linux-kernel - [PATCH] bpf: lsm: Disable or enable BPF LSM at boot time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200706165710.GA208695@gallifrey>
Date:   Mon, 6 Jul 2020 18:57:10 +0200
From:   Lorenzo Fontana <fontanalorenz@...il.com>
To:     linux-kernel@...r.kernel.org, bpf@...r.kernel.org,
        linux-security-module@...r.kernel.org
Cc:     Jonathan Corbet <corbet@....net>, James Morris <jmorris@...ei.org>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        Andrii Nakryiko <andriin@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...omium.org>
Subject: [PATCH] bpf: lsm: Disable or enable BPF LSM at boot time

This option adds a kernel parameter 'bpf_lsm',
which allows the BPF LSM to be disabled at boot.
The purpose of this option is to allow a single kernel
image to be distributed with the BPF LSM built in,
but not necessarily enabled.

Signed-off-by: Lorenzo Fontana <fontanalorenz@...il.com>
---
 Documentation/admin-guide/kernel-parameters.txt |  8 ++++++++
 init/Kconfig                                    | 12 ++++++++++++
 security/bpf/hooks.c                            | 16 ++++++++++++++++
 3 files changed, 36 insertions(+)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index fb95fad81c79..c0d5955279d7 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4575,6 +4575,14 @@
 			1 -- enable.
 			Default value is set via kernel config option.
 
+	bpf_lsm=	[BPF_LSM] Disable or enable LSM Instrumentation
+			with BPF at boot time.
+			Format: { "0" | "1" }
+			See init/Kconfig help text.
+			0 -- disable.
+			1 -- enable.
+			Default value is 1.
+
 	serialnumber	[BUGS=X86-32]
 
 	shapers=	[NET]
diff --git a/init/Kconfig b/init/Kconfig
index a46aa8f3174d..410547e4342e 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1659,6 +1659,18 @@ config BPF_LSM
 
 	  If you are unsure how to answer this question, answer N.
 
+config BPF_LSM_BOOTPARAM
+	bool "LSM Instrumentation with BPF boot parameter"
+	depends on BPF_LSM
+	help
+	  This option adds a kernel parameter 'bpf_lsm', which allows LSM
+	  instrumentation with BPF to be disabled at boot.
+	  If this option is selected, the BPF LSM
+	  functionality can be disabled with bpf_lsm=0 on the kernel
+	  command line.  The purpose of this option is to allow a single
+	  kernel image to be distributed with the BPF LSM built in, but not
+	  necessarily enabled.
+
 config BPF_SYSCALL
 	bool "Enable bpf() system call"
 	select BPF
diff --git a/security/bpf/hooks.c b/security/bpf/hooks.c
index 32d32d485451..6a4b4f63976c 100644
--- a/security/bpf/hooks.c
+++ b/security/bpf/hooks.c
@@ -3,9 +3,24 @@
 /*
  * Copyright (C) 2020 Google LLC.
  */
+
+#include <linux/init.h>
 #include <linux/lsm_hooks.h>
 #include <linux/bpf_lsm.h>
 
+int bpf_lsm_enabled_boot __initdata = 1;
+#ifdef CONFIG_BPF_LSM_BOOTPARAM
+static int __init bpf_lsm_enabled_setup(char *str)
+{
+	unsigned long enabled;
+
+	if (!kstrtoul(str, 0, &enabled))
+		bpf_lsm_enabled_boot = enabled ? 1 : 0;
+	return 1;
+}
+__setup("bpf_lsm=", bpf_lsm_enabled_setup);
+#endif
+
 static struct security_hook_list bpf_lsm_hooks[] __lsm_ro_after_init = {
 	#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
 	LSM_HOOK_INIT(NAME, bpf_lsm_##NAME),
@@ -23,4 +38,5 @@ static int __init bpf_lsm_init(void)
 DEFINE_LSM(bpf) = {
 	.name = "bpf",
 	.init = bpf_lsm_init,
+	.enabled = &bpf_lsm_enabled_boot,
 };
-- 
2.27.0