case BPF_FUNC_get_prandom_u32:
return &bpf_get_prandom_u32_proto;
case BPF_FUNC_trace_printk:
- if (bpf_token_capable(prog->aux->token, CAP_PERFMON))
+ if (perfmon_capable())
return bpf_get_trace_printk_proto();
fallthrough;
default:
struct bpf_func_state;
struct ftrace_ops;
struct cgroup;
-struct bpf_token;
-struct user_namespace;
-struct super_block;
-struct inode;
extern struct idr btf_idr;
extern spinlock_t btf_idr_lock;
#ifdef CONFIG_SECURITY
void *security;
#endif
- struct bpf_token *token;
struct bpf_prog_offload *offload;
struct btf *btf;
struct bpf_func_info *func_info;
u32 id;
};
-struct bpf_mount_opts {
- kuid_t uid;
- kgid_t gid;
- umode_t mode;
-
- /* BPF token-related delegation options */
- u64 delegate_cmds;
- u64 delegate_maps;
- u64 delegate_progs;
- u64 delegate_attachs;
-};
-
-struct bpf_token {
- struct work_struct work;
- atomic64_t refcnt;
- struct user_namespace *userns;
- u64 allowed_cmds;
- u64 allowed_maps;
- u64 allowed_progs;
- u64 allowed_attachs;
-#ifdef CONFIG_SECURITY
- void *security;
-#endif
-};
-
struct bpf_struct_ops_value;
struct btf_member;
migrate_enable();
}
-extern const struct super_operations bpf_super_ops;
extern const struct file_operations bpf_map_fops;
extern const struct file_operations bpf_prog_fops;
extern const struct file_operations bpf_iter_fops;
extern int sysctl_unprivileged_bpf_disabled;
-bool bpf_token_capable(const struct bpf_token *token, int cap);
-
-static inline bool bpf_allow_ptr_leaks(const struct bpf_token *token)
+static inline bool bpf_allow_ptr_leaks(void)
{
- return bpf_token_capable(token, CAP_PERFMON);
+ return perfmon_capable();
}
-static inline bool bpf_allow_uninit_stack(const struct bpf_token *token)
+static inline bool bpf_allow_uninit_stack(void)
{
- return bpf_token_capable(token, CAP_PERFMON);
+ return perfmon_capable();
}
-static inline bool bpf_bypass_spec_v1(const struct bpf_token *token)
+static inline bool bpf_bypass_spec_v1(void)
{
- return cpu_mitigations_off() || bpf_token_capable(token, CAP_PERFMON);
+ return cpu_mitigations_off() || perfmon_capable();
}
-static inline bool bpf_bypass_spec_v4(const struct bpf_token *token)
+static inline bool bpf_bypass_spec_v4(void)
{
- return cpu_mitigations_off() || bpf_token_capable(token, CAP_PERFMON);
+ return cpu_mitigations_off() || perfmon_capable();
}
int bpf_map_new_fd(struct bpf_map *map, int flags);
struct bpf_link *bpf_link_get_from_fd(u32 ufd);
struct bpf_link *bpf_link_get_curr_or_next(u32 *id);
-void bpf_token_inc(struct bpf_token *token);
-void bpf_token_put(struct bpf_token *token);
-int bpf_token_create(union bpf_attr *attr);
-struct bpf_token *bpf_token_get_from_fd(u32 ufd);
-
-bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd);
-bool bpf_token_allow_map_type(const struct bpf_token *token, enum bpf_map_type type);
-bool bpf_token_allow_prog_type(const struct bpf_token *token,
- enum bpf_prog_type prog_type,
- enum bpf_attach_type attach_type);
-
int bpf_obj_pin_user(u32 ufd, int path_fd, const char __user *pathname);
int bpf_obj_get_user(int path_fd, const char __user *pathname, int flags);
-struct inode *bpf_get_inode(struct super_block *sb, const struct inode *dir,
- umode_t mode);
#define BPF_ITER_FUNC_PREFIX "bpf_iter_"
#define DEFINE_BPF_ITER_FUNC(target, args...) \
struct bpf_prog *bpf_prog_by_id(u32 id);
struct bpf_link *bpf_link_by_id(u32 id);
-const struct bpf_func_proto *bpf_base_func_proto(enum bpf_func_id func_id,
- const struct bpf_prog *prog);
+const struct bpf_func_proto *bpf_base_func_proto(enum bpf_func_id func_id);
void bpf_task_storage_free(struct task_struct *task);
void bpf_cgrp_storage_free(struct cgroup *cgroup);
bool bpf_prog_has_kfunc_call(const struct bpf_prog *prog);
return -EOPNOTSUPP;
}
-static inline bool bpf_token_capable(const struct bpf_token *token, int cap)
-{
- return capable(cap) || (cap != CAP_SYS_ADMIN && capable(CAP_SYS_ADMIN));
-}
-
-static inline void bpf_token_inc(struct bpf_token *token)
-{
-}
-
-static inline void bpf_token_put(struct bpf_token *token)
-{
-}
-
-static inline struct bpf_token *bpf_token_get_from_fd(u32 ufd)
-{
- return ERR_PTR(-EOPNOTSUPP);
-}
-
static inline void __dev_flush(void)
{
}
}
static inline const struct bpf_func_proto *
-bpf_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
+bpf_base_func_proto(enum bpf_func_id func_id)
{
return NULL;
}
return false;
if (!bpf_jit_harden)
return false;
- if (bpf_jit_harden == 1 && bpf_token_capable(prog->aux->token, CAP_BPF))
+ if (bpf_jit_harden == 1 && bpf_capable())
return false;
return true;
LSM_HOOK(int, 0, bpf, int cmd, union bpf_attr *attr, unsigned int size)
LSM_HOOK(int, 0, bpf_map, struct bpf_map *map, fmode_t fmode)
LSM_HOOK(int, 0, bpf_prog, struct bpf_prog *prog)
-LSM_HOOK(int, 0, bpf_map_create, struct bpf_map *map, union bpf_attr *attr,
- struct bpf_token *token)
-LSM_HOOK(void, LSM_RET_VOID, bpf_map_free, struct bpf_map *map)
-LSM_HOOK(int, 0, bpf_prog_load, struct bpf_prog *prog, union bpf_attr *attr,
- struct bpf_token *token)
-LSM_HOOK(void, LSM_RET_VOID, bpf_prog_free, struct bpf_prog *prog)
-LSM_HOOK(int, 0, bpf_token_create, struct bpf_token *token, union bpf_attr *attr,
- struct path *path)
-LSM_HOOK(void, LSM_RET_VOID, bpf_token_free, struct bpf_token *token)
-LSM_HOOK(int, 0, bpf_token_cmd, const struct bpf_token *token, enum bpf_cmd cmd)
-LSM_HOOK(int, 0, bpf_token_capable, const struct bpf_token *token, int cap)
+LSM_HOOK(int, 0, bpf_map_alloc_security, struct bpf_map *map)
+LSM_HOOK(void, LSM_RET_VOID, bpf_map_free_security, struct bpf_map *map)
+LSM_HOOK(int, 0, bpf_prog_alloc_security, struct bpf_prog_aux *aux)
+LSM_HOOK(void, LSM_RET_VOID, bpf_prog_free_security, struct bpf_prog_aux *aux)
#endif /* CONFIG_BPF_SYSCALL */
LSM_HOOK(int, 0, locked_down, enum lockdown_reason what)
#include <linux/string.h>
#include <linux/mm.h>
#include <linux/sockptr.h>
-#include <linux/bpf.h>
struct linux_binprm;
struct cred;
union bpf_attr;
struct bpf_map;
struct bpf_prog;
-struct bpf_token;
+struct bpf_prog_aux;
#ifdef CONFIG_SECURITY
extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size);
extern int security_bpf_map(struct bpf_map *map, fmode_t fmode);
extern int security_bpf_prog(struct bpf_prog *prog);
-extern int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
- struct bpf_token *token);
+extern int security_bpf_map_alloc(struct bpf_map *map);
extern void security_bpf_map_free(struct bpf_map *map);
-extern int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
- struct bpf_token *token);
-extern void security_bpf_prog_free(struct bpf_prog *prog);
-extern int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
- struct path *path);
-extern void security_bpf_token_free(struct bpf_token *token);
-extern int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd);
-extern int security_bpf_token_capable(const struct bpf_token *token, int cap);
+extern int security_bpf_prog_alloc(struct bpf_prog_aux *aux);
+extern void security_bpf_prog_free(struct bpf_prog_aux *aux);
#else
static inline int security_bpf(int cmd, union bpf_attr *attr,
unsigned int size)
return 0;
}
-static inline int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
- struct bpf_token *token)
+static inline int security_bpf_map_alloc(struct bpf_map *map)
{
return 0;
}
static inline void security_bpf_map_free(struct bpf_map *map)
{ }
-static inline int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
- struct bpf_token *token)
+static inline int security_bpf_prog_alloc(struct bpf_prog_aux *aux)
{
return 0;
}
-static inline void security_bpf_prog_free(struct bpf_prog *prog)
+static inline void security_bpf_prog_free(struct bpf_prog_aux *aux)
{ }
-
-static inline int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
- struct path *path)
-{
- return 0;
-}
-
-static inline void security_bpf_token_free(struct bpf_token *token)
-{ }
-
-static inline int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
-{
- return 0;
-}
-
-static inline int security_bpf_token_capable(const struct bpf_token *token, int cap)
-{
- return 0;
-}
#endif /* CONFIG_SECURITY */
#endif /* CONFIG_BPF_SYSCALL */
* Returns zero on success. On error, -1 is returned and *errno*
* is set appropriately.
*
- * BPF_TOKEN_CREATE
- * Description
- * Create BPF token with embedded information about what
- * BPF-related functionality it allows:
- * - a set of allowed bpf() syscall commands;
- * - a set of allowed BPF map types to be created with
- * BPF_MAP_CREATE command, if BPF_MAP_CREATE itself is allowed;
- * - a set of allowed BPF program types and BPF program attach
- * types to be loaded with BPF_PROG_LOAD command, if
- * BPF_PROG_LOAD itself is allowed.
- *
- * BPF token is created (derived) from an instance of BPF FS,
- * assuming it has necessary delegation mount options specified.
- * This BPF token can be passed as an extra parameter to various
- * bpf() syscall commands to grant BPF subsystem functionality to
- * unprivileged processes.
- *
- * When created, BPF token is "associated" with the owning
- * user namespace of BPF FS instance (super block) that it was
- * derived from, and subsequent BPF operations performed with
- * BPF token would be performing capabilities checks (i.e.,
- * CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN, CAP_SYS_ADMIN) within
- * that user namespace. Without BPF token, such capabilities
- * have to be granted in init user namespace, making bpf()
- * syscall incompatible with user namespace, for the most part.
- *
- * Return
- * A new file descriptor (a nonnegative integer), or -1 if an
- * error occurred (in which case, *errno* is set appropriately).
- *
* NOTES
* eBPF objects (maps and programs) can be shared between processes.
*
BPF_ITER_CREATE,
BPF_LINK_DETACH,
BPF_PROG_BIND_MAP,
- BPF_TOKEN_CREATE,
- __MAX_BPF_CMD,
};
enum bpf_map_type {
BPF_MAP_TYPE_BLOOM_FILTER,
BPF_MAP_TYPE_USER_RINGBUF,
BPF_MAP_TYPE_CGRP_STORAGE,
- __MAX_BPF_MAP_TYPE
};
/* Note that tracing related programs such as
BPF_PROG_TYPE_SK_LOOKUP,
BPF_PROG_TYPE_SYSCALL, /* a program that can execute syscalls */
BPF_PROG_TYPE_NETFILTER,
- __MAX_BPF_PROG_TYPE
};
enum bpf_attach_type {
* to using 5 hash functions).
*/
__u64 map_extra;
- __u32 map_token_fd;
};
struct { /* anonymous struct used by BPF_MAP_*_ELEM commands */
* truncated), or smaller (if log buffer wasn't filled completely).
*/
__u32 log_true_size;
- __u32 prog_token_fd;
};
struct { /* anonymous struct used by BPF_OBJ_* commands */
* truncated), or smaller (if log buffer wasn't filled completely).
*/
__u32 btf_log_true_size;
- __u32 btf_token_fd;
};
struct {
__u32 flags; /* extra flags */
} prog_bind_map;
- struct { /* struct used by BPF_TOKEN_CREATE command */
- __u32 flags;
- __u32 bpffs_fd;
- } token_create;
-
} __attribute__((aligned(8)));
/* The description below is an attempt at providing documentation to eBPF
endif
CFLAGS_core.o += $(call cc-disable-warning, override-init) $(cflags-nogcse-yy)
-obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o log.o token.o
+obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o log.o
obj-$(CONFIG_BPF_SYSCALL) += bpf_iter.o map_iter.o task_iter.o prog_iter.o link_iter.o
obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o percpu_freelist.o bpf_lru_list.o lpm_trie.o map_in_map.o bloom_filter.o
obj-$(CONFIG_BPF_SYSCALL) += local_storage.o queue_stack_maps.o ringbuf.o
bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY;
int numa_node = bpf_map_attr_numa_node(attr);
u32 elem_size, index_mask, max_entries;
- bool bypass_spec_v1 = bpf_bypass_spec_v1(NULL);
+ bool bypass_spec_v1 = bpf_bypass_spec_v1();
u64 array_size, mask64;
struct bpf_array *array;
BTF_SET_START(sleepable_lsm_hooks)
BTF_ID(func, bpf_lsm_bpf)
BTF_ID(func, bpf_lsm_bpf_map)
-BTF_ID(func, bpf_lsm_bpf_map_create)
-BTF_ID(func, bpf_lsm_bpf_map_free)
+BTF_ID(func, bpf_lsm_bpf_map_alloc_security)
+BTF_ID(func, bpf_lsm_bpf_map_free_security)
BTF_ID(func, bpf_lsm_bpf_prog)
-BTF_ID(func, bpf_lsm_bpf_prog_load)
-BTF_ID(func, bpf_lsm_bpf_prog_free)
-BTF_ID(func, bpf_lsm_bpf_token_create)
-BTF_ID(func, bpf_lsm_bpf_token_free)
-BTF_ID(func, bpf_lsm_bpf_token_cmd)
-BTF_ID(func, bpf_lsm_bpf_token_capable)
BTF_ID(func, bpf_lsm_bprm_check_security)
BTF_ID(func, bpf_lsm_bprm_committed_creds)
BTF_ID(func, bpf_lsm_bprm_committing_creds)
BTF_SET_END(sleepable_lsm_hooks)
BTF_SET_START(untrusted_lsm_hooks)
-BTF_ID(func, bpf_lsm_bpf_map_free)
-BTF_ID(func, bpf_lsm_bpf_prog_free)
+BTF_ID(func, bpf_lsm_bpf_map_free_security)
+BTF_ID(func, bpf_lsm_bpf_prog_alloc_security)
+BTF_ID(func, bpf_lsm_bpf_prog_free_security)
BTF_ID(func, bpf_lsm_file_alloc_security)
BTF_ID(func, bpf_lsm_file_free_security)
#ifdef CONFIG_SECURITY_NETWORK
case BPF_FUNC_perf_event_output:
return &bpf_event_output_data_proto;
default:
- return bpf_base_func_proto(func_id, prog);
+ return bpf_base_func_proto(func_id);
}
}
case BPF_FUNC_perf_event_output:
return &bpf_event_output_data_proto;
default:
- return bpf_base_func_proto(func_id, prog);
+ return bpf_base_func_proto(func_id);
}
}
case BPF_FUNC_perf_event_output:
return &bpf_event_output_data_proto;
default:
- return bpf_base_func_proto(func_id, prog);
+ return bpf_base_func_proto(func_id);
}
}
void bpf_prog_kallsyms_add(struct bpf_prog *fp)
{
if (!bpf_prog_kallsyms_candidate(fp) ||
- !bpf_token_capable(fp->aux->token, CAP_BPF))
+ !bpf_capable())
return;
bpf_prog_ksym_set_addr(fp);
if (aux->dst_prog)
bpf_prog_put(aux->dst_prog);
- bpf_token_put(aux->token);
INIT_WORK(&aux->work, bpf_prog_free_deferred);
schedule_work(&aux->work);
}
const struct bpf_func_proto bpf_task_pt_regs_proto __weak;
const struct bpf_func_proto *
-bpf_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
+bpf_base_func_proto(enum bpf_func_id func_id)
{
switch (func_id) {
case BPF_FUNC_map_lookup_elem:
break;
}
- if (!bpf_token_capable(prog->aux->token, CAP_BPF))
+ if (!bpf_capable())
return NULL;
switch (func_id) {
break;
}
- if (!bpf_token_capable(prog->aux->token, CAP_PERFMON))
+ if (!perfmon_capable())
return NULL;
switch (func_id) {
#include <linux/filter.h>
#include <linux/bpf.h>
#include <linux/bpf_trace.h>
-#include <linux/kstrtox.h>
#include "preload/bpf_preload.h"
enum bpf_type {
static const struct inode_operations bpf_map_iops = { };
static const struct inode_operations bpf_link_iops = { };
-struct inode *bpf_get_inode(struct super_block *sb,
- const struct inode *dir,
- umode_t mode)
+static struct inode *bpf_get_inode(struct super_block *sb,
+ const struct inode *dir,
+ umode_t mode)
{
struct inode *inode;
}
EXPORT_SYMBOL(bpf_prog_get_type_path);
-struct bpffs_btf_enums {
- const struct btf *btf;
- const struct btf_type *cmd_t;
- const struct btf_type *map_t;
- const struct btf_type *prog_t;
- const struct btf_type *attach_t;
-};
-
-static int find_bpffs_btf_enums(struct bpffs_btf_enums *info)
-{
- const struct btf *btf;
- const struct btf_type *t;
- const char *name;
- int i, n;
-
- memset(info, 0, sizeof(*info));
-
- btf = bpf_get_btf_vmlinux();
- if (IS_ERR(btf))
- return PTR_ERR(btf);
- if (!btf)
- return -ENOENT;
-
- info->btf = btf;
-
- for (i = 1, n = btf_nr_types(btf); i < n; i++) {
- t = btf_type_by_id(btf, i);
- if (!btf_type_is_enum(t))
- continue;
-
- name = btf_name_by_offset(btf, t->name_off);
- if (!name)
- continue;
-
- if (strcmp(name, "bpf_cmd") == 0)
- info->cmd_t = t;
- else if (strcmp(name, "bpf_map_type") == 0)
- info->map_t = t;
- else if (strcmp(name, "bpf_prog_type") == 0)
- info->prog_t = t;
- else if (strcmp(name, "bpf_attach_type") == 0)
- info->attach_t = t;
- else
- continue;
-
- if (info->cmd_t && info->map_t && info->prog_t && info->attach_t)
- return 0;
- }
-
- return -ESRCH;
-}
-
-static bool find_btf_enum_const(const struct btf *btf, const struct btf_type *enum_t,
- const char *prefix, const char *str, int *value)
-{
- const struct btf_enum *e;
- const char *name;
- int i, n, pfx_len = strlen(prefix);
-
- *value = 0;
-
- if (!btf || !enum_t)
- return false;
-
- for (i = 0, n = btf_vlen(enum_t); i < n; i++) {
- e = &btf_enum(enum_t)[i];
-
- name = btf_name_by_offset(btf, e->name_off);
- if (!name || strncasecmp(name, prefix, pfx_len) != 0)
- continue;
-
- /* match symbolic name case insensitive and ignoring prefix */
- if (strcasecmp(name + pfx_len, str) == 0) {
- *value = e->val;
- return true;
- }
- }
-
- return false;
-}
-
-static void seq_print_delegate_opts(struct seq_file *m,
- const char *opt_name,
- const struct btf *btf,
- const struct btf_type *enum_t,
- const char *prefix,
- u64 delegate_msk, u64 any_msk)
-{
- const struct btf_enum *e;
- bool first = true;
- const char *name;
- u64 msk;
- int i, n, pfx_len = strlen(prefix);
-
- delegate_msk &= any_msk; /* clear unknown bits */
-
- if (delegate_msk == 0)
- return;
-
- seq_printf(m, ",%s", opt_name);
- if (delegate_msk == any_msk) {
- seq_printf(m, "=any");
- return;
- }
-
- if (btf && enum_t) {
- for (i = 0, n = btf_vlen(enum_t); i < n; i++) {
- e = &btf_enum(enum_t)[i];
- name = btf_name_by_offset(btf, e->name_off);
- if (!name || strncasecmp(name, prefix, pfx_len) != 0)
- continue;
- msk = 1ULL << e->val;
- if (delegate_msk & msk) {
- /* emit lower-case name without prefix */
- seq_printf(m, "%c", first ? '=' : ':');
- name += pfx_len;
- while (*name) {
- seq_printf(m, "%c", tolower(*name));
- name++;
- }
-
- delegate_msk &= ~msk;
- first = false;
- }
- }
- }
- if (delegate_msk)
- seq_printf(m, "%c0x%llx", first ? '=' : ':', delegate_msk);
-}
-
/*
* Display the mount options in /proc/mounts.
*/
static int bpf_show_options(struct seq_file *m, struct dentry *root)
{
- struct bpf_mount_opts *opts = root->d_sb->s_fs_info;
- struct inode *inode = d_inode(root);
- umode_t mode = inode->i_mode & S_IALLUGO & ~S_ISVTX;
- u64 mask;
-
- if (!uid_eq(inode->i_uid, GLOBAL_ROOT_UID))
- seq_printf(m, ",uid=%u",
- from_kuid_munged(&init_user_ns, inode->i_uid));
- if (!gid_eq(inode->i_gid, GLOBAL_ROOT_GID))
- seq_printf(m, ",gid=%u",
- from_kgid_munged(&init_user_ns, inode->i_gid));
+ umode_t mode = d_inode(root)->i_mode & S_IALLUGO & ~S_ISVTX;
+
if (mode != S_IRWXUGO)
seq_printf(m, ",mode=%o", mode);
-
- if (opts->delegate_cmds || opts->delegate_maps ||
- opts->delegate_progs || opts->delegate_attachs) {
- struct bpffs_btf_enums info;
-
- /* ignore errors, fallback to hex */
- (void)find_bpffs_btf_enums(&info);
-
- mask = (1ULL << __MAX_BPF_CMD) - 1;
- seq_print_delegate_opts(m, "delegate_cmds",
- info.btf, info.cmd_t, "BPF_",
- opts->delegate_cmds, mask);
-
- mask = (1ULL << __MAX_BPF_MAP_TYPE) - 1;
- seq_print_delegate_opts(m, "delegate_maps",
- info.btf, info.map_t, "BPF_MAP_TYPE_",
- opts->delegate_maps, mask);
-
- mask = (1ULL << __MAX_BPF_PROG_TYPE) - 1;
- seq_print_delegate_opts(m, "delegate_progs",
- info.btf, info.prog_t, "BPF_PROG_TYPE_",
- opts->delegate_progs, mask);
-
- mask = (1ULL << __MAX_BPF_ATTACH_TYPE) - 1;
- seq_print_delegate_opts(m, "delegate_attachs",
- info.btf, info.attach_t, "BPF_",
- opts->delegate_attachs, mask);
- }
-
return 0;
}
free_inode_nonrcu(inode);
}
-const struct super_operations bpf_super_ops = {
+static const struct super_operations bpf_super_ops = {
.statfs = simple_statfs,
.drop_inode = generic_delete_inode,
.show_options = bpf_show_options,
};
enum {
- OPT_UID,
- OPT_GID,
OPT_MODE,
- OPT_DELEGATE_CMDS,
- OPT_DELEGATE_MAPS,
- OPT_DELEGATE_PROGS,
- OPT_DELEGATE_ATTACHS,
};
static const struct fs_parameter_spec bpf_fs_parameters[] = {
- fsparam_u32 ("uid", OPT_UID),
- fsparam_u32 ("gid", OPT_GID),
fsparam_u32oct ("mode", OPT_MODE),
- fsparam_string ("delegate_cmds", OPT_DELEGATE_CMDS),
- fsparam_string ("delegate_maps", OPT_DELEGATE_MAPS),
- fsparam_string ("delegate_progs", OPT_DELEGATE_PROGS),
- fsparam_string ("delegate_attachs", OPT_DELEGATE_ATTACHS),
{}
};
+struct bpf_mount_opts {
+ umode_t mode;
+};
+
static int bpf_parse_param(struct fs_context *fc, struct fs_parameter *param)
{
- struct bpf_mount_opts *opts = fc->s_fs_info;
+ struct bpf_mount_opts *opts = fc->fs_private;
struct fs_parse_result result;
- kuid_t uid;
- kgid_t gid;
- int opt, err;
+ int opt;
opt = fs_parse(fc, bpf_fs_parameters, param, &result);
if (opt < 0) {
}
switch (opt) {
- case OPT_UID:
- uid = make_kuid(current_user_ns(), result.uint_32);
- if (!uid_valid(uid))
- goto bad_value;
-
- /*
- * The requested uid must be representable in the
- * filesystem's idmapping.
- */
- if (!kuid_has_mapping(fc->user_ns, uid))
- goto bad_value;
-
- opts->uid = uid;
- break;
- case OPT_GID:
- gid = make_kgid(current_user_ns(), result.uint_32);
- if (!gid_valid(gid))
- goto bad_value;
-
- /*
- * The requested gid must be representable in the
- * filesystem's idmapping.
- */
- if (!kgid_has_mapping(fc->user_ns, gid))
- goto bad_value;
-
- opts->gid = gid;
- break;
case OPT_MODE:
opts->mode = result.uint_32 & S_IALLUGO;
break;
- case OPT_DELEGATE_CMDS:
- case OPT_DELEGATE_MAPS:
- case OPT_DELEGATE_PROGS:
- case OPT_DELEGATE_ATTACHS: {
- struct bpffs_btf_enums info;
- const struct btf_type *enum_t;
- const char *enum_pfx;
- u64 *delegate_msk, msk = 0;
- char *p;
- int val;
-
- /* ignore errors, fallback to hex */
- (void)find_bpffs_btf_enums(&info);
-
- switch (opt) {
- case OPT_DELEGATE_CMDS:
- delegate_msk = &opts->delegate_cmds;
- enum_t = info.cmd_t;
- enum_pfx = "BPF_";
- break;
- case OPT_DELEGATE_MAPS:
- delegate_msk = &opts->delegate_maps;
- enum_t = info.map_t;
- enum_pfx = "BPF_MAP_TYPE_";
- break;
- case OPT_DELEGATE_PROGS:
- delegate_msk = &opts->delegate_progs;
- enum_t = info.prog_t;
- enum_pfx = "BPF_PROG_TYPE_";
- break;
- case OPT_DELEGATE_ATTACHS:
- delegate_msk = &opts->delegate_attachs;
- enum_t = info.attach_t;
- enum_pfx = "BPF_";
- break;
- default:
- return -EINVAL;
- }
-
- while ((p = strsep(¶m->string, ":"))) {
- if (strcmp(p, "any") == 0) {
- msk |= ~0ULL;
- } else if (find_btf_enum_const(info.btf, enum_t, enum_pfx, p, &val)) {
- msk |= 1ULL << val;
- } else {
- err = kstrtou64(p, 0, &msk);
- if (err)
- return err;
- }
- }
-
- /* Setting delegation mount options requires privileges */
- if (msk && !capable(CAP_SYS_ADMIN))
- return -EPERM;
-
- *delegate_msk |= msk;
- break;
- }
- default:
- /* ignore unknown mount options */
- break;
}
return 0;
-
-bad_value:
- return invalfc(fc, "Bad value for '%s'", param->key);
}
struct bpf_preload_ops *bpf_preload_ops;
static int bpf_fill_super(struct super_block *sb, struct fs_context *fc)
{
static const struct tree_descr bpf_rfiles[] = { { "" } };
- struct bpf_mount_opts *opts = sb->s_fs_info;
+ struct bpf_mount_opts *opts = fc->fs_private;
struct inode *inode;
int ret;
- /* Mounting an instance of BPF FS requires privileges */
- if (fc->user_ns != &init_user_ns && !capable(CAP_SYS_ADMIN))
- return -EPERM;
-
ret = simple_fill_super(sb, BPF_FS_MAGIC, bpf_rfiles);
if (ret)
return ret;
sb->s_op = &bpf_super_ops;
inode = sb->s_root->d_inode;
- inode->i_uid = opts->uid;
- inode->i_gid = opts->gid;
inode->i_op = &bpf_dir_iops;
inode->i_mode &= ~S_IALLUGO;
populate_bpffs(sb->s_root);
static void bpf_free_fc(struct fs_context *fc)
{
- kfree(fc->s_fs_info);
+ kfree(fc->fs_private);
}
static const struct fs_context_operations bpf_context_ops = {
return -ENOMEM;
opts->mode = S_IRWXUGO;
- opts->uid = current_fsuid();
- opts->gid = current_fsgid();
-
- /* start out with no BPF token delegation enabled */
- opts->delegate_cmds = 0;
- opts->delegate_maps = 0;
- opts->delegate_progs = 0;
- opts->delegate_attachs = 0;
- fc->s_fs_info = opts;
+ fc->fs_private = opts;
fc->ops = &bpf_context_ops;
return 0;
}
-static void bpf_kill_super(struct super_block *sb)
-{
- struct bpf_mount_opts *opts = sb->s_fs_info;
-
- kill_litter_super(sb);
- kfree(opts);
-}
-
static struct file_system_type bpf_fs_type = {
.owner = THIS_MODULE,
.name = "bpf",
.init_fs_context = bpf_init_fs_context,
.parameters = bpf_fs_parameters,
- .kill_sb = bpf_kill_super,
- .fs_flags = FS_USERNS_MOUNT,
+ .kill_sb = kill_litter_super,
};
static int __init bpf_init(void)
return -ENOTSUPP;
}
-static int map_check_btf(struct bpf_map *map, struct bpf_token *token,
- const struct btf *btf, u32 btf_key_id, u32 btf_value_id)
+static int map_check_btf(struct bpf_map *map, const struct btf *btf,
+ u32 btf_key_id, u32 btf_value_id)
{
const struct btf_type *key_type, *value_type;
u32 key_size, value_size;
if (!IS_ERR_OR_NULL(map->record)) {
int i;
- if (!bpf_token_capable(token, CAP_BPF)) {
+ if (!bpf_capable()) {
ret = -EPERM;
goto free_map_tab;
}
return ret;
}
-static bool bpf_net_capable(void)
-{
- return capable(CAP_NET_ADMIN) || capable(CAP_SYS_ADMIN);
-}
-
-#define BPF_MAP_CREATE_LAST_FIELD map_token_fd
+#define BPF_MAP_CREATE_LAST_FIELD map_extra
/* called via syscall */
static int map_create(union bpf_attr *attr)
{
const struct bpf_map_ops *ops;
- struct bpf_token *token = NULL;
int numa_node = bpf_map_attr_numa_node(attr);
u32 map_type = attr->map_type;
struct bpf_map *map;
if (!ops->map_mem_usage)
return -EINVAL;
- if (attr->map_token_fd) {
- token = bpf_token_get_from_fd(attr->map_token_fd);
- if (IS_ERR(token))
- return PTR_ERR(token);
-
- /* if current token doesn't grant map creation permissions,
- * then we can't use this token, so ignore it and rely on
- * system-wide capabilities checks
- */
- if (!bpf_token_allow_cmd(token, BPF_MAP_CREATE) ||
- !bpf_token_allow_map_type(token, attr->map_type)) {
- bpf_token_put(token);
- token = NULL;
- }
- }
-
- err = -EPERM;
-
/* Intent here is for unprivileged_bpf_disabled to block BPF map
* creation for unprivileged users; other actions depend
* on fd availability and access to bpffs, so are dependent on
* object creation success. Even with unprivileged BPF disabled,
* capability checks are still carried out.
*/
- if (sysctl_unprivileged_bpf_disabled && !bpf_token_capable(token, CAP_BPF))
- goto put_token;
+ if (sysctl_unprivileged_bpf_disabled && !bpf_capable())
+ return -EPERM;
/* check privileged map type permissions */
switch (map_type) {
case BPF_MAP_TYPE_LRU_PERCPU_HASH:
case BPF_MAP_TYPE_STRUCT_OPS:
case BPF_MAP_TYPE_CPUMAP:
- if (!bpf_token_capable(token, CAP_BPF))
- goto put_token;
+ if (!bpf_capable())
+ return -EPERM;
break;
case BPF_MAP_TYPE_SOCKMAP:
case BPF_MAP_TYPE_SOCKHASH:
case BPF_MAP_TYPE_DEVMAP:
case BPF_MAP_TYPE_DEVMAP_HASH:
case BPF_MAP_TYPE_XSKMAP:
- if (!bpf_token_capable(token, CAP_NET_ADMIN))
- goto put_token;
+ if (!capable(CAP_NET_ADMIN))
+ return -EPERM;
break;
default:
WARN(1, "unsupported map type %d", map_type);
- goto put_token;
+ return -EPERM;
}
map = ops->map_alloc(attr);
- if (IS_ERR(map)) {
- err = PTR_ERR(map);
- goto put_token;
- }
+ if (IS_ERR(map))
+ return PTR_ERR(map);
map->ops = ops;
map->map_type = map_type;
map->btf = btf;
if (attr->btf_value_type_id) {
- err = map_check_btf(map, token, btf, attr->btf_key_type_id,
+ err = map_check_btf(map, btf, attr->btf_key_type_id,
attr->btf_value_type_id);
if (err)
goto free_map;
attr->btf_vmlinux_value_type_id;
}
- err = security_bpf_map_create(map, attr, token);
+ err = security_bpf_map_alloc(map);
if (err)
- goto free_map_sec;
+ goto free_map;
err = bpf_map_alloc_id(map);
if (err)
goto free_map_sec;
bpf_map_save_memcg(map);
- bpf_token_put(token);
err = bpf_map_new_fd(map, f_flags);
if (err < 0) {
free_map:
btf_put(map->btf);
map->ops->map_free(map);
-put_token:
- bpf_token_put(token);
return err;
}
kvfree(aux->func_info);
kfree(aux->func_info_aux);
free_uid(aux->user);
- security_bpf_prog_free(aux->prog);
+ security_bpf_prog_free(aux);
bpf_prog_free(aux->prog);
}
}
/* last field in 'union bpf_attr' used by this command */
-#define BPF_PROG_LOAD_LAST_FIELD prog_token_fd
+#define BPF_PROG_LOAD_LAST_FIELD log_true_size
static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
{
enum bpf_prog_type type = attr->prog_type;
struct bpf_prog *prog, *dst_prog = NULL;
struct btf *attach_btf = NULL;
- struct bpf_token *token = NULL;
- bool bpf_cap;
int err;
char license[128];
BPF_F_TEST_REG_INVARIANTS))
return -EINVAL;
- bpf_prog_load_fixup_attach_type(attr);
-
- if (attr->prog_token_fd) {
- token = bpf_token_get_from_fd(attr->prog_token_fd);
- if (IS_ERR(token))
- return PTR_ERR(token);
- /* if current token doesn't grant prog loading permissions,
- * then we can't use this token, so ignore it and rely on
- * system-wide capabilities checks
- */
- if (!bpf_token_allow_cmd(token, BPF_PROG_LOAD) ||
- !bpf_token_allow_prog_type(token, attr->prog_type,
- attr->expected_attach_type)) {
- bpf_token_put(token);
- token = NULL;
- }
- }
-
- bpf_cap = bpf_token_capable(token, CAP_BPF);
- err = -EPERM;
-
if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) &&
(attr->prog_flags & BPF_F_ANY_ALIGNMENT) &&
- !bpf_cap)
- goto put_token;
+ !bpf_capable())
+ return -EPERM;
/* Intent here is for unprivileged_bpf_disabled to block BPF program
* creation for unprivileged users; other actions depend
* capability checks are still carried out for these
* and other operations.
*/
- if (sysctl_unprivileged_bpf_disabled && !bpf_cap)
- goto put_token;
+ if (sysctl_unprivileged_bpf_disabled && !bpf_capable())
+ return -EPERM;
if (attr->insn_cnt == 0 ||
- attr->insn_cnt > (bpf_cap ? BPF_COMPLEXITY_LIMIT_INSNS : BPF_MAXINSNS)) {
- err = -E2BIG;
- goto put_token;
- }
+ attr->insn_cnt > (bpf_capable() ? BPF_COMPLEXITY_LIMIT_INSNS : BPF_MAXINSNS))
+ return -E2BIG;
if (type != BPF_PROG_TYPE_SOCKET_FILTER &&
type != BPF_PROG_TYPE_CGROUP_SKB &&
- !bpf_cap)
- goto put_token;
+ !bpf_capable())
+ return -EPERM;
- if (is_net_admin_prog_type(type) && !bpf_token_capable(token, CAP_NET_ADMIN))
- goto put_token;
- if (is_perfmon_prog_type(type) && !bpf_token_capable(token, CAP_PERFMON))
- goto put_token;
+ if (is_net_admin_prog_type(type) && !capable(CAP_NET_ADMIN) && !capable(CAP_SYS_ADMIN))
+ return -EPERM;
+ if (is_perfmon_prog_type(type) && !perfmon_capable())
+ return -EPERM;
/* attach_prog_fd/attach_btf_obj_fd can specify fd of either bpf_prog
* or btf, we need to check which one it is
if (IS_ERR(dst_prog)) {
dst_prog = NULL;
attach_btf = btf_get_by_fd(attr->attach_btf_obj_fd);
- if (IS_ERR(attach_btf)) {
- err = -EINVAL;
- goto put_token;
- }
+ if (IS_ERR(attach_btf))
+ return -EINVAL;
if (!btf_is_kernel(attach_btf)) {
/* attaching through specifying bpf_prog's BTF
* objects directly might be supported eventually
*/
btf_put(attach_btf);
- err = -ENOTSUPP;
- goto put_token;
+ return -ENOTSUPP;
}
}
} else if (attr->attach_btf_id) {
/* fall back to vmlinux BTF, if BTF type ID is specified */
attach_btf = bpf_get_btf_vmlinux();
- if (IS_ERR(attach_btf)) {
- err = PTR_ERR(attach_btf);
- goto put_token;
- }
- if (!attach_btf) {
- err = -EINVAL;
- goto put_token;
- }
+ if (IS_ERR(attach_btf))
+ return PTR_ERR(attach_btf);
+ if (!attach_btf)
+ return -EINVAL;
btf_get(attach_btf);
}
+ bpf_prog_load_fixup_attach_type(attr);
if (bpf_prog_load_check_attach(type, attr->expected_attach_type,
attach_btf, attr->attach_btf_id,
dst_prog)) {
bpf_prog_put(dst_prog);
if (attach_btf)
btf_put(attach_btf);
- err = -EINVAL;
- goto put_token;
+ return -EINVAL;
}
/* plain bpf_prog allocation */
bpf_prog_put(dst_prog);
if (attach_btf)
btf_put(attach_btf);
- err = -EINVAL;
- goto put_token;
+ return -ENOMEM;
}
prog->expected_attach_type = attr->expected_attach_type;
prog->aux->sleepable = attr->prog_flags & BPF_F_SLEEPABLE;
prog->aux->xdp_has_frags = attr->prog_flags & BPF_F_XDP_HAS_FRAGS;
- /* move token into prog->aux, reuse taken refcnt */
- prog->aux->token = token;
- token = NULL;
+ err = security_bpf_prog_alloc(prog->aux);
+ if (err)
+ goto free_prog;
prog->aux->user = get_current_user();
prog->len = attr->insn_cnt;
if (copy_from_bpfptr(prog->insns,
make_bpfptr(attr->insns, uattr.is_kernel),
bpf_prog_insn_size(prog)) != 0)
- goto free_prog;
+ goto free_prog_sec;
/* copy eBPF program license from user space */
if (strncpy_from_bpfptr(license,
make_bpfptr(attr->license, uattr.is_kernel),
sizeof(license) - 1) < 0)
- goto free_prog;
+ goto free_prog_sec;
license[sizeof(license) - 1] = 0;
/* eBPF programs must be GPL compatible to use GPL-ed functions */
if (bpf_prog_is_dev_bound(prog->aux)) {
err = bpf_prog_dev_bound_init(prog, attr);
if (err)
- goto free_prog;
+ goto free_prog_sec;
}
if (type == BPF_PROG_TYPE_EXT && dst_prog &&
bpf_prog_is_dev_bound(dst_prog->aux)) {
err = bpf_prog_dev_bound_inherit(prog, dst_prog);
if (err)
- goto free_prog;
+ goto free_prog_sec;
}
/* find program type: socket_filter vs tracing_filter */
err = find_prog_type(type, prog);
if (err < 0)
- goto free_prog;
+ goto free_prog_sec;
prog->aux->load_time = ktime_get_boottime_ns();
err = bpf_obj_name_cpy(prog->aux->name, attr->prog_name,
sizeof(attr->prog_name));
if (err < 0)
- goto free_prog;
-
- err = security_bpf_prog_load(prog, attr, token);
- if (err)
goto free_prog_sec;
/* run eBPF verifier */
*/
__bpf_prog_put_noref(prog, prog->aux->real_func_cnt);
return err;
-
free_prog_sec:
- security_bpf_prog_free(prog);
-free_prog:
free_uid(prog->aux->user);
+ security_bpf_prog_free(prog->aux);
+free_prog:
if (prog->aux->attach_btf)
btf_put(prog->aux->attach_btf);
bpf_prog_free(prog);
-put_token:
- bpf_token_put(token);
return err;
}
case BPF_PROG_TYPE_SK_LOOKUP:
return attach_type == prog->expected_attach_type ? 0 : -EINVAL;
case BPF_PROG_TYPE_CGROUP_SKB:
- if (!bpf_token_capable(prog->aux->token, CAP_NET_ADMIN))
+ if (!capable(CAP_NET_ADMIN))
/* cg-skb progs can be loaded by unpriv user.
* check permissions at attach time.
*/
static int bpf_prog_query(const union bpf_attr *attr,
union bpf_attr __user *uattr)
{
- if (!bpf_net_capable())
+ if (!capable(CAP_NET_ADMIN))
return -EPERM;
if (CHECK_ATTR(BPF_PROG_QUERY))
return -EINVAL;
return err;
}
-#define BPF_BTF_LOAD_LAST_FIELD btf_token_fd
+#define BPF_BTF_LOAD_LAST_FIELD btf_log_true_size
static int bpf_btf_load(const union bpf_attr *attr, bpfptr_t uattr, __u32 uattr_size)
{
- struct bpf_token *token = NULL;
-
if (CHECK_ATTR(BPF_BTF_LOAD))
return -EINVAL;
- if (attr->btf_token_fd) {
- token = bpf_token_get_from_fd(attr->btf_token_fd);
- if (IS_ERR(token))
- return PTR_ERR(token);
- if (!bpf_token_allow_cmd(token, BPF_BTF_LOAD)) {
- bpf_token_put(token);
- token = NULL;
- }
- }
-
- if (!bpf_token_capable(token, CAP_BPF)) {
- bpf_token_put(token);
+ if (!bpf_capable())
return -EPERM;
- }
-
- bpf_token_put(token);
return btf_new_fd(attr, uattr, uattr_size);
}
return ret;
}
-#define BPF_TOKEN_CREATE_LAST_FIELD token_create.bpffs_fd
-
-static int token_create(union bpf_attr *attr)
-{
- if (CHECK_ATTR(BPF_TOKEN_CREATE))
- return -EINVAL;
-
- /* no flags are supported yet */
- if (attr->token_create.flags)
- return -EINVAL;
-
- return bpf_token_create(attr);
-}
-
static int __sys_bpf(int cmd, bpfptr_t uattr, unsigned int size)
{
union bpf_attr attr;
case BPF_PROG_BIND_MAP:
err = bpf_prog_bind_map(&attr);
break;
- case BPF_TOKEN_CREATE:
- err = token_create(&attr);
- break;
default:
err = -EINVAL;
break;
const struct bpf_func_proto * __weak
tracing_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
{
- return bpf_base_func_proto(func_id, prog);
+ return bpf_base_func_proto(func_id);
}
BPF_CALL_1(bpf_sys_close, u32, fd)
{
switch (func_id) {
case BPF_FUNC_sys_bpf:
- return !bpf_token_capable(prog->aux->token, CAP_PERFMON)
- ? NULL : &bpf_sys_bpf_proto;
+ return !perfmon_capable() ? NULL : &bpf_sys_bpf_proto;
case BPF_FUNC_btf_find_by_name_kind:
return &bpf_btf_find_by_name_kind_proto;
case BPF_FUNC_sys_close:
+++ /dev/null
-#include <linux/bpf.h>
-#include <linux/vmalloc.h>
-#include <linux/fdtable.h>
-#include <linux/file.h>
-#include <linux/fs.h>
-#include <linux/kernel.h>
-#include <linux/idr.h>
-#include <linux/namei.h>
-#include <linux/user_namespace.h>
-#include <linux/security.h>
-
-bool bpf_token_capable(const struct bpf_token *token, int cap)
-{
- /* BPF token allows ns_capable() level of capabilities, but only if
- * token's userns is *exactly* the same as current user's userns
- */
- if (token && current_user_ns() == token->userns) {
- if (ns_capable(token->userns, cap) ||
- (cap != CAP_SYS_ADMIN && ns_capable(token->userns, CAP_SYS_ADMIN)))
- return security_bpf_token_capable(token, cap) == 0;
- }
- /* otherwise fallback to capable() checks */
- return capable(cap) || (cap != CAP_SYS_ADMIN && capable(CAP_SYS_ADMIN));
-}
-
-void bpf_token_inc(struct bpf_token *token)
-{
- atomic64_inc(&token->refcnt);
-}
-
-static void bpf_token_free(struct bpf_token *token)
-{
- security_bpf_token_free(token);
- put_user_ns(token->userns);
- kvfree(token);
-}
-
-static void bpf_token_put_deferred(struct work_struct *work)
-{
- struct bpf_token *token = container_of(work, struct bpf_token, work);
-
- bpf_token_free(token);
-}
-
-void bpf_token_put(struct bpf_token *token)
-{
- if (!token)
- return;
-
- if (!atomic64_dec_and_test(&token->refcnt))
- return;
-
- INIT_WORK(&token->work, bpf_token_put_deferred);
- schedule_work(&token->work);
-}
-
-static int bpf_token_release(struct inode *inode, struct file *filp)
-{
- struct bpf_token *token = filp->private_data;
-
- bpf_token_put(token);
- return 0;
-}
-
-static void bpf_token_show_fdinfo(struct seq_file *m, struct file *filp)
-{
- struct bpf_token *token = filp->private_data;
- u64 mask;
-
- BUILD_BUG_ON(__MAX_BPF_CMD >= 64);
- mask = (1ULL << __MAX_BPF_CMD) - 1;
- if ((token->allowed_cmds & mask) == mask)
- seq_printf(m, "allowed_cmds:\tany\n");
- else
- seq_printf(m, "allowed_cmds:\t0x%llx\n", token->allowed_cmds);
-
- BUILD_BUG_ON(__MAX_BPF_MAP_TYPE >= 64);
- mask = (1ULL << __MAX_BPF_MAP_TYPE) - 1;
- if ((token->allowed_maps & mask) == mask)
- seq_printf(m, "allowed_maps:\tany\n");
- else
- seq_printf(m, "allowed_maps:\t0x%llx\n", token->allowed_maps);
-
- BUILD_BUG_ON(__MAX_BPF_PROG_TYPE >= 64);
- mask = (1ULL << __MAX_BPF_PROG_TYPE) - 1;
- if ((token->allowed_progs & mask) == mask)
- seq_printf(m, "allowed_progs:\tany\n");
- else
- seq_printf(m, "allowed_progs:\t0x%llx\n", token->allowed_progs);
-
- BUILD_BUG_ON(__MAX_BPF_ATTACH_TYPE >= 64);
- mask = (1ULL << __MAX_BPF_ATTACH_TYPE) - 1;
- if ((token->allowed_attachs & mask) == mask)
- seq_printf(m, "allowed_attachs:\tany\n");
- else
- seq_printf(m, "allowed_attachs:\t0x%llx\n", token->allowed_attachs);
-}
-
-#define BPF_TOKEN_INODE_NAME "bpf-token"
-
-static const struct inode_operations bpf_token_iops = { };
-
-static const struct file_operations bpf_token_fops = {
- .release = bpf_token_release,
- .show_fdinfo = bpf_token_show_fdinfo,
-};
-
-int bpf_token_create(union bpf_attr *attr)
-{
- struct bpf_mount_opts *mnt_opts;
- struct bpf_token *token = NULL;
- struct user_namespace *userns;
- struct inode *inode;
- struct file *file;
- struct path path;
- struct fd f;
- umode_t mode;
- int err, fd;
-
- f = fdget(attr->token_create.bpffs_fd);
- if (!f.file)
- return -EBADF;
-
- path = f.file->f_path;
- path_get(&path);
- fdput(f);
-
- if (path.dentry != path.mnt->mnt_sb->s_root) {
- err = -EINVAL;
- goto out_path;
- }
- if (path.mnt->mnt_sb->s_op != &bpf_super_ops) {
- err = -EINVAL;
- goto out_path;
- }
- err = path_permission(&path, MAY_ACCESS);
- if (err)
- goto out_path;
-
- userns = path.dentry->d_sb->s_user_ns;
- /*
- * Enforce that creators of BPF tokens are in the same user
- * namespace as the BPF FS instance. This makes reasoning about
- * permissions a lot easier and we can always relax this later.
- */
- if (current_user_ns() != userns) {
- err = -EPERM;
- goto out_path;
- }
- if (!ns_capable(userns, CAP_BPF)) {
- err = -EPERM;
- goto out_path;
- }
-
- mnt_opts = path.dentry->d_sb->s_fs_info;
- if (mnt_opts->delegate_cmds == 0 &&
- mnt_opts->delegate_maps == 0 &&
- mnt_opts->delegate_progs == 0 &&
- mnt_opts->delegate_attachs == 0) {
- err = -ENOENT; /* no BPF token delegation is set up */
- goto out_path;
- }
-
- mode = S_IFREG | ((S_IRUSR | S_IWUSR) & ~current_umask());
- inode = bpf_get_inode(path.mnt->mnt_sb, NULL, mode);
- if (IS_ERR(inode)) {
- err = PTR_ERR(inode);
- goto out_path;
- }
-
- inode->i_op = &bpf_token_iops;
- inode->i_fop = &bpf_token_fops;
- clear_nlink(inode); /* make sure it is unlinked */
-
- file = alloc_file_pseudo(inode, path.mnt, BPF_TOKEN_INODE_NAME, O_RDWR, &bpf_token_fops);
- if (IS_ERR(file)) {
- iput(inode);
- err = PTR_ERR(file);
- goto out_path;
- }
-
- token = kvzalloc(sizeof(*token), GFP_USER);
- if (!token) {
- err = -ENOMEM;
- goto out_file;
- }
-
- atomic64_set(&token->refcnt, 1);
-
- /* remember bpffs owning userns for future ns_capable() checks */
- token->userns = get_user_ns(userns);
-
- token->allowed_cmds = mnt_opts->delegate_cmds;
- token->allowed_maps = mnt_opts->delegate_maps;
- token->allowed_progs = mnt_opts->delegate_progs;
- token->allowed_attachs = mnt_opts->delegate_attachs;
-
- err = security_bpf_token_create(token, attr, &path);
- if (err)
- goto out_token;
-
- fd = get_unused_fd_flags(O_CLOEXEC);
- if (fd < 0) {
- err = fd;
- goto out_token;
- }
-
- file->private_data = token;
- fd_install(fd, file);
-
- path_put(&path);
- return fd;
-
-out_token:
- bpf_token_free(token);
-out_file:
- fput(file);
-out_path:
- path_put(&path);
- return err;
-}
-
-struct bpf_token *bpf_token_get_from_fd(u32 ufd)
-{
- struct fd f = fdget(ufd);
- struct bpf_token *token;
-
- if (!f.file)
- return ERR_PTR(-EBADF);
- if (f.file->f_op != &bpf_token_fops) {
- fdput(f);
- return ERR_PTR(-EINVAL);
- }
-
- token = f.file->private_data;
- bpf_token_inc(token);
- fdput(f);
-
- return token;
-}
-
-bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
-{
- /* BPF token can be used only within exactly the same userns in which
- * it was created
- */
- if (!token || current_user_ns() != token->userns)
- return false;
- if (!(token->allowed_cmds & (1ULL << cmd)))
- return false;
- return security_bpf_token_cmd(token, cmd) == 0;
-}
-
-bool bpf_token_allow_map_type(const struct bpf_token *token, enum bpf_map_type type)
-{
- if (!token || type >= __MAX_BPF_MAP_TYPE)
- return false;
-
- return token->allowed_maps & (1ULL << type);
-}
-
-bool bpf_token_allow_prog_type(const struct bpf_token *token,
- enum bpf_prog_type prog_type,
- enum bpf_attach_type attach_type)
-{
- if (!token || prog_type >= __MAX_BPF_PROG_TYPE || attach_type >= __MAX_BPF_ATTACH_TYPE)
- return false;
-
- return (token->allowed_progs & (1ULL << prog_type)) &&
- (token->allowed_attachs & (1ULL << attach_type));
-}
env->prog = *prog;
env->ops = bpf_verifier_ops[env->prog->type];
env->fd_array = make_bpfptr(attr->fd_array, uattr.is_kernel);
-
- env->allow_ptr_leaks = bpf_allow_ptr_leaks(env->prog->aux->token);
- env->allow_uninit_stack = bpf_allow_uninit_stack(env->prog->aux->token);
- env->bypass_spec_v1 = bpf_bypass_spec_v1(env->prog->aux->token);
- env->bypass_spec_v4 = bpf_bypass_spec_v4(env->prog->aux->token);
- env->bpf_capable = is_priv = bpf_token_capable(env->prog->aux->token, CAP_BPF);
+ is_priv = bpf_capable();
bpf_get_btf_vmlinux();
if (attr->prog_flags & BPF_F_ANY_ALIGNMENT)
env->strict_alignment = false;
+ env->allow_ptr_leaks = bpf_allow_ptr_leaks();
+ env->allow_uninit_stack = bpf_allow_uninit_stack();
+ env->bypass_spec_v1 = bpf_bypass_spec_v1();
+ env->bypass_spec_v4 = bpf_bypass_spec_v4();
+ env->bpf_capable = bpf_capable();
+
if (is_priv)
env->test_state_freq = attr->prog_flags & BPF_F_TEST_STATE_FREQ;
env->test_reg_invariants = attr->prog_flags & BPF_F_TEST_REG_INVARIANTS;
case BPF_FUNC_trace_vprintk:
return bpf_get_trace_vprintk_proto();
default:
- return bpf_base_func_proto(func_id, prog);
+ return bpf_base_func_proto(func_id);
}
}
#include "dev.h"
static const struct bpf_func_proto *
-bpf_sk_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog);
+bpf_sk_base_func_proto(enum bpf_func_id func_id);
int copy_bpf_fprog_from_user(struct sock_fprog *dst, sockptr_t src, int len)
{
case BPF_FUNC_ktime_get_coarse_ns:
return &bpf_ktime_get_coarse_ns_proto;
default:
- return bpf_base_func_proto(func_id, prog);
+ return bpf_base_func_proto(func_id);
}
}
return NULL;
}
default:
- return bpf_sk_base_func_proto(func_id, prog);
+ return bpf_sk_base_func_proto(func_id);
}
}
case BPF_FUNC_perf_event_output:
return &bpf_skb_event_output_proto;
default:
- return bpf_sk_base_func_proto(func_id, prog);
+ return bpf_sk_base_func_proto(func_id);
}
}
#endif
#endif
default:
- return bpf_sk_base_func_proto(func_id, prog);
+ return bpf_sk_base_func_proto(func_id);
}
}
#endif
#endif
default:
- return bpf_sk_base_func_proto(func_id, prog);
+ return bpf_sk_base_func_proto(func_id);
}
#if IS_MODULE(CONFIG_NF_CONNTRACK) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)
return &bpf_tcp_sock_proto;
#endif /* CONFIG_INET */
default:
- return bpf_sk_base_func_proto(func_id, prog);
+ return bpf_sk_base_func_proto(func_id);
}
}
return &bpf_get_cgroup_classid_curr_proto;
#endif
default:
- return bpf_sk_base_func_proto(func_id, prog);
+ return bpf_sk_base_func_proto(func_id);
}
}
return &bpf_skc_lookup_tcp_proto;
#endif
default:
- return bpf_sk_base_func_proto(func_id, prog);
+ return bpf_sk_base_func_proto(func_id);
}
}
case BPF_FUNC_skb_load_bytes:
return &bpf_flow_dissector_load_bytes_proto;
default:
- return bpf_sk_base_func_proto(func_id, prog);
+ return bpf_sk_base_func_proto(func_id);
}
}
case BPF_FUNC_skb_under_cgroup:
return &bpf_skb_under_cgroup_proto;
default:
- return bpf_sk_base_func_proto(func_id, prog);
+ return bpf_sk_base_func_proto(func_id);
}
}
return false;
case bpf_ctx_range(struct __sk_buff, data):
case bpf_ctx_range(struct __sk_buff, data_end):
- if (!bpf_token_capable(prog->aux->token, CAP_BPF))
+ if (!bpf_capable())
return false;
break;
}
case bpf_ctx_range_till(struct __sk_buff, cb[0], cb[4]):
break;
case bpf_ctx_range(struct __sk_buff, tstamp):
- if (!bpf_token_capable(prog->aux->token, CAP_BPF))
+ if (!bpf_capable())
return false;
break;
default:
case BPF_FUNC_ktime_get_coarse_ns:
return &bpf_ktime_get_coarse_ns_proto;
default:
- return bpf_base_func_proto(func_id, prog);
+ return bpf_base_func_proto(func_id);
}
}
case BPF_FUNC_sk_release:
return &bpf_sk_release_proto;
default:
- return bpf_sk_base_func_proto(func_id, prog);
+ return bpf_sk_base_func_proto(func_id);
}
}
};
static const struct bpf_func_proto *
-bpf_sk_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
+bpf_sk_base_func_proto(enum bpf_func_id func_id)
{
const struct bpf_func_proto *func;
case BPF_FUNC_ktime_get_coarse_ns:
return &bpf_ktime_get_coarse_ns_proto;
default:
- return bpf_base_func_proto(func_id, prog);
+ return bpf_base_func_proto(func_id);
}
- if (!bpf_token_capable(prog->aux->token, CAP_PERFMON))
+ if (!perfmon_capable())
return NULL;
return func;
case BPF_FUNC_ktime_get_coarse_ns:
return &bpf_ktime_get_coarse_ns_proto;
default:
- return bpf_base_func_proto(func_id, prog);
+ return bpf_base_func_proto(func_id);
}
}
static const struct bpf_func_proto *
bpf_nf_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
{
- return bpf_base_func_proto(func_id, prog);
+ return bpf_base_func_proto(func_id);
}
const struct bpf_verifier_ops netfilter_verifier_ops = {
}
/**
- * security_bpf_map_create() - Check if BPF map creation is allowed
- * @map: BPF map object
- * @attr: BPF syscall attributes used to create BPF map
- * @token: BPF token used to grant user access
- *
- * Do a check when the kernel creates a new BPF map. This is also the
- * point where LSM blob is allocated for LSMs that need them.
- *
- * Return: Returns 0 on success, error on failure.
- */
-int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
- struct bpf_token *token)
-{
- return call_int_hook(bpf_map_create, 0, map, attr, token);
-}
-
-/**
- * security_bpf_prog_load() - Check if loading of BPF program is allowed
- * @prog: BPF program object
- * @attr: BPF syscall attributes used to create BPF program
- * @token: BPF token used to grant user access to BPF subsystem
- *
- * Perform an access control check when the kernel loads a BPF program and
- * allocates associated BPF program object. This hook is also responsible for
- * allocating any required LSM state for the BPF program.
- *
- * Return: Returns 0 on success, error on failure.
- */
-int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
- struct bpf_token *token)
-{
- return call_int_hook(bpf_prog_load, 0, prog, attr, token);
-}
-
-/**
- * security_bpf_token_create() - Check if creating of BPF token is allowed
- * @token: BPF token object
- * @attr: BPF syscall attributes used to create BPF token
- * @path: path pointing to BPF FS mount point from which BPF token is created
- *
- * Do a check when the kernel instantiates a new BPF token object from BPF FS
- * instance. This is also the point where LSM blob can be allocated for LSMs.
- *
- * Return: Returns 0 on success, error on failure.
- */
-int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
- struct path *path)
-{
- return call_int_hook(bpf_token_create, 0, token, attr, path);
-}
-
-/**
- * security_bpf_token_cmd() - Check if BPF token is allowed to delegate
- * requested BPF syscall command
- * @token: BPF token object
- * @cmd: BPF syscall command requested to be delegated by BPF token
+ * security_bpf_map_alloc() - Allocate a bpf map LSM blob
+ * @map: bpf map
*
- * Do a check when the kernel decides whether provided BPF token should allow
- * delegation of requested BPF syscall command.
+ * Initialize the security field inside bpf map.
*
* Return: Returns 0 on success, error on failure.
*/
-int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
+int security_bpf_map_alloc(struct bpf_map *map)
{
- return call_int_hook(bpf_token_cmd, 0, token, cmd);
+ return call_int_hook(bpf_map_alloc_security, 0, map);
}
/**
- * security_bpf_token_capable() - Check if BPF token is allowed to delegate
- * requested BPF-related capability
- * @token: BPF token object
- * @cap: capabilities requested to be delegated by BPF token
+ * security_bpf_prog_alloc() - Allocate a bpf program LSM blob
+ * @aux: bpf program aux info struct
*
- * Do a check when the kernel decides whether provided BPF token should allow
- * delegation of requested BPF-related capabilities.
+ * Initialize the security field inside bpf program.
*
* Return: Returns 0 on success, error on failure.
*/
-int security_bpf_token_capable(const struct bpf_token *token, int cap)
+int security_bpf_prog_alloc(struct bpf_prog_aux *aux)
{
- return call_int_hook(bpf_token_capable, 0, token, cap);
+ return call_int_hook(bpf_prog_alloc_security, 0, aux);
}
/**
*/
void security_bpf_map_free(struct bpf_map *map)
{
- call_void_hook(bpf_map_free, map);
-}
-
-/**
- * security_bpf_prog_free() - Free a BPF program's LSM blob
- * @prog: BPF program struct
- *
- * Clean up the security information stored inside BPF program.
- */
-void security_bpf_prog_free(struct bpf_prog *prog)
-{
- call_void_hook(bpf_prog_free, prog);
+ call_void_hook(bpf_map_free_security, map);
}
/**
- * security_bpf_token_free() - Free a BPF token's LSM blob
- * @token: BPF token struct
+ * security_bpf_prog_free() - Free a bpf program's LSM blob
+ * @aux: bpf program aux info struct
*
- * Clean up the security information stored inside BPF token.
+ * Clean up the security information stored inside bpf prog.
*/
-void security_bpf_token_free(struct bpf_token *token)
+void security_bpf_prog_free(struct bpf_prog_aux *aux)
{
- call_void_hook(bpf_token_free, token);
+ call_void_hook(bpf_prog_free_security, aux);
}
#endif /* CONFIG_BPF_SYSCALL */
BPF__PROG_RUN, NULL);
}
-static int selinux_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
- struct bpf_token *token)
+static int selinux_bpf_map_alloc(struct bpf_map *map)
{
struct bpf_security_struct *bpfsec;
kfree(bpfsec);
}
-static int selinux_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
- struct bpf_token *token)
+static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
{
struct bpf_security_struct *bpfsec;
return -ENOMEM;
bpfsec->sid = current_sid();
- prog->aux->security = bpfsec;
+ aux->security = bpfsec;
return 0;
}
-static void selinux_bpf_prog_free(struct bpf_prog *prog)
+static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
{
- struct bpf_security_struct *bpfsec = prog->aux->security;
+ struct bpf_security_struct *bpfsec = aux->security;
- prog->aux->security = NULL;
- kfree(bpfsec);
-}
-
-static int selinux_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
- struct path *path)
-{
- struct bpf_security_struct *bpfsec;
-
- bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
- if (!bpfsec)
- return -ENOMEM;
-
- bpfsec->sid = current_sid();
- token->security = bpfsec;
-
- return 0;
-}
-
-static void selinux_bpf_token_free(struct bpf_token *token)
-{
- struct bpf_security_struct *bpfsec = token->security;
-
- token->security = NULL;
+ aux->security = NULL;
kfree(bpfsec);
}
#endif
LSM_HOOK_INIT(bpf, selinux_bpf),
LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
- LSM_HOOK_INIT(bpf_map_free, selinux_bpf_map_free),
- LSM_HOOK_INIT(bpf_prog_free, selinux_bpf_prog_free),
- LSM_HOOK_INIT(bpf_token_free, selinux_bpf_token_free),
+ LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
+ LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
#endif
#ifdef CONFIG_PERF_EVENTS
LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
#endif
#ifdef CONFIG_BPF_SYSCALL
- LSM_HOOK_INIT(bpf_map_create, selinux_bpf_map_create),
- LSM_HOOK_INIT(bpf_prog_load, selinux_bpf_prog_load),
- LSM_HOOK_INIT(bpf_token_create, selinux_bpf_token_create),
+ LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
+ LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
#endif
#ifdef CONFIG_PERF_EVENTS
LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
* Returns zero on success. On error, -1 is returned and *errno*
* is set appropriately.
*
- * BPF_TOKEN_CREATE
- * Description
- * Create BPF token with embedded information about what
- * BPF-related functionality it allows:
- * - a set of allowed bpf() syscall commands;
- * - a set of allowed BPF map types to be created with
- * BPF_MAP_CREATE command, if BPF_MAP_CREATE itself is allowed;
- * - a set of allowed BPF program types and BPF program attach
- * types to be loaded with BPF_PROG_LOAD command, if
- * BPF_PROG_LOAD itself is allowed.
- *
- * BPF token is created (derived) from an instance of BPF FS,
- * assuming it has necessary delegation mount options specified.
- * This BPF token can be passed as an extra parameter to various
- * bpf() syscall commands to grant BPF subsystem functionality to
- * unprivileged processes.
- *
- * When created, BPF token is "associated" with the owning
- * user namespace of BPF FS instance (super block) that it was
- * derived from, and subsequent BPF operations performed with
- * BPF token would be performing capabilities checks (i.e.,
- * CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN, CAP_SYS_ADMIN) within
- * that user namespace. Without BPF token, such capabilities
- * have to be granted in init user namespace, making bpf()
- * syscall incompatible with user namespace, for the most part.
- *
- * Return
- * A new file descriptor (a nonnegative integer), or -1 if an
- * error occurred (in which case, *errno* is set appropriately).
- *
* NOTES
* eBPF objects (maps and programs) can be shared between processes.
*
BPF_ITER_CREATE,
BPF_LINK_DETACH,
BPF_PROG_BIND_MAP,
- BPF_TOKEN_CREATE,
- __MAX_BPF_CMD,
};
enum bpf_map_type {
BPF_MAP_TYPE_BLOOM_FILTER,
BPF_MAP_TYPE_USER_RINGBUF,
BPF_MAP_TYPE_CGRP_STORAGE,
- __MAX_BPF_MAP_TYPE
};
/* Note that tracing related programs such as
BPF_PROG_TYPE_SK_LOOKUP,
BPF_PROG_TYPE_SYSCALL, /* a program that can execute syscalls */
BPF_PROG_TYPE_NETFILTER,
- __MAX_BPF_PROG_TYPE
};
enum bpf_attach_type {
* to using 5 hash functions).
*/
__u64 map_extra;
- __u32 map_token_fd;
};
struct { /* anonymous struct used by BPF_MAP_*_ELEM commands */
* truncated), or smaller (if log buffer wasn't filled completely).
*/
__u32 log_true_size;
- __u32 prog_token_fd;
};
struct { /* anonymous struct used by BPF_OBJ_* commands */
* truncated), or smaller (if log buffer wasn't filled completely).
*/
__u32 btf_log_true_size;
- __u32 btf_token_fd;
};
struct {
__u32 flags; /* extra flags */
} prog_bind_map;
- struct { /* struct used by BPF_TOKEN_CREATE command */
- __u32 flags;
- __u32 bpffs_fd;
- } token_create;
-
} __attribute__((aligned(8)));
/* The description below is an attempt at providing documentation to eBPF
libbpf-y := libbpf.o bpf.o nlattr.o btf.o libbpf_errno.o str_error.o \
netlink.o bpf_prog_linfo.o libbpf_probes.o hashmap.o \
btf_dump.o ringbuf.o strset.o linker.o gen_loader.o relo_core.o \
- usdt.o zip.o elf.o features.o
+ usdt.o zip.o elf.o
* [0] https://lore.kernel.org/bpf/20201201215900.3569844-1-guro@fb.com/
* [1] d05512618056 ("bpf: Add bpf_ktime_get_coarse_ns helper")
*/
-int probe_memcg_account(int token_fd)
+int probe_memcg_account(void)
{
const size_t attr_sz = offsetofend(union bpf_attr, attach_btf_obj_fd);
struct bpf_insn insns[] = {
attr.insns = ptr_to_u64(insns);
attr.insn_cnt = insn_cnt;
attr.license = ptr_to_u64("GPL");
- attr.prog_token_fd = token_fd;
prog_fd = sys_bpf_fd(BPF_PROG_LOAD, &attr, attr_sz);
if (prog_fd >= 0) {
struct rlimit rlim;
/* if kernel supports memcg-based accounting, skip bumping RLIMIT_MEMLOCK */
- if (memlock_bumped || feat_supported(NULL, FEAT_MEMCG_ACCOUNT))
+ if (memlock_bumped || kernel_supports(NULL, FEAT_MEMCG_ACCOUNT))
return 0;
memlock_bumped = true;
__u32 max_entries,
const struct bpf_map_create_opts *opts)
{
- const size_t attr_sz = offsetofend(union bpf_attr, map_token_fd);
+ const size_t attr_sz = offsetofend(union bpf_attr, map_extra);
union bpf_attr attr;
int fd;
return libbpf_err(-EINVAL);
attr.map_type = map_type;
- if (map_name && feat_supported(NULL, FEAT_PROG_NAME))
+ if (map_name && kernel_supports(NULL, FEAT_PROG_NAME))
libbpf_strlcpy(attr.map_name, map_name, sizeof(attr.map_name));
attr.key_size = key_size;
attr.value_size = value_size;
attr.numa_node = OPTS_GET(opts, numa_node, 0);
attr.map_ifindex = OPTS_GET(opts, map_ifindex, 0);
- attr.map_token_fd = OPTS_GET(opts, token_fd, 0);
-
fd = sys_bpf_fd(BPF_MAP_CREATE, &attr, attr_sz);
return libbpf_err_errno(fd);
}
const struct bpf_insn *insns, size_t insn_cnt,
struct bpf_prog_load_opts *opts)
{
- const size_t attr_sz = offsetofend(union bpf_attr, prog_token_fd);
+ const size_t attr_sz = offsetofend(union bpf_attr, log_true_size);
void *finfo = NULL, *linfo = NULL;
const char *func_info, *line_info;
__u32 log_size, log_level, attach_prog_fd, attach_btf_obj_fd;
attr.prog_flags = OPTS_GET(opts, prog_flags, 0);
attr.prog_ifindex = OPTS_GET(opts, prog_ifindex, 0);
attr.kern_version = OPTS_GET(opts, kern_version, 0);
- attr.prog_token_fd = OPTS_GET(opts, token_fd, 0);
- if (prog_name && feat_supported(NULL, FEAT_PROG_NAME))
+ if (prog_name && kernel_supports(NULL, FEAT_PROG_NAME))
libbpf_strlcpy(attr.prog_name, prog_name, sizeof(attr.prog_name));
attr.license = ptr_to_u64(license);
int bpf_btf_load(const void *btf_data, size_t btf_size, struct bpf_btf_load_opts *opts)
{
- const size_t attr_sz = offsetofend(union bpf_attr, btf_token_fd);
+ const size_t attr_sz = offsetofend(union bpf_attr, btf_log_true_size);
union bpf_attr attr;
char *log_buf;
size_t log_size;
attr.btf = ptr_to_u64(btf_data);
attr.btf_size = btf_size;
- attr.btf_token_fd = OPTS_GET(opts, token_fd, 0);
-
/* log_level == 0 and log_buf != NULL means "try loading without
* log_buf, but retry with log_buf and log_level=1 on error", which is
* consistent across low-level and high-level BTF and program loading
ret = sys_bpf(BPF_PROG_BIND_MAP, &attr, attr_sz);
return libbpf_err_errno(ret);
}
-
-int bpf_token_create(int bpffs_fd, struct bpf_token_create_opts *opts)
-{
- const size_t attr_sz = offsetofend(union bpf_attr, token_create);
- union bpf_attr attr;
- int fd;
-
- if (!OPTS_VALID(opts, bpf_token_create_opts))
- return libbpf_err(-EINVAL);
-
- memset(&attr, 0, attr_sz);
- attr.token_create.bpffs_fd = bpffs_fd;
- attr.token_create.flags = OPTS_GET(opts, flags, 0);
-
- fd = sys_bpf_fd(BPF_TOKEN_CREATE, &attr, attr_sz);
- return libbpf_err_errno(fd);
-}
__u32 numa_node;
__u32 map_ifindex;
-
- __u32 token_fd;
- size_t :0;
};
-#define bpf_map_create_opts__last_field token_fd
+#define bpf_map_create_opts__last_field map_ifindex
LIBBPF_API int bpf_map_create(enum bpf_map_type map_type,
const char *map_name,
* If kernel doesn't support this feature, log_size is left unchanged.
*/
__u32 log_true_size;
- __u32 token_fd;
size_t :0;
};
-#define bpf_prog_load_opts__last_field token_fd
+#define bpf_prog_load_opts__last_field log_true_size
LIBBPF_API int bpf_prog_load(enum bpf_prog_type prog_type,
const char *prog_name, const char *license,
* If kernel doesn't support this feature, log_size is left unchanged.
*/
__u32 log_true_size;
- __u32 token_fd;
size_t :0;
};
-#define bpf_btf_load_opts__last_field token_fd
+#define bpf_btf_load_opts__last_field log_true_size
LIBBPF_API int bpf_btf_load(const void *btf_data, size_t btf_size,
struct bpf_btf_load_opts *opts);
LIBBPF_API int bpf_prog_test_run_opts(int prog_fd,
struct bpf_test_run_opts *opts);
-struct bpf_token_create_opts {
- size_t sz; /* size of this struct for forward/backward compatibility */
- __u32 flags;
- size_t :0;
-};
-#define bpf_token_create_opts__last_field flags
-
-/**
- * @brief **bpf_token_create()** creates a new instance of BPF token derived
- * from specified BPF FS mount point.
- *
- * BPF token created with this API can be passed to bpf() syscall for
- * commands like BPF_PROG_LOAD, BPF_MAP_CREATE, etc.
- *
- * @param bpffs_fd FD for BPF FS instance from which to derive a BPF token
- * instance.
- * @param opts optional BPF token creation options, can be NULL
- *
- * @return BPF token FD > 0, on success; negative error code, otherwise (errno
- * is also set to the error code)
- */
-LIBBPF_API int bpf_token_create(int bpffs_fd,
- struct bpf_token_create_opts *opts);
-
#ifdef __cplusplus
} /* extern "C" */
#endif
static void *btf_get_raw_data(const struct btf *btf, __u32 *size, bool swap_endian);
-int btf_load_into_kernel(struct btf *btf,
- char *log_buf, size_t log_sz, __u32 log_level,
- int token_fd)
+int btf_load_into_kernel(struct btf *btf, char *log_buf, size_t log_sz, __u32 log_level)
{
LIBBPF_OPTS(bpf_btf_load_opts, opts);
__u32 buf_sz = 0, raw_size;
opts.log_level = log_level;
}
- opts.token_fd = token_fd;
btf->fd = bpf_btf_load(raw_data, raw_size, &opts);
if (btf->fd < 0) {
/* time to turn on verbose mode and try again */
int btf__load_into_kernel(struct btf *btf)
{
- return btf_load_into_kernel(btf, NULL, 0, 0, 0);
+ return btf_load_into_kernel(btf, NULL, 0, 0);
}
int btf__fd(const struct btf *btf)
#include "libbpf_internal.h"
#include "str_error.h"
+#define STRERR_BUFSIZE 128
+
/* A SHT_GNU_versym section holds 16-bit words. This bit is set if
* the symbol is hidden and can only be seen when referenced using an
* explicit version number. This is a GNU extension.
+++ /dev/null
-// SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
-/* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */
-#include <linux/kernel.h>
-#include <linux/filter.h>
-#include "bpf.h"
-#include "libbpf.h"
-#include "libbpf_common.h"
-#include "libbpf_internal.h"
-#include "str_error.h"
-
-static inline __u64 ptr_to_u64(const void *ptr)
-{
- return (__u64)(unsigned long)ptr;
-}
-
-static int probe_fd(int fd)
-{
- if (fd >= 0)
- close(fd);
- return fd >= 0;
-}
-
-static int probe_kern_prog_name(int token_fd)
-{
- const size_t attr_sz = offsetofend(union bpf_attr, prog_name);
- struct bpf_insn insns[] = {
- BPF_MOV64_IMM(BPF_REG_0, 0),
- BPF_EXIT_INSN(),
- };
- union bpf_attr attr;
- int ret;
-
- memset(&attr, 0, attr_sz);
- attr.prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
- attr.license = ptr_to_u64("GPL");
- attr.insns = ptr_to_u64(insns);
- attr.insn_cnt = (__u32)ARRAY_SIZE(insns);
- attr.prog_token_fd = token_fd;
- libbpf_strlcpy(attr.prog_name, "libbpf_nametest", sizeof(attr.prog_name));
-
- /* make sure loading with name works */
- ret = sys_bpf_prog_load(&attr, attr_sz, PROG_LOAD_ATTEMPTS);
- return probe_fd(ret);
-}
-
-static int probe_kern_global_data(int token_fd)
-{
- char *cp, errmsg[STRERR_BUFSIZE];
- struct bpf_insn insns[] = {
- BPF_LD_MAP_VALUE(BPF_REG_1, 0, 16),
- BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 42),
- BPF_MOV64_IMM(BPF_REG_0, 0),
- BPF_EXIT_INSN(),
- };
- LIBBPF_OPTS(bpf_map_create_opts, map_opts, .token_fd = token_fd);
- LIBBPF_OPTS(bpf_prog_load_opts, prog_opts, .token_fd = token_fd);
- int ret, map, insn_cnt = ARRAY_SIZE(insns);
-
- map = bpf_map_create(BPF_MAP_TYPE_ARRAY, "libbpf_global", sizeof(int), 32, 1, &map_opts);
- if (map < 0) {
- ret = -errno;
- cp = libbpf_strerror_r(ret, errmsg, sizeof(errmsg));
- pr_warn("Error in %s():%s(%d). Couldn't create simple array map.\n",
- __func__, cp, -ret);
- return ret;
- }
-
- insns[0].imm = map;
-
- ret = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL", insns, insn_cnt, &prog_opts);
- close(map);
- return probe_fd(ret);
-}
-
-static int probe_kern_btf(int token_fd)
-{
- static const char strs[] = "\0int";
- __u32 types[] = {
- /* int */
- BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4),
- };
-
- return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
- strs, sizeof(strs), token_fd));
-}
-
-static int probe_kern_btf_func(int token_fd)
-{
- static const char strs[] = "\0int\0x\0a";
- /* void x(int a) {} */
- __u32 types[] = {
- /* int */
- BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
- /* FUNC_PROTO */ /* [2] */
- BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_FUNC_PROTO, 0, 1), 0),
- BTF_PARAM_ENC(7, 1),
- /* FUNC x */ /* [3] */
- BTF_TYPE_ENC(5, BTF_INFO_ENC(BTF_KIND_FUNC, 0, 0), 2),
- };
-
- return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
- strs, sizeof(strs), token_fd));
-}
-
-static int probe_kern_btf_func_global(int token_fd)
-{
- static const char strs[] = "\0int\0x\0a";
- /* static void x(int a) {} */
- __u32 types[] = {
- /* int */
- BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
- /* FUNC_PROTO */ /* [2] */
- BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_FUNC_PROTO, 0, 1), 0),
- BTF_PARAM_ENC(7, 1),
- /* FUNC x BTF_FUNC_GLOBAL */ /* [3] */
- BTF_TYPE_ENC(5, BTF_INFO_ENC(BTF_KIND_FUNC, 0, BTF_FUNC_GLOBAL), 2),
- };
-
- return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
- strs, sizeof(strs), token_fd));
-}
-
-static int probe_kern_btf_datasec(int token_fd)
-{
- static const char strs[] = "\0x\0.data";
- /* static int a; */
- __u32 types[] = {
- /* int */
- BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
- /* VAR x */ /* [2] */
- BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),
- BTF_VAR_STATIC,
- /* DATASEC val */ /* [3] */
- BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4),
- BTF_VAR_SECINFO_ENC(2, 0, 4),
- };
-
- return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
- strs, sizeof(strs), token_fd));
-}
-
-static int probe_kern_btf_float(int token_fd)
-{
- static const char strs[] = "\0float";
- __u32 types[] = {
- /* float */
- BTF_TYPE_FLOAT_ENC(1, 4),
- };
-
- return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
- strs, sizeof(strs), token_fd));
-}
-
-static int probe_kern_btf_decl_tag(int token_fd)
-{
- static const char strs[] = "\0tag";
- __u32 types[] = {
- /* int */
- BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
- /* VAR x */ /* [2] */
- BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),
- BTF_VAR_STATIC,
- /* attr */
- BTF_TYPE_DECL_TAG_ENC(1, 2, -1),
- };
-
- return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
- strs, sizeof(strs), token_fd));
-}
-
-static int probe_kern_btf_type_tag(int token_fd)
-{
- static const char strs[] = "\0tag";
- __u32 types[] = {
- /* int */
- BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
- /* attr */
- BTF_TYPE_TYPE_TAG_ENC(1, 1), /* [2] */
- /* ptr */
- BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2), /* [3] */
- };
-
- return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
- strs, sizeof(strs), token_fd));
-}
-
-static int probe_kern_array_mmap(int token_fd)
-{
- LIBBPF_OPTS(bpf_map_create_opts, opts,
- .map_flags = BPF_F_MMAPABLE,
- .token_fd = token_fd,
- );
- int fd;
-
- fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, "libbpf_mmap", sizeof(int), sizeof(int), 1, &opts);
- return probe_fd(fd);
-}
-
-static int probe_kern_exp_attach_type(int token_fd)
-{
- LIBBPF_OPTS(bpf_prog_load_opts, opts,
- .expected_attach_type = BPF_CGROUP_INET_SOCK_CREATE,
- .token_fd = token_fd,
- );
- struct bpf_insn insns[] = {
- BPF_MOV64_IMM(BPF_REG_0, 0),
- BPF_EXIT_INSN(),
- };
- int fd, insn_cnt = ARRAY_SIZE(insns);
-
- /* use any valid combination of program type and (optional)
- * non-zero expected attach type (i.e., not a BPF_CGROUP_INET_INGRESS)
- * to see if kernel supports expected_attach_type field for
- * BPF_PROG_LOAD command
- */
- fd = bpf_prog_load(BPF_PROG_TYPE_CGROUP_SOCK, NULL, "GPL", insns, insn_cnt, &opts);
- return probe_fd(fd);
-}
-
-static int probe_kern_probe_read_kernel(int token_fd)
-{
- LIBBPF_OPTS(bpf_prog_load_opts, opts, .token_fd = token_fd);
- struct bpf_insn insns[] = {
- BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), /* r1 = r10 (fp) */
- BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), /* r1 += -8 */
- BPF_MOV64_IMM(BPF_REG_2, 8), /* r2 = 8 */
- BPF_MOV64_IMM(BPF_REG_3, 0), /* r3 = 0 */
- BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_probe_read_kernel),
- BPF_EXIT_INSN(),
- };
- int fd, insn_cnt = ARRAY_SIZE(insns);
-
- fd = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, NULL, "GPL", insns, insn_cnt, &opts);
- return probe_fd(fd);
-}
-
-static int probe_prog_bind_map(int token_fd)
-{
- char *cp, errmsg[STRERR_BUFSIZE];
- struct bpf_insn insns[] = {
- BPF_MOV64_IMM(BPF_REG_0, 0),
- BPF_EXIT_INSN(),
- };
- LIBBPF_OPTS(bpf_map_create_opts, map_opts, .token_fd = token_fd);
- LIBBPF_OPTS(bpf_prog_load_opts, prog_opts, .token_fd = token_fd);
- int ret, map, prog, insn_cnt = ARRAY_SIZE(insns);
-
- map = bpf_map_create(BPF_MAP_TYPE_ARRAY, "libbpf_det_bind", sizeof(int), 32, 1, &map_opts);
- if (map < 0) {
- ret = -errno;
- cp = libbpf_strerror_r(ret, errmsg, sizeof(errmsg));
- pr_warn("Error in %s():%s(%d). Couldn't create simple array map.\n",
- __func__, cp, -ret);
- return ret;
- }
-
- prog = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL", insns, insn_cnt, &prog_opts);
- if (prog < 0) {
- close(map);
- return 0;
- }
-
- ret = bpf_prog_bind_map(prog, map, NULL);
-
- close(map);
- close(prog);
-
- return ret >= 0;
-}
-
-static int probe_module_btf(int token_fd)
-{
- static const char strs[] = "\0int";
- __u32 types[] = {
- /* int */
- BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4),
- };
- struct bpf_btf_info info;
- __u32 len = sizeof(info);
- char name[16];
- int fd, err;
-
- fd = libbpf__load_raw_btf((char *)types, sizeof(types), strs, sizeof(strs), token_fd);
- if (fd < 0)
- return 0; /* BTF not supported at all */
-
- memset(&info, 0, sizeof(info));
- info.name = ptr_to_u64(name);
- info.name_len = sizeof(name);
-
- /* check that BPF_OBJ_GET_INFO_BY_FD supports specifying name pointer;
- * kernel's module BTF support coincides with support for
- * name/name_len fields in struct bpf_btf_info.
- */
- err = bpf_btf_get_info_by_fd(fd, &info, &len);
- close(fd);
- return !err;
-}
-
-static int probe_perf_link(int token_fd)
-{
- struct bpf_insn insns[] = {
- BPF_MOV64_IMM(BPF_REG_0, 0),
- BPF_EXIT_INSN(),
- };
- LIBBPF_OPTS(bpf_prog_load_opts, opts, .token_fd = token_fd);
- int prog_fd, link_fd, err;
-
- prog_fd = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, NULL, "GPL",
- insns, ARRAY_SIZE(insns), &opts);
- if (prog_fd < 0)
- return -errno;
-
- /* use invalid perf_event FD to get EBADF, if link is supported;
- * otherwise EINVAL should be returned
- */
- link_fd = bpf_link_create(prog_fd, -1, BPF_PERF_EVENT, NULL);
- err = -errno; /* close() can clobber errno */
-
- if (link_fd >= 0)
- close(link_fd);
- close(prog_fd);
-
- return link_fd < 0 && err == -EBADF;
-}
-
-static int probe_uprobe_multi_link(int token_fd)
-{
- LIBBPF_OPTS(bpf_prog_load_opts, load_opts,
- .expected_attach_type = BPF_TRACE_UPROBE_MULTI,
- .token_fd = token_fd,
- );
- LIBBPF_OPTS(bpf_link_create_opts, link_opts);
- struct bpf_insn insns[] = {
- BPF_MOV64_IMM(BPF_REG_0, 0),
- BPF_EXIT_INSN(),
- };
- int prog_fd, link_fd, err;
- unsigned long offset = 0;
-
- prog_fd = bpf_prog_load(BPF_PROG_TYPE_KPROBE, NULL, "GPL",
- insns, ARRAY_SIZE(insns), &load_opts);
- if (prog_fd < 0)
- return -errno;
-
- /* Creating uprobe in '/' binary should fail with -EBADF. */
- link_opts.uprobe_multi.path = "/";
- link_opts.uprobe_multi.offsets = &offset;
- link_opts.uprobe_multi.cnt = 1;
-
- link_fd = bpf_link_create(prog_fd, -1, BPF_TRACE_UPROBE_MULTI, &link_opts);
- err = -errno; /* close() can clobber errno */
-
- if (link_fd >= 0)
- close(link_fd);
- close(prog_fd);
-
- return link_fd < 0 && err == -EBADF;
-}
-
-static int probe_kern_bpf_cookie(int token_fd)
-{
- struct bpf_insn insns[] = {
- BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_attach_cookie),
- BPF_EXIT_INSN(),
- };
- LIBBPF_OPTS(bpf_prog_load_opts, opts, .token_fd = token_fd);
- int ret, insn_cnt = ARRAY_SIZE(insns);
-
- ret = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, NULL, "GPL", insns, insn_cnt, &opts);
- return probe_fd(ret);
-}
-
-static int probe_kern_btf_enum64(int token_fd)
-{
- static const char strs[] = "\0enum64";
- __u32 types[] = {
- BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_ENUM64, 0, 0), 8),
- };
-
- return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
- strs, sizeof(strs), token_fd));
-}
-
-typedef int (*feature_probe_fn)(int /* token_fd */);
-
-static struct kern_feature_cache feature_cache;
-
-static struct kern_feature_desc {
- const char *desc;
- feature_probe_fn probe;
-} feature_probes[__FEAT_CNT] = {
- [FEAT_PROG_NAME] = {
- "BPF program name", probe_kern_prog_name,
- },
- [FEAT_GLOBAL_DATA] = {
- "global variables", probe_kern_global_data,
- },
- [FEAT_BTF] = {
- "minimal BTF", probe_kern_btf,
- },
- [FEAT_BTF_FUNC] = {
- "BTF functions", probe_kern_btf_func,
- },
- [FEAT_BTF_GLOBAL_FUNC] = {
- "BTF global function", probe_kern_btf_func_global,
- },
- [FEAT_BTF_DATASEC] = {
- "BTF data section and variable", probe_kern_btf_datasec,
- },
- [FEAT_ARRAY_MMAP] = {
- "ARRAY map mmap()", probe_kern_array_mmap,
- },
- [FEAT_EXP_ATTACH_TYPE] = {
- "BPF_PROG_LOAD expected_attach_type attribute",
- probe_kern_exp_attach_type,
- },
- [FEAT_PROBE_READ_KERN] = {
- "bpf_probe_read_kernel() helper", probe_kern_probe_read_kernel,
- },
- [FEAT_PROG_BIND_MAP] = {
- "BPF_PROG_BIND_MAP support", probe_prog_bind_map,
- },
- [FEAT_MODULE_BTF] = {
- "module BTF support", probe_module_btf,
- },
- [FEAT_BTF_FLOAT] = {
- "BTF_KIND_FLOAT support", probe_kern_btf_float,
- },
- [FEAT_PERF_LINK] = {
- "BPF perf link support", probe_perf_link,
- },
- [FEAT_BTF_DECL_TAG] = {
- "BTF_KIND_DECL_TAG support", probe_kern_btf_decl_tag,
- },
- [FEAT_BTF_TYPE_TAG] = {
- "BTF_KIND_TYPE_TAG support", probe_kern_btf_type_tag,
- },
- [FEAT_MEMCG_ACCOUNT] = {
- "memcg-based memory accounting", probe_memcg_account,
- },
- [FEAT_BPF_COOKIE] = {
- "BPF cookie support", probe_kern_bpf_cookie,
- },
- [FEAT_BTF_ENUM64] = {
- "BTF_KIND_ENUM64 support", probe_kern_btf_enum64,
- },
- [FEAT_SYSCALL_WRAPPER] = {
- "Kernel using syscall wrapper", probe_kern_syscall_wrapper,
- },
- [FEAT_UPROBE_MULTI_LINK] = {
- "BPF multi-uprobe link support", probe_uprobe_multi_link,
- },
-};
-
-bool feat_supported(struct kern_feature_cache *cache, enum kern_feature_id feat_id)
-{
- struct kern_feature_desc *feat = &feature_probes[feat_id];
- int ret;
-
- /* assume global feature cache, unless custom one is provided */
- if (!cache)
- cache = &feature_cache;
-
- if (READ_ONCE(cache->res[feat_id]) == FEAT_UNKNOWN) {
- ret = feat->probe(cache->token_fd);
- if (ret > 0) {
- WRITE_ONCE(cache->res[feat_id], FEAT_SUPPORTED);
- } else if (ret == 0) {
- WRITE_ONCE(cache->res[feat_id], FEAT_MISSING);
- } else {
- pr_warn("Detection of kernel %s support failed: %d\n", feat->desc, ret);
- WRITE_ONCE(cache->res[feat_id], FEAT_MISSING);
- }
- }
-
- return READ_ONCE(cache->res[feat_id]) == FEAT_SUPPORTED;
-}
#define BPF_FS_MAGIC 0xcafe4a11
#endif
-#define BPF_FS_DEFAULT_PATH "/sys/fs/bpf"
-
#define BPF_INSN_SZ (sizeof(struct bpf_insn))
/* vsprintf() in __base_pr() uses nonliteral format string. It may break
struct usdt_manager *usdt_man;
- struct kern_feature_cache *feat_cache;
- char *token_path;
- int token_fd;
-
char path[];
};
int err;
if (!path)
- path = BPF_FS_DEFAULT_PATH;
+ path = "/sys/fs/bpf";
err = pathname_concat(buf, sizeof(buf), path, bpf_map__name(map));
if (err)
} else {
/* currently BPF_BTF_LOAD only supports log_level 1 */
err = btf_load_into_kernel(kern_btf, obj->log_buf, obj->log_size,
- obj->log_level ? 1 : 0, obj->token_fd);
+ obj->log_level ? 1 : 0);
}
if (sanitize) {
if (!err) {
return 0;
}
-static int bpf_object_prepare_token(struct bpf_object *obj)
-{
- const char *bpffs_path;
- int bpffs_fd = -1, token_fd, err;
- bool mandatory;
- enum libbpf_print_level level;
-
- /* token is already set up */
- if (obj->token_fd > 0)
- return 0;
- /* token is explicitly prevented */
- if (obj->token_fd < 0) {
- pr_debug("object '%s': token is prevented, skipping...\n", obj->name);
- /* reset to zero to avoid extra checks during map_create and prog_load steps */
- obj->token_fd = 0;
- return 0;
- }
-
- mandatory = obj->token_path != NULL;
- level = mandatory ? LIBBPF_WARN : LIBBPF_DEBUG;
-
- bpffs_path = obj->token_path ?: BPF_FS_DEFAULT_PATH;
- bpffs_fd = open(bpffs_path, O_DIRECTORY, O_RDWR);
- if (bpffs_fd < 0) {
- err = -errno;
- __pr(level, "object '%s': failed (%d) to open BPF FS mount at '%s'%s\n",
- obj->name, err, bpffs_path,
- mandatory ? "" : ", skipping optional step...");
- return mandatory ? err : 0;
- }
-
- token_fd = bpf_token_create(bpffs_fd, 0);
- close(bpffs_fd);
- if (token_fd < 0) {
- if (!mandatory && token_fd == -ENOENT) {
- pr_debug("object '%s': BPF FS at '%s' doesn't have BPF token delegation set up, skipping...\n",
- obj->name, bpffs_path);
- return 0;
- }
- __pr(level, "object '%s': failed (%d) to create BPF token from '%s'%s\n",
- obj->name, token_fd, bpffs_path,
- mandatory ? "" : ", skipping optional step...");
- return mandatory ? token_fd : 0;
- }
-
- obj->feat_cache = calloc(1, sizeof(*obj->feat_cache));
- if (!obj->feat_cache) {
- close(token_fd);
- return -ENOMEM;
- }
-
- obj->token_fd = token_fd;
- obj->feat_cache->token_fd = token_fd;
-
- return 0;
-}
-
static int
bpf_object__probe_loading(struct bpf_object *obj)
{
BPF_EXIT_INSN(),
};
int ret, insn_cnt = ARRAY_SIZE(insns);
- LIBBPF_OPTS(bpf_prog_load_opts, opts, .token_fd = obj->token_fd);
if (obj->gen_loader)
return 0;
pr_warn("Failed to bump RLIMIT_MEMLOCK (err = %d), you might need to do it explicitly!\n", ret);
/* make sure basic loading works */
- ret = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL", insns, insn_cnt, &opts);
+ ret = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL", insns, insn_cnt, NULL);
if (ret < 0)
- ret = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, NULL, "GPL", insns, insn_cnt, &opts);
+ ret = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, NULL, "GPL", insns, insn_cnt, NULL);
if (ret < 0) {
ret = errno;
cp = libbpf_strerror_r(ret, errmsg, sizeof(errmsg));
return 0;
}
+static int probe_fd(int fd)
+{
+ if (fd >= 0)
+ close(fd);
+ return fd >= 0;
+}
+
+static int probe_kern_prog_name(void)
+{
+ const size_t attr_sz = offsetofend(union bpf_attr, prog_name);
+ struct bpf_insn insns[] = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ };
+ union bpf_attr attr;
+ int ret;
+
+ memset(&attr, 0, attr_sz);
+ attr.prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
+ attr.license = ptr_to_u64("GPL");
+ attr.insns = ptr_to_u64(insns);
+ attr.insn_cnt = (__u32)ARRAY_SIZE(insns);
+ libbpf_strlcpy(attr.prog_name, "libbpf_nametest", sizeof(attr.prog_name));
+
+ /* make sure loading with name works */
+ ret = sys_bpf_prog_load(&attr, attr_sz, PROG_LOAD_ATTEMPTS);
+ return probe_fd(ret);
+}
+
+static int probe_kern_global_data(void)
+{
+ char *cp, errmsg[STRERR_BUFSIZE];
+ struct bpf_insn insns[] = {
+ BPF_LD_MAP_VALUE(BPF_REG_1, 0, 16),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 42),
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ };
+ int ret, map, insn_cnt = ARRAY_SIZE(insns);
+
+ map = bpf_map_create(BPF_MAP_TYPE_ARRAY, "libbpf_global", sizeof(int), 32, 1, NULL);
+ if (map < 0) {
+ ret = -errno;
+ cp = libbpf_strerror_r(ret, errmsg, sizeof(errmsg));
+ pr_warn("Error in %s():%s(%d). Couldn't create simple array map.\n",
+ __func__, cp, -ret);
+ return ret;
+ }
+
+ insns[0].imm = map;
+
+ ret = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL", insns, insn_cnt, NULL);
+ close(map);
+ return probe_fd(ret);
+}
+
+static int probe_kern_btf(void)
+{
+ static const char strs[] = "\0int";
+ __u32 types[] = {
+ /* int */
+ BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4),
+ };
+
+ return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
+ strs, sizeof(strs)));
+}
+
+static int probe_kern_btf_func(void)
+{
+ static const char strs[] = "\0int\0x\0a";
+ /* void x(int a) {} */
+ __u32 types[] = {
+ /* int */
+ BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
+ /* FUNC_PROTO */ /* [2] */
+ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_FUNC_PROTO, 0, 1), 0),
+ BTF_PARAM_ENC(7, 1),
+ /* FUNC x */ /* [3] */
+ BTF_TYPE_ENC(5, BTF_INFO_ENC(BTF_KIND_FUNC, 0, 0), 2),
+ };
+
+ return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
+ strs, sizeof(strs)));
+}
+
+static int probe_kern_btf_func_global(void)
+{
+ static const char strs[] = "\0int\0x\0a";
+ /* static void x(int a) {} */
+ __u32 types[] = {
+ /* int */
+ BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
+ /* FUNC_PROTO */ /* [2] */
+ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_FUNC_PROTO, 0, 1), 0),
+ BTF_PARAM_ENC(7, 1),
+ /* FUNC x BTF_FUNC_GLOBAL */ /* [3] */
+ BTF_TYPE_ENC(5, BTF_INFO_ENC(BTF_KIND_FUNC, 0, BTF_FUNC_GLOBAL), 2),
+ };
+
+ return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
+ strs, sizeof(strs)));
+}
+
+static int probe_kern_btf_datasec(void)
+{
+ static const char strs[] = "\0x\0.data";
+ /* static int a; */
+ __u32 types[] = {
+ /* int */
+ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
+ /* VAR x */ /* [2] */
+ BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),
+ BTF_VAR_STATIC,
+ /* DATASEC val */ /* [3] */
+ BTF_TYPE_ENC(3, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 1), 4),
+ BTF_VAR_SECINFO_ENC(2, 0, 4),
+ };
+
+ return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
+ strs, sizeof(strs)));
+}
+
+static int probe_kern_btf_float(void)
+{
+ static const char strs[] = "\0float";
+ __u32 types[] = {
+ /* float */
+ BTF_TYPE_FLOAT_ENC(1, 4),
+ };
+
+ return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
+ strs, sizeof(strs)));
+}
+
+static int probe_kern_btf_decl_tag(void)
+{
+ static const char strs[] = "\0tag";
+ __u32 types[] = {
+ /* int */
+ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
+ /* VAR x */ /* [2] */
+ BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_VAR, 0, 0), 1),
+ BTF_VAR_STATIC,
+ /* attr */
+ BTF_TYPE_DECL_TAG_ENC(1, 2, -1),
+ };
+
+ return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
+ strs, sizeof(strs)));
+}
+
+static int probe_kern_btf_type_tag(void)
+{
+ static const char strs[] = "\0tag";
+ __u32 types[] = {
+ /* int */
+ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
+ /* attr */
+ BTF_TYPE_TYPE_TAG_ENC(1, 1), /* [2] */
+ /* ptr */
+ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2), /* [3] */
+ };
+
+ return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
+ strs, sizeof(strs)));
+}
+
+static int probe_kern_array_mmap(void)
+{
+ LIBBPF_OPTS(bpf_map_create_opts, opts, .map_flags = BPF_F_MMAPABLE);
+ int fd;
+
+ fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, "libbpf_mmap", sizeof(int), sizeof(int), 1, &opts);
+ return probe_fd(fd);
+}
+
+static int probe_kern_exp_attach_type(void)
+{
+ LIBBPF_OPTS(bpf_prog_load_opts, opts, .expected_attach_type = BPF_CGROUP_INET_SOCK_CREATE);
+ struct bpf_insn insns[] = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ };
+ int fd, insn_cnt = ARRAY_SIZE(insns);
+
+ /* use any valid combination of program type and (optional)
+ * non-zero expected attach type (i.e., not a BPF_CGROUP_INET_INGRESS)
+ * to see if kernel supports expected_attach_type field for
+ * BPF_PROG_LOAD command
+ */
+ fd = bpf_prog_load(BPF_PROG_TYPE_CGROUP_SOCK, NULL, "GPL", insns, insn_cnt, &opts);
+ return probe_fd(fd);
+}
+
+static int probe_kern_probe_read_kernel(void)
+{
+ struct bpf_insn insns[] = {
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), /* r1 = r10 (fp) */
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8), /* r1 += -8 */
+ BPF_MOV64_IMM(BPF_REG_2, 8), /* r2 = 8 */
+ BPF_MOV64_IMM(BPF_REG_3, 0), /* r3 = 0 */
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_probe_read_kernel),
+ BPF_EXIT_INSN(),
+ };
+ int fd, insn_cnt = ARRAY_SIZE(insns);
+
+ fd = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, NULL, "GPL", insns, insn_cnt, NULL);
+ return probe_fd(fd);
+}
+
+static int probe_prog_bind_map(void)
+{
+ char *cp, errmsg[STRERR_BUFSIZE];
+ struct bpf_insn insns[] = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ };
+ int ret, map, prog, insn_cnt = ARRAY_SIZE(insns);
+
+ map = bpf_map_create(BPF_MAP_TYPE_ARRAY, "libbpf_det_bind", sizeof(int), 32, 1, NULL);
+ if (map < 0) {
+ ret = -errno;
+ cp = libbpf_strerror_r(ret, errmsg, sizeof(errmsg));
+ pr_warn("Error in %s():%s(%d). Couldn't create simple array map.\n",
+ __func__, cp, -ret);
+ return ret;
+ }
+
+ prog = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL", insns, insn_cnt, NULL);
+ if (prog < 0) {
+ close(map);
+ return 0;
+ }
+
+ ret = bpf_prog_bind_map(prog, map, NULL);
+
+ close(map);
+ close(prog);
+
+ return ret >= 0;
+}
+
+static int probe_module_btf(void)
+{
+ static const char strs[] = "\0int";
+ __u32 types[] = {
+ /* int */
+ BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4),
+ };
+ struct bpf_btf_info info;
+ __u32 len = sizeof(info);
+ char name[16];
+ int fd, err;
+
+ fd = libbpf__load_raw_btf((char *)types, sizeof(types), strs, sizeof(strs));
+ if (fd < 0)
+ return 0; /* BTF not supported at all */
+
+ memset(&info, 0, sizeof(info));
+ info.name = ptr_to_u64(name);
+ info.name_len = sizeof(name);
+
+ /* check that BPF_OBJ_GET_INFO_BY_FD supports specifying name pointer;
+ * kernel's module BTF support coincides with support for
+ * name/name_len fields in struct bpf_btf_info.
+ */
+ err = bpf_btf_get_info_by_fd(fd, &info, &len);
+ close(fd);
+ return !err;
+}
+
+static int probe_perf_link(void)
+{
+ struct bpf_insn insns[] = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ };
+ int prog_fd, link_fd, err;
+
+ prog_fd = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, NULL, "GPL",
+ insns, ARRAY_SIZE(insns), NULL);
+ if (prog_fd < 0)
+ return -errno;
+
+ /* use invalid perf_event FD to get EBADF, if link is supported;
+ * otherwise EINVAL should be returned
+ */
+ link_fd = bpf_link_create(prog_fd, -1, BPF_PERF_EVENT, NULL);
+ err = -errno; /* close() can clobber errno */
+
+ if (link_fd >= 0)
+ close(link_fd);
+ close(prog_fd);
+
+ return link_fd < 0 && err == -EBADF;
+}
+
+static int probe_uprobe_multi_link(void)
+{
+ LIBBPF_OPTS(bpf_prog_load_opts, load_opts,
+ .expected_attach_type = BPF_TRACE_UPROBE_MULTI,
+ );
+ LIBBPF_OPTS(bpf_link_create_opts, link_opts);
+ struct bpf_insn insns[] = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ };
+ int prog_fd, link_fd, err;
+ unsigned long offset = 0;
+
+ prog_fd = bpf_prog_load(BPF_PROG_TYPE_KPROBE, NULL, "GPL",
+ insns, ARRAY_SIZE(insns), &load_opts);
+ if (prog_fd < 0)
+ return -errno;
+
+ /* Creating uprobe in '/' binary should fail with -EBADF. */
+ link_opts.uprobe_multi.path = "/";
+ link_opts.uprobe_multi.offsets = &offset;
+ link_opts.uprobe_multi.cnt = 1;
+
+ link_fd = bpf_link_create(prog_fd, -1, BPF_TRACE_UPROBE_MULTI, &link_opts);
+ err = -errno; /* close() can clobber errno */
+
+ if (link_fd >= 0)
+ close(link_fd);
+ close(prog_fd);
+
+ return link_fd < 0 && err == -EBADF;
+}
+
+static int probe_kern_bpf_cookie(void)
+{
+ struct bpf_insn insns[] = {
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_attach_cookie),
+ BPF_EXIT_INSN(),
+ };
+ int ret, insn_cnt = ARRAY_SIZE(insns);
+
+ ret = bpf_prog_load(BPF_PROG_TYPE_KPROBE, NULL, "GPL", insns, insn_cnt, NULL);
+ return probe_fd(ret);
+}
+
+static int probe_kern_btf_enum64(void)
+{
+ static const char strs[] = "\0enum64";
+ __u32 types[] = {
+ BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_ENUM64, 0, 0), 8),
+ };
+
+ return probe_fd(libbpf__load_raw_btf((char *)types, sizeof(types),
+ strs, sizeof(strs)));
+}
+
+static int probe_kern_syscall_wrapper(void);
+
+enum kern_feature_result {
+ FEAT_UNKNOWN = 0,
+ FEAT_SUPPORTED = 1,
+ FEAT_MISSING = 2,
+};
+
+typedef int (*feature_probe_fn)(void);
+
+static struct kern_feature_desc {
+ const char *desc;
+ feature_probe_fn probe;
+ enum kern_feature_result res;
+} feature_probes[__FEAT_CNT] = {
+ [FEAT_PROG_NAME] = {
+ "BPF program name", probe_kern_prog_name,
+ },
+ [FEAT_GLOBAL_DATA] = {
+ "global variables", probe_kern_global_data,
+ },
+ [FEAT_BTF] = {
+ "minimal BTF", probe_kern_btf,
+ },
+ [FEAT_BTF_FUNC] = {
+ "BTF functions", probe_kern_btf_func,
+ },
+ [FEAT_BTF_GLOBAL_FUNC] = {
+ "BTF global function", probe_kern_btf_func_global,
+ },
+ [FEAT_BTF_DATASEC] = {
+ "BTF data section and variable", probe_kern_btf_datasec,
+ },
+ [FEAT_ARRAY_MMAP] = {
+ "ARRAY map mmap()", probe_kern_array_mmap,
+ },
+ [FEAT_EXP_ATTACH_TYPE] = {
+ "BPF_PROG_LOAD expected_attach_type attribute",
+ probe_kern_exp_attach_type,
+ },
+ [FEAT_PROBE_READ_KERN] = {
+ "bpf_probe_read_kernel() helper", probe_kern_probe_read_kernel,
+ },
+ [FEAT_PROG_BIND_MAP] = {
+ "BPF_PROG_BIND_MAP support", probe_prog_bind_map,
+ },
+ [FEAT_MODULE_BTF] = {
+ "module BTF support", probe_module_btf,
+ },
+ [FEAT_BTF_FLOAT] = {
+ "BTF_KIND_FLOAT support", probe_kern_btf_float,
+ },
+ [FEAT_PERF_LINK] = {
+ "BPF perf link support", probe_perf_link,
+ },
+ [FEAT_BTF_DECL_TAG] = {
+ "BTF_KIND_DECL_TAG support", probe_kern_btf_decl_tag,
+ },
+ [FEAT_BTF_TYPE_TAG] = {
+ "BTF_KIND_TYPE_TAG support", probe_kern_btf_type_tag,
+ },
+ [FEAT_MEMCG_ACCOUNT] = {
+ "memcg-based memory accounting", probe_memcg_account,
+ },
+ [FEAT_BPF_COOKIE] = {
+ "BPF cookie support", probe_kern_bpf_cookie,
+ },
+ [FEAT_BTF_ENUM64] = {
+ "BTF_KIND_ENUM64 support", probe_kern_btf_enum64,
+ },
+ [FEAT_SYSCALL_WRAPPER] = {
+ "Kernel using syscall wrapper", probe_kern_syscall_wrapper,
+ },
+ [FEAT_UPROBE_MULTI_LINK] = {
+ "BPF multi-uprobe link support", probe_uprobe_multi_link,
+ },
+};
+
bool kernel_supports(const struct bpf_object *obj, enum kern_feature_id feat_id)
{
+ struct kern_feature_desc *feat = &feature_probes[feat_id];
+ int ret;
+
if (obj && obj->gen_loader)
/* To generate loader program assume the latest kernel
* to avoid doing extra prog_load, map_create syscalls.
*/
return true;
- if (obj->token_fd)
- return feat_supported(obj->feat_cache, feat_id);
+ if (READ_ONCE(feat->res) == FEAT_UNKNOWN) {
+ ret = feat->probe();
+ if (ret > 0) {
+ WRITE_ONCE(feat->res, FEAT_SUPPORTED);
+ } else if (ret == 0) {
+ WRITE_ONCE(feat->res, FEAT_MISSING);
+ } else {
+ pr_warn("Detection of kernel %s support failed: %d\n", feat->desc, ret);
+ WRITE_ONCE(feat->res, FEAT_MISSING);
+ }
+ }
- return feat_supported(NULL, feat_id);
+ return READ_ONCE(feat->res) == FEAT_SUPPORTED;
}
static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
create_attr.map_flags = def->map_flags;
create_attr.numa_node = map->numa_node;
create_attr.map_extra = map->map_extra;
- create_attr.token_fd = obj->token_fd;
if (bpf_map__is_struct_ops(map))
create_attr.btf_vmlinux_value_type_id = map->btf_vmlinux_value_type_id;
load_attr.attach_btf_id = prog->attach_btf_id;
load_attr.kern_version = kern_version;
load_attr.prog_ifindex = prog->prog_ifindex;
- load_attr.token_fd = obj->token_fd;
/* specify func_info/line_info only if kernel supports them */
btf_fd = bpf_object__btf_fd(obj);
static struct bpf_object *bpf_object_open(const char *path, const void *obj_buf, size_t obj_buf_sz,
const struct bpf_object_open_opts *opts)
{
- const char *obj_name, *kconfig, *btf_tmp_path, *token_path;
+ const char *obj_name, *kconfig, *btf_tmp_path;
struct bpf_object *obj;
char tmp_name[64];
- int err, token_fd;
+ int err;
char *log_buf;
size_t log_size;
__u32 log_level;
if (log_size && !log_buf)
return ERR_PTR(-EINVAL);
- token_path = OPTS_GET(opts, bpf_token_path, NULL);
- token_fd = OPTS_GET(opts, bpf_token_fd, -1);
- /* non-empty token path can't be combined with invalid token FD */
- if (token_path && token_path[0] != '\0' && token_fd < 0)
- return ERR_PTR(-EINVAL);
- /* empty token path can't be combined with valid token FD */
- if (token_path && token_path[0] == '\0' && token_fd > 0)
- return ERR_PTR(-EINVAL);
- /* if user didn't specify bpf_token_path/bpf_token_fd explicitly,
- * check if LIBBPF_BPF_TOKEN_PATH envvar was set and treat it as
- * bpf_token_path option
- */
- if (token_fd == 0 && !token_path)
- token_path = getenv("LIBBPF_BPF_TOKEN_PATH");
- /* empty token_path is equivalent to invalid token_fd */
- if (token_path && token_path[0] == '\0') {
- token_path = NULL;
- token_fd = -1;
- }
- if (token_path && strlen(token_path) >= PATH_MAX)
- return ERR_PTR(-ENAMETOOLONG);
-
obj = bpf_object__new(path, obj_buf, obj_buf_sz, obj_name);
if (IS_ERR(obj))
return obj;
obj->log_size = log_size;
obj->log_level = log_level;
- obj->token_fd = token_fd <= 0 ? token_fd : dup_good_fd(token_fd);
- if (token_fd > 0 && obj->token_fd < 0) {
- err = -errno;
- goto out;
- }
- if (token_path) {
- obj->token_path = strdup(token_path);
- if (!obj->token_path) {
- err = -ENOMEM;
- goto out;
- }
- }
-
btf_tmp_path = OPTS_GET(opts, btf_custom_path, NULL);
if (btf_tmp_path) {
if (strlen(btf_tmp_path) >= PATH_MAX) {
if (obj->gen_loader)
bpf_gen__init(obj->gen_loader, extra_log_level, obj->nr_programs, obj->nr_maps);
- err = bpf_object_prepare_token(obj);
- err = err ? : bpf_object__probe_loading(obj);
+ err = bpf_object__probe_loading(obj);
err = err ? : bpf_object__load_vmlinux_btf(obj, false);
err = err ? : bpf_object__resolve_externs(obj, obj->kconfig);
err = err ? : bpf_object__sanitize_and_load_btf(obj);
}
zfree(&obj->programs);
- zfree(&obj->feat_cache);
- zfree(&obj->token_path);
- if (obj->token_fd > 0)
- close(obj->token_fd);
-
free(obj);
}
#endif
}
-int probe_kern_syscall_wrapper(int token_fd)
+static int probe_kern_syscall_wrapper(void)
{
char syscall_name[64];
const char *ksys_pfx;
* logs through its print callback.
*/
__u32 kernel_log_level;
- /* FD of a BPF token instantiated by user through bpf_token_create()
- * API. BPF object will keep dup()'ed FD internally, so passed token
- * FD can be closed after BPF object/skeleton open step.
- *
- * Setting bpf_token_fd to negative value disables libbpf's automatic
- * attempt to create BPF token from default BPF FS mount point
- * (/sys/fs/bpf), in case this default behavior is undesirable.
- *
- * If bpf_token_path and bpf_token_fd are not specified, libbpf will
- * consult LIBBPF_BPF_TOKEN_PATH environment variable. If set, it will
- * be taken as a value of bpf_token_path option and will force libbpf
- * to either create BPF token from provided custom BPF FS path, or
- * will disable implicit BPF token creation, if envvar value is an
- * empty string.
- *
- * bpf_token_path and bpf_token_fd are mutually exclusive and only one
- * of those options should be set. Either of them overrides
- * LIBBPF_BPF_TOKEN_PATH envvar.
- */
- int bpf_token_fd;
- /* Path to BPF FS mount point to derive BPF token from.
- *
- * Created BPF token will be used for all bpf() syscall operations
- * that accept BPF token (e.g., map creation, BTF and program loads,
- * etc) automatically within instantiated BPF object.
- *
- * Setting bpf_token_path option to empty string disables libbpf's
- * automatic attempt to create BPF token from default BPF FS mount
- * point (/sys/fs/bpf), in case this default behavior is undesirable.
- *
- * bpf_token_path and bpf_token_fd are mutually exclusive and only one
- * of those options should be set. Either of them overrides
- * LIBBPF_BPF_TOKEN_PATH envvar.
- */
- const char *bpf_token_path;
size_t :0;
};
-#define bpf_object_open_opts__last_field bpf_token_path
+#define bpf_object_open_opts__last_field kernel_log_level
/**
* @brief **bpf_object__open()** creates a bpf_object by opening
bpf_program__attach_netkit;
bpf_program__attach_tcx;
bpf_program__attach_uprobe_multi;
- bpf_token_create;
ring__avail_data_size;
ring__consume;
ring__consumer_pos;
__FEAT_CNT,
};
-enum kern_feature_result {
- FEAT_UNKNOWN = 0,
- FEAT_SUPPORTED = 1,
- FEAT_MISSING = 2,
-};
-
-struct kern_feature_cache {
- enum kern_feature_result res[__FEAT_CNT];
- int token_fd;
-};
-
-bool feat_supported(struct kern_feature_cache *cache, enum kern_feature_id feat_id);
+int probe_memcg_account(void);
bool kernel_supports(const struct bpf_object *obj, enum kern_feature_id feat_id);
-
-int probe_kern_syscall_wrapper(int token_fd);
-int probe_memcg_account(int token_fd);
int bump_rlimit_memlock(void);
int parse_cpu_mask_str(const char *s, bool **mask, int *mask_sz);
int parse_cpu_mask_file(const char *fcpu, bool **mask, int *mask_sz);
int libbpf__load_raw_btf(const char *raw_types, size_t types_len,
- const char *str_sec, size_t str_len,
- int token_fd);
-int btf_load_into_kernel(struct btf *btf,
- char *log_buf, size_t log_sz, __u32 log_level,
- int token_fd);
+ const char *str_sec, size_t str_len);
+int btf_load_into_kernel(struct btf *btf, char *log_buf, size_t log_sz, __u32 log_level);
struct btf *btf_get_from_fd(int btf_fd, struct btf *base_btf);
void btf_get_kernel_prefix_kind(enum bpf_attach_type attach_type,
return insn->code == (BPF_LD | BPF_IMM | BPF_DW);
}
-/* Unconditionally dup FD, ensuring it doesn't use [0, 2] range.
- * Original FD is not closed or altered in any other way.
- * Preserves original FD value, if it's invalid (negative).
- */
-static inline int dup_good_fd(int fd)
-{
- if (fd < 0)
- return fd;
- return fcntl(fd, F_DUPFD_CLOEXEC, 3);
-}
-
/* if fd is stdin, stdout, or stderr, dup to a fd greater than 2
* Takes ownership of the fd passed in, and closes it if calling
* fcntl(fd, F_DUPFD_CLOEXEC, 3).
if (fd < 0)
return fd;
if (fd < 3) {
- fd = dup_good_fd(fd);
+ fd = fcntl(fd, F_DUPFD_CLOEXEC, 3);
saved_errno = errno;
close(old_fd);
errno = saved_errno;
}
int libbpf__load_raw_btf(const char *raw_types, size_t types_len,
- const char *str_sec, size_t str_len,
- int token_fd)
+ const char *str_sec, size_t str_len)
{
struct btf_header hdr = {
.magic = BTF_MAGIC,
.str_off = types_len,
.str_len = str_len,
};
- LIBBPF_OPTS(bpf_btf_load_opts, opts, .token_fd = token_fd);
int btf_fd, btf_len;
__u8 *raw_btf;
memcpy(raw_btf + hdr.hdr_len, raw_types, hdr.type_len);
memcpy(raw_btf + hdr.hdr_len + hdr.type_len, str_sec, hdr.str_len);
- btf_fd = bpf_btf_load(raw_btf, btf_len, &opts);
+ btf_fd = bpf_btf_load(raw_btf, btf_len, NULL);
free(raw_btf);
return btf_fd;
};
return libbpf__load_raw_btf((char *)types, sizeof(types),
- strs, sizeof(strs), 0);
+ strs, sizeof(strs));
}
static int probe_map_create(enum bpf_map_type map_type)
#ifndef __LIBBPF_STR_ERROR_H
#define __LIBBPF_STR_ERROR_H
-#define STRERR_BUFSIZE 128
-
char *libbpf_strerror_r(int err, char *dst, int len);
-
#endif /* __LIBBPF_STR_ERROR_H */
if (prog_type == BPF_PROG_TYPE_UNSPEC)
continue;
- if (strcmp(prog_type_name, "__MAX_BPF_PROG_TYPE") == 0)
- continue;
if (!test__start_subtest(prog_type_name))
continue;
if (map_type == BPF_MAP_TYPE_UNSPEC)
continue;
- if (strcmp(map_type_name, "__MAX_BPF_MAP_TYPE") == 0)
- continue;
if (!test__start_subtest(map_type_name))
continue;
const char *map_type_str;
char buf[256];
- if (map_type == __MAX_BPF_MAP_TYPE)
- continue;
-
map_type_name = btf__str_by_offset(btf, e->name_off);
map_type_str = libbpf_bpf_map_type_str(map_type);
ASSERT_OK_PTR(map_type_str, map_type_name);
const char *prog_type_str;
char buf[256];
- if (prog_type == __MAX_BPF_PROG_TYPE)
- continue;
-
prog_type_name = btf__str_by_offset(btf, e->name_off);
prog_type_str = libbpf_bpf_prog_type_str(prog_type);
ASSERT_OK_PTR(prog_type_str, prog_type_name);
+++ /dev/null
-// SPDX-License-Identifier: GPL-2.0
-/* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */
-#define _GNU_SOURCE
-#include <test_progs.h>
-#include <bpf/btf.h>
-#include "cap_helpers.h"
-#include <fcntl.h>
-#include <sched.h>
-#include <signal.h>
-#include <unistd.h>
-#include <linux/filter.h>
-#include <linux/unistd.h>
-#include <linux/mount.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/syscall.h>
-#include <sys/un.h>
-#include "priv_map.skel.h"
-#include "priv_prog.skel.h"
-#include "dummy_st_ops_success.skel.h"
-
-static inline int sys_mount(const char *dev_name, const char *dir_name,
- const char *type, unsigned long flags,
- const void *data)
-{
- return syscall(__NR_mount, dev_name, dir_name, type, flags, data);
-}
-
-static inline int sys_fsopen(const char *fsname, unsigned flags)
-{
- return syscall(__NR_fsopen, fsname, flags);
-}
-
-static inline int sys_fspick(int dfd, const char *path, unsigned flags)
-{
- return syscall(__NR_fspick, dfd, path, flags);
-}
-
-static inline int sys_fsconfig(int fs_fd, unsigned cmd, const char *key, const void *val, int aux)
-{
- return syscall(__NR_fsconfig, fs_fd, cmd, key, val, aux);
-}
-
-static inline int sys_fsmount(int fs_fd, unsigned flags, unsigned ms_flags)
-{
- return syscall(__NR_fsmount, fs_fd, flags, ms_flags);
-}
-
-static inline int sys_move_mount(int from_dfd, const char *from_path,
- int to_dfd, const char *to_path,
- unsigned flags)
-{
- return syscall(__NR_move_mount, from_dfd, from_path, to_dfd, to_path, flags);
-}
-
-static int drop_priv_caps(__u64 *old_caps)
-{
- return cap_disable_effective((1ULL << CAP_BPF) |
- (1ULL << CAP_PERFMON) |
- (1ULL << CAP_NET_ADMIN) |
- (1ULL << CAP_SYS_ADMIN), old_caps);
-}
-
-static int restore_priv_caps(__u64 old_caps)
-{
- return cap_enable_effective(old_caps, NULL);
-}
-
-static int set_delegate_mask(int fs_fd, const char *key, __u64 mask, const char *mask_str)
-{
- char buf[32];
- int err;
-
- if (!mask_str) {
- if (mask == ~0ULL) {
- mask_str = "any";
- } else {
- snprintf(buf, sizeof(buf), "0x%llx", (unsigned long long)mask);
- mask_str = buf;
- }
- }
-
- err = sys_fsconfig(fs_fd, FSCONFIG_SET_STRING, key,
- mask_str, 0);
- if (err < 0)
- err = -errno;
- return err;
-}
-
-#define zclose(fd) do { if (fd >= 0) close(fd); fd = -1; } while (0)
-
-struct bpffs_opts {
- __u64 cmds;
- __u64 maps;
- __u64 progs;
- __u64 attachs;
- const char *cmds_str;
- const char *maps_str;
- const char *progs_str;
- const char *attachs_str;
-};
-
-static int create_bpffs_fd(void)
-{
- int fs_fd;
-
- /* create VFS context */
- fs_fd = sys_fsopen("bpf", 0);
- ASSERT_GE(fs_fd, 0, "fs_fd");
-
- return fs_fd;
-}
-
-static int materialize_bpffs_fd(int fs_fd, struct bpffs_opts *opts)
-{
- int mnt_fd, err;
-
- /* set up token delegation mount options */
- err = set_delegate_mask(fs_fd, "delegate_cmds", opts->cmds, opts->cmds_str);
- if (!ASSERT_OK(err, "fs_cfg_cmds"))
- return err;
- err = set_delegate_mask(fs_fd, "delegate_maps", opts->maps, opts->maps_str);
- if (!ASSERT_OK(err, "fs_cfg_maps"))
- return err;
- err = set_delegate_mask(fs_fd, "delegate_progs", opts->progs, opts->progs_str);
- if (!ASSERT_OK(err, "fs_cfg_progs"))
- return err;
- err = set_delegate_mask(fs_fd, "delegate_attachs", opts->attachs, opts->attachs_str);
- if (!ASSERT_OK(err, "fs_cfg_attachs"))
- return err;
-
- /* instantiate FS object */
- err = sys_fsconfig(fs_fd, FSCONFIG_CMD_CREATE, NULL, NULL, 0);
- if (err < 0)
- return -errno;
-
- /* create O_PATH fd for detached mount */
- mnt_fd = sys_fsmount(fs_fd, 0, 0);
- if (err < 0)
- return -errno;
-
- return mnt_fd;
-}
-
-/* send FD over Unix domain (AF_UNIX) socket */
-static int sendfd(int sockfd, int fd)
-{
- struct msghdr msg = {};
- struct cmsghdr *cmsg;
- int fds[1] = { fd }, err;
- char iobuf[1];
- struct iovec io = {
- .iov_base = iobuf,
- .iov_len = sizeof(iobuf),
- };
- union {
- char buf[CMSG_SPACE(sizeof(fds))];
- struct cmsghdr align;
- } u;
-
- msg.msg_iov = &io;
- msg.msg_iovlen = 1;
- msg.msg_control = u.buf;
- msg.msg_controllen = sizeof(u.buf);
- cmsg = CMSG_FIRSTHDR(&msg);
- cmsg->cmsg_level = SOL_SOCKET;
- cmsg->cmsg_type = SCM_RIGHTS;
- cmsg->cmsg_len = CMSG_LEN(sizeof(fds));
- memcpy(CMSG_DATA(cmsg), fds, sizeof(fds));
-
- err = sendmsg(sockfd, &msg, 0);
- if (err < 0)
- err = -errno;
- if (!ASSERT_EQ(err, 1, "sendmsg"))
- return -EINVAL;
-
- return 0;
-}
-
-/* receive FD over Unix domain (AF_UNIX) socket */
-static int recvfd(int sockfd, int *fd)
-{
- struct msghdr msg = {};
- struct cmsghdr *cmsg;
- int fds[1], err;
- char iobuf[1];
- struct iovec io = {
- .iov_base = iobuf,
- .iov_len = sizeof(iobuf),
- };
- union {
- char buf[CMSG_SPACE(sizeof(fds))];
- struct cmsghdr align;
- } u;
-
- msg.msg_iov = &io;
- msg.msg_iovlen = 1;
- msg.msg_control = u.buf;
- msg.msg_controllen = sizeof(u.buf);
-
- err = recvmsg(sockfd, &msg, 0);
- if (err < 0)
- err = -errno;
- if (!ASSERT_EQ(err, 1, "recvmsg"))
- return -EINVAL;
-
- cmsg = CMSG_FIRSTHDR(&msg);
- if (!ASSERT_OK_PTR(cmsg, "cmsg_null") ||
- !ASSERT_EQ(cmsg->cmsg_len, CMSG_LEN(sizeof(fds)), "cmsg_len") ||
- !ASSERT_EQ(cmsg->cmsg_level, SOL_SOCKET, "cmsg_level") ||
- !ASSERT_EQ(cmsg->cmsg_type, SCM_RIGHTS, "cmsg_type"))
- return -EINVAL;
-
- memcpy(fds, CMSG_DATA(cmsg), sizeof(fds));
- *fd = fds[0];
-
- return 0;
-}
-
-static ssize_t write_nointr(int fd, const void *buf, size_t count)
-{
- ssize_t ret;
-
- do {
- ret = write(fd, buf, count);
- } while (ret < 0 && errno == EINTR);
-
- return ret;
-}
-
-static int write_file(const char *path, const void *buf, size_t count)
-{
- int fd;
- ssize_t ret;
-
- fd = open(path, O_WRONLY | O_CLOEXEC | O_NOCTTY | O_NOFOLLOW);
- if (fd < 0)
- return -1;
-
- ret = write_nointr(fd, buf, count);
- close(fd);
- if (ret < 0 || (size_t)ret != count)
- return -1;
-
- return 0;
-}
-
-static int create_and_enter_userns(void)
-{
- uid_t uid;
- gid_t gid;
- char map[100];
-
- uid = getuid();
- gid = getgid();
-
- if (unshare(CLONE_NEWUSER))
- return -1;
-
- if (write_file("/proc/self/setgroups", "deny", sizeof("deny") - 1) &&
- errno != ENOENT)
- return -1;
-
- snprintf(map, sizeof(map), "0 %d 1", uid);
- if (write_file("/proc/self/uid_map", map, strlen(map)))
- return -1;
-
-
- snprintf(map, sizeof(map), "0 %d 1", gid);
- if (write_file("/proc/self/gid_map", map, strlen(map)))
- return -1;
-
- if (setgid(0))
- return -1;
-
- if (setuid(0))
- return -1;
-
- return 0;
-}
-
-typedef int (*child_callback_fn)(int);
-
-static void child(int sock_fd, struct bpffs_opts *opts, child_callback_fn callback)
-{
- LIBBPF_OPTS(bpf_map_create_opts, map_opts);
- int mnt_fd = -1, fs_fd = -1, err = 0, bpffs_fd = -1;
-
- /* setup userns with root mappings */
- err = create_and_enter_userns();
- if (!ASSERT_OK(err, "create_and_enter_userns"))
- goto cleanup;
-
- /* setup mountns to allow creating BPF FS (fsopen("bpf")) from unpriv process */
- err = unshare(CLONE_NEWNS);
- if (!ASSERT_OK(err, "create_mountns"))
- goto cleanup;
-
- err = sys_mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, 0);
- if (!ASSERT_OK(err, "remount_root"))
- goto cleanup;
-
- fs_fd = create_bpffs_fd();
- if (!ASSERT_GE(fs_fd, 0, "create_bpffs_fd")) {
- err = -EINVAL;
- goto cleanup;
- }
-
- /* ensure unprivileged child cannot set delegation options */
- err = set_delegate_mask(fs_fd, "delegate_cmds", 0x1, NULL);
- ASSERT_EQ(err, -EPERM, "delegate_cmd_eperm");
- err = set_delegate_mask(fs_fd, "delegate_maps", 0x1, NULL);
- ASSERT_EQ(err, -EPERM, "delegate_maps_eperm");
- err = set_delegate_mask(fs_fd, "delegate_progs", 0x1, NULL);
- ASSERT_EQ(err, -EPERM, "delegate_progs_eperm");
- err = set_delegate_mask(fs_fd, "delegate_attachs", 0x1, NULL);
- ASSERT_EQ(err, -EPERM, "delegate_attachs_eperm");
-
- /* pass BPF FS context object to parent */
- err = sendfd(sock_fd, fs_fd);
- if (!ASSERT_OK(err, "send_fs_fd"))
- goto cleanup;
- zclose(fs_fd);
-
- /* avoid mucking around with mount namespaces and mounting at
- * well-known path, just get detach-mounted BPF FS fd back from parent
- */
- err = recvfd(sock_fd, &mnt_fd);
- if (!ASSERT_OK(err, "recv_mnt_fd"))
- goto cleanup;
-
- /* try to fspick() BPF FS and try to add some delegation options */
- fs_fd = sys_fspick(mnt_fd, "", FSPICK_EMPTY_PATH);
- if (!ASSERT_GE(fs_fd, 0, "bpffs_fspick")) {
- err = -EINVAL;
- goto cleanup;
- }
-
- /* ensure unprivileged child cannot reconfigure to set delegation options */
- err = set_delegate_mask(fs_fd, "delegate_cmds", 0, "any");
- if (!ASSERT_EQ(err, -EPERM, "delegate_cmd_eperm_reconfig")) {
- err = -EINVAL;
- goto cleanup;
- }
- err = set_delegate_mask(fs_fd, "delegate_maps", 0, "any");
- if (!ASSERT_EQ(err, -EPERM, "delegate_maps_eperm_reconfig")) {
- err = -EINVAL;
- goto cleanup;
- }
- err = set_delegate_mask(fs_fd, "delegate_progs", 0, "any");
- if (!ASSERT_EQ(err, -EPERM, "delegate_progs_eperm_reconfig")) {
- err = -EINVAL;
- goto cleanup;
- }
- err = set_delegate_mask(fs_fd, "delegate_attachs", 0, "any");
- if (!ASSERT_EQ(err, -EPERM, "delegate_attachs_eperm_reconfig")) {
- err = -EINVAL;
- goto cleanup;
- }
- zclose(fs_fd);
-
- bpffs_fd = openat(mnt_fd, ".", 0, O_RDWR);
- if (!ASSERT_GE(bpffs_fd, 0, "bpffs_open")) {
- err = -EINVAL;
- goto cleanup;
- }
-
- /* do custom test logic with customly set up BPF FS instance */
- err = callback(bpffs_fd);
- if (!ASSERT_OK(err, "test_callback"))
- goto cleanup;
-
- err = 0;
-cleanup:
- zclose(sock_fd);
- zclose(mnt_fd);
- zclose(fs_fd);
- zclose(bpffs_fd);
-
- exit(-err);
-}
-
-static int wait_for_pid(pid_t pid)
-{
- int status, ret;
-
-again:
- ret = waitpid(pid, &status, 0);
- if (ret == -1) {
- if (errno == EINTR)
- goto again;
-
- return -1;
- }
-
- if (!WIFEXITED(status))
- return -1;
-
- return WEXITSTATUS(status);
-}
-
-static void parent(int child_pid, struct bpffs_opts *bpffs_opts, int sock_fd)
-{
- int fs_fd = -1, mnt_fd = -1, err;
-
- err = recvfd(sock_fd, &fs_fd);
- if (!ASSERT_OK(err, "recv_bpffs_fd"))
- goto cleanup;
-
- mnt_fd = materialize_bpffs_fd(fs_fd, bpffs_opts);
- if (!ASSERT_GE(mnt_fd, 0, "materialize_bpffs_fd")) {
- err = -EINVAL;
- goto cleanup;
- }
- zclose(fs_fd);
-
- /* pass BPF FS context object to parent */
- err = sendfd(sock_fd, mnt_fd);
- if (!ASSERT_OK(err, "send_mnt_fd"))
- goto cleanup;
- zclose(mnt_fd);
-
- err = wait_for_pid(child_pid);
- ASSERT_OK(err, "waitpid_child");
-
-cleanup:
- zclose(sock_fd);
- zclose(fs_fd);
- zclose(mnt_fd);
-
- if (child_pid > 0)
- (void)kill(child_pid, SIGKILL);
-}
-
-static void subtest_userns(struct bpffs_opts *bpffs_opts, child_callback_fn cb)
-{
- int sock_fds[2] = { -1, -1 };
- int child_pid = 0, err;
-
- err = socketpair(AF_UNIX, SOCK_STREAM, 0, sock_fds);
- if (!ASSERT_OK(err, "socketpair"))
- goto cleanup;
-
- child_pid = fork();
- if (!ASSERT_GE(child_pid, 0, "fork"))
- goto cleanup;
-
- if (child_pid == 0) {
- zclose(sock_fds[0]);
- return child(sock_fds[1], bpffs_opts, cb);
-
- } else {
- zclose(sock_fds[1]);
- return parent(child_pid, bpffs_opts, sock_fds[0]);
- }
-
-cleanup:
- zclose(sock_fds[0]);
- zclose(sock_fds[1]);
- if (child_pid > 0)
- (void)kill(child_pid, SIGKILL);
-}
-
-static int userns_map_create(int mnt_fd)
-{
- LIBBPF_OPTS(bpf_map_create_opts, map_opts);
- int err, token_fd = -1, map_fd = -1;
- __u64 old_caps = 0;
-
- /* create BPF token from BPF FS mount */
- token_fd = bpf_token_create(mnt_fd, NULL);
- if (!ASSERT_GT(token_fd, 0, "token_create")) {
- err = -EINVAL;
- goto cleanup;
- }
-
- /* while inside non-init userns, we need both a BPF token *and*
- * CAP_BPF inside current userns to create privileged map; let's test
- * that neither BPF token alone nor namespaced CAP_BPF is sufficient
- */
- err = drop_priv_caps(&old_caps);
- if (!ASSERT_OK(err, "drop_caps"))
- goto cleanup;
-
- /* no token, no CAP_BPF -> fail */
- map_opts.token_fd = 0;
- map_fd = bpf_map_create(BPF_MAP_TYPE_STACK, "wo_token_wo_bpf", 0, 8, 1, &map_opts);
- if (!ASSERT_LT(map_fd, 0, "stack_map_wo_token_wo_cap_bpf_should_fail")) {
- err = -EINVAL;
- goto cleanup;
- }
-
- /* token without CAP_BPF -> fail */
- map_opts.token_fd = token_fd;
- map_fd = bpf_map_create(BPF_MAP_TYPE_STACK, "w_token_wo_bpf", 0, 8, 1, &map_opts);
- if (!ASSERT_LT(map_fd, 0, "stack_map_w_token_wo_cap_bpf_should_fail")) {
- err = -EINVAL;
- goto cleanup;
- }
-
- /* get back effective local CAP_BPF (and CAP_SYS_ADMIN) */
- err = restore_priv_caps(old_caps);
- if (!ASSERT_OK(err, "restore_caps"))
- goto cleanup;
-
- /* CAP_BPF without token -> fail */
- map_opts.token_fd = 0;
- map_fd = bpf_map_create(BPF_MAP_TYPE_STACK, "wo_token_w_bpf", 0, 8, 1, &map_opts);
- if (!ASSERT_LT(map_fd, 0, "stack_map_wo_token_w_cap_bpf_should_fail")) {
- err = -EINVAL;
- goto cleanup;
- }
-
- /* finally, namespaced CAP_BPF + token -> success */
- map_opts.token_fd = token_fd;
- map_fd = bpf_map_create(BPF_MAP_TYPE_STACK, "w_token_w_bpf", 0, 8, 1, &map_opts);
- if (!ASSERT_GT(map_fd, 0, "stack_map_w_token_w_cap_bpf")) {
- err = -EINVAL;
- goto cleanup;
- }
-
-cleanup:
- zclose(token_fd);
- zclose(map_fd);
- return err;
-}
-
-static int userns_btf_load(int mnt_fd)
-{
- LIBBPF_OPTS(bpf_btf_load_opts, btf_opts);
- int err, token_fd = -1, btf_fd = -1;
- const void *raw_btf_data;
- struct btf *btf = NULL;
- __u32 raw_btf_size;
- __u64 old_caps = 0;
-
- /* create BPF token from BPF FS mount */
- token_fd = bpf_token_create(mnt_fd, NULL);
- if (!ASSERT_GT(token_fd, 0, "token_create")) {
- err = -EINVAL;
- goto cleanup;
- }
-
- /* while inside non-init userns, we need both a BPF token *and*
- * CAP_BPF inside current userns to create privileged map; let's test
- * that neither BPF token alone nor namespaced CAP_BPF is sufficient
- */
- err = drop_priv_caps(&old_caps);
- if (!ASSERT_OK(err, "drop_caps"))
- goto cleanup;
-
- /* setup a trivial BTF data to load to the kernel */
- btf = btf__new_empty();
- if (!ASSERT_OK_PTR(btf, "empty_btf"))
- goto cleanup;
-
- ASSERT_GT(btf__add_int(btf, "int", 4, 0), 0, "int_type");
-
- raw_btf_data = btf__raw_data(btf, &raw_btf_size);
- if (!ASSERT_OK_PTR(raw_btf_data, "raw_btf_data"))
- goto cleanup;
-
- /* no token + no CAP_BPF -> failure */
- btf_opts.token_fd = 0;
- btf_fd = bpf_btf_load(raw_btf_data, raw_btf_size, &btf_opts);
- if (!ASSERT_LT(btf_fd, 0, "no_token_no_cap_should_fail"))
- goto cleanup;
-
- /* token + no CAP_BPF -> failure */
- btf_opts.token_fd = token_fd;
- btf_fd = bpf_btf_load(raw_btf_data, raw_btf_size, &btf_opts);
- if (!ASSERT_LT(btf_fd, 0, "token_no_cap_should_fail"))
- goto cleanup;
-
- /* get back effective local CAP_BPF (and CAP_SYS_ADMIN) */
- err = restore_priv_caps(old_caps);
- if (!ASSERT_OK(err, "restore_caps"))
- goto cleanup;
-
- /* token + CAP_BPF -> success */
- btf_opts.token_fd = token_fd;
- btf_fd = bpf_btf_load(raw_btf_data, raw_btf_size, &btf_opts);
- if (!ASSERT_GT(btf_fd, 0, "token_and_cap_success"))
- goto cleanup;
-
- err = 0;
-cleanup:
- btf__free(btf);
- zclose(btf_fd);
- zclose(token_fd);
- return err;
-}
-
-static int userns_prog_load(int mnt_fd)
-{
- LIBBPF_OPTS(bpf_prog_load_opts, prog_opts);
- int err, token_fd = -1, prog_fd = -1;
- struct bpf_insn insns[] = {
- /* bpf_jiffies64() requires CAP_BPF */
- BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_jiffies64),
- /* bpf_get_current_task() requires CAP_PERFMON */
- BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_current_task),
- /* r0 = 0; exit; */
- BPF_MOV64_IMM(BPF_REG_0, 0),
- BPF_EXIT_INSN(),
- };
- size_t insn_cnt = ARRAY_SIZE(insns);
- __u64 old_caps = 0;
-
- /* create BPF token from BPF FS mount */
- token_fd = bpf_token_create(mnt_fd, NULL);
- if (!ASSERT_GT(token_fd, 0, "token_create")) {
- err = -EINVAL;
- goto cleanup;
- }
-
- /* validate we can successfully load BPF program with token; this
- * being XDP program (CAP_NET_ADMIN) using bpf_jiffies64() (CAP_BPF)
- * and bpf_get_current_task() (CAP_PERFMON) helpers validates we have
- * BPF token wired properly in a bunch of places in the kernel
- */
- prog_opts.token_fd = token_fd;
- prog_opts.expected_attach_type = BPF_XDP;
- prog_fd = bpf_prog_load(BPF_PROG_TYPE_XDP, "token_prog", "GPL",
- insns, insn_cnt, &prog_opts);
- if (!ASSERT_GT(prog_fd, 0, "prog_fd")) {
- err = -EPERM;
- goto cleanup;
- }
-
- /* no token + caps -> failure */
- prog_opts.token_fd = 0;
- prog_fd = bpf_prog_load(BPF_PROG_TYPE_XDP, "token_prog", "GPL",
- insns, insn_cnt, &prog_opts);
- if (!ASSERT_EQ(prog_fd, -EPERM, "prog_fd_eperm")) {
- err = -EPERM;
- goto cleanup;
- }
-
- err = drop_priv_caps(&old_caps);
- if (!ASSERT_OK(err, "drop_caps"))
- goto cleanup;
-
- /* no caps + token -> failure */
- prog_opts.token_fd = token_fd;
- prog_fd = bpf_prog_load(BPF_PROG_TYPE_XDP, "token_prog", "GPL",
- insns, insn_cnt, &prog_opts);
- if (!ASSERT_EQ(prog_fd, -EPERM, "prog_fd_eperm")) {
- err = -EPERM;
- goto cleanup;
- }
-
- /* no caps + no token -> definitely a failure */
- prog_opts.token_fd = 0;
- prog_fd = bpf_prog_load(BPF_PROG_TYPE_XDP, "token_prog", "GPL",
- insns, insn_cnt, &prog_opts);
- if (!ASSERT_EQ(prog_fd, -EPERM, "prog_fd_eperm")) {
- err = -EPERM;
- goto cleanup;
- }
-
- err = 0;
-cleanup:
- zclose(prog_fd);
- zclose(token_fd);
- return err;
-}
-
-static int userns_obj_priv_map(int mnt_fd)
-{
- LIBBPF_OPTS(bpf_object_open_opts, opts);
- char buf[256];
- struct priv_map *skel;
- int err, token_fd;
-
- skel = priv_map__open_and_load();
- if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load")) {
- priv_map__destroy(skel);
- return -EINVAL;
- }
-
- /* use bpf_token_path to provide BPF FS path */
- snprintf(buf, sizeof(buf), "/proc/self/fd/%d", mnt_fd);
- opts.bpf_token_path = buf;
- skel = priv_map__open_opts(&opts);
- if (!ASSERT_OK_PTR(skel, "obj_token_path_open"))
- return -EINVAL;
-
- err = priv_map__load(skel);
- priv_map__destroy(skel);
- if (!ASSERT_OK(err, "obj_token_path_load"))
- return -EINVAL;
-
- /* create token and pass it through bpf_token_fd */
- token_fd = bpf_token_create(mnt_fd, NULL);
- if (!ASSERT_GT(token_fd, 0, "create_token"))
- return -EINVAL;
-
- opts.bpf_token_path = NULL;
- opts.bpf_token_fd = token_fd;
- skel = priv_map__open_opts(&opts);
- if (!ASSERT_OK_PTR(skel, "obj_token_fd_open"))
- return -EINVAL;
-
- /* we can close our token FD, bpf_object owns dup()'ed FD now */
- close(token_fd);
-
- err = priv_map__load(skel);
- priv_map__destroy(skel);
- if (!ASSERT_OK(err, "obj_token_fd_load"))
- return -EINVAL;
-
- return 0;
-}
-
-static int userns_obj_priv_prog(int mnt_fd)
-{
- LIBBPF_OPTS(bpf_object_open_opts, opts);
- char buf[256];
- struct priv_prog *skel;
- int err;
-
- skel = priv_prog__open_and_load();
- if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load")) {
- priv_prog__destroy(skel);
- return -EINVAL;
- }
-
- /* use bpf_token_path to provide BPF FS path */
- snprintf(buf, sizeof(buf), "/proc/self/fd/%d", mnt_fd);
- opts.bpf_token_path = buf;
- skel = priv_prog__open_opts(&opts);
- if (!ASSERT_OK_PTR(skel, "obj_token_path_open"))
- return -EINVAL;
-
- err = priv_prog__load(skel);
- priv_prog__destroy(skel);
- if (!ASSERT_OK(err, "obj_token_path_load"))
- return -EINVAL;
-
- return 0;
-}
-
-/* this test is called with BPF FS that doesn't delegate BPF_BTF_LOAD command,
- * which should cause struct_ops application to fail, as BTF won't be uploaded
- * into the kernel, even if STRUCT_OPS programs themselves are allowed
- */
-static int validate_struct_ops_load(int mnt_fd, bool expect_success)
-{
- LIBBPF_OPTS(bpf_object_open_opts, opts);
- char buf[256];
- struct dummy_st_ops_success *skel;
- int err;
-
- snprintf(buf, sizeof(buf), "/proc/self/fd/%d", mnt_fd);
- opts.bpf_token_path = buf;
- skel = dummy_st_ops_success__open_opts(&opts);
- if (!ASSERT_OK_PTR(skel, "obj_token_path_open"))
- return -EINVAL;
-
- err = dummy_st_ops_success__load(skel);
- dummy_st_ops_success__destroy(skel);
- if (expect_success) {
- if (!ASSERT_OK(err, "obj_token_path_load"))
- return -EINVAL;
- } else /* expect failure */ {
- if (!ASSERT_ERR(err, "obj_token_path_load"))
- return -EINVAL;
- }
-
- return 0;
-}
-
-static int userns_obj_priv_btf_fail(int mnt_fd)
-{
- return validate_struct_ops_load(mnt_fd, false /* should fail */);
-}
-
-static int userns_obj_priv_btf_success(int mnt_fd)
-{
- return validate_struct_ops_load(mnt_fd, true /* should succeed */);
-}
-
-#define TOKEN_ENVVAR "LIBBPF_BPF_TOKEN_PATH"
-#define TOKEN_BPFFS_CUSTOM "/bpf-token-fs"
-
-static int userns_obj_priv_implicit_token(int mnt_fd)
-{
- LIBBPF_OPTS(bpf_object_open_opts, opts);
- struct dummy_st_ops_success *skel;
- int err;
-
- /* before we mount BPF FS with token delegation, struct_ops skeleton
- * should fail to load
- */
- skel = dummy_st_ops_success__open_and_load();
- if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load")) {
- dummy_st_ops_success__destroy(skel);
- return -EINVAL;
- }
-
- /* mount custom BPF FS over /sys/fs/bpf so that libbpf can create BPF
- * token automatically and implicitly
- */
- err = sys_move_mount(mnt_fd, "", AT_FDCWD, "/sys/fs/bpf", MOVE_MOUNT_F_EMPTY_PATH);
- if (!ASSERT_OK(err, "move_mount_bpffs"))
- return -EINVAL;
-
- /* disable implicit BPF token creation by setting
- * LIBBPF_BPF_TOKEN_PATH envvar to empty value, load should fail
- */
- err = setenv(TOKEN_ENVVAR, "", 1 /*overwrite*/);
- if (!ASSERT_OK(err, "setenv_token_path"))
- return -EINVAL;
- skel = dummy_st_ops_success__open_and_load();
- if (!ASSERT_ERR_PTR(skel, "obj_token_envvar_disabled_load")) {
- unsetenv(TOKEN_ENVVAR);
- dummy_st_ops_success__destroy(skel);
- return -EINVAL;
- }
- unsetenv(TOKEN_ENVVAR);
-
- /* now the same struct_ops skeleton should succeed thanks to libppf
- * creating BPF token from /sys/fs/bpf mount point
- */
- skel = dummy_st_ops_success__open_and_load();
- if (!ASSERT_OK_PTR(skel, "obj_implicit_token_load"))
- return -EINVAL;
-
- dummy_st_ops_success__destroy(skel);
-
- /* now disable implicit token through empty bpf_token_path, should fail */
- opts.bpf_token_path = "";
- skel = dummy_st_ops_success__open_opts(&opts);
- if (!ASSERT_OK_PTR(skel, "obj_empty_token_path_open"))
- return -EINVAL;
-
- err = dummy_st_ops_success__load(skel);
- dummy_st_ops_success__destroy(skel);
- if (!ASSERT_ERR(err, "obj_empty_token_path_load"))
- return -EINVAL;
-
- /* now disable implicit token through negative bpf_token_fd, should fail */
- opts.bpf_token_path = NULL;
- opts.bpf_token_fd = -1;
- skel = dummy_st_ops_success__open_opts(&opts);
- if (!ASSERT_OK_PTR(skel, "obj_neg_token_fd_open"))
- return -EINVAL;
-
- err = dummy_st_ops_success__load(skel);
- dummy_st_ops_success__destroy(skel);
- if (!ASSERT_ERR(err, "obj_neg_token_fd_load"))
- return -EINVAL;
-
- return 0;
-}
-
-static int userns_obj_priv_implicit_token_envvar(int mnt_fd)
-{
- LIBBPF_OPTS(bpf_object_open_opts, opts);
- struct dummy_st_ops_success *skel;
- int err;
-
- /* before we mount BPF FS with token delegation, struct_ops skeleton
- * should fail to load
- */
- skel = dummy_st_ops_success__open_and_load();
- if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load")) {
- dummy_st_ops_success__destroy(skel);
- return -EINVAL;
- }
-
- /* mount custom BPF FS over custom location, so libbpf can't create
- * BPF token implicitly, unless pointed to it through
- * LIBBPF_BPF_TOKEN_PATH envvar
- */
- rmdir(TOKEN_BPFFS_CUSTOM);
- if (!ASSERT_OK(mkdir(TOKEN_BPFFS_CUSTOM, 0777), "mkdir_bpffs_custom"))
- goto err_out;
- err = sys_move_mount(mnt_fd, "", AT_FDCWD, TOKEN_BPFFS_CUSTOM, MOVE_MOUNT_F_EMPTY_PATH);
- if (!ASSERT_OK(err, "move_mount_bpffs"))
- goto err_out;
-
- /* even though we have BPF FS with delegation, it's not at default
- * /sys/fs/bpf location, so we still fail to load until envvar is set up
- */
- skel = dummy_st_ops_success__open_and_load();
- if (!ASSERT_ERR_PTR(skel, "obj_tokenless_load2")) {
- dummy_st_ops_success__destroy(skel);
- goto err_out;
- }
-
- err = setenv(TOKEN_ENVVAR, TOKEN_BPFFS_CUSTOM, 1 /*overwrite*/);
- if (!ASSERT_OK(err, "setenv_token_path"))
- goto err_out;
-
- /* now the same struct_ops skeleton should succeed thanks to libppf
- * creating BPF token from custom mount point
- */
- skel = dummy_st_ops_success__open_and_load();
- if (!ASSERT_OK_PTR(skel, "obj_implicit_token_load"))
- goto err_out;
-
- dummy_st_ops_success__destroy(skel);
-
- /* now disable implicit token through empty bpf_token_path, envvar
- * will be ignored, should fail
- */
- opts.bpf_token_path = "";
- skel = dummy_st_ops_success__open_opts(&opts);
- if (!ASSERT_OK_PTR(skel, "obj_empty_token_path_open"))
- goto err_out;
-
- err = dummy_st_ops_success__load(skel);
- dummy_st_ops_success__destroy(skel);
- if (!ASSERT_ERR(err, "obj_empty_token_path_load"))
- goto err_out;
-
- /* now disable implicit token through negative bpf_token_fd, envvar
- * will be ignored, should fail
- */
- opts.bpf_token_path = NULL;
- opts.bpf_token_fd = -1;
- skel = dummy_st_ops_success__open_opts(&opts);
- if (!ASSERT_OK_PTR(skel, "obj_neg_token_fd_open"))
- goto err_out;
-
- err = dummy_st_ops_success__load(skel);
- dummy_st_ops_success__destroy(skel);
- if (!ASSERT_ERR(err, "obj_neg_token_fd_load"))
- goto err_out;
-
- rmdir(TOKEN_BPFFS_CUSTOM);
- unsetenv(TOKEN_ENVVAR);
- return 0;
-err_out:
- rmdir(TOKEN_BPFFS_CUSTOM);
- unsetenv(TOKEN_ENVVAR);
- return -EINVAL;
-}
-
-#define bit(n) (1ULL << (n))
-
-void test_token(void)
-{
- if (test__start_subtest("map_token")) {
- struct bpffs_opts opts = {
- .cmds_str = "map_create",
- .maps_str = "stack",
- };
-
- subtest_userns(&opts, userns_map_create);
- }
- if (test__start_subtest("btf_token")) {
- struct bpffs_opts opts = {
- .cmds = 1ULL << BPF_BTF_LOAD,
- };
-
- subtest_userns(&opts, userns_btf_load);
- }
- if (test__start_subtest("prog_token")) {
- struct bpffs_opts opts = {
- .cmds_str = "PROG_LOAD",
- .progs_str = "XDP",
- .attachs_str = "xdp",
- };
-
- subtest_userns(&opts, userns_prog_load);
- }
- if (test__start_subtest("obj_priv_map")) {
- struct bpffs_opts opts = {
- .cmds = bit(BPF_MAP_CREATE),
- .maps = bit(BPF_MAP_TYPE_QUEUE),
- };
-
- subtest_userns(&opts, userns_obj_priv_map);
- }
- if (test__start_subtest("obj_priv_prog")) {
- struct bpffs_opts opts = {
- .cmds = bit(BPF_PROG_LOAD),
- .progs = bit(BPF_PROG_TYPE_KPROBE),
- .attachs = ~0ULL,
- };
-
- subtest_userns(&opts, userns_obj_priv_prog);
- }
- if (test__start_subtest("obj_priv_btf_fail")) {
- struct bpffs_opts opts = {
- /* disallow BTF loading */
- .cmds = bit(BPF_MAP_CREATE) | bit(BPF_PROG_LOAD),
- .maps = bit(BPF_MAP_TYPE_STRUCT_OPS),
- .progs = bit(BPF_PROG_TYPE_STRUCT_OPS),
- .attachs = ~0ULL,
- };
-
- subtest_userns(&opts, userns_obj_priv_btf_fail);
- }
- if (test__start_subtest("obj_priv_btf_success")) {
- struct bpffs_opts opts = {
- /* allow BTF loading */
- .cmds = bit(BPF_BTF_LOAD) | bit(BPF_MAP_CREATE) | bit(BPF_PROG_LOAD),
- .maps = bit(BPF_MAP_TYPE_STRUCT_OPS),
- .progs = bit(BPF_PROG_TYPE_STRUCT_OPS),
- .attachs = ~0ULL,
- };
-
- subtest_userns(&opts, userns_obj_priv_btf_success);
- }
- if (test__start_subtest("obj_priv_implicit_token")) {
- struct bpffs_opts opts = {
- /* allow BTF loading */
- .cmds = bit(BPF_BTF_LOAD) | bit(BPF_MAP_CREATE) | bit(BPF_PROG_LOAD),
- .maps = bit(BPF_MAP_TYPE_STRUCT_OPS),
- .progs = bit(BPF_PROG_TYPE_STRUCT_OPS),
- .attachs = ~0ULL,
- };
-
- subtest_userns(&opts, userns_obj_priv_implicit_token);
- }
- if (test__start_subtest("obj_priv_implicit_token_envvar")) {
- struct bpffs_opts opts = {
- /* allow BTF loading */
- .cmds = bit(BPF_BTF_LOAD) | bit(BPF_MAP_CREATE) | bit(BPF_PROG_LOAD),
- .maps = bit(BPF_MAP_TYPE_STRUCT_OPS),
- .progs = bit(BPF_PROG_TYPE_STRUCT_OPS),
- .attachs = ~0ULL,
- };
-
- subtest_userns(&opts, userns_obj_priv_implicit_token_envvar);
- }
-}
+++ /dev/null
-// SPDX-License-Identifier: GPL-2.0
-/* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */
-
-#include "vmlinux.h"
-#include <bpf/bpf_helpers.h>
-
-char _license[] SEC("license") = "GPL";
-
-struct {
- __uint(type, BPF_MAP_TYPE_QUEUE);
- __uint(max_entries, 1);
- __type(value, __u32);
-} priv_map SEC(".maps");
+++ /dev/null
-// SPDX-License-Identifier: GPL-2.0
-/* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */
-
-#include "vmlinux.h"
-#include <bpf/bpf_helpers.h>
-
-char _license[] SEC("license") = "GPL";
-
-SEC("kprobe")
-int kprobe_prog(void *ctx)
-{
- return 1;
-}
projects / linux-2.6-microblaze.git / commitdiff