Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/808426/?format=api
{ "id": 808426, "url": "http://patchwork.ozlabs.org/api/patches/808426/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netdev/patch/20170831205635.80256-2-chenbofeng.kernel@gmail.com/", "project": { "id": 7, "url": "http://patchwork.ozlabs.org/api/projects/7/?format=api", "name": "Linux network development", "link_name": "netdev", "list_id": "netdev.vger.kernel.org", "list_email": "netdev@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20170831205635.80256-2-chenbofeng.kernel@gmail.com>", "list_archive_url": null, "date": "2017-08-31T20:56:33", "name": "[1/3] security: bpf: Add eBPF LSM hooks to security module", "commit_ref": null, "pull_url": null, "state": "changes-requested", "archived": true, "hash": "69ca9bc3d4e4da0df1a6684098215382187a2e90", "submitter": { "id": 70894, "url": "http://patchwork.ozlabs.org/api/people/70894/?format=api", "name": "Chenbo Feng", "email": "chenbofeng.kernel@gmail.com" }, "delegate": { "id": 34, "url": "http://patchwork.ozlabs.org/api/users/34/?format=api", "username": "davem", "first_name": "David", "last_name": "Miller", "email": "davem@davemloft.net" }, "mbox": "http://patchwork.ozlabs.org/project/netdev/patch/20170831205635.80256-2-chenbofeng.kernel@gmail.com/mbox/", "series": [ { "id": 906, "url": "http://patchwork.ozlabs.org/api/series/906/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netdev/list/?series=906", "date": "2017-08-31T20:56:32", "name": "Security: add lsm hooks for checking permissions on eBPF objects", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/906/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/808426/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/808426/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<netdev-owner@vger.kernel.org>", "X-Original-To": "patchwork-incoming@ozlabs.org", "Delivered-To": "patchwork-incoming@ozlabs.org", "Authentication-Results": [ "ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=<UNKNOWN>)", "ozlabs.org; dkim=pass (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"efnf/pfO\"; dkim-atps=neutral" ], "Received": [ "from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xjvnh2cqNz9t1t\n\tfor <patchwork-incoming@ozlabs.org>;\n\tFri, 1 Sep 2017 06:57:12 +1000 (AEST)", "(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1751409AbdHaU5K (ORCPT <rfc822;patchwork-incoming@ozlabs.org>);\n\tThu, 31 Aug 2017 16:57:10 -0400", "from mail-pg0-f68.google.com ([74.125.83.68]:35360 \"EHLO\n\tmail-pg0-f68.google.com\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1751309AbdHaU5I (ORCPT\n\t<rfc822;netdev@vger.kernel.org>); Thu, 31 Aug 2017 16:57:08 -0400", "by mail-pg0-f68.google.com with SMTP id r133so469483pgr.2;\n\tThu, 31 Aug 2017 13:57:08 -0700 (PDT)", "from fengc.mtv.corp.google.com ([100.98.121.64])\n\tby smtp.gmail.com with ESMTPSA id\n\tg68sm710967pfj.33.2017.08.31.13.57.07\n\t(version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);\n\tThu, 31 Aug 2017 13:57:07 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=gmail.com; s=20161025;\n\th=from:to:cc:subject:date:message-id:in-reply-to:references;\n\tbh=E8cX7VtyX0vGbSQxmp9m57Lzn6sgUbEdMrj7UqEeknY=;\n\tb=efnf/pfOmLIgxelqBmpZ/VV8WkjbqmBfGxKLNKh9EjRKLYN4cKUAUcjHTL9qjyzJNC\n\taLlJJYG+jaFHhqhIbnrXDlJEnE8BR1deO+F4HNztdWxjGkjwrldu7fC+FB5Wxe/ozVwF\n\tKwePyjgPogzsHOBG0yj14d1g63yOoCieMimZU1uItXluQjTXCXlPbsMaWJL+qT9ZMmtH\n\tTZxJ1YfSNBEqs0vqVdZ4cUsY1UM9WQViFEg5U8Z5EBGy+/DT9nhie3Ry9qVeCxyQlqIP\n\tu5glcOWZYPJ2fDS9G/8Fp33DgC4SI0CMmUeENtNM/Kjvv8g7ab+5M0+vroYQlL20msz6\n\t6Qlg==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to\n\t:references;\n\tbh=E8cX7VtyX0vGbSQxmp9m57Lzn6sgUbEdMrj7UqEeknY=;\n\tb=qH7S5I5UQIKRwaBmNYUJHrT1kXqsl8KoXgrfllRP5yvd8HXOOnTlLq4U4MvWs9G7Dw\n\tZ5pvfHPFrlLQmIRpHuqyQwaEjHM+0JrewcYpINrfYd2Ggz4SpMOGiKwbWrUnenvCKqGz\n\t1AFIiuvp6NvMZqQLe3ScVVrQntVng7CdnOf34PFj/i+EsGRsihggduXhnygVLo4Mvf53\n\tBvmApTNI+lxqEnJDYhc4kvVYjq7IKrUM5BQmVDr5LNKKERVqMcr1Z6VGYC4cUQeHl4Wk\n\t7DdBcbDRunSMC18x+V7khYf8Nbd0PSq7EQ+3eK2MBbXeCAlEhp78SVKyuO129KNtib/j\n\tN4eg==", "X-Gm-Message-State": "AHYfb5gg6qmbO6Hi3rXvGpAOcToJg7d23jjmLB6gM1t9i1EffBABZ8w1\n\tDH6Lj38LQdNl8crn", "X-Google-Smtp-Source": "ADKCNb6BMPEm+POJu5MTYvIgbrTvzIAzKSqq89VmTSX+PbMALThR8lNu6/vHkQCCjeUY0trSodPKGA==", "X-Received": "by 10.98.75.200 with SMTP id d69mr3667303pfj.271.1504213027916; \n\tThu, 31 Aug 2017 13:57:07 -0700 (PDT)", "From": "Chenbo Feng <chenbofeng.kernel@gmail.com>", "To": "linux-security-module@vger.kernel.org", "Cc": "Jeffrey Vander Stoep <jeffv@google.com>, netdev@vger.kernel.org,\n\tSELinux <Selinux@tycho.nsa.gov>,\n\tAlexei Starovoitov <alexei.starovoitov@gmail.com>,\n\tlorenzo@google.com, Chenbo Feng <fengc@google.com>", "Subject": "[PATCH 1/3] security: bpf: Add eBPF LSM hooks to security module", "Date": "Thu, 31 Aug 2017 13:56:33 -0700", "Message-Id": "<20170831205635.80256-2-chenbofeng.kernel@gmail.com>", "X-Mailer": "git-send-email 2.14.1.581.gf28d330327-goog", "In-Reply-To": "<20170831205635.80256-1-chenbofeng.kernel@gmail.com>", "References": "<20170831205635.80256-1-chenbofeng.kernel@gmail.com>", "Sender": "netdev-owner@vger.kernel.org", "Precedence": "bulk", "List-ID": "<netdev.vger.kernel.org>", "X-Mailing-List": "netdev@vger.kernel.org" }, "content": "From: Chenbo Feng <fengc@google.com>\n\nIntroduce 5 LSM hooks to provide finer granularity controls on eBPF\nrelated operations including create eBPF maps, modify and read eBPF maps\ncontent and load eBPF programs to the kernel. Hooks use the new security\npointer inside the eBPF map struct to store the owner's security\ninformation and the different security modules can perform different\nchecks based on the information stored inside the security field.\n\nSigned-off-by: Chenbo Feng <fengc@google.com>\n---\n include/linux/lsm_hooks.h | 41 +++++++++++++++++++++++++++++++++++++++++\n include/linux/security.h | 36 ++++++++++++++++++++++++++++++++++++\n security/security.c | 28 ++++++++++++++++++++++++++++\n 3 files changed, 105 insertions(+)", "diff": "diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h\nindex ce02f76a6188..3aaf9a08a983 100644\n--- a/include/linux/lsm_hooks.h\n+++ b/include/linux/lsm_hooks.h\n@@ -1353,6 +1353,32 @@\n *\t@inode we wish to get the security context of.\n *\t@ctx is a pointer in which to place the allocated security context.\n *\t@ctxlen points to the place to put the length of @ctx.\n+ *\n+ * Security hooks for using the eBPF maps and programs functionalities through\n+ * eBPF syscalls.\n+ *\n+ * @bpf_map_create:\n+ *\tCheck permissions prior to creating a new bpf map.\n+ *\tReturn 0 if the permission is granted.\n+ *\n+ * @bpf_map_modify:\n+ *\tCheck permission prior to insert, update and delete map content.\n+ *\t@map pointer to the struct bpf_map that contains map information.\n+ *\tReturn 0 if the permission is granted.\n+ *\n+ * @bpf_map_read:\n+ *\tCheck permission prior to read a bpf map content.\n+ *\t@map pointer to the struct bpf_map that contains map information.\n+ *\tReturn 0 if the permission is granted.\n+ *\n+ * @bpf_prog_load:\n+ *\tCheck permission prior to load eBPF program.\n+ *\tReturn 0 if the permission is granted.\n+ *\n+ * @bpf_post_create:\n+ *\tInitialize the bpf object security field inside struct bpf_maps and\n+ *\tit is used for future security checks.\n+ *\n */\n union security_list_options {\n \tint (*binder_set_context_mgr)(struct task_struct *mgr);\n@@ -1685,6 +1711,14 @@ union security_list_options {\n \t\t\t\tstruct audit_context *actx);\n \tvoid (*audit_rule_free)(void *lsmrule);\n #endif /* CONFIG_AUDIT */\n+\n+#ifdef CONFIG_BPF_SYSCALL\n+\tint (*bpf_map_create)(void);\n+\tint (*bpf_map_read)(struct bpf_map *map);\n+\tint (*bpf_map_modify)(struct bpf_map *map);\n+\tint (*bpf_prog_load)(void);\n+\tint (*bpf_post_create)(struct bpf_map *map);\n+#endif /* CONFIG_BPF_SYSCALL */\n };\n \n struct security_hook_heads {\n@@ -1905,6 +1939,13 @@ struct security_hook_heads {\n \tstruct list_head audit_rule_match;\n \tstruct list_head audit_rule_free;\n #endif /* CONFIG_AUDIT */\n+#ifdef CONFIG_BPF_SYSCALL\n+\tstruct list_head bpf_map_create;\n+\tstruct list_head bpf_map_read;\n+\tstruct list_head bpf_map_modify;\n+\tstruct list_head bpf_prog_load;\n+\tstruct list_head bpf_post_create;\n+#endif /* CONFIG_BPF_SYSCALL */\n } __randomize_layout;\n \n /*\ndiff --git a/include/linux/security.h b/include/linux/security.h\nindex 458e24bea2d4..0656a4f74d14 100644\n--- a/include/linux/security.h\n+++ b/include/linux/security.h\n@@ -31,6 +31,7 @@\n #include <linux/string.h>\n #include <linux/mm.h>\n #include <linux/fs.h>\n+#include <linux/bpf.h>\n \n struct linux_binprm;\n struct cred;\n@@ -1735,6 +1736,41 @@ static inline void securityfs_remove(struct dentry *dentry)\n \n #endif\n \n+#ifdef CONFIG_BPF_SYSCALL\n+#ifdef CONFIG_SECURITY\n+int security_map_create(void);\n+int security_map_modify(struct bpf_map *map);\n+int security_map_read(struct bpf_map *map);\n+int security_prog_load(void);\n+int security_post_create(struct bpf_map *map);\n+#else\n+static inline int security_map_create(void)\n+{\n+\treturn 0;\n+}\n+\n+static inline int security_map_read(struct bpf_map *map)\n+{\n+\treturn 0;\n+}\n+\n+static inline int security_map_modify(struct bpf_map *map)\n+{\n+\treturn 0;\n+}\n+\n+static inline int security_prog_load(void)\n+{\n+\treturn 0;\n+}\n+\n+static inline int security_post_create(struct bpf_map *map)\n+{\n+\treturn 0;\n+}\n+#endif /* CONFIG_SECURITY */\n+#endif /* CONFIG_BPF_SYSCALL */\n+\n #ifdef CONFIG_SECURITY\n \n static inline char *alloc_secdata(void)\ndiff --git a/security/security.c b/security/security.c\nindex 55b5997e4b72..02272f93a89e 100644\n--- a/security/security.c\n+++ b/security/security.c\n@@ -12,6 +12,7 @@\n *\t(at your option) any later version.\n */\n \n+#include <linux/bpf.h>\n #include <linux/capability.h>\n #include <linux/dcache.h>\n #include <linux/module.h>\n@@ -1708,3 +1709,30 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,\n \t\t\t\tactx);\n }\n #endif /* CONFIG_AUDIT */\n+\n+#ifdef CONFIG_BPF_SYSCALL\n+int security_map_create(void)\n+{\n+\treturn call_int_hook(bpf_map_create, 0);\n+}\n+\n+int security_map_modify(struct bpf_map *map)\n+{\n+\treturn call_int_hook(bpf_map_modify, 0, map);\n+}\n+\n+int security_map_read(struct bpf_map *map)\n+{\n+\treturn call_int_hook(bpf_map_read, 0, map);\n+}\n+\n+int security_prog_load(void)\n+{\n+\treturn call_int_hook(bpf_prog_load, 0);\n+}\n+\n+int security_post_create(struct bpf_map *map)\n+{\n+\treturn call_int_hook(bpf_post_create, 0, map);\n+}\n+#endif /* CONFIG_BPF_SYSCALL */\n", "prefixes": [ "1/3" ] }