This series implements new lsm flavor for attaching per-cgroup programs to
existing lsm hooks. The cgroup is taken out of 'current', unless
the first argument of the hook is 'struct socket'. In this case,
the cgroup association is taken out of socket. The attachment
looks like a regular per-cgroup attachment: we add new BPF_LSM_CGROUP
attach type which, together with attach_btf_id, signals per-cgroup lsm.
Behind the scenes, we allocate trampoline shim program and
attach to lsm. This program looks up cgroup from current/socket
and runs cgroup's effective prog array. The rest of the per-cgroup BPF
stays the same: hierarchy, local storage, retval conventions
(return 1 == success).
Current limitations:
* haven't considered sleepable bpf; can be extended later on
* not sure the verifier does the right thing with null checks;
see latest selftest for details
* total of 10 (global) per-cgroup LSM attach points; this bloats
bpf_cgroup a bit
Cc: ast@xxxxxxxxxx
Cc: daniel@xxxxxxxxxxxxx
Cc: kafai@xxxxxx
Cc: kpsingh@xxxxxxxxxx
Cc: jakub@xxxxxxxxxxxxxx
v6:
- remove active count & stats for shim program (Martin KaFai Lau)
- remove NULL/error check for btf_vmlinux (Martin)
- don't check cgroup_atype in bpf_cgroup_lsm_shim_release (Martin)
- use old_prog (instead of passed one) in __cgroup_bpf_detach (Martin)
- make sure attach_btf_id is the same in __cgroup_bpf_replace (Martin)
- enable cgroup local storage and test it (Martin)
- properly implement prog query and add bpftool & tests (Martin)
- prohibit non-shared cgroup storage mode for BPF_LSM_CGROUP (Martin)
v5:
- __cgroup_bpf_run_lsm_socket remove NULL sock/sk checks (Martin KaFai Lau)
- __cgroup_bpf_run_lsm_{socket,current} s/prog/shim_prog/ (Martin)
- make sure bpf_lsm_find_cgroup_shim works for hooks without args (Martin)
- __cgroup_bpf_attach make sure attach_btf_id is the same when replacing (Martin)
- call bpf_cgroup_lsm_shim_release only for LSM_CGROUP (Martin)
- drop BPF_LSM_CGROUP from bpf_attach_type_to_tramp (Martin)
- drop jited check from cgroup_shim_find (Martin)
- new patch to convert cgroup_bpf to hlist_node (Jakub Sitnicki)
- new shim flavor for 'struct sock' + list of exceptions (Martin)
v4:
- fix build when jit is on but syscall is off
v3:
- add BPF_LSM_CGROUP to bpftool
- use simple int instead of refcnt_t (to avoid use-after-free
false positive)
v2:
- addressed build bot failures
Stanislav Fomichev (10):
bpf: add bpf_func_t and trampoline helpers
bpf: convert cgroup_bpf.progs to hlist
bpf: per-cgroup lsm flavor
bpf: minimize number of allocated lsm slots per program
bpf: implement BPF_PROG_QUERY for BPF_LSM_CGROUP
bpf: allow writing to a subset of sock fields from lsm progtype
libbpf: add lsm_cgoup_sock type
bpftool: implement cgroup tree for BPF_LSM_CGROUP
selftests/bpf: lsm_cgroup functional test
selftests/bpf: verify lsm_cgroup struct sock access
arch/x86/net/bpf_jit_comp.c | 22 +-
include/linux/bpf-cgroup-defs.h | 11 +-
include/linux/bpf-cgroup.h | 9 +-
include/linux/bpf.h | 26 +-
include/linux/bpf_lsm.h | 8 +
include/uapi/linux/bpf.h | 2 +
kernel/bpf/bpf_lsm.c | 117 ++++++
kernel/bpf/btf.c | 11 +
kernel/bpf/cgroup.c | 391 +++++++++++++++---
kernel/bpf/syscall.c | 13 +-
kernel/bpf/trampoline.c | 222 ++++++++--
kernel/bpf/verifier.c | 35 +-
tools/bpf/bpftool/cgroup.c | 138 +++++--
tools/bpf/bpftool/common.c | 1 +
tools/include/uapi/linux/bpf.h | 2 +
tools/lib/bpf/bpf.c | 42 +-
tools/lib/bpf/bpf.h | 15 +
tools/lib/bpf/libbpf.c | 2 +
tools/lib/bpf/libbpf.map | 1 +
.../selftests/bpf/prog_tests/lsm_cgroup.c | 236 +++++++++++
.../testing/selftests/bpf/progs/lsm_cgroup.c | 160 +++++++
tools/testing/selftests/bpf/test_verifier.c | 54 ++-
.../selftests/bpf/verifier/lsm_cgroup.c | 34 ++
23 files changed, 1406 insertions(+), 146 deletions(-)
create mode 100644 tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c
create mode 100644 tools/testing/selftests/bpf/progs/lsm_cgroup.c
create mode 100644 tools/testing/selftests/bpf/verifier/lsm_cgroup.c
--
2.36.0.464.gb9c8b46e94-goog
