From patchwork Mon Aug 29 11:46:21 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sargun Dhillon X-Patchwork-Id: 9303679 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 39A51607F0 for ; Mon, 29 Aug 2016 11:46:31 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2AE2A285E2 for ; Mon, 29 Aug 2016 11:46:31 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1F7A228823; Mon, 29 Aug 2016 11:46:31 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DD927285E2 for ; Mon, 29 Aug 2016 11:46:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932929AbcH2LqZ (ORCPT ); Mon, 29 Aug 2016 07:46:25 -0400 Received: from mail-it0-f46.google.com ([209.85.214.46]:37526 "EHLO mail-it0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932820AbcH2LqY (ORCPT ); Mon, 29 Aug 2016 07:46:24 -0400 Received: by mail-it0-f46.google.com with SMTP id d65so91810692ith.0 for ; Mon, 29 Aug 2016 04:46:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sargun.me; s=google; h=date:from:to:cc:subject:message-id:mime-version:content-disposition :user-agent; bh=VjA1AY51JEn6rJlLYeC/ngAo3Zccw74bfOMRbJtKOKM=; b=P0vt+0bKlaTnC4kY/vC+BrgOmFrHBwx5j7PB+QtSrHVCjIAOHlmUynP2z6flkM8Xm3 mL01s4Sp6/HujcFM/z7UD2mmXKcibDxqbiAiR59bVdnbSMDlfwRYYTLLmF3IJjpOBsuZ diUCc9Rxo+v/7GT/iaZmOeYhP3s+GsE1f7TZc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition:user-agent; bh=VjA1AY51JEn6rJlLYeC/ngAo3Zccw74bfOMRbJtKOKM=; b=Bh+yAe8+XtOeSqWo48BZyCoQpbWhAYxlFnG7I5XJlV8FzIKUdVoTCI6lLlMPyYHJVL gtEn6cuStJSfmokL6X2YB6maSTMPAmvMmk1ssUZmk3oGHGYihdy1DUZGuL/I4z/UPH5U QOhb2/GsEOg8s0VTa8QFJzj7Q/SvEGEd/881Ggt/+NgwmDAfXWnetEGvEpO3HxVZB580 V4sCRaWvkGgakjSAd83AFUCGGmz1JJUiyNT2wqi+ZL2NNZvAC2iSJRFVir5iI6NayfYa WjNo7W/7SQ+ZM0n64OyShOnzmrAiY2f+Y18yZTXehGwKX1HFY9+9Ac1c7SBBMIraM+3m e5Tg== X-Gm-Message-State: AE9vXwMqAmQYaXmFiE3se+YfiTF48LHN8K1t2r10i8losfhW56k0Wm1Pqm4/gd57F9Zvhg== X-Received: by 10.36.19.209 with SMTP id 200mr14555249itz.83.1472471183368; Mon, 29 Aug 2016 04:46:23 -0700 (PDT) Received: from ircssh.c.rugged-nimbus-611.internal (55.145.251.23.bc.googleusercontent.com. [23.251.145.55]) by smtp.gmail.com with ESMTPSA id 69sm6005228itf.6.2016.08.29.04.46.23 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Mon, 29 Aug 2016 04:46:23 -0700 (PDT) Date: Mon, 29 Aug 2016 04:46:21 -0700 From: Sargun Dhillon To: netdev@vger.kernel.org Cc: cgroups@vger.kernel.org, linux-security-module@vger.kernel.org, daniel@iogearbox.net, ast@fb.com Subject: [net-next RFC v2 3/9] bpf: move tracing helpers (probe_read, get_current_task) to shared helpers Message-ID: <20160829114620.GA20854@ircssh.c.rugged-nimbus-611.internal> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP This patch moves bpf_probe_read and bpf_get_current_task to be the shared cgroup infrastructure. These are useful outside of the context of just tracing, but also inspection of a process memory during security policy enforcement. Signed-off-by: Sargun Dhillon --- include/linux/bpf.h | 2 ++ kernel/bpf/helpers.c | 34 ++++++++++++++++++++++++++++++++++ kernel/trace/bpf_trace.c | 33 --------------------------------- 3 files changed, 36 insertions(+), 33 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 1113423..4e1fa57 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -314,6 +314,8 @@ extern const struct bpf_func_proto bpf_get_current_comm_proto; extern const struct bpf_func_proto bpf_skb_vlan_push_proto; extern const struct bpf_func_proto bpf_skb_vlan_pop_proto; extern const struct bpf_func_proto bpf_get_stackid_proto; +extern const struct bpf_func_proto bpf_get_current_task_proto; +extern const struct bpf_func_proto bpf_probe_read_proto; /* Shared helpers among cBPF and eBPF. */ void bpf_user_rnd_init_once(void); diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index 1ea3afb..c439afc 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -16,6 +16,7 @@ #include #include #include +#include /* If kernel subsystem is allowing eBPF programs to call this function, * inside its own verifier_ops->get_func_proto() callback it should return @@ -186,3 +187,36 @@ const struct bpf_func_proto bpf_get_current_comm_proto = { .arg1_type = ARG_PTR_TO_RAW_STACK, .arg2_type = ARG_CONST_STACK_SIZE, }; + +static u64 bpf_get_current_task(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5) +{ + return (long) current; +} + +const struct bpf_func_proto bpf_get_current_task_proto = { + .func = bpf_get_current_task, + .gpl_only = true, + .ret_type = RET_INTEGER, +}; + +static u64 bpf_probe_read(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5) +{ + void *dst = (void *) (long) r1; + int ret, size = (int) r2; + void *unsafe_ptr = (void *) (long) r3; + + ret = probe_kernel_read(dst, unsafe_ptr, size); + if (unlikely(ret < 0)) + memset(dst, 0, size); + + return ret; +} + +const struct bpf_func_proto bpf_probe_read_proto = { + .func = bpf_probe_read, + .gpl_only = true, + .ret_type = RET_INTEGER, + .arg1_type = ARG_PTR_TO_RAW_STACK, + .arg2_type = ARG_CONST_STACK_SIZE, + .arg3_type = ARG_ANYTHING, +}; diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index ad35213..cb96eda 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -59,28 +59,6 @@ unsigned int trace_call_bpf(struct bpf_prog *prog, void *ctx) } EXPORT_SYMBOL_GPL(trace_call_bpf); -static u64 bpf_probe_read(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5) -{ - void *dst = (void *) (long) r1; - int ret, size = (int) r2; - void *unsafe_ptr = (void *) (long) r3; - - ret = probe_kernel_read(dst, unsafe_ptr, size); - if (unlikely(ret < 0)) - memset(dst, 0, size); - - return ret; -} - -static const struct bpf_func_proto bpf_probe_read_proto = { - .func = bpf_probe_read, - .gpl_only = true, - .ret_type = RET_INTEGER, - .arg1_type = ARG_PTR_TO_RAW_STACK, - .arg2_type = ARG_CONST_STACK_SIZE, - .arg3_type = ARG_ANYTHING, -}; - static u64 bpf_probe_write_user(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5) { void *unsafe_ptr = (void *) (long) r1; @@ -365,17 +343,6 @@ u64 bpf_event_output(struct bpf_map *map, u64 flags, void *meta, u64 meta_size, return __bpf_perf_event_output(regs, map, flags, &raw); } -static u64 bpf_get_current_task(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5) -{ - return (long) current; -} - -static const struct bpf_func_proto bpf_get_current_task_proto = { - .func = bpf_get_current_task, - .gpl_only = true, - .ret_type = RET_INTEGER, -}; - static u64 bpf_current_task_under_cgroup(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5) { struct bpf_map *map = (struct bpf_map *)(long)r1;