186 lines · c
1// SPDX-License-Identifier: GPL-2.02/* Copyright (c) 2024 Google LLC. */3 4#include <linux/bpf.h>5#include <linux/btf.h>6#include <linux/btf_ids.h>7#include <linux/dcache.h>8#include <linux/fs.h>9#include <linux/file.h>10#include <linux/mm.h>11#include <linux/xattr.h>12 13__bpf_kfunc_start_defs();14 15/**16 * bpf_get_task_exe_file - get a reference on the exe_file struct file member of17 * the mm_struct that is nested within the supplied18 * task_struct19 * @task: task_struct of which the nested mm_struct exe_file member to get a20 * reference on21 *22 * Get a reference on the exe_file struct file member field of the mm_struct23 * nested within the supplied *task*. The referenced file pointer acquired by24 * this BPF kfunc must be released using bpf_put_file(). Failing to call25 * bpf_put_file() on the returned referenced struct file pointer that has been26 * acquired by this BPF kfunc will result in the BPF program being rejected by27 * the BPF verifier.28 *29 * This BPF kfunc may only be called from BPF LSM programs.30 *31 * Internally, this BPF kfunc leans on get_task_exe_file(), such that calling32 * bpf_get_task_exe_file() would be analogous to calling get_task_exe_file()33 * directly in kernel context.34 *35 * Return: A referenced struct file pointer to the exe_file member of the36 * mm_struct that is nested within the supplied *task*. On error, NULL is37 * returned.38 */39__bpf_kfunc struct file *bpf_get_task_exe_file(struct task_struct *task)40{41 return get_task_exe_file(task);42}43 44/**45 * bpf_put_file - put a reference on the supplied file46 * @file: file to put a reference on47 *48 * Put a reference on the supplied *file*. Only referenced file pointers may be49 * passed to this BPF kfunc. Attempting to pass an unreferenced file pointer, or50 * any other arbitrary pointer for that matter, will result in the BPF program51 * being rejected by the BPF verifier.52 *53 * This BPF kfunc may only be called from BPF LSM programs.54 */55__bpf_kfunc void bpf_put_file(struct file *file)56{57 fput(file);58}59 60/**61 * bpf_path_d_path - resolve the pathname for the supplied path62 * @path: path to resolve the pathname for63 * @buf: buffer to return the resolved pathname in64 * @buf__sz: length of the supplied buffer65 *66 * Resolve the pathname for the supplied *path* and store it in *buf*. This BPF67 * kfunc is the safer variant of the legacy bpf_d_path() helper and should be68 * used in place of bpf_d_path() whenever possible. It enforces KF_TRUSTED_ARGS69 * semantics, meaning that the supplied *path* must itself hold a valid70 * reference, or else the BPF program will be outright rejected by the BPF71 * verifier.72 *73 * This BPF kfunc may only be called from BPF LSM programs.74 *75 * Return: A positive integer corresponding to the length of the resolved76 * pathname in *buf*, including the NUL termination character. On error, a77 * negative integer is returned.78 */79__bpf_kfunc int bpf_path_d_path(struct path *path, char *buf, size_t buf__sz)80{81 int len;82 char *ret;83 84 if (!buf__sz)85 return -EINVAL;86 87 ret = d_path(path, buf, buf__sz);88 if (IS_ERR(ret))89 return PTR_ERR(ret);90 91 len = buf + buf__sz - ret;92 memmove(buf, ret, len);93 return len;94}95 96/**97 * bpf_get_dentry_xattr - get xattr of a dentry98 * @dentry: dentry to get xattr from99 * @name__str: name of the xattr100 * @value_p: output buffer of the xattr value101 *102 * Get xattr *name__str* of *dentry* and store the output in *value_ptr*.103 *104 * For security reasons, only *name__str* with prefix "user." is allowed.105 *106 * Return: 0 on success, a negative value on error.107 */108__bpf_kfunc int bpf_get_dentry_xattr(struct dentry *dentry, const char *name__str,109 struct bpf_dynptr *value_p)110{111 struct bpf_dynptr_kern *value_ptr = (struct bpf_dynptr_kern *)value_p;112 struct inode *inode = d_inode(dentry);113 u32 value_len;114 void *value;115 int ret;116 117 if (WARN_ON(!inode))118 return -EINVAL;119 120 if (strncmp(name__str, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))121 return -EPERM;122 123 value_len = __bpf_dynptr_size(value_ptr);124 value = __bpf_dynptr_data_rw(value_ptr, value_len);125 if (!value)126 return -EINVAL;127 128 ret = inode_permission(&nop_mnt_idmap, inode, MAY_READ);129 if (ret)130 return ret;131 return __vfs_getxattr(dentry, inode, name__str, value, value_len);132}133 134/**135 * bpf_get_file_xattr - get xattr of a file136 * @file: file to get xattr from137 * @name__str: name of the xattr138 * @value_p: output buffer of the xattr value139 *140 * Get xattr *name__str* of *file* and store the output in *value_ptr*.141 *142 * For security reasons, only *name__str* with prefix "user." is allowed.143 *144 * Return: 0 on success, a negative value on error.145 */146__bpf_kfunc int bpf_get_file_xattr(struct file *file, const char *name__str,147 struct bpf_dynptr *value_p)148{149 struct dentry *dentry;150 151 dentry = file_dentry(file);152 return bpf_get_dentry_xattr(dentry, name__str, value_p);153}154 155__bpf_kfunc_end_defs();156 157BTF_KFUNCS_START(bpf_fs_kfunc_set_ids)158BTF_ID_FLAGS(func, bpf_get_task_exe_file,159 KF_ACQUIRE | KF_TRUSTED_ARGS | KF_RET_NULL)160BTF_ID_FLAGS(func, bpf_put_file, KF_RELEASE)161BTF_ID_FLAGS(func, bpf_path_d_path, KF_TRUSTED_ARGS)162BTF_ID_FLAGS(func, bpf_get_dentry_xattr, KF_SLEEPABLE | KF_TRUSTED_ARGS)163BTF_ID_FLAGS(func, bpf_get_file_xattr, KF_SLEEPABLE | KF_TRUSTED_ARGS)164BTF_KFUNCS_END(bpf_fs_kfunc_set_ids)165 166static int bpf_fs_kfuncs_filter(const struct bpf_prog *prog, u32 kfunc_id)167{168 if (!btf_id_set8_contains(&bpf_fs_kfunc_set_ids, kfunc_id) ||169 prog->type == BPF_PROG_TYPE_LSM)170 return 0;171 return -EACCES;172}173 174static const struct btf_kfunc_id_set bpf_fs_kfunc_set = {175 .owner = THIS_MODULE,176 .set = &bpf_fs_kfunc_set_ids,177 .filter = bpf_fs_kfuncs_filter,178};179 180static int __init bpf_fs_kfuncs_init(void)181{182 return register_btf_kfunc_id_set(BPF_PROG_TYPE_LSM, &bpf_fs_kfunc_set);183}184 185late_initcall(bpf_fs_kfuncs_init);186