From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexei Starovoitov Subject: [PATCH bpf-next 0/6] bpf: introduce BPF_CGROUP_FILE_OPEN Date: Wed, 3 Oct 2018 19:57:44 -0700 Message-ID: <20181004025750.498303-1-ast@kernel.org> Mime-Version: 1.0 Content-Type: text/plain Cc: , , , , , To: "David S . Miller" Return-path: Received: from mx0a-00082601.pphosted.com ([67.231.145.42]:54950 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726633AbeJDJtF (ORCPT ); Thu, 4 Oct 2018 05:49:05 -0400 Received: from pps.filterd (m0148461.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w942qJDh008250 for ; Wed, 3 Oct 2018 19:57:57 -0700 Received: from mail.thefacebook.com ([199.201.64.23]) by mx0a-00082601.pphosted.com with ESMTP id 2mw7708g4e-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Wed, 03 Oct 2018 19:57:57 -0700 Sender: netdev-owner@vger.kernel.org List-ID: Hi All, Similar to networking sandboxing programs and cgroup-v2 based hooks (BPF_CGROUP_INET_[INGRESS|EGRESS,] BPF_CGROUP_INET[4|6]_[BIND|CONNECT], etc) introduce basic per-container sandboxing for file access via new BPF_PROG_TYPE_FILE_FILTER program type that attaches after security_file_open() LSM hook and works as additional file_open filter. The new cgroup bpf hook is called BPF_CGROUP_FILE_OPEN. Just like other cgroup-bpf programs new BPF_PROG_TYPE_FILE_FILTER type is only available to root. Use cases: - disallow certain FS types within containers (fs_magic == CGROUP2_SUPER_MAGIC) - restrict permissions in particular mount (mnt_id == X && (flags & O_RDWR)) - disallow access to hard linked sensitive files (nlink > 1 && mode == 0700) - disallow access to world writeable files (mode == 0..7) - disallow access to given set of files (dev_major == X && dev_minor == Y && inode == Z) Alexei Starovoitov (6): bpf: introduce BPF_PROG_TYPE_FILE_FILTER fs: wire in BPF_CGROUP_FILE_OPEN hook tools/bpf: sync uapi/bpf.h trace/bpf: allow %o modifier in bpf_trace_printk libbpf: support BPF_CGROUP_FILE_OPEN in libbpf selftests/bpf: add a test for BPF_CGROUP_FILE_OPEN fs/open.c | 4 + include/linux/bpf-cgroup.h | 10 + include/linux/bpf_types.h | 1 + include/uapi/linux/bpf.h | 28 ++- kernel/bpf/cgroup.c | 171 ++++++++++++++++++ kernel/bpf/syscall.c | 7 + kernel/trace/bpf_trace.c | 2 +- tools/include/uapi/linux/bpf.h | 28 ++- tools/lib/bpf/libbpf.c | 3 + tools/testing/selftests/bpf/.gitignore | 1 + tools/testing/selftests/bpf/Makefile | 6 +- tools/testing/selftests/bpf/bpf_helpers.h | 2 + tools/testing/selftests/bpf/test_file_open.c | 154 ++++++++++++++++ .../selftests/bpf/test_file_open_common.h | 13 ++ .../selftests/bpf/test_file_open_kern.c | 48 +++++ 15 files changed, 473 insertions(+), 5 deletions(-) create mode 100644 tools/testing/selftests/bpf/test_file_open.c create mode 100644 tools/testing/selftests/bpf/test_file_open_common.h create mode 100644 tools/testing/selftests/bpf/test_file_open_kern.c -- 2.17.1