netdev - Re: [PATCH v7 11/18] bpf,lsm: add bpf_token_create and bpf_token

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4BzbYu0+6p+V8EmDSUA3q8Hi7QVmAz3rwg3EuhOK+BQnK9A@mail.gmail.com>
Date: Fri, 13 Oct 2023 14:55:11 -0700
From: Andrii Nakryiko <andrii.nakryiko@...il.com>
To: Paul Moore <paul@...l-moore.com>
Cc: Andrii Nakryiko <andrii@...nel.org>, bpf@...r.kernel.org, netdev@...r.kernel.org, 
	linux-fsdevel@...r.kernel.org, linux-security-module@...r.kernel.org, 
	keescook@...omium.org, brauner@...nel.org, lennart@...ttering.net, 
	kernel-team@...a.com, sargun@...gun.me
Subject: Re: [PATCH v7 11/18] bpf,lsm: add bpf_token_create and bpf_token_free
 LSM hooks

On Fri, Oct 13, 2023 at 2:15 PM Paul Moore <paul@...l-moore.com> wrote:
>
> On Oct 12, 2023 Andrii Nakryiko <andrii@...nel.org> wrote:
> >
> > Wire up bpf_token_create and bpf_token_free LSM hooks, which allow to
> > allocate LSM security blob (we add `void *security` field to struct
> > bpf_token for that), but also control who can instantiate BPF token.
> > This follows existing pattern for BPF map and BPF prog.
> >
> > Signed-off-by: Andrii Nakryiko <andrii@...nel.org>
> > ---
> >  include/linux/bpf.h           |  3 +++
> >  include/linux/lsm_hook_defs.h |  3 +++
> >  include/linux/security.h      | 11 +++++++++++
> >  kernel/bpf/bpf_lsm.c          |  2 ++
> >  kernel/bpf/token.c            |  6 ++++++
> >  security/security.c           | 28 ++++++++++++++++++++++++++++
> >  6 files changed, 53 insertions(+)
>
> ...
>
> > diff --git a/kernel/bpf/token.c b/kernel/bpf/token.c
> > index d4e0cc8075d3..18fd1e04f92d 100644
> > --- a/kernel/bpf/token.c
> > +++ b/kernel/bpf/token.c
> > @@ -7,6 +7,7 @@
> >  #include <linux/idr.h>
> >  #include <linux/namei.h>
> >  #include <linux/user_namespace.h>
> > +#include <linux/security.h>
> >
> >  bool bpf_token_capable(const struct bpf_token *token, int cap)
> >  {
> > @@ -28,6 +29,7 @@ void bpf_token_inc(struct bpf_token *token)
> >
> >  static void bpf_token_free(struct bpf_token *token)
> >  {
> > +     security_bpf_token_free(token);
> >       put_user_ns(token->userns);
> >       kvfree(token);
> >  }
> > @@ -183,6 +185,10 @@ int bpf_token_create(union bpf_attr *attr)
> >       token->allowed_progs = mnt_opts->delegate_progs;
> >       token->allowed_attachs = mnt_opts->delegate_attachs;
> >
> > +     err = security_bpf_token_create(token, attr, &path);
> > +     if (err)
> > +             goto out_token;
> > +
> >       fd = get_unused_fd_flags(O_CLOEXEC);
> >       if (fd < 0) {
> >               err = fd;
>
> As long as bpf_token_alloc() remains separate from bpf_token_create()
> I'm not comfortable not having a security_bpf_token_alloc() hook in
> bpf_token_alloc().  If you really don't want a LSM token alloc hook
> can you fold bpf_token_alloc() into bpf_token_create()?

Yeah, that's easy, I'll just inline it into bpf_token_create(), which
is the only place where I was intending to use it anyways. I just want
to keep all this consistent between map, token, and progs.

>
> --
> paul-moore.com