Re: [PATCH v7 11/18] bpf,lsm: add bpf_token_create and bpf_token_free LSM hooks
From: Paul Moore <paul@paul-moore.com>
Date: 2023-10-13 21:15:47
Also in:
bpf, linux-fsdevel, linux-security-module
On Oct 12, 2023 Andrii Nakryiko [off-list ref] wrote:
Wire up bpf_token_create and bpf_token_free LSM hooks, which allow to allocate LSM security blob (we add `void *security` field to struct bpf_token for that), but also control who can instantiate BPF token. This follows existing pattern for BPF map and BPF prog. Signed-off-by: Andrii Nakryiko <andrii@kernel.org> --- include/linux/bpf.h | 3 +++ include/linux/lsm_hook_defs.h | 3 +++ include/linux/security.h | 11 +++++++++++ kernel/bpf/bpf_lsm.c | 2 ++ kernel/bpf/token.c | 6 ++++++ security/security.c | 28 ++++++++++++++++++++++++++++ 6 files changed, 53 insertions(+)
...
quoted hunk ↗ jump to hunk
diff --git a/kernel/bpf/token.c b/kernel/bpf/token.c index d4e0cc8075d3..18fd1e04f92d 100644 --- a/kernel/bpf/token.c +++ b/kernel/bpf/token.c@@ -7,6 +7,7 @@ #include <linux/idr.h> #include <linux/namei.h> #include <linux/user_namespace.h> +#include <linux/security.h> bool bpf_token_capable(const struct bpf_token *token, int cap) {@@ -28,6 +29,7 @@ void bpf_token_inc(struct bpf_token *token) static void bpf_token_free(struct bpf_token *token) { + security_bpf_token_free(token); put_user_ns(token->userns); kvfree(token); }@@ -183,6 +185,10 @@ int bpf_token_create(union bpf_attr *attr) token->allowed_progs = mnt_opts->delegate_progs; token->allowed_attachs = mnt_opts->delegate_attachs; + err = security_bpf_token_create(token, attr, &path); + if (err) + goto out_token; + fd = get_unused_fd_flags(O_CLOEXEC); if (fd < 0) { err = fd;
As long as bpf_token_alloc() remains separate from bpf_token_create() I'm not comfortable not having a security_bpf_token_alloc() hook in bpf_token_alloc(). If you really don't want a LSM token alloc hook can you fold bpf_token_alloc() into bpf_token_create()? -- paul-moore.com