On 03/26, Yafang Shao wrote:
Currently only CAP_SYS_ADMIN can iterate BPF object IDs and convert IDs
to FDs, that's intended for BPF's security model[1]. Not only does it
prevent non-privilidged users from getting other users' bpf program, but
also it prevents the user from iterating his own bpf objects.
In container environment, some users want to run bpf programs in their
containers. These users can run their bpf programs under CAP_BPF and
some other specific CAPs, but they can't inspect their bpf programs in a
generic way. For example, the bpftool can't be used as it requires
CAP_SYS_ADMIN. That is very inconvenient.
Without CAP_SYS_ADMIN, the only way to get the information of a bpf object
which is not created by the process itself is with SCM_RIGHTS, that
requires each processes which created bpf object has to implement a unix
domain socket to share the fd of a bpf object between different
processes, that is really trivial and troublesome.
Hence we need a better mechanism to get bpf object info without
CAP_SYS_ADMIN.
[..]
BPF namespace is introduced in this patchset with an attempt to remove
the CAP_SYS_ADMIN requirement. The user can create bpf map, prog and
link in a specific bpf namespace, then these bpf objects will not be
visible to the users in a different bpf namespace. But these bpf
objects are visible to its parent bpf namespace, so the sys admin can
still iterate and inspect them.
Does it essentially mean unpriv bpf? Can I, as a non-root, create
a new bpf namespace and start loading/attaching progs?
Maybe add a paragraph about now vs whatever you're proposing.
Otherwise it's not very clear what's the security story.
(haven't looked at the whole series, so maybe it's answered somewhere else?)
BPF namespace is similar to PID namespace, and the bpf objects are
similar to tasks, so BPF namespace is very easy to understand. These
patchset only implements BPF namespace for bpf map, prog and link. In the
future we may extend it to other bpf objects like btf, bpffs and etc.
For example, we can allow some of the BTF objects to be used in
non-init bpf namespace, then the container user can only trace the
processes running in his container, but can't get the information of
tasks running in other containers.
A simple example is introduced into selftests/bpf on how to use the bpf
namespace.
Putting bpf map, prog and link into bpf namespace is the first step.
Let's start with it.
[1].
https://lore.kernel.org/bpf/20200513230355.7858-1-alexei.starovoitov@xxxxxxxxx/
Yafang Shao (13):
fork: New clone3 flag for BPF namespace
proc_ns: Extend the field type in struct proc_ns_operations to long
bpf: Implement bpf namespace
bpf: No need to check if id is 0
bpf: Make bpf objects id have the same alloc and free pattern
bpf: Helpers to alloc and free object id in bpf namespace
bpf: Add bpf helper to get bpf object id
bpf: Alloc and free bpf_map id in bpf namespace
bpf: Alloc and free bpf_prog id in bpf namespace
bpf: Alloc and free bpf_link id in bpf namespace
bpf: Allow iterating bpf objects with CAP_BPF in bpf namespace
bpf: Use bpf_idr_lock array instead
selftests/bpf: Add selftest for bpf namespace
fs/proc/namespaces.c | 4 +
include/linux/bpf.h | 9 +-
include/linux/bpf_namespace.h | 88 ++++++++++
include/linux/nsproxy.h | 4 +
include/linux/proc_ns.h | 3 +-
include/linux/user_namespace.h | 1 +
include/uapi/linux/bpf.h | 7 +
include/uapi/linux/sched.h | 1 +
kernel/bpf/Makefile | 1 +
kernel/bpf/bpf_namespace.c | 283
++++++++++++++++++++++++++++++
kernel/bpf/offload.c | 16 +-
kernel/bpf/syscall.c | 262
++++++++++-----------------
kernel/bpf/task_iter.c | 12 ++
kernel/fork.c | 5 +-
kernel/nsproxy.c | 19 +-
kernel/trace/bpf_trace.c | 2 +
kernel/ucount.c | 1 +
tools/bpf/bpftool/skeleton/pid_iter.bpf.c | 13 +-
tools/include/uapi/linux/bpf.h | 7 +
tools/testing/selftests/bpf/Makefile | 3 +-
tools/testing/selftests/bpf/test_bpfns.c | 76 ++++++++
21 files changed, 637 insertions(+), 180 deletions(-)
create mode 100644 include/linux/bpf_namespace.h
create mode 100644 kernel/bpf/bpf_namespace.c
create mode 100644 tools/testing/selftests/bpf/test_bpfns.c
--
1.8.3.1
