netdev - [RFC PATCH bpf-next 2/2] bpf: relax CAP_SYS_ADMIN requirement for BPF_PROG_TEST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 19 Dec 2019 01:36:27 +0000
From:   Edwin Peer <epeer@...iper.net>
To:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     "ast@...nel.org" <ast@...nel.org>,
        "daniel@...earbox.net" <daniel@...earbox.net>,
        Edwin Peer <epeer@...iper.net>
Subject: [RFC PATCH bpf-next 2/2] bpf: relax CAP_SYS_ADMIN requirement for
 BPF_PROG_TEST_RUN

Introduce a bpf_prog_get_lax() API to provide unprivileged access to BPF
programs. The new API is provided to make explicit the intent to allow
such access at a given call site, however, it is not exposed beyond the
syscall interface here as there is no plan to use this beyond
BPF_PROG_TEST_RUN at this stage. The semantics remain unchanged for all
other existing callers.

This change allows unprivileged users to execute BPF_PROG_TEST_RUN for
all BPF program types.

Signed-off-by: Edwin Peer <epeer@...iper.net>
---
 kernel/bpf/syscall.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 8e56768ebc06..970aeff9a9d9 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1578,7 +1578,7 @@ bool bpf_prog_get_ok(struct bpf_prog *prog,
 }
 
 static struct bpf_prog *__bpf_prog_get(u32 ufd, enum bpf_prog_type *attach_type,
-				       bool attach_drv)
+				       bool attach_drv, bool privilege_required)
 {
 	struct fd f = fdget(ufd);
 	struct bpf_prog *prog;
@@ -1587,7 +1587,8 @@ static struct bpf_prog *__bpf_prog_get(u32 ufd, enum bpf_prog_type *attach_type,
 	if (IS_ERR(prog))
 		return prog;
 	if (prog->type != BPF_PROG_TYPE_SOCKET_FILTER &&
-	    prog->type != BPF_PROG_TYPE_CGROUP_SKB && !prog->privileged_load) {
+	    prog->type != BPF_PROG_TYPE_CGROUP_SKB &&
+	    privilege_required && !prog->privileged_load) {
 		prog = ERR_PTR(-EPERM);
 		goto out;
 	}
@@ -1604,13 +1605,18 @@ static struct bpf_prog *__bpf_prog_get(u32 ufd, enum bpf_prog_type *attach_type,
 
 struct bpf_prog *bpf_prog_get(u32 ufd)
 {
-	return __bpf_prog_get(ufd, NULL, false);
+	return __bpf_prog_get(ufd, NULL, false, true);
+}
+
+struct bpf_prog *bpf_prog_get_lax(u32 ufd)
+{
+	return __bpf_prog_get(ufd, NULL, false, false);
 }
 
 struct bpf_prog *bpf_prog_get_type_dev(u32 ufd, enum bpf_prog_type type,
 				       bool attach_drv)
 {
-	return __bpf_prog_get(ufd, &type, attach_drv);
+	return __bpf_prog_get(ufd, &type, attach_drv, true);
 }
 EXPORT_SYMBOL_GPL(bpf_prog_get_type_dev);
 
@@ -2254,8 +2260,6 @@ static int bpf_prog_test_run(const union bpf_attr *attr,
 	struct bpf_prog *prog;
 	int ret = -ENOTSUPP;
 
-	if (!capable(CAP_SYS_ADMIN))
-		return -EPERM;
 	if (CHECK_ATTR(BPF_PROG_TEST_RUN))
 		return -EINVAL;
 
@@ -2267,7 +2271,7 @@ static int bpf_prog_test_run(const union bpf_attr *attr,
 	    (!attr->test.ctx_size_out && attr->test.ctx_out))
 		return -EINVAL;
 
-	prog = bpf_prog_get(attr->test.prog_fd);
+	prog = bpf_prog_get_lax(attr->test.prog_fd);
 	if (IS_ERR(prog))
 		return PTR_ERR(prog);
 
-- 
2.24.1