On Mon, Jul 29, 2019 at 10:07 PM Song Liu [off-list ref] wrote:

Hi Andy,

quoted

On Jul 27, 2019, at 11:20 AM, Song Liu [off-list ref] wrote:

Hi Andy,

quoted

quoted

quoted

quoted

Well, yes. sys_bpf() is pretty powerful.

The goal of /dev/bpf is to enable special users to call sys_bpf(). In
the meanwhile, such users should not take down the whole system easily
by accident, e.g., with rm -rf /.

That’s easy, though — bpftool could learn to read /etc/bpfusers before allowing ruid != 0.

This is a great idea! fscaps + /etc/bpfusers should do the trick.

After some discussions and more thinking on this, I have some concerns
with the user space only approach.

IIUC, your proposal for user space only approach is like:

1. bpftool (and other tools) check /etc/bpfusers and only do
  setuid for allowed users:

      int main()
      {
              if (/* uid in /etc/bpfusers */)
                      setuid(0);
              sys_bpf(...);
      }

2. bpftool (and other tools) is installed with CAP_SETUID:

      setcap cap_setuid=e+p /bin/bpftool

3. sys admin maintains proper /etc/bpfusers.

This approach is not ideal, because we need to trust the tool to give
it CAP_SETUID. A hacked tool could easily bypass /etc/bpfusers check
or use other root only sys calls after setuid(0).

I would like more comments on this.

Currently, bpf permission is more or less "root or nothing", which we
would like to change.

The short term goal is to separate bpf from root, in other words, it is
"all or nothing". Special user space utilities, such as systemd, would
benefit from this. Once this is implemented, systemd can call sys_bpf()
when it is not running as root.

As generally nasty as Linux capabilities are, this sounds like a good
use for CAP_BPF_ADMIN.

But what do you have in mind?  Isn't non-root systemd mostly just the
user systemd session?  That should *not* have bpf() privileges until
bpf() is improved such that you can't use it to compromise the system.

In longer term, it may be useful to provide finer grain permission of
sys_bpf(). For example, sys_bpf() should be aware of containers; and
user may only have access to certain bpf maps. Let's call this
"fine grain" capability.


Since we are seeing new use cases every year, we will need many
iterations to implement the fine grain permission. I think we need an
API that is flexible enough to cover different types of permission
control.

For example, bpf_with_cap() can be flexible:

        bpf_with_cap(cmd, attr, size, perm_fd);

We can get different types of permission via different combinations of
arguments:

    A perm_fd to /dev/bpf gives access to all sys_bpf() commands, so
    this is "all or nothing" permission.

    A perm_fd to /sys/fs/cgroup/.../bpf.xxx would only allow some
    commands to this specific cgroup.

I don't see why you need to invent a whole new mechanism for this.
The entire cgroup ecosystem outside bpf() does just fine using the
write permission on files in cgroupfs to control access.  Why can't
bpf() do the same thing?

Alexei raised another idea in offline discussions: instead of adding
bpf_with_cap(), we add a command LOAD_PERM_FD, which enables special
permission for the _next_ sys_bpf() from current task:

    bpf(LOAD_PERM_FD, perm_fd);
    /* the next sys_bpf() uses permission from perm_fd */
    bpf(cmd, attr, size);

This is equivalent to bpf_with_cap(cmd, attr, size, perm_fd), but
doesn't require the new sys call.

That sounds almost every bit as problematic as the approach where you
ask for permission once and it sticks.

1. User space only approach doesn't work, even for "all or nothing"
   permission control. I expanded the discussion in the previous
   email. Please let me know if I missed anything there.

As in my previous email, I disagree.