1#include <linux/bpf.h>
  2#include <linux/vmalloc.h>
 
  3#include <linux/file.h>
  4#include <linux/fs.h>
  5#include <linux/kernel.h>
  6#include <linux/idr.h>
  7#include <linux/namei.h>
  8#include <linux/user_namespace.h>
  9#include <linux/security.h>
 10
 11static bool bpf_ns_capable(struct user_namespace *ns, int cap)
 12{
 13	return ns_capable(ns, cap) || (cap != CAP_SYS_ADMIN && ns_capable(ns, CAP_SYS_ADMIN));
 14}
 15
 16bool bpf_token_capable(const struct bpf_token *token, int cap)
 17{
 18	struct user_namespace *userns;
 19
 20	/* BPF token allows ns_capable() level of capabilities */
 21	userns = token ? token->userns : &init_user_ns;
 22	if (!bpf_ns_capable(userns, cap))
 23		return false;
 24	if (token && security_bpf_token_capable(token, cap) < 0)
 25		return false;
 26	return true;
 27}
 28
 29void bpf_token_inc(struct bpf_token *token)
 30{
 31	atomic64_inc(&token->refcnt);
 32}
 33
 34static void bpf_token_free(struct bpf_token *token)
 35{
 36	security_bpf_token_free(token);
 37	put_user_ns(token->userns);
 38	kfree(token);
 39}
 40
 41static void bpf_token_put_deferred(struct work_struct *work)
 42{
 43	struct bpf_token *token = container_of(work, struct bpf_token, work);
 44
 45	bpf_token_free(token);
 46}
 47
 48void bpf_token_put(struct bpf_token *token)
 49{
 50	if (!token)
 51		return;
 52
 53	if (!atomic64_dec_and_test(&token->refcnt))
 54		return;
 55
 56	INIT_WORK(&token->work, bpf_token_put_deferred);
 57	schedule_work(&token->work);
 58}
 59
 60static int bpf_token_release(struct inode *inode, struct file *filp)
 61{
 62	struct bpf_token *token = filp->private_data;
 63
 64	bpf_token_put(token);
 65	return 0;
 66}
 67
 68static void bpf_token_show_fdinfo(struct seq_file *m, struct file *filp)
 69{
 70	struct bpf_token *token = filp->private_data;
 71	u64 mask;
 72
 73	BUILD_BUG_ON(__MAX_BPF_CMD >= 64);
 74	mask = BIT_ULL(__MAX_BPF_CMD) - 1;
 75	if ((token->allowed_cmds & mask) == mask)
 76		seq_printf(m, "allowed_cmds:\tany\n");
 77	else
 78		seq_printf(m, "allowed_cmds:\t0x%llx\n", token->allowed_cmds);
 79
 80	BUILD_BUG_ON(__MAX_BPF_MAP_TYPE >= 64);
 81	mask = BIT_ULL(__MAX_BPF_MAP_TYPE) - 1;
 82	if ((token->allowed_maps & mask) == mask)
 83		seq_printf(m, "allowed_maps:\tany\n");
 84	else
 85		seq_printf(m, "allowed_maps:\t0x%llx\n", token->allowed_maps);
 86
 87	BUILD_BUG_ON(__MAX_BPF_PROG_TYPE >= 64);
 88	mask = BIT_ULL(__MAX_BPF_PROG_TYPE) - 1;
 89	if ((token->allowed_progs & mask) == mask)
 90		seq_printf(m, "allowed_progs:\tany\n");
 91	else
 92		seq_printf(m, "allowed_progs:\t0x%llx\n", token->allowed_progs);
 93
 94	BUILD_BUG_ON(__MAX_BPF_ATTACH_TYPE >= 64);
 95	mask = BIT_ULL(__MAX_BPF_ATTACH_TYPE) - 1;
 96	if ((token->allowed_attachs & mask) == mask)
 97		seq_printf(m, "allowed_attachs:\tany\n");
 98	else
 99		seq_printf(m, "allowed_attachs:\t0x%llx\n", token->allowed_attachs);
100}
101
102#define BPF_TOKEN_INODE_NAME "bpf-token"
103
104static const struct inode_operations bpf_token_iops = { };
105
106static const struct file_operations bpf_token_fops = {
107	.release	= bpf_token_release,
108	.show_fdinfo	= bpf_token_show_fdinfo,
109};
110
111int bpf_token_create(union bpf_attr *attr)
112{
113	struct bpf_mount_opts *mnt_opts;
114	struct bpf_token *token = NULL;
115	struct user_namespace *userns;
116	struct inode *inode;
117	struct file *file;
118	CLASS(fd, f)(attr->token_create.bpffs_fd);
119	struct path path;
120	struct super_block *sb;
121	umode_t mode;
122	int err, fd;
123
124	if (fd_empty(f))
 
125		return -EBADF;
126
127	path = fd_file(f)->f_path;
128	sb = path.dentry->d_sb;
129
130	if (path.dentry != sb->s_root)
131		return -EINVAL;
132	if (sb->s_op != &bpf_super_ops)
133		return -EINVAL;
 
 
 
 
 
134	err = path_permission(&path, MAY_ACCESS);
135	if (err)
136		return err;
137
138	userns = sb->s_user_ns;
139	/*
140	 * Enforce that creators of BPF tokens are in the same user
141	 * namespace as the BPF FS instance. This makes reasoning about
142	 * permissions a lot easier and we can always relax this later.
143	 */
144	if (current_user_ns() != userns)
145		return -EPERM;
146	if (!ns_capable(userns, CAP_BPF))
147		return -EPERM;
 
 
 
 
148
149	/* Creating BPF token in init_user_ns doesn't make much sense. */
150	if (current_user_ns() == &init_user_ns)
151		return -EOPNOTSUPP;
 
 
152
153	mnt_opts = sb->s_fs_info;
154	if (mnt_opts->delegate_cmds == 0 &&
155	    mnt_opts->delegate_maps == 0 &&
156	    mnt_opts->delegate_progs == 0 &&
157	    mnt_opts->delegate_attachs == 0)
158		return -ENOENT; /* no BPF token delegation is set up */
 
 
159
160	mode = S_IFREG | ((S_IRUSR | S_IWUSR) & ~current_umask());
161	inode = bpf_get_inode(sb, NULL, mode);
162	if (IS_ERR(inode))
163		return PTR_ERR(inode);
 
 
164
165	inode->i_op = &bpf_token_iops;
166	inode->i_fop = &bpf_token_fops;
167	clear_nlink(inode); /* make sure it is unlinked */
168
169	file = alloc_file_pseudo(inode, path.mnt, BPF_TOKEN_INODE_NAME, O_RDWR, &bpf_token_fops);
170	if (IS_ERR(file)) {
171		iput(inode);
172		return PTR_ERR(file);
 
173	}
174
175	token = kzalloc(sizeof(*token), GFP_USER);
176	if (!token) {
177		err = -ENOMEM;
178		goto out_file;
179	}
180
181	atomic64_set(&token->refcnt, 1);
182
183	/* remember bpffs owning userns for future ns_capable() checks */
184	token->userns = get_user_ns(userns);
185
186	token->allowed_cmds = mnt_opts->delegate_cmds;
187	token->allowed_maps = mnt_opts->delegate_maps;
188	token->allowed_progs = mnt_opts->delegate_progs;
189	token->allowed_attachs = mnt_opts->delegate_attachs;
190
191	err = security_bpf_token_create(token, attr, &path);
192	if (err)
193		goto out_token;
194
195	fd = get_unused_fd_flags(O_CLOEXEC);
196	if (fd < 0) {
197		err = fd;
198		goto out_token;
199	}
200
201	file->private_data = token;
202	fd_install(fd, file);
203
 
204	return fd;
205
206out_token:
207	bpf_token_free(token);
208out_file:
209	fput(file);
 
 
210	return err;
211}
212
213struct bpf_token *bpf_token_get_from_fd(u32 ufd)
214{
215	CLASS(fd, f)(ufd);
216	struct bpf_token *token;
217
218	if (fd_empty(f))
219		return ERR_PTR(-EBADF);
220	if (fd_file(f)->f_op != &bpf_token_fops)
 
221		return ERR_PTR(-EINVAL);
 
222
223	token = fd_file(f)->private_data;
224	bpf_token_inc(token);
 
225
226	return token;
227}
228
229bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
230{
231	if (!token)
232		return false;
233	if (!(token->allowed_cmds & BIT_ULL(cmd)))
234		return false;
235	return security_bpf_token_cmd(token, cmd) == 0;
236}
237
238bool bpf_token_allow_map_type(const struct bpf_token *token, enum bpf_map_type type)
239{
240	if (!token || type >= __MAX_BPF_MAP_TYPE)
241		return false;
242
243	return token->allowed_maps & BIT_ULL(type);
244}
245
246bool bpf_token_allow_prog_type(const struct bpf_token *token,
247			       enum bpf_prog_type prog_type,
248			       enum bpf_attach_type attach_type)
249{
250	if (!token || prog_type >= __MAX_BPF_PROG_TYPE || attach_type >= __MAX_BPF_ATTACH_TYPE)
251		return false;
252
253	return (token->allowed_progs & BIT_ULL(prog_type)) &&
254	       (token->allowed_attachs & BIT_ULL(attach_type));
255}

  1#include <linux/bpf.h>
  2#include <linux/vmalloc.h>
  3#include <linux/fdtable.h>
  4#include <linux/file.h>
  5#include <linux/fs.h>
  6#include <linux/kernel.h>
  7#include <linux/idr.h>
  8#include <linux/namei.h>
  9#include <linux/user_namespace.h>
 10#include <linux/security.h>
 11
 12static bool bpf_ns_capable(struct user_namespace *ns, int cap)
 13{
 14	return ns_capable(ns, cap) || (cap != CAP_SYS_ADMIN && ns_capable(ns, CAP_SYS_ADMIN));
 15}
 16
 17bool bpf_token_capable(const struct bpf_token *token, int cap)
 18{
 19	struct user_namespace *userns;
 20
 21	/* BPF token allows ns_capable() level of capabilities */
 22	userns = token ? token->userns : &init_user_ns;
 23	if (!bpf_ns_capable(userns, cap))
 24		return false;
 25	if (token && security_bpf_token_capable(token, cap) < 0)
 26		return false;
 27	return true;
 28}
 29
 30void bpf_token_inc(struct bpf_token *token)
 31{
 32	atomic64_inc(&token->refcnt);
 33}
 34
 35static void bpf_token_free(struct bpf_token *token)
 36{
 37	security_bpf_token_free(token);
 38	put_user_ns(token->userns);
 39	kfree(token);
 40}
 41
 42static void bpf_token_put_deferred(struct work_struct *work)
 43{
 44	struct bpf_token *token = container_of(work, struct bpf_token, work);
 45
 46	bpf_token_free(token);
 47}
 48
 49void bpf_token_put(struct bpf_token *token)
 50{
 51	if (!token)
 52		return;
 53
 54	if (!atomic64_dec_and_test(&token->refcnt))
 55		return;
 56
 57	INIT_WORK(&token->work, bpf_token_put_deferred);
 58	schedule_work(&token->work);
 59}
 60
 61static int bpf_token_release(struct inode *inode, struct file *filp)
 62{
 63	struct bpf_token *token = filp->private_data;
 64
 65	bpf_token_put(token);
 66	return 0;
 67}
 68
 69static void bpf_token_show_fdinfo(struct seq_file *m, struct file *filp)
 70{
 71	struct bpf_token *token = filp->private_data;
 72	u64 mask;
 73
 74	BUILD_BUG_ON(__MAX_BPF_CMD >= 64);
 75	mask = BIT_ULL(__MAX_BPF_CMD) - 1;
 76	if ((token->allowed_cmds & mask) == mask)
 77		seq_printf(m, "allowed_cmds:\tany\n");
 78	else
 79		seq_printf(m, "allowed_cmds:\t0x%llx\n", token->allowed_cmds);
 80
 81	BUILD_BUG_ON(__MAX_BPF_MAP_TYPE >= 64);
 82	mask = BIT_ULL(__MAX_BPF_MAP_TYPE) - 1;
 83	if ((token->allowed_maps & mask) == mask)
 84		seq_printf(m, "allowed_maps:\tany\n");
 85	else
 86		seq_printf(m, "allowed_maps:\t0x%llx\n", token->allowed_maps);
 87
 88	BUILD_BUG_ON(__MAX_BPF_PROG_TYPE >= 64);
 89	mask = BIT_ULL(__MAX_BPF_PROG_TYPE) - 1;
 90	if ((token->allowed_progs & mask) == mask)
 91		seq_printf(m, "allowed_progs:\tany\n");
 92	else
 93		seq_printf(m, "allowed_progs:\t0x%llx\n", token->allowed_progs);
 94
 95	BUILD_BUG_ON(__MAX_BPF_ATTACH_TYPE >= 64);
 96	mask = BIT_ULL(__MAX_BPF_ATTACH_TYPE) - 1;
 97	if ((token->allowed_attachs & mask) == mask)
 98		seq_printf(m, "allowed_attachs:\tany\n");
 99	else
100		seq_printf(m, "allowed_attachs:\t0x%llx\n", token->allowed_attachs);
101}
102
103#define BPF_TOKEN_INODE_NAME "bpf-token"
104
105static const struct inode_operations bpf_token_iops = { };
106
107static const struct file_operations bpf_token_fops = {
108	.release	= bpf_token_release,
109	.show_fdinfo	= bpf_token_show_fdinfo,
110};
111
112int bpf_token_create(union bpf_attr *attr)
113{
114	struct bpf_mount_opts *mnt_opts;
115	struct bpf_token *token = NULL;
116	struct user_namespace *userns;
117	struct inode *inode;
118	struct file *file;
 
119	struct path path;
120	struct fd f;
121	umode_t mode;
122	int err, fd;
123
124	f = fdget(attr->token_create.bpffs_fd);
125	if (!f.file)
126		return -EBADF;
127
128	path = f.file->f_path;
129	path_get(&path);
130	fdput(f);
131
132	if (path.dentry != path.mnt->mnt_sb->s_root) {
133		err = -EINVAL;
134		goto out_path;
135	}
136	if (path.mnt->mnt_sb->s_op != &bpf_super_ops) {
137		err = -EINVAL;
138		goto out_path;
139	}
140	err = path_permission(&path, MAY_ACCESS);
141	if (err)
142		goto out_path;
143
144	userns = path.dentry->d_sb->s_user_ns;
145	/*
146	 * Enforce that creators of BPF tokens are in the same user
147	 * namespace as the BPF FS instance. This makes reasoning about
148	 * permissions a lot easier and we can always relax this later.
149	 */
150	if (current_user_ns() != userns) {
151		err = -EPERM;
152		goto out_path;
153	}
154	if (!ns_capable(userns, CAP_BPF)) {
155		err = -EPERM;
156		goto out_path;
157	}
158
159	/* Creating BPF token in init_user_ns doesn't make much sense. */
160	if (current_user_ns() == &init_user_ns) {
161		err = -EOPNOTSUPP;
162		goto out_path;
163	}
164
165	mnt_opts = path.dentry->d_sb->s_fs_info;
166	if (mnt_opts->delegate_cmds == 0 &&
167	    mnt_opts->delegate_maps == 0 &&
168	    mnt_opts->delegate_progs == 0 &&
169	    mnt_opts->delegate_attachs == 0) {
170		err = -ENOENT; /* no BPF token delegation is set up */
171		goto out_path;
172	}
173
174	mode = S_IFREG | ((S_IRUSR | S_IWUSR) & ~current_umask());
175	inode = bpf_get_inode(path.mnt->mnt_sb, NULL, mode);
176	if (IS_ERR(inode)) {
177		err = PTR_ERR(inode);
178		goto out_path;
179	}
180
181	inode->i_op = &bpf_token_iops;
182	inode->i_fop = &bpf_token_fops;
183	clear_nlink(inode); /* make sure it is unlinked */
184
185	file = alloc_file_pseudo(inode, path.mnt, BPF_TOKEN_INODE_NAME, O_RDWR, &bpf_token_fops);
186	if (IS_ERR(file)) {
187		iput(inode);
188		err = PTR_ERR(file);
189		goto out_path;
190	}
191
192	token = kzalloc(sizeof(*token), GFP_USER);
193	if (!token) {
194		err = -ENOMEM;
195		goto out_file;
196	}
197
198	atomic64_set(&token->refcnt, 1);
199
200	/* remember bpffs owning userns for future ns_capable() checks */
201	token->userns = get_user_ns(userns);
202
203	token->allowed_cmds = mnt_opts->delegate_cmds;
204	token->allowed_maps = mnt_opts->delegate_maps;
205	token->allowed_progs = mnt_opts->delegate_progs;
206	token->allowed_attachs = mnt_opts->delegate_attachs;
207
208	err = security_bpf_token_create(token, attr, &path);
209	if (err)
210		goto out_token;
211
212	fd = get_unused_fd_flags(O_CLOEXEC);
213	if (fd < 0) {
214		err = fd;
215		goto out_token;
216	}
217
218	file->private_data = token;
219	fd_install(fd, file);
220
221	path_put(&path);
222	return fd;
223
224out_token:
225	bpf_token_free(token);
226out_file:
227	fput(file);
228out_path:
229	path_put(&path);
230	return err;
231}
232
233struct bpf_token *bpf_token_get_from_fd(u32 ufd)
234{
235	struct fd f = fdget(ufd);
236	struct bpf_token *token;
237
238	if (!f.file)
239		return ERR_PTR(-EBADF);
240	if (f.file->f_op != &bpf_token_fops) {
241		fdput(f);
242		return ERR_PTR(-EINVAL);
243	}
244
245	token = f.file->private_data;
246	bpf_token_inc(token);
247	fdput(f);
248
249	return token;
250}
251
252bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
253{
254	if (!token)
255		return false;
256	if (!(token->allowed_cmds & BIT_ULL(cmd)))
257		return false;
258	return security_bpf_token_cmd(token, cmd) == 0;
259}
260
261bool bpf_token_allow_map_type(const struct bpf_token *token, enum bpf_map_type type)
262{
263	if (!token || type >= __MAX_BPF_MAP_TYPE)
264		return false;
265
266	return token->allowed_maps & BIT_ULL(type);
267}
268
269bool bpf_token_allow_prog_type(const struct bpf_token *token,
270			       enum bpf_prog_type prog_type,
271			       enum bpf_attach_type attach_type)
272{
273	if (!token || prog_type >= __MAX_BPF_PROG_TYPE || attach_type >= __MAX_BPF_ATTACH_TYPE)
274		return false;
275
276	return (token->allowed_progs & BIT_ULL(prog_type)) &&
277	       (token->allowed_attachs & BIT_ULL(attach_type));
278}