{"id":808428,"url":"http://patchwork.ozlabs.org/api/1.0/patches/808428/?format=json","project":{"id":7,"url":"http://patchwork.ozlabs.org/api/1.0/projects/7/?format=json","name":"Linux network development","link_name":"netdev","list_id":"netdev.vger.kernel.org","list_email":"netdev@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null},"msgid":"<20170831205635.80256-4-chenbofeng.kernel@gmail.com>","date":"2017-08-31T20:56:35","name":"[3/3] selinux: bpf: Implement the selinux checks for eBPF object","commit_ref":null,"pull_url":null,"state":"changes-requested","archived":true,"hash":"c3da470241ab6b59536e62f1f36df0fc81028cd1","submitter":{"id":70894,"url":"http://patchwork.ozlabs.org/api/1.0/people/70894/?format=json","name":"Chenbo Feng","email":"chenbofeng.kernel@gmail.com"},"delegate":{"id":34,"url":"http://patchwork.ozlabs.org/api/1.0/users/34/?format=json","username":"davem","first_name":"David","last_name":"Miller","email":"davem@davemloft.net"},"mbox":"http://patchwork.ozlabs.org/project/netdev/patch/20170831205635.80256-4-chenbofeng.kernel@gmail.com/mbox/","series":[{"id":906,"url":"http://patchwork.ozlabs.org/api/1.0/series/906/?format=json","date":"2017-08-31T20:56:32","name":"Security: add lsm hooks for checking permissions on eBPF objects","version":1,"mbox":"http://patchwork.ozlabs.org/series/906/mbox/"}],"check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/808428/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"patchwork-incoming@ozlabs.org","Delivered-To":"patchwork-incoming@ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","ozlabs.org; dkim=pass (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"dYoDlvXJ\"; dkim-atps=neutral"],"Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xjvnm724zz9t1t\n\tfor ;\n\tFri, 1 Sep 2017 06:57:16 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1751623AbdHaU5O (ORCPT );\n\tThu, 31 Aug 2017 16:57:14 -0400","from mail-pf0-f196.google.com ([209.85.192.196]:36708 \"EHLO\n\tmail-pf0-f196.google.com\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1751443AbdHaU5L (ORCPT\n\t); Thu, 31 Aug 2017 16:57:11 -0400","by mail-pf0-f196.google.com with SMTP id k3so442882pfc.3;\n\tThu, 31 Aug 2017 13:57:11 -0700 (PDT)","from fengc.mtv.corp.google.com ([100.98.121.64])\n\tby smtp.gmail.com with ESMTPSA id\n\tg68sm710967pfj.33.2017.08.31.13.57.10\n\t(version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);\n\tThu, 31 Aug 2017 13:57:10 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=gmail.com; s=20161025;\n\th=from:to:cc:subject:date:message-id:in-reply-to:references;\n\tbh=ZQwf78Y7+8SpP7CrKLxmsUluboYOsNY+gmSAPXJnhRo=;\n\tb=dYoDlvXJ/J5Hhc9NeJZMhhYSjLuD0RQTFIYhMXnPX6FUjl8IfOLiWxSmQRBYSAXiK3\n\tUiZ7X8xFtOOZ9m0BqhET5V46Qw/HnbQvQLes6VnUIcZYLl6daY3fZmqdBH4JybiNJb8M\n\tZhXj3c8Ie9vm3OfmvrOg0n5r840DTU4oAR6HOJrC0eybRyLa0hDJesWmz3+MV1ZfCU89\n\tr/qisZe8qM8eyyyaMQelJBlsr5eFsSUanLvtB1G2vhj154vtljCjv53MUhGr9APgdWhc\n\tOTIuOCtmAXaoltHe6LsgJYBcJ+wQC0hzHtKdP1poiPuXFW+50ocdLpkD05+9e9LuRwFv\n\tzxww==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to\n\t:references;\n\tbh=ZQwf78Y7+8SpP7CrKLxmsUluboYOsNY+gmSAPXJnhRo=;\n\tb=n0FDRxhZjrywbZVPF1zaRcLGDSdandaOsrRCFrBO/iuiW3tgxGzNCNwx+t+KNl6lE0\n\tGHaqN6/vBSoxuGJk5ez6q3KZtd9rFBjccA8KqxF5zuCCh2igbVZs17fHwDLeqnKkslOI\n\tcurryRZYfnclMWVTiC7EfUcBIFPnOjm42SY9jZdzzjZRjubNh6JK73gmpSGJ9Z4FbO+Q\n\tiCaIYFTPhH1D/vXe7l36zqXOe3CYDPIjbeg9q2Uqej53asguDusX5mOOKhXcME84PQlS\n\tcfgD4npc+vgCzjoNV+psJ5GP2ACD4NQjhv4t5yE959AS86SeZmB7Mh+STRy52qquBVxD\n\tUm2Q==","X-Gm-Message-State":"AHYfb5g5Gv58W2ICLWTXtXmfdmPMNlxLdV1IJ67n88U//kuRDENI1ick\n\ta8dMG/5/pyNYDzwI","X-Google-Smtp-Source":"ADKCNb7FttGeWvNw9kTzuAMY5iQowygHVrSvBDPi9Sks/9fvmamxA35d05Zk+Nb5yFTEWN7P3+ncsA==","X-Received":"by 10.84.194.228 with SMTP id h91mr3931939pld.419.1504213031150; \n\tThu, 31 Aug 2017 13:57:11 -0700 (PDT)","From":"Chenbo Feng ","To":"linux-security-module@vger.kernel.org","Cc":"Jeffrey Vander Stoep , netdev@vger.kernel.org,\n\tSELinux ,\n\tAlexei Starovoitov ,\n\tlorenzo@google.com, Chenbo Feng ","Subject":"[PATCH 3/3] selinux: bpf: Implement the selinux checks for eBPF\n\tobject","Date":"Thu, 31 Aug 2017 13:56:35 -0700","Message-Id":"<20170831205635.80256-4-chenbofeng.kernel@gmail.com>","X-Mailer":"git-send-email 2.14.1.581.gf28d330327-goog","In-Reply-To":"<20170831205635.80256-1-chenbofeng.kernel@gmail.com>","References":"<20170831205635.80256-1-chenbofeng.kernel@gmail.com>","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"},"content":"From: Chenbo Feng \n\nIntroduce 5 new selinux checks for eBPF object related operations. The\ncheck is based on the ownership information of eBPF maps and the\ncapability of creating eBPF object.\n\nSigned-off-by: Chenbo Feng \n---\n security/selinux/hooks.c | 54 +++++++++++++++++++++++++++++++++++++\n security/selinux/include/classmap.h | 2 ++\n security/selinux/include/objsec.h | 4 +++\n 3 files changed, 60 insertions(+)","diff":"diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c\nindex 33fd061305c4..39ad7d9f335d 100644\n--- a/security/selinux/hooks.c\n+++ b/security/selinux/hooks.c\n@@ -85,6 +85,7 @@\n #include \n #include \n #include \n+#include \n \n #include \"avc.h\"\n #include \"objsec.h\"\n@@ -6245,6 +6246,52 @@ static void selinux_ib_free_security(void *ib_sec)\n }\n #endif\n \n+#ifdef CONFIG_BPF_SYSCALL\n+static int selinux_bpf_map_create(void)\n+{\n+\tu32 sid = current_sid();\n+\n+\treturn avc_has_perm(sid, sid, SECCLASS_BPF, BPF__MAP_CREATE, NULL);\n+}\n+\n+static int selinux_bpf_map_modify(struct bpf_map *map)\n+{\n+\tstruct bpf_security_struct *bpfsec = map->security;\n+\n+\treturn avc_has_perm(current_sid(), bpfsec->sid, SECCLASS_BPF,\n+\t\t\t BPF__MAP_MODIFY, NULL);\n+}\n+\n+static int selinux_bpf_map_read(struct bpf_map *map)\n+{\n+\tstruct bpf_security_struct *bpfsec = map->security;\n+\n+\treturn avc_has_perm(current_sid(), bpfsec->sid, SECCLASS_BPF,\n+\t\t\t BPF__MAP_READ, NULL);\n+}\n+\n+static int selinux_bpf_prog_load(void)\n+{\n+\tu32 sid = current_sid();\n+\n+\treturn avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD, NULL);\n+}\n+\n+static int selinux_bpf_post_create(struct bpf_map *map)\n+{\n+\tstruct bpf_security_struct *bpfsec;\n+\n+\tbpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);\n+\tif (!bpfsec)\n+\t\treturn -ENOMEM;\n+\n+\tbpfsec->sid = current_sid();\n+\tmap->security = bpfsec;\n+\n+\treturn 0;\n+}\n+#endif\n+\n static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {\n \tLSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),\n \tLSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),\n@@ -6465,6 +6512,13 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {\n \tLSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),\n \tLSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),\n #endif\n+#ifdef CONFIG_BPF_SYSCALL\n+\tLSM_HOOK_INIT(bpf_map_create, selinux_bpf_map_create),\n+\tLSM_HOOK_INIT(bpf_map_modify, selinux_bpf_map_modify),\n+\tLSM_HOOK_INIT(bpf_map_read, selinux_bpf_map_read),\n+\tLSM_HOOK_INIT(bpf_prog_load, selinux_bpf_prog_load),\n+\tLSM_HOOK_INIT(bpf_post_create, selinux_bpf_post_create),\n+#endif\n };\n \n static __init int selinux_init(void)\ndiff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h\nindex b9fe3434b036..83c880fb17b4 100644\n--- a/security/selinux/include/classmap.h\n+++ b/security/selinux/include/classmap.h\n@@ -235,6 +235,8 @@ struct security_class_mapping secclass_map[] = {\n \t { \"access\", NULL } },\n \t{ \"infiniband_endport\",\n \t { \"manage_subnet\", NULL } },\n+\t{ \"bpf\",\n+\t {\"map_create\", \"map_modify\", \"map_read\", \"prog_load\" } },\n \t{ NULL }\n };\n \ndiff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h\nindex 6ebc61e370ff..ba564f662b0d 100644\n--- a/security/selinux/include/objsec.h\n+++ b/security/selinux/include/objsec.h\n@@ -150,6 +150,10 @@ struct pkey_security_struct {\n \tu32\tsid;\t/* SID of pkey */\n };\n \n+struct bpf_security_struct {\n+\tu32 sid;\t/*SID of bpf obj creater*/\n+};\n+\n extern unsigned int selinux_checkreqprot;\n \n #endif /* _SELINUX_OBJSEC_H_ */\n","prefixes":["3/3"]}