[PATCH] bpf: lsm: Disable or enable BPF LSM at boot time

This option adds a kernel parameter 'bpf_lsm',
which allows the BPF LSM to be disabled at boot.
The purpose of this option is to allow a single kernel
image to be distributed with the BPF LSM built in,
but not necessarily enabled.

Signed-off-by: Lorenzo Fontana <redacted>
---
 Documentation/admin-guide/kernel-parameters.txt |  8 ++++++++
 init/Kconfig                                    | 12 ++++++++++++
 security/bpf/hooks.c                            | 16 ++++++++++++++++
 3 files changed, 36 insertions(+)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index fb95fad81c79..c0d5955279d7 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt

@@ -4575,6 +4575,14 @@
 			1 -- enable.
 			Default value is set via kernel config option.
 
+	bpf_lsm=	[BPF_LSM] Disable or enable LSM Instrumentation
+			with BPF at boot time.
+			Format: { "0" | "1" }
+			See init/Kconfig help text.
+			0 -- disable.
+			1 -- enable.
+			Default value is 1.
+
 	serialnumber	[BUGS=X86-32]
 
 	shapers=	[NET]

diff --git a/init/Kconfig b/init/Kconfig
index a46aa8f3174d..410547e4342e 100644
--- a/init/Kconfig
+++ b/init/Kconfig

@@ -1659,6 +1659,18 @@ config BPF_LSM
 
 	  If you are unsure how to answer this question, answer N.
 
+config BPF_LSM_BOOTPARAM
+	bool "LSM Instrumentation with BPF boot parameter"
+	depends on BPF_LSM
+	help
+	  This option adds a kernel parameter 'bpf_lsm', which allows LSM
+	  instrumentation with BPF to be disabled at boot.
+	  If this option is selected, the BPF LSM
+	  functionality can be disabled with bpf_lsm=0 on the kernel
+	  command line.  The purpose of this option is to allow a single
+	  kernel image to be distributed with the BPF LSM built in, but not
+	  necessarily enabled.
+
 config BPF_SYSCALL
 	bool "Enable bpf() system call"
 	select BPF

diff --git a/security/bpf/hooks.c b/security/bpf/hooks.c
index 32d32d485451..6a4b4f63976c 100644
--- a/security/bpf/hooks.c
+++ b/security/bpf/hooks.c

@@ -3,9 +3,24 @@
 /*
  * Copyright (C) 2020 Google LLC.
  */
+
+#include <linux/init.h>
 #include <linux/lsm_hooks.h>
 #include <linux/bpf_lsm.h>
 
+int bpf_lsm_enabled_boot __initdata = 1;
+#ifdef CONFIG_BPF_LSM_BOOTPARAM
+static int __init bpf_lsm_enabled_setup(char *str)
+{
+	unsigned long enabled;
+
+	if (!kstrtoul(str, 0, &enabled))
+		bpf_lsm_enabled_boot = enabled ? 1 : 0;
+	return 1;
+}
+__setup("bpf_lsm=", bpf_lsm_enabled_setup);
+#endif
+
 static struct security_hook_list bpf_lsm_hooks[] __lsm_ro_after_init = {
 	#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
 	LSM_HOOK_INIT(NAME, bpf_lsm_##NAME),

@@ -23,4 +38,5 @@ static int __init bpf_lsm_init(void)
 DEFINE_LSM(bpf) = {
 	.name = "bpf",
 	.init = bpf_lsm_init,
+	.enabled = &bpf_lsm_enabled_boot,
 };

-- 
2.27.0

On 7/6/20 6:57 PM, Lorenzo Fontana wrote:

This option adds a kernel parameter 'bpf_lsm',
which allows the BPF LSM to be disabled at boot.
The purpose of this option is to allow a single kernel
image to be distributed with the BPF LSM built in,
but not necessarily enabled.

Signed-off-by: Lorenzo Fontana <redacted>

Well, this explains what the patch is doing but not *why* you need it exactly.
Please explain your concrete use-case for this patch.

Thanks,
Daniel

On Mon, Jul 6, 2020 at 8:51 PM Daniel Borkmann [off-list ref] wrote:

On 7/6/20 6:57 PM, Lorenzo Fontana wrote:

quoted

This option adds a kernel parameter 'bpf_lsm',
which allows the BPF LSM to be disabled at boot.
The purpose of this option is to allow a single kernel
image to be distributed with the BPF LSM built in,
but not necessarily enabled.

Signed-off-by: Lorenzo Fontana <redacted>

Well, this explains what the patch is doing but not *why* you need it exactly.
Please explain your concrete use-case for this patch.

Also, this patch is not really needed as it can already be done with the current
kernel parameters.

LSMs can be enabled on the command line
with the lsm= parameter. So you can just pass lsm="selinux,capabilities" etc
and not pass "bpf" and it will disable the BPF_LSM.

- KP

Thanks,
Daniel

On Mon, Jul 06, 2020 at 08:59:13PM +0200, KP Singh wrote:

On Mon, Jul 6, 2020 at 8:51 PM Daniel Borkmann [off-list ref] wrote:

quoted

On 7/6/20 6:57 PM, Lorenzo Fontana wrote:

quoted

This option adds a kernel parameter 'bpf_lsm',
which allows the BPF LSM to be disabled at boot.
The purpose of this option is to allow a single kernel
image to be distributed with the BPF LSM built in,
but not necessarily enabled.

Signed-off-by: Lorenzo Fontana <redacted>

Well, this explains what the patch is doing but not *why* you need it exactly.
Please explain your concrete use-case for this patch.

Also, this patch is not really needed as it can already be done with the current
kernel parameters.

LSMs can be enabled on the command line
with the lsm= parameter. So you can just pass lsm="selinux,capabilities" etc
and not pass "bpf" and it will disable the BPF_LSM.

- KP

quoted

Thanks,
Daniel

Hi,
Thanks Daniel and KP for looking into this, I really appreciate it!

The *why* I need it is because I need to ship the kernel with BPF LSM
disabled at boot time.

The use case is exactly the same as the one described by KP, however
for a personal preference I prefer to pass specifically bpf_lsm=1 or
bpf_lsm=0 - It's easier to change programmatically in my scripts
with a simple sprintf("bpf_lsm=%d", value). I do the same
with "selinux=1" and "selinux=0" in my systems.
From what I can see by reading the code and testing, the two ways
bot act on 'lsm_info.enabled' defined in 'lsm_hooks.h'.
So it's not just  a personal preference, I just want the same set
of options available to me as I do with selinux.

Thanks a lot,
Lore

On Mon, Jul 6, 2020 at 10:06 PM Lorenzo Fontana [off-list ref] wrote:

On Mon, Jul 06, 2020 at 08:59:13PM +0200, KP Singh wrote:

quoted

On Mon, Jul 6, 2020 at 8:51 PM Daniel Borkmann [off-list ref] wrote:

quoted

On 7/6/20 6:57 PM, Lorenzo Fontana wrote:

quoted

This option adds a kernel parameter 'bpf_lsm',
which allows the BPF LSM to be disabled at boot.
The purpose of this option is to allow a single kernel
image to be distributed with the BPF LSM built in,
but not necessarily enabled.

Signed-off-by: Lorenzo Fontana <redacted>

Well, this explains what the patch is doing but not *why* you need it exactly.
Please explain your concrete use-case for this patch.

Also, this patch is not really needed as it can already be done with the current
kernel parameters.

LSMs can be enabled on the command line
with the lsm= parameter. So you can just pass lsm="selinux,capabilities" etc
and not pass "bpf" and it will disable the BPF_LSM.

- KP

quoted

Thanks,
Daniel

Hi,
Thanks Daniel and KP for looking into this, I really appreciate it!

The *why* I need it is because I need to ship the kernel with BPF LSM
disabled at boot time.

The use case is exactly the same as the one described by KP, however
for a personal preference I prefer to pass specifically bpf_lsm=1 or
bpf_lsm=0 - It's easier to change programmatically in my scripts
with a simple sprintf("bpf_lsm=%d", value). I do the same
with "selinux=1" and "selinux=0" in my systems.
From what I can see by reading the code and testing, the two ways
bot act on 'lsm_info.enabled' defined in 'lsm_hooks.h'.
So it's not just  a personal preference, I just want the same set
of options available to me as I do with selinux.

The "selinux=" option existed before the "lsm=" parameter was added and it
now exists only for backward compatibility. I added Paul and Stephen to Cc
who might have more information about this.

- KP

Thanks a lot,
Lore