From: Jiri Olsa <olsajiri@gmail.com>
To: Andrii Nakryiko <andrii@kernel.org>
Cc: bpf@vger.kernel.org, netdev@vger.kernel.org,
linux-fsdevel@vger.kernel.org,
linux-security-module@vger.kernel.org, keescook@chromium.org,
brauner@kernel.org, lennart@poettering.net, kernel-team@meta.com,
sargun@sargun.me
Subject: Re: [PATCH v6 bpf-next 04/13] bpf: add BPF token support to BPF_MAP_CREATE command
Date: Tue, 10 Oct 2023 10:35:48 +0200 [thread overview]
Message-ID: <ZSUM5A+dJHptbRSx@krava> (raw)
In-Reply-To: <20230927225809.2049655-5-andrii@kernel.org>
On Wed, Sep 27, 2023 at 03:58:00PM -0700, Andrii Nakryiko wrote:
SNIP
> -#define BPF_MAP_CREATE_LAST_FIELD map_extra
> +#define BPF_MAP_CREATE_LAST_FIELD map_token_fd
> /* called via syscall */
> static int map_create(union bpf_attr *attr)
> {
> const struct bpf_map_ops *ops;
> + struct bpf_token *token = NULL;
> int numa_node = bpf_map_attr_numa_node(attr);
> u32 map_type = attr->map_type;
> struct bpf_map *map;
> @@ -1157,14 +1158,32 @@ static int map_create(union bpf_attr *attr)
> if (!ops->map_mem_usage)
> return -EINVAL;
>
> + if (attr->map_token_fd) {
> + token = bpf_token_get_from_fd(attr->map_token_fd);
> + if (IS_ERR(token))
> + return PTR_ERR(token);
> +
> + /* if current token doesn't grant map creation permissions,
> + * then we can't use this token, so ignore it and rely on
> + * system-wide capabilities checks
> + */
> + if (!bpf_token_allow_cmd(token, BPF_MAP_CREATE) ||
> + !bpf_token_allow_map_type(token, attr->map_type)) {
> + bpf_token_put(token);
> + token = NULL;
> + }
> + }
> +
> + err = -EPERM;
> +
> /* Intent here is for unprivileged_bpf_disabled to block BPF map
> * creation for unprivileged users; other actions depend
> * on fd availability and access to bpffs, so are dependent on
> * object creation success. Even with unprivileged BPF disabled,
> * capability checks are still carried out.
> */
> - if (sysctl_unprivileged_bpf_disabled && !bpf_capable())
> - return -EPERM;
> + if (sysctl_unprivileged_bpf_disabled && !bpf_token_capable(token, CAP_BPF))
> + goto put_token;
>
> /* check privileged map type permissions */
> switch (map_type) {
> @@ -1197,25 +1216,27 @@ static int map_create(union bpf_attr *attr)
> case BPF_MAP_TYPE_LRU_PERCPU_HASH:
> case BPF_MAP_TYPE_STRUCT_OPS:
> case BPF_MAP_TYPE_CPUMAP:
> - if (!bpf_capable())
> - return -EPERM;
> + if (!bpf_token_capable(token, CAP_BPF))
> + goto put_token;
> break;
> case BPF_MAP_TYPE_SOCKMAP:
> case BPF_MAP_TYPE_SOCKHASH:
> case BPF_MAP_TYPE_DEVMAP:
> case BPF_MAP_TYPE_DEVMAP_HASH:
> case BPF_MAP_TYPE_XSKMAP:
> - if (!bpf_net_capable())
> - return -EPERM;
> + if (!bpf_token_capable(token, CAP_NET_ADMIN))
> + goto put_token;
> break;
> default:
> WARN(1, "unsupported map type %d", map_type);
> - return -EPERM;
> + goto put_token;
> }
>
> map = ops->map_alloc(attr);
> - if (IS_ERR(map))
> - return PTR_ERR(map);
> + if (IS_ERR(map)) {
> + err = PTR_ERR(map);
> + goto put_token;
> + }
> map->ops = ops;
> map->map_type = map_type;
>
> @@ -1252,7 +1273,7 @@ static int map_create(union bpf_attr *attr)
> map->btf = btf;
>
> if (attr->btf_value_type_id) {
> - err = map_check_btf(map, btf, attr->btf_key_type_id,
> + err = map_check_btf(map, token, btf, attr->btf_key_type_id,
> attr->btf_value_type_id);
> if (err)
> goto free_map;
I might be missing something, but should we call bpf_token_put(token)
on non-error path as well? probably after bpf_map_save_memcg call
jirka
> @@ -1293,6 +1314,8 @@ static int map_create(union bpf_attr *attr)
> free_map:
> btf_put(map->btf);
> map->ops->map_free(map);
> +put_token:
> + bpf_token_put(token);
> return err;
> }
>
SNIP
next prev parent reply other threads:[~2023-10-10 8:35 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-27 22:57 [PATCH v6 bpf-next 00/13] BPF token and BPF FS-based delegation Andrii Nakryiko
2023-09-27 22:57 ` [PATCH v6 bpf-next 01/13] bpf: align CAP_NET_ADMIN checks with bpf_capable() approach Andrii Nakryiko
2023-09-27 22:57 ` [PATCH v6 bpf-next 02/13] bpf: add BPF token delegation mount options to BPF FS Andrii Nakryiko
2023-10-10 7:08 ` Hou Tao
2023-10-12 0:30 ` Andrii Nakryiko
2023-09-27 22:57 ` [PATCH v6 bpf-next 03/13] bpf: introduce BPF token object Andrii Nakryiko
2023-10-11 1:17 ` [PATCH v6 3/13] " Paul Moore
2023-10-12 0:31 ` Andrii Nakryiko
2023-10-12 21:48 ` Andrii Nakryiko
2023-10-12 23:43 ` Paul Moore
2023-10-12 23:51 ` Andrii Nakryiko
2023-10-12 23:18 ` Paul Moore
2023-10-12 23:45 ` Andrii Nakryiko
2023-10-11 2:35 ` [PATCH v6 bpf-next 03/13] " Hou Tao
2023-10-12 0:31 ` Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 04/13] bpf: add BPF token support to BPF_MAP_CREATE command Andrii Nakryiko
2023-10-10 8:35 ` Jiri Olsa [this message]
2023-10-12 0:30 ` Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 05/13] bpf: add BPF token support to BPF_BTF_LOAD command Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 06/13] bpf: add BPF token support to BPF_PROG_LOAD command Andrii Nakryiko
2023-10-11 1:17 ` [PATCH v6 6/13] " Paul Moore
2023-10-12 0:31 ` Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 07/13] bpf: take into account BPF token when fetching helper protos Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 08/13] bpf: consistenly use BPF token throughout BPF verifier logic Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 09/13] libbpf: add bpf_token_create() API Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 10/13] libbpf: add BPF token support to bpf_map_create() API Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 11/13] libbpf: add BPF token support to bpf_btf_load() API Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 12/13] libbpf: add BPF token support to bpf_prog_load() API Andrii Nakryiko
2023-09-27 22:58 ` [PATCH v6 bpf-next 13/13] selftests/bpf: add BPF token-enabled tests Andrii Nakryiko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZSUM5A+dJHptbRSx@krava \
--to=olsajiri@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=brauner@kernel.org \
--cc=keescook@chromium.org \
--cc=kernel-team@meta.com \
--cc=lennart@poettering.net \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=sargun@sargun.me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).