file_open.c
create mode 100644 tools/testing/selftests/bpf/test_file_open_common.h
create mode 100644 tools/testing/selftests/bpf/test_file_open_kern.c

--
2.17.1