bpf: Take into account BPF token when fetching helper protos

Instead of performing unconditional system-wide bpf_capable() and
perfmon_capable() calls inside bpf_base_func_proto() function (and other
similar ones) to determine eligibility of a given BPF helper for a given
program, use previously recorded BPF token during BPF_PROG_LOAD command
handling to inform the decision.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20240124022127.2379740-8-andrii@kernel.org

diff --git a/drivers/media/rc/bpf-lirc.c b/drivers/media/rc/bpf-lirc.c
index fe17c7f98e8101afdae3d608ab12a2ef7f971d0e..6d07693c6b9f5d640f98cec1ed2b798350791ca5 100644 (file)
--- a/drivers/media/rc/bpf-lirc.c
+++ b/drivers/media/rc/bpf-lirc.c
@@ -110,7 +110,7 @@ lirc_mode2_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_get_prandom_u32:
                return &bpf_get_prandom_u32_proto;
        case BPF_FUNC_trace_printk:
-               if (perfmon_capable())
+               if (bpf_token_capable(prog->aux->token, CAP_PERFMON))
                        return bpf_get_trace_printk_proto();
                fallthrough;
        default:

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index d0bf37e3f166af1df355e543058ca66042d8582b..1325225bf6022b30b3bfc2dffb41cf58c0b8cc27 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -2550,7 +2550,8 @@ int btf_find_next_decl_tag(const struct btf *btf, const struct btf_type *pt,
 struct bpf_prog *bpf_prog_by_id(u32 id);
 struct bpf_link *bpf_link_by_id(u32 id);
 
-const struct bpf_func_proto *bpf_base_func_proto(enum bpf_func_id func_id);
+const struct bpf_func_proto *bpf_base_func_proto(enum bpf_func_id func_id,
+                                                const struct bpf_prog *prog);
 void bpf_task_storage_free(struct task_struct *task);
 void bpf_cgrp_storage_free(struct cgroup *cgroup);
 bool bpf_prog_has_kfunc_call(const struct bpf_prog *prog);
@@ -2810,7 +2811,7 @@ static inline int btf_struct_access(struct bpf_verifier_log *log,
 }
 
 static inline const struct bpf_func_proto *
-bpf_base_func_proto(enum bpf_func_id func_id)
+bpf_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
        return NULL;
 }

diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index 491d20038cbe0cc133ce906ed035bca10b012727..98e0e3835b28b615d447d4b5ff08b10831d858e9 100644 (file)
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -1630,7 +1630,7 @@ cgroup_dev_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_perf_event_output:
                return &bpf_event_output_data_proto;
        default:
-               return bpf_base_func_proto(func_id);
+               return bpf_base_func_proto(func_id, prog);
        }
 }
 
@@ -2191,7 +2191,7 @@ sysctl_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_perf_event_output:
                return &bpf_event_output_data_proto;
        default:
-               return bpf_base_func_proto(func_id);
+               return bpf_base_func_proto(func_id, prog);
        }
 }
 
@@ -2348,7 +2348,7 @@ cg_sockopt_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_perf_event_output:
                return &bpf_event_output_data_proto;
        default:
-               return bpf_base_func_proto(func_id);
+               return bpf_base_func_proto(func_id, prog);
        }
 }
 

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index e04ca1af892723581354b06ba24f5637dab200d8..bcb951a2ecf4b93f1d6ddb4c3affb8ada03e191a 100644 (file)
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -1680,7 +1680,7 @@ const struct bpf_func_proto bpf_probe_read_kernel_str_proto __weak;
 const struct bpf_func_proto bpf_task_pt_regs_proto __weak;
 
 const struct bpf_func_proto *
-bpf_base_func_proto(enum bpf_func_id func_id)
+bpf_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
        switch (func_id) {
        case BPF_FUNC_map_lookup_elem:
@@ -1731,7 +1731,7 @@ bpf_base_func_proto(enum bpf_func_id func_id)
                break;
        }
 
-       if (!bpf_capable())
+       if (!bpf_token_capable(prog->aux->token, CAP_BPF))
                return NULL;
 
        switch (func_id) {
@@ -1789,7 +1789,7 @@ bpf_base_func_proto(enum bpf_func_id func_id)
                break;
        }
 
-       if (!perfmon_capable())
+       if (!bpf_token_capable(prog->aux->token, CAP_PERFMON))
                return NULL;
 
        switch (func_id) {

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 61b4bf4cc2870c2559dbe3f4089a74fb1c40e649..f76408c957ced05b4ad6699d907de04e3a3b66c1 100644 (file)
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -5772,7 +5772,7 @@ static const struct bpf_func_proto bpf_sys_bpf_proto = {
 const struct bpf_func_proto * __weak
 tracing_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
-       return bpf_base_func_proto(func_id);
+       return bpf_base_func_proto(func_id, prog);
 }
 
 BPF_CALL_1(bpf_sys_close, u32, fd)
@@ -5822,7 +5822,8 @@ syscall_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
        switch (func_id) {
        case BPF_FUNC_sys_bpf:
-               return !perfmon_capable() ? NULL : &bpf_sys_bpf_proto;
+               return !bpf_token_capable(prog->aux->token, CAP_PERFMON)
+                      ? NULL : &bpf_sys_bpf_proto;
        case BPF_FUNC_btf_find_by_name_kind:
                return &bpf_btf_find_by_name_kind_proto;
        case BPF_FUNC_sys_close:

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index c98c20abaf99d2dc49064ea37ca03c80d07f26d2..64fdaf79d11365084416da50f0bd59fe49dac6c0 100644 (file)
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -1629,7 +1629,7 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_trace_vprintk:
                return bpf_get_trace_vprintk_proto();
        default:
-               return bpf_base_func_proto(func_id);
+               return bpf_base_func_proto(func_id, prog);
        }
 }
 

diff --git a/net/core/filter.c b/net/core/filter.c
index 6a7abbaa50b889c94363f72f6014cfe9cc0db4df..521bcd0f5e4d49f922252b04b8c76b6664cdc07e 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -87,7 +87,7 @@
 #include "dev.h"
 
 static const struct bpf_func_proto *
-bpf_sk_base_func_proto(enum bpf_func_id func_id);
+bpf_sk_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog);
 
 int copy_bpf_fprog_from_user(struct sock_fprog *dst, sockptr_t src, int len)
 {
@@ -7862,7 +7862,7 @@ sock_filter_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_ktime_get_coarse_ns:
                return &bpf_ktime_get_coarse_ns_proto;
        default:
-               return bpf_base_func_proto(func_id);
+               return bpf_base_func_proto(func_id, prog);
        }
 }
 
@@ -7955,7 +7955,7 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
                        return NULL;
                }
        default:
-               return bpf_sk_base_func_proto(func_id);
+               return bpf_sk_base_func_proto(func_id, prog);
        }
 }
 
@@ -7974,7 +7974,7 @@ sk_filter_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_perf_event_output:
                return &bpf_skb_event_output_proto;
        default:
-               return bpf_sk_base_func_proto(func_id);
+               return bpf_sk_base_func_proto(func_id, prog);
        }
 }
 
@@ -8161,7 +8161,7 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 #endif
 #endif
        default:
-               return bpf_sk_base_func_proto(func_id);
+               return bpf_sk_base_func_proto(func_id, prog);
        }
 }
 
@@ -8220,7 +8220,7 @@ xdp_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 #endif
 #endif
        default:
-               return bpf_sk_base_func_proto(func_id);
+               return bpf_sk_base_func_proto(func_id, prog);
        }
 
 #if IS_MODULE(CONFIG_NF_CONNTRACK) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)
@@ -8281,7 +8281,7 @@ sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
                return &bpf_tcp_sock_proto;
 #endif /* CONFIG_INET */
        default:
-               return bpf_sk_base_func_proto(func_id);
+               return bpf_sk_base_func_proto(func_id, prog);
        }
 }
 
@@ -8323,7 +8323,7 @@ sk_msg_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
                return &bpf_get_cgroup_classid_curr_proto;
 #endif
        default:
-               return bpf_sk_base_func_proto(func_id);
+               return bpf_sk_base_func_proto(func_id, prog);
        }
 }
 
@@ -8367,7 +8367,7 @@ sk_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
                return &bpf_skc_lookup_tcp_proto;
 #endif
        default:
-               return bpf_sk_base_func_proto(func_id);
+               return bpf_sk_base_func_proto(func_id, prog);
        }
 }
 
@@ -8378,7 +8378,7 @@ flow_dissector_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_skb_load_bytes:
                return &bpf_flow_dissector_load_bytes_proto;
        default:
-               return bpf_sk_base_func_proto(func_id);
+               return bpf_sk_base_func_proto(func_id, prog);
        }
 }
 
@@ -8405,7 +8405,7 @@ lwt_out_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_skb_under_cgroup:
                return &bpf_skb_under_cgroup_proto;
        default:
-               return bpf_sk_base_func_proto(func_id);
+               return bpf_sk_base_func_proto(func_id, prog);
        }
 }
 
@@ -11236,7 +11236,7 @@ sk_reuseport_func_proto(enum bpf_func_id func_id,
        case BPF_FUNC_ktime_get_coarse_ns:
                return &bpf_ktime_get_coarse_ns_proto;
        default:
-               return bpf_base_func_proto(func_id);
+               return bpf_base_func_proto(func_id, prog);
        }
 }
 
@@ -11418,7 +11418,7 @@ sk_lookup_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_sk_release:
                return &bpf_sk_release_proto;
        default:
-               return bpf_sk_base_func_proto(func_id);
+               return bpf_sk_base_func_proto(func_id, prog);
        }
 }
 
@@ -11752,7 +11752,7 @@ const struct bpf_func_proto bpf_sock_from_file_proto = {
 };
 
 static const struct bpf_func_proto *
-bpf_sk_base_func_proto(enum bpf_func_id func_id)
+bpf_sk_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
        const struct bpf_func_proto *func;
 
@@ -11781,10 +11781,10 @@ bpf_sk_base_func_proto(enum bpf_func_id func_id)
        case BPF_FUNC_ktime_get_coarse_ns:
                return &bpf_ktime_get_coarse_ns_proto;
        default:
-               return bpf_base_func_proto(func_id);
+               return bpf_base_func_proto(func_id, prog);
        }
 
-       if (!perfmon_capable())
+       if (!bpf_token_capable(prog->aux->token, CAP_PERFMON))
                return NULL;
 
        return func;

diff --git a/net/ipv4/bpf_tcp_ca.c b/net/ipv4/bpf_tcp_ca.c
index 8e7716256d3c1d2186117349208eaa4060128bb9..834edc18463ac1b6d9621c4a9842b16903589ba1 100644 (file)
--- a/net/ipv4/bpf_tcp_ca.c
+++ b/net/ipv4/bpf_tcp_ca.c
@@ -197,7 +197,7 @@ bpf_tcp_ca_get_func_proto(enum bpf_func_id func_id,
        case BPF_FUNC_ktime_get_coarse_ns:
                return &bpf_ktime_get_coarse_ns_proto;
        default:
-               return bpf_base_func_proto(func_id);
+               return bpf_base_func_proto(func_id, prog);
        }
 }
 

diff --git a/net/netfilter/nf_bpf_link.c b/net/netfilter/nf_bpf_link.c
index 0e4beae421f8302cb0bc6cb798daf36366da0e4b..5257d5e7eb09d82aaa233f2417dfbca3e4c1f97f 100644 (file)
--- a/net/netfilter/nf_bpf_link.c
+++ b/net/netfilter/nf_bpf_link.c
@@ -314,7 +314,7 @@ static bool nf_is_valid_access(int off, int size, enum bpf_access_type type,
 static const struct bpf_func_proto *
 bpf_nf_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
-       return bpf_base_func_proto(func_id);
+       return bpf_base_func_proto(func_id, prog);
 }
 
 const struct bpf_verifier_ops netfilter_verifier_ops = {