1 #include <linux/bpf.h> 2 #include <linux/vmalloc.h> 3 #include <linux/fdtable.h> 4 #include <linux/file.h> 5 #include <linux/fs.h> 6 #include <linux/kernel.h> 7 #include <linux/idr.h> 8 #include <linux/namei.h> 9 #include <linux/user_namespace.h> 10 11 bool bpf_token_capable(const struct bpf_token *token, int cap) 12 { 13 /* BPF token allows ns_capable() level of capabilities, but only if 14 * token's userns is *exactly* the same as current user's userns 15 */ 16 if (token && current_user_ns() == token->userns) { 17 if (ns_capable(token->userns, cap)) 18 return true; 19 if (cap != CAP_SYS_ADMIN && ns_capable(token->userns, CAP_SYS_ADMIN)) 20 return true; 21 } 22 /* otherwise fallback to capable() checks */ 23 return capable(cap) || (cap != CAP_SYS_ADMIN && capable(CAP_SYS_ADMIN)); 24 } 25 26 void bpf_token_inc(struct bpf_token *token) 27 { 28 atomic64_inc(&token->refcnt); 29 } 30 31 static void bpf_token_free(struct bpf_token *token) 32 { 33 put_user_ns(token->userns); 34 kvfree(token); 35 } 36 37 static void bpf_token_put_deferred(struct work_struct *work) 38 { 39 struct bpf_token *token = container_of(work, struct bpf_token, work); 40 41 bpf_token_free(token); 42 } 43 44 void bpf_token_put(struct bpf_token *token) 45 { 46 if (!token) 47 return; 48 49 if (!atomic64_dec_and_test(&token->refcnt)) 50 return; 51 52 INIT_WORK(&token->work, bpf_token_put_deferred); 53 schedule_work(&token->work); 54 } 55 56 static int bpf_token_release(struct inode *inode, struct file *filp) 57 { 58 struct bpf_token *token = filp->private_data; 59 60 bpf_token_put(token); 61 return 0; 62 } 63 64 static void bpf_token_show_fdinfo(struct seq_file *m, struct file *filp) 65 { 66 struct bpf_token *token = filp->private_data; 67 u64 mask; 68 69 BUILD_BUG_ON(__MAX_BPF_CMD >= 64); 70 mask = (1ULL << __MAX_BPF_CMD) - 1; 71 if ((token->allowed_cmds & mask) == mask) 72 seq_printf(m, "allowed_cmds:\tany\n"); 73 else 74 seq_printf(m, "allowed_cmds:\t0x%llx\n", token->allowed_cmds); 75 76 BUILD_BUG_ON(__MAX_BPF_MAP_TYPE >= 64); 77 mask = (1ULL << __MAX_BPF_MAP_TYPE) - 1; 78 if ((token->allowed_maps & mask) == mask) 79 seq_printf(m, "allowed_maps:\tany\n"); 80 else 81 seq_printf(m, "allowed_maps:\t0x%llx\n", token->allowed_maps); 82 83 BUILD_BUG_ON(__MAX_BPF_PROG_TYPE >= 64); 84 mask = (1ULL << __MAX_BPF_PROG_TYPE) - 1; 85 if ((token->allowed_progs & mask) == mask) 86 seq_printf(m, "allowed_progs:\tany\n"); 87 else 88 seq_printf(m, "allowed_progs:\t0x%llx\n", token->allowed_progs); 89 90 BUILD_BUG_ON(__MAX_BPF_ATTACH_TYPE >= 64); 91 mask = (1ULL << __MAX_BPF_ATTACH_TYPE) - 1; 92 if ((token->allowed_attachs & mask) == mask) 93 seq_printf(m, "allowed_attachs:\tany\n"); 94 else 95 seq_printf(m, "allowed_attachs:\t0x%llx\n", token->allowed_attachs); 96 } 97 98 #define BPF_TOKEN_INODE_NAME "bpf-token" 99 100 static const struct inode_operations bpf_token_iops = { }; 101 102 static const struct file_operations bpf_token_fops = { 103 .release = bpf_token_release, 104 .show_fdinfo = bpf_token_show_fdinfo, 105 }; 106 107 int bpf_token_create(union bpf_attr *attr) 108 { 109 struct bpf_mount_opts *mnt_opts; 110 struct bpf_token *token = NULL; 111 struct user_namespace *userns; 112 struct inode *inode; 113 struct file *file; 114 struct path path; 115 struct fd f; 116 umode_t mode; 117 int err, fd; 118 119 f = fdget(attr->token_create.bpffs_fd); 120 if (!f.file) 121 return -EBADF; 122 123 path = f.file->f_path; 124 path_get(&path); 125 fdput(f); 126 127 if (path.dentry != path.mnt->mnt_sb->s_root) { 128 err = -EINVAL; 129 goto out_path; 130 } 131 if (path.mnt->mnt_sb->s_op != &bpf_super_ops) { 132 err = -EINVAL; 133 goto out_path; 134 } 135 err = path_permission(&path, MAY_ACCESS); 136 if (err) 137 goto out_path; 138 139 userns = path.dentry->d_sb->s_user_ns; 140 /* 141 * Enforce that creators of BPF tokens are in the same user 142 * namespace as the BPF FS instance. This makes reasoning about 143 * permissions a lot easier and we can always relax this later. 144 */ 145 if (current_user_ns() != userns) { 146 err = -EPERM; 147 goto out_path; 148 } 149 if (!ns_capable(userns, CAP_BPF)) { 150 err = -EPERM; 151 goto out_path; 152 } 153 154 mode = S_IFREG | ((S_IRUSR | S_IWUSR) & ~current_umask()); 155 inode = bpf_get_inode(path.mnt->mnt_sb, NULL, mode); 156 if (IS_ERR(inode)) { 157 err = PTR_ERR(inode); 158 goto out_path; 159 } 160 161 inode->i_op = &bpf_token_iops; 162 inode->i_fop = &bpf_token_fops; 163 clear_nlink(inode); /* make sure it is unlinked */ 164 165 file = alloc_file_pseudo(inode, path.mnt, BPF_TOKEN_INODE_NAME, O_RDWR, &bpf_token_fops); 166 if (IS_ERR(file)) { 167 iput(inode); 168 err = PTR_ERR(file); 169 goto out_path; 170 } 171 172 token = kvzalloc(sizeof(*token), GFP_USER); 173 if (!token) { 174 err = -ENOMEM; 175 goto out_file; 176 } 177 178 atomic64_set(&token->refcnt, 1); 179 180 /* remember bpffs owning userns for future ns_capable() checks */ 181 token->userns = get_user_ns(userns); 182 183 mnt_opts = path.dentry->d_sb->s_fs_info; 184 token->allowed_cmds = mnt_opts->delegate_cmds; 185 token->allowed_maps = mnt_opts->delegate_maps; 186 token->allowed_progs = mnt_opts->delegate_progs; 187 token->allowed_attachs = mnt_opts->delegate_attachs; 188 189 fd = get_unused_fd_flags(O_CLOEXEC); 190 if (fd < 0) { 191 err = fd; 192 goto out_token; 193 } 194 195 file->private_data = token; 196 fd_install(fd, file); 197 198 path_put(&path); 199 return fd; 200 201 out_token: 202 bpf_token_free(token); 203 out_file: 204 fput(file); 205 out_path: 206 path_put(&path); 207 return err; 208 } 209 210 struct bpf_token *bpf_token_get_from_fd(u32 ufd) 211 { 212 struct fd f = fdget(ufd); 213 struct bpf_token *token; 214 215 if (!f.file) 216 return ERR_PTR(-EBADF); 217 if (f.file->f_op != &bpf_token_fops) { 218 fdput(f); 219 return ERR_PTR(-EINVAL); 220 } 221 222 token = f.file->private_data; 223 bpf_token_inc(token); 224 fdput(f); 225 226 return token; 227 } 228 229 bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd) 230 { 231 /* BPF token can be used only within exactly the same userns in which 232 * it was created 233 */ 234 if (!token || current_user_ns() != token->userns) 235 return false; 236 237 return token->allowed_cmds & (1ULL << cmd); 238 } 239 240 bool bpf_token_allow_map_type(const struct bpf_token *token, enum bpf_map_type type) 241 { 242 if (!token || type >= __MAX_BPF_MAP_TYPE) 243 return false; 244 245 return token->allowed_maps & (1ULL << type); 246 } 247 248 bool bpf_token_allow_prog_type(const struct bpf_token *token, 249 enum bpf_prog_type prog_type, 250 enum bpf_attach_type attach_type) 251 { 252 if (!token || prog_type >= __MAX_BPF_PROG_TYPE || attach_type >= __MAX_BPF_ATTACH_TYPE) 253 return false; 254 255 return (token->allowed_progs & (1ULL << prog_type)) && 256 (token->allowed_attachs & (1ULL << attach_type)); 257 } 258