linux-kernel - Re: [PATCH] bpf: lirc program type should not require SYS_CAP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Apr 2023 09:28:36 +0100
From:   Sean Young <sean@...s.org>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        John Fastabend <john.fastabend@...il.com>,
        Andrii Nakryiko <andrii@...nel.org>,
        Martin KaFai Lau <martin.lau@...ux.dev>,
        Song Liu <song@...nel.org>, Yonghong Song <yhs@...com>,
        KP Singh <kpsingh@...nel.org>,
        Stanislav Fomichev <sdf@...gle.com>,
        Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
        bpf <bpf@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>,
        linux-media@...r.kernel.org
Subject: Re: [PATCH] bpf: lirc program type should not require SYS_CAP_ADMIN

On Wed, Apr 12, 2023 at 04:14:05PM -0700, Alexei Starovoitov wrote:
> On Tue, Apr 11, 2023 at 8:45 AM Sean Young <sean@...s.org> wrote:
> >
> > Make it possible to load lirc program type with just CAP_BPF.
> 
> Is it safe?
> If the user can load with just CAP_BPF the FD to the prog and target_fd
> will allow attach as well.

Exactly, that's the $1m question of course. 

I think it's safe from a lirc perspective because you need to be able to
open the /dev/lirc0 device in the first place; if you can open it, you
alter all sorts of lirc receiving options already. Changing the IR protocol
decoder is no different in that perspective.

The other side of course, is it save to load a bpf lirc program as a normal
user. I don't see any issue with this; I guess this depends on whether the
subset of functions in lirc_mode2_func_proto() is safe. I am hoping that
the expert opinion everyone here can help answer that question.

Thanks,

Sean

> 
> 
> > Signed-off-by: Sean Young <sean@...s.org>
> > ---
> >  kernel/bpf/syscall.c | 1 -
> >  1 file changed, 1 deletion(-)
> >
> > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> > index adc83cb82f37..19d9265270b3 100644
> > --- a/kernel/bpf/syscall.c
> > +++ b/kernel/bpf/syscall.c
> > @@ -2439,7 +2439,6 @@ static bool is_net_admin_prog_type(enum bpf_prog_type prog_type)
> >         case BPF_PROG_TYPE_LWT_SEG6LOCAL:
> >         case BPF_PROG_TYPE_SK_SKB:
> >         case BPF_PROG_TYPE_SK_MSG:
> > -       case BPF_PROG_TYPE_LIRC_MODE2:
> >         case BPF_PROG_TYPE_FLOW_DISSECTOR:
> >         case BPF_PROG_TYPE_CGROUP_DEVICE:
> >         case BPF_PROG_TYPE_CGROUP_SOCK:
> > --
> > 2.39.2
> >