162 lines · c
1// SPDX-License-Identifier: GPL-2.02/* Copyright (c) 2024 Google LLC. */3 4#include <vmlinux.h>5#include <bpf/bpf_helpers.h>6#include <bpf/bpf_tracing.h>7#include <linux/limits.h>8 9#include "bpf_misc.h"10#include "bpf_experimental.h"11 12static char buf[PATH_MAX];13 14SEC("lsm.s/file_open")15__failure __msg("Possibly NULL pointer passed to trusted arg0")16int BPF_PROG(get_task_exe_file_kfunc_null)17{18 struct file *acquired;19 20 /* Can't pass a NULL pointer to bpf_get_task_exe_file(). */21 acquired = bpf_get_task_exe_file(NULL);22 if (!acquired)23 return 0;24 25 bpf_put_file(acquired);26 return 0;27}28 29SEC("lsm.s/inode_getxattr")30__failure __msg("arg#0 pointer type STRUCT task_struct must point to scalar, or struct with scalar")31int BPF_PROG(get_task_exe_file_kfunc_fp)32{33 u64 x;34 struct file *acquired;35 struct task_struct *task;36 37 task = (struct task_struct *)&x;38 /* Can't pass random frame pointer to bpf_get_task_exe_file(). */39 acquired = bpf_get_task_exe_file(task);40 if (!acquired)41 return 0;42 43 bpf_put_file(acquired);44 return 0;45}46 47SEC("lsm.s/file_open")48__failure __msg("R1 must be referenced or trusted")49int BPF_PROG(get_task_exe_file_kfunc_untrusted)50{51 struct file *acquired;52 struct task_struct *parent;53 54 /* Walking a trusted struct task_struct returned from55 * bpf_get_current_task_btf() yields an untrusted pointer.56 */57 parent = bpf_get_current_task_btf()->parent;58 /* Can't pass untrusted pointer to bpf_get_task_exe_file(). */59 acquired = bpf_get_task_exe_file(parent);60 if (!acquired)61 return 0;62 63 bpf_put_file(acquired);64 return 0;65}66 67SEC("lsm.s/file_open")68__failure __msg("Unreleased reference")69int BPF_PROG(get_task_exe_file_kfunc_unreleased)70{71 struct file *acquired;72 73 acquired = bpf_get_task_exe_file(bpf_get_current_task_btf());74 if (!acquired)75 return 0;76 77 /* Acquired but never released. */78 return 0;79}80 81SEC("lsm.s/file_open")82__failure __msg("release kernel function bpf_put_file expects")83int BPF_PROG(put_file_kfunc_unacquired, struct file *file)84{85 /* Can't release an unacquired pointer. */86 bpf_put_file(file);87 return 0;88}89 90SEC("lsm.s/file_open")91__failure __msg("Possibly NULL pointer passed to trusted arg0")92int BPF_PROG(path_d_path_kfunc_null)93{94 /* Can't pass NULL value to bpf_path_d_path() kfunc. */95 bpf_path_d_path(NULL, buf, sizeof(buf));96 return 0;97}98 99SEC("lsm.s/task_alloc")100__failure __msg("R1 must be referenced or trusted")101int BPF_PROG(path_d_path_kfunc_untrusted_from_argument, struct task_struct *task)102{103 struct path *root;104 105 /* Walking a trusted argument typically yields an untrusted106 * pointer. This is one example of that.107 */108 root = &task->fs->root;109 bpf_path_d_path(root, buf, sizeof(buf));110 return 0;111}112 113SEC("lsm.s/file_open")114__failure __msg("R1 must be referenced or trusted")115int BPF_PROG(path_d_path_kfunc_untrusted_from_current)116{117 struct path *pwd;118 struct task_struct *current;119 120 current = bpf_get_current_task_btf();121 /* Walking a trusted pointer returned from bpf_get_current_task_btf()122 * yields an untrusted pointer.123 */124 pwd = ¤t->fs->pwd;125 bpf_path_d_path(pwd, buf, sizeof(buf));126 return 0;127}128 129SEC("lsm.s/file_open")130__failure __msg("kernel function bpf_path_d_path args#0 expected pointer to STRUCT path but R1 has a pointer to STRUCT file")131int BPF_PROG(path_d_path_kfunc_type_mismatch, struct file *file)132{133 bpf_path_d_path((struct path *)&file->f_task_work, buf, sizeof(buf));134 return 0;135}136 137SEC("lsm.s/file_open")138__failure __msg("invalid access to map value, value_size=4096 off=0 size=8192")139int BPF_PROG(path_d_path_kfunc_invalid_buf_sz, struct file *file)140{141 /* bpf_path_d_path() enforces a constraint on the buffer size supplied142 * by the BPF LSM program via the __sz annotation. buf here is set to143 * PATH_MAX, so let's ensure that the BPF verifier rejects BPF_PROG_LOAD144 * attempts if the supplied size and the actual size of the buffer145 * mismatches.146 */147 bpf_path_d_path(&file->f_path, buf, PATH_MAX * 2);148 return 0;149}150 151SEC("fentry/vfs_open")152__failure __msg("calling kernel function bpf_path_d_path is not allowed")153int BPF_PROG(path_d_path_kfunc_non_lsm, struct path *path, struct file *f)154{155 /* Calling bpf_path_d_path() from a non-LSM BPF program isn't permitted.156 */157 bpf_path_d_path(path, buf, sizeof(buf));158 return 0;159}160 161char _license[] SEC("license") = "GPL";162