Skip to content

Commit 3f6719c

Browse files
sinkapborkmann
sinkap
authored and
borkmann
committed
bpf: Add bpf_bprm_opts_set helper
The helper allows modification of certain bits on the linux_binprm struct starting with the secureexec bit which can be updated using the BPF_F_BPRM_SECUREEXEC flag. secureexec can be set by the LSM for privilege gaining executions to set the AT_SECURE auxv for glibc. When set, the dynamic linker disables the use of certain environment variables (like LD_PRELOAD). Signed-off-by: KP Singh <kpsingh@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20201117232929.2156341-1-kpsingh@chromium.org
1 parent cbf398d commit 3f6719c

4 files changed

Lines changed: 60 additions & 0 deletions

File tree

‎include/uapi/linux/bpf.h‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3787,6 +3787,16 @@ union bpf_attr {
37873787
* *ARG_PTR_TO_BTF_ID* of type *task_struct*.
37883788
* Return
37893789
* Pointer to the current task.
3790+
*
3791+
* long bpf_bprm_opts_set(struct linux_binprm *bprm, u64 flags)
3792+
* Description
3793+
* Set or clear certain options on *bprm*:
3794+
*
3795+
* **BPF_F_BPRM_SECUREEXEC** Set the secureexec bit
3796+
* which sets the **AT_SECURE** auxv for glibc. The bit
3797+
* is cleared if the flag is not specified.
3798+
* Return
3799+
* **-EINVAL** if invalid *flags* are passed, zero otherwise.
37903800
*/
37913801
#define __BPF_FUNC_MAPPER(FN) \
37923802
FN(unspec), \
@@ -3948,6 +3958,7 @@ union bpf_attr {
39483958
FN(task_storage_get), \
39493959
FN(task_storage_delete), \
39503960
FN(get_current_task_btf), \
3961+
FN(bprm_opts_set), \
39513962
/* */
39523963

39533964
/* integer value in 'imm' field of BPF_CALL instruction selects which helper
@@ -4119,6 +4130,11 @@ enum bpf_lwt_encap_mode {
41194130
BPF_LWT_ENCAP_IP,
41204131
};
41214132

4133+
/* Flags for bpf_bprm_opts_set helper */
4134+
enum {
4135+
BPF_F_BPRM_SECUREEXEC = (1ULL << 0),
4136+
};
4137+
41224138
#define __bpf_md_ptr(type, name) \
41234139
union { \
41244140
type name; \

‎kernel/bpf/bpf_lsm.c‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
#include <linux/filter.h>
88
#include <linux/bpf.h>
99
#include <linux/btf.h>
10+
#include <linux/binfmts.h>
1011
#include <linux/lsm_hooks.h>
1112
#include <linux/bpf_lsm.h>
1213
#include <linux/kallsyms.h>
@@ -51,6 +52,29 @@ int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
5152
return 0;
5253
}
5354

55+
/* Mask for all the currently supported BPRM option flags */
56+
#define BPF_F_BRPM_OPTS_MASK BPF_F_BPRM_SECUREEXEC
57+
58+
BPF_CALL_2(bpf_bprm_opts_set, struct linux_binprm *, bprm, u64, flags)
59+
{
60+
if (flags & ~BPF_F_BRPM_OPTS_MASK)
61+
return -EINVAL;
62+
63+
bprm->secureexec = (flags & BPF_F_BPRM_SECUREEXEC);
64+
return 0;
65+
}
66+
67+
BTF_ID_LIST_SINGLE(bpf_bprm_opts_set_btf_ids, struct, linux_binprm)
68+
69+
const static struct bpf_func_proto bpf_bprm_opts_set_proto = {
70+
.func = bpf_bprm_opts_set,
71+
.gpl_only = false,
72+
.ret_type = RET_INTEGER,
73+
.arg1_type = ARG_PTR_TO_BTF_ID,
74+
.arg1_btf_id = &bpf_bprm_opts_set_btf_ids[0],
75+
.arg2_type = ARG_ANYTHING,
76+
};
77+
5478
static const struct bpf_func_proto *
5579
bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
5680
{
@@ -71,6 +95,8 @@ bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
7195
return &bpf_task_storage_get_proto;
7296
case BPF_FUNC_task_storage_delete:
7397
return &bpf_task_storage_delete_proto;
98+
case BPF_FUNC_bprm_opts_set:
99+
return &bpf_bprm_opts_set_proto;
74100
default:
75101
return tracing_prog_func_proto(func_id, prog);
76102
}

‎scripts/bpf_helpers_doc.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -418,6 +418,7 @@ class PrinterHelpers(Printer):
418418
'struct bpf_tcp_sock',
419419
'struct bpf_tunnel_key',
420420
'struct bpf_xfrm_state',
421+
'struct linux_binprm',
421422
'struct pt_regs',
422423
'struct sk_reuseport_md',
423424
'struct sockaddr',
@@ -465,6 +466,7 @@ class PrinterHelpers(Printer):
465466
'struct bpf_tcp_sock',
466467
'struct bpf_tunnel_key',
467468
'struct bpf_xfrm_state',
469+
'struct linux_binprm',
468470
'struct pt_regs',
469471
'struct sk_reuseport_md',
470472
'struct sockaddr',

‎tools/include/uapi/linux/bpf.h‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3787,6 +3787,16 @@ union bpf_attr {
37873787
* *ARG_PTR_TO_BTF_ID* of type *task_struct*.
37883788
* Return
37893789
* Pointer to the current task.
3790+
*
3791+
* long bpf_bprm_opts_set(struct linux_binprm *bprm, u64 flags)
3792+
* Description
3793+
* Set or clear certain options on *bprm*:
3794+
*
3795+
* **BPF_F_BPRM_SECUREEXEC** Set the secureexec bit
3796+
* which sets the **AT_SECURE** auxv for glibc. The bit
3797+
* is cleared if the flag is not specified.
3798+
* Return
3799+
* **-EINVAL** if invalid *flags* are passed, zero otherwise.
37903800
*/
37913801
#define __BPF_FUNC_MAPPER(FN) \
37923802
FN(unspec), \
@@ -3948,6 +3958,7 @@ union bpf_attr {
39483958
FN(task_storage_get), \
39493959
FN(task_storage_delete), \
39503960
FN(get_current_task_btf), \
3961+
FN(bprm_opts_set), \
39513962
/* */
39523963

39533964
/* integer value in 'imm' field of BPF_CALL instruction selects which helper
@@ -4119,6 +4130,11 @@ enum bpf_lwt_encap_mode {
41194130
BPF_LWT_ENCAP_IP,
41204131
};
41214132

4133+
/* Flags for bpf_bprm_opts_set helper */
4134+
enum {
4135+
BPF_F_BPRM_SECUREEXEC = (1ULL << 0),
4136+
};
4137+
41224138
#define __bpf_md_ptr(type, name) \
41234139
union { \
41244140
type name; \

0 commit comments

Comments
 (0)