| Message ID | 20200323164415.12943-4-kpsingh@chromium.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | MAC and Audit policy using eBPF (KRSI) | expand |
On 3/23/20 9:44 AM, KP Singh wrote: > From: KP Singh <kpsingh@google.com> > > When CONFIG_BPF_LSM is enabled, nops functions, bpf_lsm_<hook_name>, are > generated for each LSM hook. These nops are initialized as LSM hooks in > a subsequent patch. > > Signed-off-by: KP Singh <kpsingh@google.com> > Reviewed-by: Brendan Jackman <jackmanb@google.com> > Reviewed-by: Florent Revest <revest@google.com> Acked-by: Yonghong Song <yhs@fb.com>
On Mon, Mar 23, 2020 at 05:44:11PM +0100, KP Singh wrote: > From: KP Singh <kpsingh@google.com> > > When CONFIG_BPF_LSM is enabled, nops functions, bpf_lsm_<hook_name>, are > generated for each LSM hook. These nops are initialized as LSM hooks in > a subsequent patch. > > Signed-off-by: KP Singh <kpsingh@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> -Kees > Reviewed-by: Brendan Jackman <jackmanb@google.com> > Reviewed-by: Florent Revest <revest@google.com> > --- > include/linux/bpf_lsm.h | 21 +++++++++++++++++++++ > kernel/bpf/bpf_lsm.c | 19 +++++++++++++++++++ > 2 files changed, 40 insertions(+) > create mode 100644 include/linux/bpf_lsm.h > > diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h > new file mode 100644 > index 000000000000..c6423a140220 > --- /dev/null > +++ b/include/linux/bpf_lsm.h > @@ -0,0 +1,21 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > + > +/* > + * Copyright (C) 2020 Google LLC. > + */ > + > +#ifndef _LINUX_BPF_LSM_H > +#define _LINUX_BPF_LSM_H > + > +#include <linux/bpf.h> > +#include <linux/lsm_hooks.h> > + > +#ifdef CONFIG_BPF_LSM > + > +#define LSM_HOOK(RET, NAME, ...) RET bpf_lsm_##NAME(__VA_ARGS__); > +#include <linux/lsm_hook_names.h> > +#undef LSM_HOOK > + > +#endif /* CONFIG_BPF_LSM */ > + > +#endif /* _LINUX_BPF_LSM_H */ > diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c > index 82875039ca90..530d137f7a84 100644 > --- a/kernel/bpf/bpf_lsm.c > +++ b/kernel/bpf/bpf_lsm.c > @@ -7,6 +7,25 @@ > #include <linux/filter.h> > #include <linux/bpf.h> > #include <linux/btf.h> > +#include <linux/lsm_hooks.h> > +#include <linux/bpf_lsm.h> > + > +/* For every LSM hook that allows attachment of BPF programs, declare a NOP > + * function where a BPF program can be attached as an fexit trampoline. > + */ > +#define LSM_HOOK(RET, NAME, ...) LSM_HOOK_##RET(NAME, __VA_ARGS__) > + > +#define LSM_HOOK_int(NAME, ...) \ > +noinline __weak int bpf_lsm_##NAME(__VA_ARGS__) \ > +{ \ > + return 0; \ > +} > + > +#define LSM_HOOK_void(NAME, ...) \ > +noinline __weak void bpf_lsm_##NAME(__VA_ARGS__) {} > + > +#include <linux/lsm_hook_names.h> > +#undef LSM_HOOK > > const struct bpf_prog_ops lsm_prog_ops = { > }; > -- > 2.20.1 >
On Mon, Mar 23, 2020 at 9:45 AM KP Singh <kpsingh@chromium.org> wrote: > > From: KP Singh <kpsingh@google.com> > > When CONFIG_BPF_LSM is enabled, nops functions, bpf_lsm_<hook_name>, are > generated for each LSM hook. These nops are initialized as LSM hooks in > a subsequent patch. > > Signed-off-by: KP Singh <kpsingh@google.com> > Reviewed-by: Brendan Jackman <jackmanb@google.com> > Reviewed-by: Florent Revest <revest@google.com> > --- > include/linux/bpf_lsm.h | 21 +++++++++++++++++++++ > kernel/bpf/bpf_lsm.c | 19 +++++++++++++++++++ > 2 files changed, 40 insertions(+) > create mode 100644 include/linux/bpf_lsm.h > > diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h > new file mode 100644 > index 000000000000..c6423a140220 > --- /dev/null > +++ b/include/linux/bpf_lsm.h > @@ -0,0 +1,21 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > + > +/* > + * Copyright (C) 2020 Google LLC. > + */ > + > +#ifndef _LINUX_BPF_LSM_H > +#define _LINUX_BPF_LSM_H > + > +#include <linux/bpf.h> > +#include <linux/lsm_hooks.h> > + > +#ifdef CONFIG_BPF_LSM > + > +#define LSM_HOOK(RET, NAME, ...) RET bpf_lsm_##NAME(__VA_ARGS__); > +#include <linux/lsm_hook_names.h> > +#undef LSM_HOOK > + > +#endif /* CONFIG_BPF_LSM */ > + > +#endif /* _LINUX_BPF_LSM_H */ > diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c > index 82875039ca90..530d137f7a84 100644 > --- a/kernel/bpf/bpf_lsm.c > +++ b/kernel/bpf/bpf_lsm.c > @@ -7,6 +7,25 @@ > #include <linux/filter.h> > #include <linux/bpf.h> > #include <linux/btf.h> > +#include <linux/lsm_hooks.h> > +#include <linux/bpf_lsm.h> > + > +/* For every LSM hook that allows attachment of BPF programs, declare a NOP > + * function where a BPF program can be attached as an fexit trampoline. > + */ > +#define LSM_HOOK(RET, NAME, ...) LSM_HOOK_##RET(NAME, __VA_ARGS__) > + > +#define LSM_HOOK_int(NAME, ...) \ > +noinline __weak int bpf_lsm_##NAME(__VA_ARGS__) \ > +{ \ > + return 0; \ > +} > + > +#define LSM_HOOK_void(NAME, ...) \ > +noinline __weak void bpf_lsm_##NAME(__VA_ARGS__) {} > + Could unify with: #define LSM_HOOK(RET, NAME, ...) noinline __weak RET bpf_lsm_##NAME(__VA_ARGS__) { return (RET)0; } then you don't need LSM_HOOK_int and LSM_HOOK_void. > +#include <linux/lsm_hook_names.h> > +#undef LSM_HOOK > > const struct bpf_prog_ops lsm_prog_ops = { > }; > -- > 2.20.1 >
On 23-Mär 12:59, Andrii Nakryiko wrote: > On Mon, Mar 23, 2020 at 9:45 AM KP Singh <kpsingh@chromium.org> wrote: > > > > From: KP Singh <kpsingh@google.com> > > > > When CONFIG_BPF_LSM is enabled, nops functions, bpf_lsm_<hook_name>, are > > generated for each LSM hook. These nops are initialized as LSM hooks in > > a subsequent patch. > > > > Signed-off-by: KP Singh <kpsingh@google.com> > > Reviewed-by: Brendan Jackman <jackmanb@google.com> > > Reviewed-by: Florent Revest <revest@google.com> > > --- > > include/linux/bpf_lsm.h | 21 +++++++++++++++++++++ > > kernel/bpf/bpf_lsm.c | 19 +++++++++++++++++++ > > 2 files changed, 40 insertions(+) > > create mode 100644 include/linux/bpf_lsm.h > > > > diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h > > new file mode 100644 > > index 000000000000..c6423a140220 > > --- /dev/null > > +++ b/include/linux/bpf_lsm.h > > @@ -0,0 +1,21 @@ > > +/* SPDX-License-Identifier: GPL-2.0 */ > > + > > +/* > > + * Copyright (C) 2020 Google LLC. > > + */ > > + > > +#ifndef _LINUX_BPF_LSM_H > > +#define _LINUX_BPF_LSM_H > > + > > +#include <linux/bpf.h> > > +#include <linux/lsm_hooks.h> > > + > > +#ifdef CONFIG_BPF_LSM > > + > > +#define LSM_HOOK(RET, NAME, ...) RET bpf_lsm_##NAME(__VA_ARGS__); > > +#include <linux/lsm_hook_names.h> > > +#undef LSM_HOOK > > + > > +#endif /* CONFIG_BPF_LSM */ > > + > > +#endif /* _LINUX_BPF_LSM_H */ > > diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c > > index 82875039ca90..530d137f7a84 100644 > > --- a/kernel/bpf/bpf_lsm.c > > +++ b/kernel/bpf/bpf_lsm.c > > @@ -7,6 +7,25 @@ > > #include <linux/filter.h> > > #include <linux/bpf.h> > > #include <linux/btf.h> > > +#include <linux/lsm_hooks.h> > > +#include <linux/bpf_lsm.h> > > + > > +/* For every LSM hook that allows attachment of BPF programs, declare a NOP > > + * function where a BPF program can be attached as an fexit trampoline. > > + */ > > +#define LSM_HOOK(RET, NAME, ...) LSM_HOOK_##RET(NAME, __VA_ARGS__) > > + > > +#define LSM_HOOK_int(NAME, ...) \ > > +noinline __weak int bpf_lsm_##NAME(__VA_ARGS__) \ > > +{ \ > > + return 0; \ > > +} > > + > > +#define LSM_HOOK_void(NAME, ...) \ > > +noinline __weak void bpf_lsm_##NAME(__VA_ARGS__) {} > > + > > Could unify with: > > #define LSM_HOOK(RET, NAME, ...) noinline __weak RET bpf_lsm_##NAME(__VA_ARGS__) > { > return (RET)0; > } > > then you don't need LSM_HOOK_int and LSM_HOOK_void. Nice. But, given that we are adding default values and that they are only needed for int hooks, we will need to keep the macros separate for int and void. Or, Am I missing a trick here? - KP > > > +#include <linux/lsm_hook_names.h> > > +#undef LSM_HOOK > > > > const struct bpf_prog_ops lsm_prog_ops = { > > }; > > -- > > 2.20.1 > >
On 24-Mär 11:39, KP Singh wrote: > On 23-Mär 12:59, Andrii Nakryiko wrote: > > On Mon, Mar 23, 2020 at 9:45 AM KP Singh <kpsingh@chromium.org> wrote: > > > > > > From: KP Singh <kpsingh@google.com> > > > > > > When CONFIG_BPF_LSM is enabled, nops functions, bpf_lsm_<hook_name>, are > > > generated for each LSM hook. These nops are initialized as LSM hooks in > > > a subsequent patch. > > > > > > Signed-off-by: KP Singh <kpsingh@google.com> > > > Reviewed-by: Brendan Jackman <jackmanb@google.com> > > > Reviewed-by: Florent Revest <revest@google.com> > > > --- > > > include/linux/bpf_lsm.h | 21 +++++++++++++++++++++ > > > kernel/bpf/bpf_lsm.c | 19 +++++++++++++++++++ > > > 2 files changed, 40 insertions(+) > > > create mode 100644 include/linux/bpf_lsm.h > > > > > > diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h > > > new file mode 100644 > > > index 000000000000..c6423a140220 > > > --- /dev/null > > > +++ b/include/linux/bpf_lsm.h > > > @@ -0,0 +1,21 @@ > > > +/* SPDX-License-Identifier: GPL-2.0 */ > > > + > > > +/* > > > + * Copyright (C) 2020 Google LLC. > > > + */ > > > + > > > +#ifndef _LINUX_BPF_LSM_H > > > +#define _LINUX_BPF_LSM_H > > > + > > > +#include <linux/bpf.h> > > > +#include <linux/lsm_hooks.h> > > > + > > > +#ifdef CONFIG_BPF_LSM > > > + > > > +#define LSM_HOOK(RET, NAME, ...) RET bpf_lsm_##NAME(__VA_ARGS__); > > > +#include <linux/lsm_hook_names.h> > > > +#undef LSM_HOOK > > > + > > > +#endif /* CONFIG_BPF_LSM */ > > > + > > > +#endif /* _LINUX_BPF_LSM_H */ > > > diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c > > > index 82875039ca90..530d137f7a84 100644 > > > --- a/kernel/bpf/bpf_lsm.c > > > +++ b/kernel/bpf/bpf_lsm.c > > > @@ -7,6 +7,25 @@ > > > #include <linux/filter.h> > > > #include <linux/bpf.h> > > > #include <linux/btf.h> > > > +#include <linux/lsm_hooks.h> > > > +#include <linux/bpf_lsm.h> > > > + > > > +/* For every LSM hook that allows attachment of BPF programs, declare a NOP > > > + * function where a BPF program can be attached as an fexit trampoline. > > > + */ > > > +#define LSM_HOOK(RET, NAME, ...) LSM_HOOK_##RET(NAME, __VA_ARGS__) > > > + > > > +#define LSM_HOOK_int(NAME, ...) \ > > > +noinline __weak int bpf_lsm_##NAME(__VA_ARGS__) \ > > > +{ \ > > > + return 0; \ > > > +} > > > + > > > +#define LSM_HOOK_void(NAME, ...) \ > > > +noinline __weak void bpf_lsm_##NAME(__VA_ARGS__) {} > > > + > > > > Could unify with: > > > > #define LSM_HOOK(RET, NAME, ...) noinline __weak RET bpf_lsm_##NAME(__VA_ARGS__) > > { > > return (RET)0; > > } > > > > then you don't need LSM_HOOK_int and LSM_HOOK_void. > > Nice. > > But, given that we are adding default values and that > they are only needed for int hooks, we will need to keep the macros > separate for int and void. Or, Am I missing a trick here? > > - KP Actually, was able to get it work. not setting a default for void hooks makes the macros messier. So i just set it void. For example: LSM_HOOK(void, void, bprm_committing_creds, struct linux_binprm *bprm) This also allows me to use the cleanup you suggested and not having to split every usage into int and void. - KP > > > > > > +#include <linux/lsm_hook_names.h> > > > +#undef LSM_HOOK > > > > > > const struct bpf_prog_ops lsm_prog_ops = { > > > }; > > > -- > > > 2.20.1 > > >
On Tue, Mar 24, 2020 at 9:12 AM KP Singh <kpsingh@chromium.org> wrote: > > On 24-Mär 11:39, KP Singh wrote: > > On 23-Mär 12:59, Andrii Nakryiko wrote: > > > On Mon, Mar 23, 2020 at 9:45 AM KP Singh <kpsingh@chromium.org> wrote: > > > > > > > > From: KP Singh <kpsingh@google.com> > > > > > > > > When CONFIG_BPF_LSM is enabled, nops functions, bpf_lsm_<hook_name>, are > > > > generated for each LSM hook. These nops are initialized as LSM hooks in > > > > a subsequent patch. > > > > > > > > Signed-off-by: KP Singh <kpsingh@google.com> > > > > Reviewed-by: Brendan Jackman <jackmanb@google.com> > > > > Reviewed-by: Florent Revest <revest@google.com> > > > > --- > > > > include/linux/bpf_lsm.h | 21 +++++++++++++++++++++ > > > > kernel/bpf/bpf_lsm.c | 19 +++++++++++++++++++ > > > > 2 files changed, 40 insertions(+) > > > > create mode 100644 include/linux/bpf_lsm.h > > > > > > > > diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h > > > > new file mode 100644 > > > > index 000000000000..c6423a140220 > > > > --- /dev/null > > > > +++ b/include/linux/bpf_lsm.h > > > > @@ -0,0 +1,21 @@ > > > > +/* SPDX-License-Identifier: GPL-2.0 */ > > > > + > > > > +/* > > > > + * Copyright (C) 2020 Google LLC. > > > > + */ > > > > + > > > > +#ifndef _LINUX_BPF_LSM_H > > > > +#define _LINUX_BPF_LSM_H > > > > + > > > > +#include <linux/bpf.h> > > > > +#include <linux/lsm_hooks.h> > > > > + > > > > +#ifdef CONFIG_BPF_LSM > > > > + > > > > +#define LSM_HOOK(RET, NAME, ...) RET bpf_lsm_##NAME(__VA_ARGS__); > > > > +#include <linux/lsm_hook_names.h> > > > > +#undef LSM_HOOK > > > > + > > > > +#endif /* CONFIG_BPF_LSM */ > > > > + > > > > +#endif /* _LINUX_BPF_LSM_H */ > > > > diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c > > > > index 82875039ca90..530d137f7a84 100644 > > > > --- a/kernel/bpf/bpf_lsm.c > > > > +++ b/kernel/bpf/bpf_lsm.c > > > > @@ -7,6 +7,25 @@ > > > > #include <linux/filter.h> > > > > #include <linux/bpf.h> > > > > #include <linux/btf.h> > > > > +#include <linux/lsm_hooks.h> > > > > +#include <linux/bpf_lsm.h> > > > > + > > > > +/* For every LSM hook that allows attachment of BPF programs, declare a NOP > > > > + * function where a BPF program can be attached as an fexit trampoline. > > > > + */ > > > > +#define LSM_HOOK(RET, NAME, ...) LSM_HOOK_##RET(NAME, __VA_ARGS__) > > > > + > > > > +#define LSM_HOOK_int(NAME, ...) \ > > > > +noinline __weak int bpf_lsm_##NAME(__VA_ARGS__) \ > > > > +{ \ > > > > + return 0; \ > > > > +} > > > > + > > > > +#define LSM_HOOK_void(NAME, ...) \ > > > > +noinline __weak void bpf_lsm_##NAME(__VA_ARGS__) {} > > > > + > > > > > > Could unify with: > > > > > > #define LSM_HOOK(RET, NAME, ...) noinline __weak RET bpf_lsm_##NAME(__VA_ARGS__) > > > { > > > return (RET)0; > > > } > > > > > > then you don't need LSM_HOOK_int and LSM_HOOK_void. > > > > Nice. > > > > But, given that we are adding default values and that > > they are only needed for int hooks, we will need to keep the macros > > separate for int and void. Or, Am I missing a trick here? > > > > - KP > > Actually, was able to get it work. not setting a default for void > hooks makes the macros messier. So i just set it void. For example: > > LSM_HOOK(void, void, bprm_committing_creds, struct linux_binprm *bprm) surprised this works, was going to propose to specify `(void)0` as default value :) > > This also allows me to use the cleanup you suggested and not having > to split every usage into int and void. > Nice, one of the reasons for proposing this. > - KP > > > > > > > > > > +#include <linux/lsm_hook_names.h> > > > > +#undef LSM_HOOK > > > > > > > > const struct bpf_prog_ops lsm_prog_ops = { > > > > }; > > > > -- > > > > 2.20.1 > > > >
On 24-Mär 14:26, Andrii Nakryiko wrote: > On Tue, Mar 24, 2020 at 9:12 AM KP Singh <kpsingh@chromium.org> wrote: > > > > On 24-Mär 11:39, KP Singh wrote: > > > On 23-Mär 12:59, Andrii Nakryiko wrote: > > > > On Mon, Mar 23, 2020 at 9:45 AM KP Singh <kpsingh@chromium.org> wrote: > > > > > > > > > > From: KP Singh <kpsingh@google.com> > > > > > > > > > > When CONFIG_BPF_LSM is enabled, nops functions, bpf_lsm_<hook_name>, are > > > > > generated for each LSM hook. These nops are initialized as LSM hooks in > > > > > a subsequent patch. > > > > > > > > > > Signed-off-by: KP Singh <kpsingh@google.com> > > > > > Reviewed-by: Brendan Jackman <jackmanb@google.com> > > > > > Reviewed-by: Florent Revest <revest@google.com> > > > > > --- > > > > > include/linux/bpf_lsm.h | 21 +++++++++++++++++++++ > > > > > kernel/bpf/bpf_lsm.c | 19 +++++++++++++++++++ > > > > > 2 files changed, 40 insertions(+) > > > > > create mode 100644 include/linux/bpf_lsm.h > > > > > > > > > > diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h > > > > > new file mode 100644 > > > > > index 000000000000..c6423a140220 > > > > > --- /dev/null > > > > > +++ b/include/linux/bpf_lsm.h > > > > > @@ -0,0 +1,21 @@ > > > > > +/* SPDX-License-Identifier: GPL-2.0 */ > > > > > + > > > > > +/* > > > > > + * Copyright (C) 2020 Google LLC. > > > > > + */ > > > > > + > > > > > +#ifndef _LINUX_BPF_LSM_H > > > > > +#define _LINUX_BPF_LSM_H > > > > > + > > > > > +#include <linux/bpf.h> > > > > > +#include <linux/lsm_hooks.h> > > > > > + > > > > > +#ifdef CONFIG_BPF_LSM > > > > > + > > > > > +#define LSM_HOOK(RET, NAME, ...) RET bpf_lsm_##NAME(__VA_ARGS__); > > > > > +#include <linux/lsm_hook_names.h> > > > > > +#undef LSM_HOOK > > > > > + > > > > > +#endif /* CONFIG_BPF_LSM */ > > > > > + > > > > > +#endif /* _LINUX_BPF_LSM_H */ > > > > > diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c > > > > > index 82875039ca90..530d137f7a84 100644 > > > > > --- a/kernel/bpf/bpf_lsm.c > > > > > +++ b/kernel/bpf/bpf_lsm.c > > > > > @@ -7,6 +7,25 @@ > > > > > #include <linux/filter.h> > > > > > #include <linux/bpf.h> > > > > > #include <linux/btf.h> > > > > > +#include <linux/lsm_hooks.h> > > > > > +#include <linux/bpf_lsm.h> > > > > > + > > > > > +/* For every LSM hook that allows attachment of BPF programs, declare a NOP > > > > > + * function where a BPF program can be attached as an fexit trampoline. > > > > > + */ > > > > > +#define LSM_HOOK(RET, NAME, ...) LSM_HOOK_##RET(NAME, __VA_ARGS__) > > > > > + > > > > > +#define LSM_HOOK_int(NAME, ...) \ > > > > > +noinline __weak int bpf_lsm_##NAME(__VA_ARGS__) \ > > > > > +{ \ > > > > > + return 0; \ > > > > > +} > > > > > + > > > > > +#define LSM_HOOK_void(NAME, ...) \ > > > > > +noinline __weak void bpf_lsm_##NAME(__VA_ARGS__) {} > > > > > + > > > > > > > > Could unify with: > > > > > > > > #define LSM_HOOK(RET, NAME, ...) noinline __weak RET bpf_lsm_##NAME(__VA_ARGS__) > > > > { > > > > return (RET)0; > > > > } > > > > > > > > then you don't need LSM_HOOK_int and LSM_HOOK_void. > > > > > > Nice. > > > > > > But, given that we are adding default values and that > > > they are only needed for int hooks, we will need to keep the macros > > > separate for int and void. Or, Am I missing a trick here? > > > > > > - KP > > > > Actually, was able to get it work. not setting a default for void > > hooks makes the macros messier. So i just set it void. For example: > > > > LSM_HOOK(void, void, bprm_committing_creds, struct linux_binprm *bprm) > > surprised this works, was going to propose to specify `(void)0` as > default value :) Yeah, you are right that does not work. so I added: LSM_HOOK(void, LSM_RET_VOID, bprm_committed_creds, struct linux_binprm *bprm) and as you suggested defined LSM_RET_VOID in lsm_hooks.h: /* LSM_RET_VOID is used as the default value in LSM_HOOK definitions for void * for void LSM hooks (in include/linux/lsm_hook_defs.h). */ #define LSM_RET_VOID ((void) 0) I also noticed a few other hooks that were passing an initial return value to call_int_hook which were missed in this revision. Have fixed these for the next one. - KP > > > > > This also allows me to use the cleanup you suggested and not having > > to split every usage into int and void. > > > > Nice, one of the reasons for proposing this. > > > - KP > > > > > > > > > > > > > > +#include <linux/lsm_hook_names.h> > > > > > +#undef LSM_HOOK > > > > > > > > > > const struct bpf_prog_ops lsm_prog_ops = { > > > > > }; > > > > > -- > > > > > 2.20.1 > > > > >
diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h new file mode 100644 index 000000000000..c6423a140220 --- /dev/null +++ b/include/linux/bpf_lsm.h @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +/* + * Copyright (C) 2020 Google LLC. + */ + +#ifndef _LINUX_BPF_LSM_H +#define _LINUX_BPF_LSM_H + +#include <linux/bpf.h> +#include <linux/lsm_hooks.h> + +#ifdef CONFIG_BPF_LSM + +#define LSM_HOOK(RET, NAME, ...) RET bpf_lsm_##NAME(__VA_ARGS__); +#include <linux/lsm_hook_names.h> +#undef LSM_HOOK + +#endif /* CONFIG_BPF_LSM */ + +#endif /* _LINUX_BPF_LSM_H */ diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c index 82875039ca90..530d137f7a84 100644 --- a/kernel/bpf/bpf_lsm.c +++ b/kernel/bpf/bpf_lsm.c @@ -7,6 +7,25 @@ #include <linux/filter.h> #include <linux/bpf.h> #include <linux/btf.h> +#include <linux/lsm_hooks.h> +#include <linux/bpf_lsm.h> + +/* For every LSM hook that allows attachment of BPF programs, declare a NOP + * function where a BPF program can be attached as an fexit trampoline. + */ +#define LSM_HOOK(RET, NAME, ...) LSM_HOOK_##RET(NAME, __VA_ARGS__) + +#define LSM_HOOK_int(NAME, ...) \ +noinline __weak int bpf_lsm_##NAME(__VA_ARGS__) \ +{ \ + return 0; \ +} + +#define LSM_HOOK_void(NAME, ...) \ +noinline __weak void bpf_lsm_##NAME(__VA_ARGS__) {} + +#include <linux/lsm_hook_names.h> +#undef LSM_HOOK const struct bpf_prog_ops lsm_prog_ops = { };