Currently only CAP_SYS_ADMIN can iterate BPF object IDs and convert IDs to FDs, that's intended for BPF's security model[1]. Not only does it prevent non-privilidged users from getting other users' bpf program, but also it prevents the user from iterating his own bpf objects. In container environment, some users want to run bpf programs in their containers. These users can run their bpf programs under CAP_BPF and some other specific CAPs, but they can't inspect their bpf programs in a generic way. For example, the bpftool can't be used as it requires CAP_SYS_ADMIN. That is very inconvenient. Without CAP_SYS_ADMIN, the only way to get the information of a bpf object which is not created by the process itself is with SCM_RIGHTS, that requires each processes which created bpf object has to implement a unix domain socket to share the fd of a bpf object between different processes, that is really trivial and troublesome. Hence we need a better mechanism to get bpf object info without CAP_SYS_ADMIN. BPF namespace is introduced in this patchset with an attempt to remove the CAP_SYS_ADMIN requirement. The user can create bpf map, prog and link in a specific bpf namespace, then these bpf objects will not be visible to the users in a different bpf namespace. But these bpf objects are visible to its parent bpf namespace, so the sys admin can still iterate and inspect them. BPF namespace is similar to PID namespace, and the bpf objects are similar to tasks, so BPF namespace is very easy to understand. These patchset only implements BPF namespace for bpf map, prog and link. In the future we may extend it to other bpf objects like btf, bpffs and etc. For example, we can allow some of the BTF objects to be used in non-init bpf namespace, then the container user can only trace the processes running in his container, but can't get the information of tasks running in other containers. A simple example is introduced into selftests/bpf on how to use the bpf namespace. Putting bpf map, prog and link into bpf namespace is the first step. Let's start with it. [1]. https://lore.kernel.org/bpf/20200513230355.7858-1-alexei.starovoitov@xxxxxxxxx/ Yafang Shao (13): fork: New clone3 flag for BPF namespace proc_ns: Extend the field type in struct proc_ns_operations to long bpf: Implement bpf namespace bpf: No need to check if id is 0 bpf: Make bpf objects id have the same alloc and free pattern bpf: Helpers to alloc and free object id in bpf namespace bpf: Add bpf helper to get bpf object id bpf: Alloc and free bpf_map id in bpf namespace bpf: Alloc and free bpf_prog id in bpf namespace bpf: Alloc and free bpf_link id in bpf namespace bpf: Allow iterating bpf objects with CAP_BPF in bpf namespace bpf: Use bpf_idr_lock array instead selftests/bpf: Add selftest for bpf namespace fs/proc/namespaces.c | 4 + include/linux/bpf.h | 9 +- include/linux/bpf_namespace.h | 88 ++++++++++ include/linux/nsproxy.h | 4 + include/linux/proc_ns.h | 3 +- include/linux/user_namespace.h | 1 + include/uapi/linux/bpf.h | 7 + include/uapi/linux/sched.h | 1 + kernel/bpf/Makefile | 1 + kernel/bpf/bpf_namespace.c | 283 ++++++++++++++++++++++++++++++ kernel/bpf/offload.c | 16 +- kernel/bpf/syscall.c | 262 ++++++++++----------------- kernel/bpf/task_iter.c | 12 ++ kernel/fork.c | 5 +- kernel/nsproxy.c | 19 +- kernel/trace/bpf_trace.c | 2 + kernel/ucount.c | 1 + tools/bpf/bpftool/skeleton/pid_iter.bpf.c | 13 +- tools/include/uapi/linux/bpf.h | 7 + tools/testing/selftests/bpf/Makefile | 3 +- tools/testing/selftests/bpf/test_bpfns.c | 76 ++++++++ 21 files changed, 637 insertions(+), 180 deletions(-) create mode 100644 include/linux/bpf_namespace.h create mode 100644 kernel/bpf/bpf_namespace.c create mode 100644 tools/testing/selftests/bpf/test_bpfns.c -- 1.8.3.1
