1// SPDX-License-Identifier: GPL-2.0
 2
 3/*
 4 * Copyright (C) 2022 Huawei Technologies Duesseldorf GmbH
 5 *
 6 * Author: Roberto Sassu <roberto.sassu@huawei.com>
 7 */
 8
 9#include "vmlinux.h"
10#include <errno.h>
11#include <bpf/bpf_helpers.h>
12#include <bpf/bpf_tracing.h>
13
14extern struct bpf_key *bpf_lookup_system_key(__u64 id) __ksym;
15extern void bpf_key_put(struct bpf_key *key) __ksym;
16extern int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_ptr,
17				      struct bpf_dynptr *sig_ptr,
18				      struct bpf_key *trusted_keyring) __ksym;
19
20struct {
21	__uint(type, BPF_MAP_TYPE_RINGBUF);
22} ringbuf SEC(".maps");
23
24struct {
25	__uint(type, BPF_MAP_TYPE_ARRAY);
26	__uint(max_entries, 1);
27	__type(key, __u32);
28	__type(value, __u32);
29} array_map SEC(".maps");
30
31int err, pid;
32
33char _license[] SEC("license") = "GPL";
34
35SEC("?lsm.s/bpf")
36int BPF_PROG(not_valid_dynptr, int cmd, union bpf_attr *attr, unsigned int size)
37{
38	unsigned long val;
39
40	return bpf_verify_pkcs7_signature((struct bpf_dynptr *)&val,
41					  (struct bpf_dynptr *)&val, NULL);
42}
43
44SEC("?lsm.s/bpf")
45int BPF_PROG(not_ptr_to_stack, int cmd, union bpf_attr *attr, unsigned int size)
46{
47	unsigned long val;
48
49	return bpf_verify_pkcs7_signature((struct bpf_dynptr *)val,
50					  (struct bpf_dynptr *)val, NULL);
51}
52
53SEC("lsm.s/bpf")
54int BPF_PROG(dynptr_data_null, int cmd, union bpf_attr *attr, unsigned int size)
55{
56	struct bpf_key *trusted_keyring;
57	struct bpf_dynptr ptr;
58	__u32 *value;
59	int ret, zero = 0;
60
61	if (bpf_get_current_pid_tgid() >> 32 != pid)
62		return 0;
63
64	value = bpf_map_lookup_elem(&array_map, &zero);
65	if (!value)
66		return 0;
67
68	/* Pass invalid flags. */
69	ret = bpf_dynptr_from_mem(value, sizeof(*value), ((__u64)~0ULL), &ptr);
70	if (ret != -EINVAL)
71		return 0;
72
73	trusted_keyring = bpf_lookup_system_key(0);
74	if (!trusted_keyring)
75		return 0;
76
77	err = bpf_verify_pkcs7_signature(&ptr, &ptr, trusted_keyring);
78
79	bpf_key_put(trusted_keyring);
80
81	return 0;
82}