wonderful-mobile/exynos-linux-stable
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

BACKPORT: security: bpf: Add LSM hooks for bpf object related syscall

Browse source 
Introduce several LSM hooks for the syscalls that will allow the
userspace to access to eBPF object such as eBPF programs and eBPF maps.
The security check is aimed to enforce a per object security protection
for eBPF object so only processes with the right priviliges can
read/write to a specific map or use a specific eBPF program. Besides
that, a general security hook is added before the multiplexer of bpf
syscall to check the cmd and the attribute used for the command. The
actual security module can decide which command need to be checked and
how the cmd should be checked.

Signed-off-by: Chenbo Feng <fengc@google.com>
Acked-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Added the LIST_HEAD_INIT call for security hooks, it nolonger exist in
uptream code.
(cherry-pick from net-next: afdb09c720b62b8090584c11151d856df330e57d)
Bug: 30950746

Change-Id: Ieb3ac74392f531735fc7c949b83346a5f587a77b
This commit is contained in:
Chenbo Feng 2017-10-18 13:00:24 -07:00
parent 4672ded3ec
commit f3ad3766a9
5 changed files with 185 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

55
include/linux/lsm_hooks.h
View file

@ -1328,7 +1328,40 @@
* @inode we wish to get the security context of.
* @ctx is a pointer in which to place the allocated security context.
* @ctxlen points to the place to put the length of @ctx.
* This is the main security structure.
*
* Security hooks for using the eBPF maps and programs functionalities through
* eBPF syscalls.
*
* @bpf:
* Do a initial check for all bpf syscalls after the attribute is copied
* into the kernel. The actual security module can implement their own
* rules to check the specific cmd they need.
*
* @bpf_map:
* Do a check when the kernel generate and return a file descriptor for
* eBPF maps.
*
* @map: bpf map that we want to access
* @mask: the access flags
*
* @bpf_prog:
* Do a check when the kernel generate and return a file descriptor for
* eBPF programs.
*
* @prog: bpf prog that userspace want to use.
*
* @bpf_map_alloc_security:
* Initialize the security field inside bpf map.
*
* @bpf_map_free_security:
* Clean up the security information stored inside bpf map.
*
* @bpf_prog_alloc_security:
* Initialize the security field inside bpf program.
*
* @bpf_prog_free_security:
* Clean up the security information stored inside bpf prog.
*
*/
union security_list_options {
@ -1652,6 +1685,17 @@ union security_list_options {
struct audit_context *actx);
void (*audit_rule_free)(void *lsmrule);
#endif /* CONFIG_AUDIT */
#ifdef CONFIG_BPF_SYSCALL
int (*bpf)(int cmd, union bpf_attr *attr,
unsigned int size);
int (*bpf_map)(struct bpf_map *map, fmode_t fmode);
int (*bpf_prog)(struct bpf_prog *prog);
int (*bpf_map_alloc_security)(struct bpf_map *map);
void (*bpf_map_free_security)(struct bpf_map *map);
int (*bpf_prog_alloc_security)(struct bpf_prog_aux *aux);
void (*bpf_prog_free_security)(struct bpf_prog_aux *aux);
#endif /* CONFIG_BPF_SYSCALL */
};
struct security_hook_heads {
@ -1866,6 +1910,15 @@ struct security_hook_heads {
struct list_head audit_rule_match;
struct list_head audit_rule_free;
#endif /* CONFIG_AUDIT */
#ifdef CONFIG_BPF_SYSCALL
struct list_head bpf;
struct list_head bpf_map;
struct list_head bpf_prog;
struct list_head bpf_map_alloc_security;
struct list_head bpf_map_free_security;
struct list_head bpf_prog_alloc_security;
struct list_head bpf_prog_free_security;
#endif /* CONFIG_BPF_SYSCALL */
};
/*