mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-26 22:24:09 +08:00
9e4e01dfd3
JITed BPF programs are dynamically attached to the LSM hooks using BPF trampolines. The trampoline prologue generates code to handle conversion of the signature of the hook to the appropriate BPF context. The allocated trampoline programs are attached to the nop functions initialized as LSM hooks. BPF_PROG_TYPE_LSM programs must have a GPL compatible license and and need CAP_SYS_ADMIN (required for loading eBPF programs). Upon attachment: * A BPF fexit trampoline is used for LSM hooks with a void return type. * A BPF fmod_ret trampoline is used for LSM hooks which return an int. The attached programs can override the return value of the bpf LSM hook to indicate a MAC Policy decision. Signed-off-by: KP Singh <kpsingh@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Brendan Jackman <jackmanb@google.com> Reviewed-by: Florent Revest <revest@google.com> Acked-by: Andrii Nakryiko <andriin@fb.com> Acked-by: James Morris <jamorris@linux.microsoft.com> Link: https://lore.kernel.org/bpf/20200329004356.27286-5-kpsingh@chromium.org
55 lines
1.2 KiB
C
55 lines
1.2 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
/*
|
|
* Copyright (C) 2020 Google LLC.
|
|
*/
|
|
|
|
#include <linux/filter.h>
|
|
#include <linux/bpf.h>
|
|
#include <linux/btf.h>
|
|
#include <linux/lsm_hooks.h>
|
|
#include <linux/bpf_lsm.h>
|
|
#include <linux/kallsyms.h>
|
|
#include <linux/bpf_verifier.h>
|
|
|
|
/* For every LSM hook that allows attachment of BPF programs, declare a nop
|
|
* function where a BPF program can be attached.
|
|
*/
|
|
#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
|
|
noinline RET bpf_lsm_##NAME(__VA_ARGS__) \
|
|
{ \
|
|
return DEFAULT; \
|
|
}
|
|
|
|
#include <linux/lsm_hook_defs.h>
|
|
#undef LSM_HOOK
|
|
|
|
#define BPF_LSM_SYM_PREFX "bpf_lsm_"
|
|
|
|
int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
|
|
const struct bpf_prog *prog)
|
|
{
|
|
if (!prog->gpl_compatible) {
|
|
bpf_log(vlog,
|
|
"LSM programs must have a GPL compatible license\n");
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (strncmp(BPF_LSM_SYM_PREFX, prog->aux->attach_func_name,
|
|
sizeof(BPF_LSM_SYM_PREFX) - 1)) {
|
|
bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n",
|
|
prog->aux->attach_btf_id, prog->aux->attach_func_name);
|
|
return -EINVAL;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
const struct bpf_prog_ops lsm_prog_ops = {
|
|
};
|
|
|
|
const struct bpf_verifier_ops lsm_verifier_ops = {
|
|
.get_func_proto = bpf_tracing_func_proto,
|
|
.is_valid_access = btf_ctx_access,
|
|
};
|