bpf: add BPF token support to BPF_PROG_LOAD command

Add basic support of BPF token to BPF_PROG_LOAD. Wire through a set of
allowed BPF program types and attach types, derived from BPF FS at BPF
token creation time. Then make sure we perform bpf_token_capable()
checks everywhere where it's relevant.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231130185229.2688956-7-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index e08e8436df38b4b0f6c1fa00a89ecc3ee476f809..20af87b59d709ea536b878741a3ba97a0d86554a 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1461,6 +1461,7 @@ struct bpf_prog_aux {
 #ifdef CONFIG_SECURITY
        void *security;
 #endif
+       struct bpf_token *token;
        struct bpf_prog_offload *offload;
        struct btf *btf;
        struct bpf_func_info *func_info;
@@ -1601,6 +1602,8 @@ struct bpf_token {
        struct user_namespace *userns;
        u64 allowed_cmds;
        u64 allowed_maps;
+       u64 allowed_progs;
+       u64 allowed_attachs;
 };
 
 struct bpf_struct_ops_value;
@@ -2238,6 +2241,9 @@ struct bpf_token *bpf_token_get_from_fd(u32 ufd);
 
 bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd);
 bool bpf_token_allow_map_type(const struct bpf_token *token, enum bpf_map_type type);
+bool bpf_token_allow_prog_type(const struct bpf_token *token,
+                              enum bpf_prog_type prog_type,
+                              enum bpf_attach_type attach_type);
 
 int bpf_obj_pin_user(u32 ufd, int path_fd, const char __user *pathname);
 int bpf_obj_get_user(int path_fd, const char __user *pathname, int flags);

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 9f9989e0d062b3756a7b0c5148badbbfe0ff8db2..4df2d025c784526b434bcebc3e1a1e218fa1c48c 100644 (file)
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1028,6 +1028,7 @@ enum bpf_prog_type {
        BPF_PROG_TYPE_SK_LOOKUP,
        BPF_PROG_TYPE_SYSCALL, /* a program that can execute syscalls */
        BPF_PROG_TYPE_NETFILTER,
+       __MAX_BPF_PROG_TYPE
 };
 
 enum bpf_attach_type {
@@ -1504,6 +1505,7 @@ union bpf_attr {
                 * truncated), or smaller (if log buffer wasn't filled completely).
                 */
                __u32           log_true_size;
+               __u32           prog_token_fd;
        };
 
        struct { /* anonymous struct used by BPF_OBJ_* commands */

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 4b813da8d6c070ca1cda7ff1ca148681332b6743..47085839af8d0ec1a8d94fc4a638f2153f9b5167 100644 (file)
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2751,6 +2751,7 @@ void bpf_prog_free(struct bpf_prog *fp)
 
        if (aux->dst_prog)
                bpf_prog_put(aux->dst_prog);
+       bpf_token_put(aux->token);
        INIT_WORK(&aux->work, bpf_prog_free_deferred);
        schedule_work(&aux->work);
 }

diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
index 9c7865d1c53d1014106a0e2e75ace1716ce96930..5359a0929c35d75149ead1c543521e1587bc6bc7 100644 (file)
--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -619,12 +619,14 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)
        else if (opts->delegate_maps)
                seq_printf(m, ",delegate_maps=0x%llx", opts->delegate_maps);
 
-       if (opts->delegate_progs == ~0ULL)
+       mask = (1ULL << __MAX_BPF_PROG_TYPE) - 1;
+       if ((opts->delegate_progs & mask) == mask)
                seq_printf(m, ",delegate_progs=any");
        else if (opts->delegate_progs)
                seq_printf(m, ",delegate_progs=0x%llx", opts->delegate_progs);
 
-       if (opts->delegate_attachs == ~0ULL)
+       mask = (1ULL << __MAX_BPF_ATTACH_TYPE) - 1;
+       if ((opts->delegate_attachs & mask) == mask)
                seq_printf(m, ",delegate_attachs=any");
        else if (opts->delegate_attachs)
                seq_printf(m, ",delegate_attachs=0x%llx", opts->delegate_attachs);

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index d87c5c27cde31a9648a2efbb212eb5b809407152..2c8393c21b8c66151e1a87567a0d3ade96f3c45e 100644 (file)
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2608,13 +2608,15 @@ static bool is_perfmon_prog_type(enum bpf_prog_type prog_type)
 }
 
 /* last field in 'union bpf_attr' used by this command */
-#define        BPF_PROG_LOAD_LAST_FIELD log_true_size
+#define BPF_PROG_LOAD_LAST_FIELD prog_token_fd
 
 static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
 {
        enum bpf_prog_type type = attr->prog_type;
        struct bpf_prog *prog, *dst_prog = NULL;
        struct btf *attach_btf = NULL;
+       struct bpf_token *token = NULL;
+       bool bpf_cap;
        int err;
        char license[128];
 
@@ -2631,10 +2633,31 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
                                 BPF_F_TEST_REG_INVARIANTS))
                return -EINVAL;
 
+       bpf_prog_load_fixup_attach_type(attr);
+
+       if (attr->prog_token_fd) {
+               token = bpf_token_get_from_fd(attr->prog_token_fd);
+               if (IS_ERR(token))
+                       return PTR_ERR(token);
+               /* if current token doesn't grant prog loading permissions,
+                * then we can't use this token, so ignore it and rely on
+                * system-wide capabilities checks
+                */
+               if (!bpf_token_allow_cmd(token, BPF_PROG_LOAD) ||
+                   !bpf_token_allow_prog_type(token, attr->prog_type,
+                                              attr->expected_attach_type)) {
+                       bpf_token_put(token);
+                       token = NULL;
+               }
+       }
+
+       bpf_cap = bpf_token_capable(token, CAP_BPF);
+       err = -EPERM;
+
        if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) &&
            (attr->prog_flags & BPF_F_ANY_ALIGNMENT) &&
-           !bpf_capable())
-               return -EPERM;
+           !bpf_cap)
+               goto put_token;
 
        /* Intent here is for unprivileged_bpf_disabled to block BPF program
         * creation for unprivileged users; other actions depend
@@ -2643,21 +2666,23 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
         * capability checks are still carried out for these
         * and other operations.
         */
-       if (sysctl_unprivileged_bpf_disabled && !bpf_capable())
-               return -EPERM;
+       if (sysctl_unprivileged_bpf_disabled && !bpf_cap)
+               goto put_token;
 
        if (attr->insn_cnt == 0 ||
-           attr->insn_cnt > (bpf_capable() ? BPF_COMPLEXITY_LIMIT_INSNS : BPF_MAXINSNS))
-               return -E2BIG;
+           attr->insn_cnt > (bpf_cap ? BPF_COMPLEXITY_LIMIT_INSNS : BPF_MAXINSNS)) {
+               err = -E2BIG;
+               goto put_token;
+       }
        if (type != BPF_PROG_TYPE_SOCKET_FILTER &&
            type != BPF_PROG_TYPE_CGROUP_SKB &&
-           !bpf_capable())
-               return -EPERM;
+           !bpf_cap)
+               goto put_token;
 
-       if (is_net_admin_prog_type(type) && !bpf_net_capable())
-               return -EPERM;
-       if (is_perfmon_prog_type(type) && !perfmon_capable())
-               return -EPERM;
+       if (is_net_admin_prog_type(type) && !bpf_token_capable(token, CAP_NET_ADMIN))
+               goto put_token;
+       if (is_perfmon_prog_type(type) && !bpf_token_capable(token, CAP_PERFMON))
+               goto put_token;
 
        /* attach_prog_fd/attach_btf_obj_fd can specify fd of either bpf_prog
         * or btf, we need to check which one it is
@@ -2667,27 +2692,33 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
                if (IS_ERR(dst_prog)) {
                        dst_prog = NULL;
                        attach_btf = btf_get_by_fd(attr->attach_btf_obj_fd);
-                       if (IS_ERR(attach_btf))
-                               return -EINVAL;
+                       if (IS_ERR(attach_btf)) {
+                               err = -EINVAL;
+                               goto put_token;
+                       }
                        if (!btf_is_kernel(attach_btf)) {
                                /* attaching through specifying bpf_prog's BTF
                                 * objects directly might be supported eventually
                                 */
                                btf_put(attach_btf);
-                               return -ENOTSUPP;
+                               err = -ENOTSUPP;
+                               goto put_token;
                        }
                }
        } else if (attr->attach_btf_id) {
                /* fall back to vmlinux BTF, if BTF type ID is specified */
                attach_btf = bpf_get_btf_vmlinux();
-               if (IS_ERR(attach_btf))
-                       return PTR_ERR(attach_btf);
-               if (!attach_btf)
-                       return -EINVAL;
+               if (IS_ERR(attach_btf)) {
+                       err = PTR_ERR(attach_btf);
+                       goto put_token;
+               }
+               if (!attach_btf) {
+                       err = -EINVAL;
+                       goto put_token;
+               }
                btf_get(attach_btf);
        }
 
-       bpf_prog_load_fixup_attach_type(attr);
        if (bpf_prog_load_check_attach(type, attr->expected_attach_type,
                                       attach_btf, attr->attach_btf_id,
                                       dst_prog)) {
@@ -2695,7 +2726,8 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
                        bpf_prog_put(dst_prog);
                if (attach_btf)
                        btf_put(attach_btf);
-               return -EINVAL;
+               err = -EINVAL;
+               goto put_token;
        }
 
        /* plain bpf_prog allocation */
@@ -2705,7 +2737,8 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
                        bpf_prog_put(dst_prog);
                if (attach_btf)
                        btf_put(attach_btf);
-               return -ENOMEM;
+               err = -EINVAL;
+               goto put_token;
        }
 
        prog->expected_attach_type = attr->expected_attach_type;
@@ -2716,6 +2749,10 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
        prog->aux->sleepable = attr->prog_flags & BPF_F_SLEEPABLE;
        prog->aux->xdp_has_frags = attr->prog_flags & BPF_F_XDP_HAS_FRAGS;
 
+       /* move token into prog->aux, reuse taken refcnt */
+       prog->aux->token = token;
+       token = NULL;
+
        err = security_bpf_prog_alloc(prog->aux);
        if (err)
                goto free_prog;
@@ -2817,6 +2854,8 @@ free_prog:
        if (prog->aux->attach_btf)
                btf_put(prog->aux->attach_btf);
        bpf_prog_free(prog);
+put_token:
+       bpf_token_put(token);
        return err;
 }
 
@@ -3806,7 +3845,7 @@ static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog,
        case BPF_PROG_TYPE_SK_LOOKUP:
                return attach_type == prog->expected_attach_type ? 0 : -EINVAL;
        case BPF_PROG_TYPE_CGROUP_SKB:
-               if (!bpf_net_capable())
+               if (!bpf_token_capable(prog->aux->token, CAP_NET_ADMIN))
                        /* cg-skb progs can be loaded by unpriv user.
                         * check permissions at attach time.
                         */

diff --git a/kernel/bpf/token.c b/kernel/bpf/token.c
index 06c34dae658e05eaf0acc8b80f45eb2dd7f2a4a4..5a51e6b8f6bf5d5ce4152db43f582e1a46350839 100644 (file)
--- a/kernel/bpf/token.c
+++ b/kernel/bpf/token.c
@@ -79,6 +79,20 @@ static void bpf_token_show_fdinfo(struct seq_file *m, struct file *filp)
                seq_printf(m, "allowed_maps:\tany\n");
        else
                seq_printf(m, "allowed_maps:\t0x%llx\n", token->allowed_maps);
+
+       BUILD_BUG_ON(__MAX_BPF_PROG_TYPE >= 64);
+       mask = (1ULL << __MAX_BPF_PROG_TYPE) - 1;
+       if ((token->allowed_progs & mask) == mask)
+               seq_printf(m, "allowed_progs:\tany\n");
+       else
+               seq_printf(m, "allowed_progs:\t0x%llx\n", token->allowed_progs);
+
+       BUILD_BUG_ON(__MAX_BPF_ATTACH_TYPE >= 64);
+       mask = (1ULL << __MAX_BPF_ATTACH_TYPE) - 1;
+       if ((token->allowed_attachs & mask) == mask)
+               seq_printf(m, "allowed_attachs:\tany\n");
+       else
+               seq_printf(m, "allowed_attachs:\t0x%llx\n", token->allowed_attachs);
 }
 
 #define BPF_TOKEN_INODE_NAME "bpf-token"
@@ -169,6 +183,8 @@ int bpf_token_create(union bpf_attr *attr)
        mnt_opts = path.dentry->d_sb->s_fs_info;
        token->allowed_cmds = mnt_opts->delegate_cmds;
        token->allowed_maps = mnt_opts->delegate_maps;
+       token->allowed_progs = mnt_opts->delegate_progs;
+       token->allowed_attachs = mnt_opts->delegate_attachs;
 
        fd = get_unused_fd_flags(O_CLOEXEC);
        if (fd < 0) {
@@ -228,3 +244,14 @@ bool bpf_token_allow_map_type(const struct bpf_token *token, enum bpf_map_type t
 
        return token->allowed_maps & (1ULL << type);
 }
+
+bool bpf_token_allow_prog_type(const struct bpf_token *token,
+                              enum bpf_prog_type prog_type,
+                              enum bpf_attach_type attach_type)
+{
+       if (!token || prog_type >= __MAX_BPF_PROG_TYPE || attach_type >= __MAX_BPF_ATTACH_TYPE)
+               return false;
+
+       return (token->allowed_progs & (1ULL << prog_type)) &&
+              (token->allowed_attachs & (1ULL << attach_type));
+}

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 9f9989e0d062b3756a7b0c5148badbbfe0ff8db2..4df2d025c784526b434bcebc3e1a1e218fa1c48c 100644 (file)
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -1028,6 +1028,7 @@ enum bpf_prog_type {
        BPF_PROG_TYPE_SK_LOOKUP,
        BPF_PROG_TYPE_SYSCALL, /* a program that can execute syscalls */
        BPF_PROG_TYPE_NETFILTER,
+       __MAX_BPF_PROG_TYPE
 };
 
 enum bpf_attach_type {
@@ -1504,6 +1505,7 @@ union bpf_attr {
                 * truncated), or smaller (if log buffer wasn't filled completely).
                 */
                __u32           log_true_size;
+               __u32           prog_token_fd;
        };
 
        struct { /* anonymous struct used by BPF_OBJ_* commands */

diff --git a/tools/testing/selftests/bpf/prog_tests/libbpf_probes.c b/tools/testing/selftests/bpf/prog_tests/libbpf_probes.c
index 573249a2814dc2741f7b43ba39ae078cfb87c095..4ed46ed58a7b098259572581bcc87ee85a9f9013 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/libbpf_probes.c
+++ b/tools/testing/selftests/bpf/prog_tests/libbpf_probes.c
@@ -30,6 +30,8 @@ void test_libbpf_probe_prog_types(void)
 
                if (prog_type == BPF_PROG_TYPE_UNSPEC)
                        continue;
+               if (strcmp(prog_type_name, "__MAX_BPF_PROG_TYPE") == 0)
+                       continue;
 
                if (!test__start_subtest(prog_type_name))
                        continue;

diff --git a/tools/testing/selftests/bpf/prog_tests/libbpf_str.c b/tools/testing/selftests/bpf/prog_tests/libbpf_str.c
index 2a0633f43c73c4813f6596af1ffbaa169815aa87..384bc1f7a65ea039a13136d3fa38050422e62f30 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/libbpf_str.c
+++ b/tools/testing/selftests/bpf/prog_tests/libbpf_str.c
@@ -189,6 +189,9 @@ static void test_libbpf_bpf_prog_type_str(void)
                const char *prog_type_str;
                char buf[256];
 
+               if (prog_type == __MAX_BPF_PROG_TYPE)
+                       continue;
+
                prog_type_name = btf__str_by_offset(btf, e->name_off);
                prog_type_str = libbpf_bpf_prog_type_str(prog_type);
                ASSERT_OK_PTR(prog_type_str, prog_type_name);