1fc611f47SKP Singh // SPDX-License-Identifier: GPL-2.0 2fc611f47SKP Singh 3fc611f47SKP Singh /* 4fc611f47SKP Singh * Copyright (C) 2020 Google LLC. 5fc611f47SKP Singh */ 6fc611f47SKP Singh 7fc611f47SKP Singh #include <linux/filter.h> 8fc611f47SKP Singh #include <linux/bpf.h> 9fc611f47SKP Singh #include <linux/btf.h> 103f6719c7SKP Singh #include <linux/binfmts.h> 119d3fdea7SKP Singh #include <linux/lsm_hooks.h> 129d3fdea7SKP Singh #include <linux/bpf_lsm.h> 139e4e01dfSKP Singh #include <linux/kallsyms.h> 149e4e01dfSKP Singh #include <linux/bpf_verifier.h> 1530897832SKP Singh #include <net/bpf_sk_storage.h> 1630897832SKP Singh #include <linux/bpf_local_storage.h> 176f64e477SKP Singh #include <linux/btf_ids.h> 1827672f0dSKP Singh #include <linux/ima.h> 1969fd337aSStanislav Fomichev #include <linux/bpf-cgroup.h> 209d3fdea7SKP Singh 219d3fdea7SKP Singh /* For every LSM hook that allows attachment of BPF programs, declare a nop 229d3fdea7SKP Singh * function where a BPF program can be attached. 239d3fdea7SKP Singh */ 249d3fdea7SKP Singh #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ 259d3fdea7SKP Singh noinline RET bpf_lsm_##NAME(__VA_ARGS__) \ 269d3fdea7SKP Singh { \ 279d3fdea7SKP Singh return DEFAULT; \ 289d3fdea7SKP Singh } 299d3fdea7SKP Singh 309d3fdea7SKP Singh #include <linux/lsm_hook_defs.h> 319d3fdea7SKP Singh #undef LSM_HOOK 32fc611f47SKP Singh 336f64e477SKP Singh #define LSM_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME) 346f64e477SKP Singh BTF_SET_START(bpf_lsm_hooks) 356f64e477SKP Singh #include <linux/lsm_hook_defs.h> 366f64e477SKP Singh #undef LSM_HOOK 376f64e477SKP Singh BTF_SET_END(bpf_lsm_hooks) 389e4e01dfSKP Singh 3969fd337aSStanislav Fomichev /* List of LSM hooks that should operate on 'current' cgroup regardless 4069fd337aSStanislav Fomichev * of function signature. 4169fd337aSStanislav Fomichev */ 4269fd337aSStanislav Fomichev BTF_SET_START(bpf_lsm_current_hooks) 4369fd337aSStanislav Fomichev /* operate on freshly allocated sk without any cgroup association */ 4469fd337aSStanislav Fomichev BTF_ID(func, bpf_lsm_sk_alloc_security) 4569fd337aSStanislav Fomichev BTF_ID(func, bpf_lsm_sk_free_security) 4669fd337aSStanislav Fomichev BTF_SET_END(bpf_lsm_current_hooks) 4769fd337aSStanislav Fomichev 489113d7e4SStanislav Fomichev /* List of LSM hooks that trigger while the socket is properly locked. 499113d7e4SStanislav Fomichev */ 509113d7e4SStanislav Fomichev BTF_SET_START(bpf_lsm_locked_sockopt_hooks) 519113d7e4SStanislav Fomichev BTF_ID(func, bpf_lsm_socket_sock_rcv_skb) 529113d7e4SStanislav Fomichev BTF_ID(func, bpf_lsm_sock_graft) 539113d7e4SStanislav Fomichev BTF_ID(func, bpf_lsm_inet_csk_clone) 549113d7e4SStanislav Fomichev BTF_ID(func, bpf_lsm_inet_conn_established) 559113d7e4SStanislav Fomichev BTF_SET_END(bpf_lsm_locked_sockopt_hooks) 569113d7e4SStanislav Fomichev 579113d7e4SStanislav Fomichev /* List of LSM hooks that trigger while the socket is _not_ locked, 589113d7e4SStanislav Fomichev * but it's ok to call bpf_{g,s}etsockopt because the socket is still 599113d7e4SStanislav Fomichev * in the early init phase. 609113d7e4SStanislav Fomichev */ 619113d7e4SStanislav Fomichev BTF_SET_START(bpf_lsm_unlocked_sockopt_hooks) 629113d7e4SStanislav Fomichev BTF_ID(func, bpf_lsm_socket_post_create) 639113d7e4SStanislav Fomichev BTF_ID(func, bpf_lsm_socket_socketpair) 649113d7e4SStanislav Fomichev BTF_SET_END(bpf_lsm_unlocked_sockopt_hooks) 659113d7e4SStanislav Fomichev 663908fcddSStanislav Fomichev #ifdef CONFIG_CGROUP_BPF 6769fd337aSStanislav Fomichev void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, 6869fd337aSStanislav Fomichev bpf_func_t *bpf_func) 6969fd337aSStanislav Fomichev { 703908fcddSStanislav Fomichev const struct btf_param *args __maybe_unused; 7169fd337aSStanislav Fomichev 7269fd337aSStanislav Fomichev if (btf_type_vlen(prog->aux->attach_func_proto) < 1 || 7369fd337aSStanislav Fomichev btf_id_set_contains(&bpf_lsm_current_hooks, 7469fd337aSStanislav Fomichev prog->aux->attach_btf_id)) { 7569fd337aSStanislav Fomichev *bpf_func = __cgroup_bpf_run_lsm_current; 7669fd337aSStanislav Fomichev return; 7769fd337aSStanislav Fomichev } 7869fd337aSStanislav Fomichev 793908fcddSStanislav Fomichev #ifdef CONFIG_NET 8069fd337aSStanislav Fomichev args = btf_params(prog->aux->attach_func_proto); 8169fd337aSStanislav Fomichev 8269fd337aSStanislav Fomichev if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCKET]) 8369fd337aSStanislav Fomichev *bpf_func = __cgroup_bpf_run_lsm_socket; 8469fd337aSStanislav Fomichev else if (args[0].type == btf_sock_ids[BTF_SOCK_TYPE_SOCK]) 8569fd337aSStanislav Fomichev *bpf_func = __cgroup_bpf_run_lsm_sock; 8669fd337aSStanislav Fomichev else 8769fd337aSStanislav Fomichev #endif 8869fd337aSStanislav Fomichev *bpf_func = __cgroup_bpf_run_lsm_current; 8969fd337aSStanislav Fomichev } 903908fcddSStanislav Fomichev #endif 9169fd337aSStanislav Fomichev 929e4e01dfSKP Singh int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, 939e4e01dfSKP Singh const struct bpf_prog *prog) 949e4e01dfSKP Singh { 959e4e01dfSKP Singh if (!prog->gpl_compatible) { 969e4e01dfSKP Singh bpf_log(vlog, 979e4e01dfSKP Singh "LSM programs must have a GPL compatible license\n"); 989e4e01dfSKP Singh return -EINVAL; 999e4e01dfSKP Singh } 1009e4e01dfSKP Singh 1016f64e477SKP Singh if (!btf_id_set_contains(&bpf_lsm_hooks, prog->aux->attach_btf_id)) { 1029e4e01dfSKP Singh bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n", 1039e4e01dfSKP Singh prog->aux->attach_btf_id, prog->aux->attach_func_name); 1049e4e01dfSKP Singh return -EINVAL; 1059e4e01dfSKP Singh } 1069e4e01dfSKP Singh 1079e4e01dfSKP Singh return 0; 1089e4e01dfSKP Singh } 1099e4e01dfSKP Singh 1103f6719c7SKP Singh /* Mask for all the currently supported BPRM option flags */ 1113f6719c7SKP Singh #define BPF_F_BRPM_OPTS_MASK BPF_F_BPRM_SECUREEXEC 1123f6719c7SKP Singh 1133f6719c7SKP Singh BPF_CALL_2(bpf_bprm_opts_set, struct linux_binprm *, bprm, u64, flags) 1143f6719c7SKP Singh { 1153f6719c7SKP Singh if (flags & ~BPF_F_BRPM_OPTS_MASK) 1163f6719c7SKP Singh return -EINVAL; 1173f6719c7SKP Singh 1183f6719c7SKP Singh bprm->secureexec = (flags & BPF_F_BPRM_SECUREEXEC); 1193f6719c7SKP Singh return 0; 1203f6719c7SKP Singh } 1213f6719c7SKP Singh 1223f6719c7SKP Singh BTF_ID_LIST_SINGLE(bpf_bprm_opts_set_btf_ids, struct, linux_binprm) 1233f6719c7SKP Singh 124e2c69f3aSArnd Bergmann static const struct bpf_func_proto bpf_bprm_opts_set_proto = { 1253f6719c7SKP Singh .func = bpf_bprm_opts_set, 1263f6719c7SKP Singh .gpl_only = false, 1273f6719c7SKP Singh .ret_type = RET_INTEGER, 1283f6719c7SKP Singh .arg1_type = ARG_PTR_TO_BTF_ID, 1293f6719c7SKP Singh .arg1_btf_id = &bpf_bprm_opts_set_btf_ids[0], 1303f6719c7SKP Singh .arg2_type = ARG_ANYTHING, 1313f6719c7SKP Singh }; 1323f6719c7SKP Singh 13327672f0dSKP Singh BPF_CALL_3(bpf_ima_inode_hash, struct inode *, inode, void *, dst, u32, size) 13427672f0dSKP Singh { 13527672f0dSKP Singh return ima_inode_hash(inode, dst, size); 13627672f0dSKP Singh } 13727672f0dSKP Singh 13827672f0dSKP Singh static bool bpf_ima_inode_hash_allowed(const struct bpf_prog *prog) 13927672f0dSKP Singh { 14027672f0dSKP Singh return bpf_lsm_is_sleepable_hook(prog->aux->attach_btf_id); 14127672f0dSKP Singh } 14227672f0dSKP Singh 14327672f0dSKP Singh BTF_ID_LIST_SINGLE(bpf_ima_inode_hash_btf_ids, struct, inode) 14427672f0dSKP Singh 145e2c69f3aSArnd Bergmann static const struct bpf_func_proto bpf_ima_inode_hash_proto = { 14627672f0dSKP Singh .func = bpf_ima_inode_hash, 14727672f0dSKP Singh .gpl_only = false, 14827672f0dSKP Singh .ret_type = RET_INTEGER, 14927672f0dSKP Singh .arg1_type = ARG_PTR_TO_BTF_ID, 15027672f0dSKP Singh .arg1_btf_id = &bpf_ima_inode_hash_btf_ids[0], 15127672f0dSKP Singh .arg2_type = ARG_PTR_TO_UNINIT_MEM, 15227672f0dSKP Singh .arg3_type = ARG_CONST_SIZE, 15327672f0dSKP Singh .allowed = bpf_ima_inode_hash_allowed, 15427672f0dSKP Singh }; 15527672f0dSKP Singh 156174b1694SRoberto Sassu BPF_CALL_3(bpf_ima_file_hash, struct file *, file, void *, dst, u32, size) 157174b1694SRoberto Sassu { 158174b1694SRoberto Sassu return ima_file_hash(file, dst, size); 159174b1694SRoberto Sassu } 160174b1694SRoberto Sassu 161174b1694SRoberto Sassu BTF_ID_LIST_SINGLE(bpf_ima_file_hash_btf_ids, struct, file) 162174b1694SRoberto Sassu 163174b1694SRoberto Sassu static const struct bpf_func_proto bpf_ima_file_hash_proto = { 164174b1694SRoberto Sassu .func = bpf_ima_file_hash, 165174b1694SRoberto Sassu .gpl_only = false, 166174b1694SRoberto Sassu .ret_type = RET_INTEGER, 167174b1694SRoberto Sassu .arg1_type = ARG_PTR_TO_BTF_ID, 168174b1694SRoberto Sassu .arg1_btf_id = &bpf_ima_file_hash_btf_ids[0], 169174b1694SRoberto Sassu .arg2_type = ARG_PTR_TO_UNINIT_MEM, 170174b1694SRoberto Sassu .arg3_type = ARG_CONST_SIZE, 171174b1694SRoberto Sassu .allowed = bpf_ima_inode_hash_allowed, 172174b1694SRoberto Sassu }; 173174b1694SRoberto Sassu 1742fcc8241SKui-Feng Lee BPF_CALL_1(bpf_get_attach_cookie, void *, ctx) 1752fcc8241SKui-Feng Lee { 1762fcc8241SKui-Feng Lee struct bpf_trace_run_ctx *run_ctx; 1772fcc8241SKui-Feng Lee 1782fcc8241SKui-Feng Lee run_ctx = container_of(current->bpf_ctx, struct bpf_trace_run_ctx, run_ctx); 1792fcc8241SKui-Feng Lee return run_ctx->bpf_cookie; 1802fcc8241SKui-Feng Lee } 1812fcc8241SKui-Feng Lee 1822fcc8241SKui-Feng Lee static const struct bpf_func_proto bpf_get_attach_cookie_proto = { 1832fcc8241SKui-Feng Lee .func = bpf_get_attach_cookie, 1842fcc8241SKui-Feng Lee .gpl_only = false, 1852fcc8241SKui-Feng Lee .ret_type = RET_INTEGER, 1862fcc8241SKui-Feng Lee .arg1_type = ARG_PTR_TO_CTX, 1872fcc8241SKui-Feng Lee }; 1882fcc8241SKui-Feng Lee 18930897832SKP Singh static const struct bpf_func_proto * 19030897832SKP Singh bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) 19130897832SKP Singh { 19230897832SKP Singh switch (func_id) { 19330897832SKP Singh case BPF_FUNC_inode_storage_get: 19430897832SKP Singh return &bpf_inode_storage_get_proto; 19530897832SKP Singh case BPF_FUNC_inode_storage_delete: 19630897832SKP Singh return &bpf_inode_storage_delete_proto; 1975c9d706fSDaniel Borkmann #ifdef CONFIG_NET 19830897832SKP Singh case BPF_FUNC_sk_storage_get: 199592a3498SMartin KaFai Lau return &bpf_sk_storage_get_proto; 20030897832SKP Singh case BPF_FUNC_sk_storage_delete: 201592a3498SMartin KaFai Lau return &bpf_sk_storage_delete_proto; 2025c9d706fSDaniel Borkmann #endif /* CONFIG_NET */ 2039e7a4d98SKP Singh case BPF_FUNC_spin_lock: 2049e7a4d98SKP Singh return &bpf_spin_lock_proto; 2059e7a4d98SKP Singh case BPF_FUNC_spin_unlock: 2069e7a4d98SKP Singh return &bpf_spin_unlock_proto; 2073f6719c7SKP Singh case BPF_FUNC_bprm_opts_set: 2083f6719c7SKP Singh return &bpf_bprm_opts_set_proto; 20927672f0dSKP Singh case BPF_FUNC_ima_inode_hash: 21027672f0dSKP Singh return prog->aux->sleepable ? &bpf_ima_inode_hash_proto : NULL; 211174b1694SRoberto Sassu case BPF_FUNC_ima_file_hash: 212174b1694SRoberto Sassu return prog->aux->sleepable ? &bpf_ima_file_hash_proto : NULL; 2132fcc8241SKui-Feng Lee case BPF_FUNC_get_attach_cookie: 2142fcc8241SKui-Feng Lee return bpf_prog_has_trampoline(prog) ? &bpf_get_attach_cookie_proto : NULL; 21569fd337aSStanislav Fomichev case BPF_FUNC_get_local_storage: 21669fd337aSStanislav Fomichev return prog->expected_attach_type == BPF_LSM_CGROUP ? 21769fd337aSStanislav Fomichev &bpf_get_local_storage_proto : NULL; 21869fd337aSStanislav Fomichev case BPF_FUNC_set_retval: 21969fd337aSStanislav Fomichev return prog->expected_attach_type == BPF_LSM_CGROUP ? 22069fd337aSStanislav Fomichev &bpf_set_retval_proto : NULL; 22169fd337aSStanislav Fomichev case BPF_FUNC_get_retval: 22269fd337aSStanislav Fomichev return prog->expected_attach_type == BPF_LSM_CGROUP ? 22369fd337aSStanislav Fomichev &bpf_get_retval_proto : NULL; 2243908fcddSStanislav Fomichev #ifdef CONFIG_NET 2259113d7e4SStanislav Fomichev case BPF_FUNC_setsockopt: 2269113d7e4SStanislav Fomichev if (prog->expected_attach_type != BPF_LSM_CGROUP) 2279113d7e4SStanislav Fomichev return NULL; 2289113d7e4SStanislav Fomichev if (btf_id_set_contains(&bpf_lsm_locked_sockopt_hooks, 2299113d7e4SStanislav Fomichev prog->aux->attach_btf_id)) 2309113d7e4SStanislav Fomichev return &bpf_sk_setsockopt_proto; 2319113d7e4SStanislav Fomichev if (btf_id_set_contains(&bpf_lsm_unlocked_sockopt_hooks, 2329113d7e4SStanislav Fomichev prog->aux->attach_btf_id)) 2339113d7e4SStanislav Fomichev return &bpf_unlocked_sk_setsockopt_proto; 2349113d7e4SStanislav Fomichev return NULL; 2359113d7e4SStanislav Fomichev case BPF_FUNC_getsockopt: 2369113d7e4SStanislav Fomichev if (prog->expected_attach_type != BPF_LSM_CGROUP) 2379113d7e4SStanislav Fomichev return NULL; 2389113d7e4SStanislav Fomichev if (btf_id_set_contains(&bpf_lsm_locked_sockopt_hooks, 2399113d7e4SStanislav Fomichev prog->aux->attach_btf_id)) 2409113d7e4SStanislav Fomichev return &bpf_sk_getsockopt_proto; 2419113d7e4SStanislav Fomichev if (btf_id_set_contains(&bpf_lsm_unlocked_sockopt_hooks, 2429113d7e4SStanislav Fomichev prog->aux->attach_btf_id)) 2439113d7e4SStanislav Fomichev return &bpf_unlocked_sk_getsockopt_proto; 2449113d7e4SStanislav Fomichev return NULL; 2453908fcddSStanislav Fomichev #endif 24630897832SKP Singh default: 24730897832SKP Singh return tracing_prog_func_proto(func_id, prog); 24830897832SKP Singh } 24930897832SKP Singh } 25030897832SKP Singh 251423f1610SKP Singh /* The set of hooks which are called without pagefaults disabled and are allowed 252712b78c6SShuyi Cheng * to "sleep" and thus can be used for sleepable BPF programs. 253423f1610SKP Singh */ 254423f1610SKP Singh BTF_SET_START(sleepable_lsm_hooks) 255423f1610SKP Singh BTF_ID(func, bpf_lsm_bpf) 256423f1610SKP Singh BTF_ID(func, bpf_lsm_bpf_map) 257423f1610SKP Singh BTF_ID(func, bpf_lsm_bpf_map_alloc_security) 258423f1610SKP Singh BTF_ID(func, bpf_lsm_bpf_map_free_security) 259423f1610SKP Singh BTF_ID(func, bpf_lsm_bpf_prog) 260423f1610SKP Singh BTF_ID(func, bpf_lsm_bprm_check_security) 261423f1610SKP Singh BTF_ID(func, bpf_lsm_bprm_committed_creds) 262423f1610SKP Singh BTF_ID(func, bpf_lsm_bprm_committing_creds) 263423f1610SKP Singh BTF_ID(func, bpf_lsm_bprm_creds_for_exec) 264423f1610SKP Singh BTF_ID(func, bpf_lsm_bprm_creds_from_file) 265423f1610SKP Singh BTF_ID(func, bpf_lsm_capget) 266423f1610SKP Singh BTF_ID(func, bpf_lsm_capset) 267423f1610SKP Singh BTF_ID(func, bpf_lsm_cred_prepare) 268423f1610SKP Singh BTF_ID(func, bpf_lsm_file_ioctl) 269423f1610SKP Singh BTF_ID(func, bpf_lsm_file_lock) 270423f1610SKP Singh BTF_ID(func, bpf_lsm_file_open) 271423f1610SKP Singh BTF_ID(func, bpf_lsm_file_receive) 27278031381SMikko Ylinen 27378031381SMikko Ylinen #ifdef CONFIG_SECURITY_NETWORK 274423f1610SKP Singh BTF_ID(func, bpf_lsm_inet_conn_established) 27578031381SMikko Ylinen #endif /* CONFIG_SECURITY_NETWORK */ 27678031381SMikko Ylinen 277423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_create) 278423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_free_security) 279423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_getattr) 280423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_getxattr) 281423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_mknod) 282423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_need_killpriv) 283423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_post_setxattr) 284423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_readlink) 285423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_rename) 286423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_rmdir) 287423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_setattr) 288423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_setxattr) 289423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_symlink) 290423f1610SKP Singh BTF_ID(func, bpf_lsm_inode_unlink) 291423f1610SKP Singh BTF_ID(func, bpf_lsm_kernel_module_request) 292df6b3039SRoberto Sassu BTF_ID(func, bpf_lsm_kernel_read_file) 293423f1610SKP Singh BTF_ID(func, bpf_lsm_kernfs_init_security) 29478031381SMikko Ylinen 29578031381SMikko Ylinen #ifdef CONFIG_KEYS 296423f1610SKP Singh BTF_ID(func, bpf_lsm_key_free) 29778031381SMikko Ylinen #endif /* CONFIG_KEYS */ 29878031381SMikko Ylinen 299423f1610SKP Singh BTF_ID(func, bpf_lsm_mmap_file) 300423f1610SKP Singh BTF_ID(func, bpf_lsm_netlink_send) 301423f1610SKP Singh BTF_ID(func, bpf_lsm_path_notify) 302423f1610SKP Singh BTF_ID(func, bpf_lsm_release_secctx) 303423f1610SKP Singh BTF_ID(func, bpf_lsm_sb_alloc_security) 304423f1610SKP Singh BTF_ID(func, bpf_lsm_sb_eat_lsm_opts) 305423f1610SKP Singh BTF_ID(func, bpf_lsm_sb_kern_mount) 306423f1610SKP Singh BTF_ID(func, bpf_lsm_sb_mount) 307423f1610SKP Singh BTF_ID(func, bpf_lsm_sb_remount) 308423f1610SKP Singh BTF_ID(func, bpf_lsm_sb_set_mnt_opts) 309423f1610SKP Singh BTF_ID(func, bpf_lsm_sb_show_options) 310423f1610SKP Singh BTF_ID(func, bpf_lsm_sb_statfs) 311423f1610SKP Singh BTF_ID(func, bpf_lsm_sb_umount) 312423f1610SKP Singh BTF_ID(func, bpf_lsm_settime) 31378031381SMikko Ylinen 31478031381SMikko Ylinen #ifdef CONFIG_SECURITY_NETWORK 315423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_accept) 316423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_bind) 317423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_connect) 318423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_create) 319423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_getpeername) 320423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_getpeersec_dgram) 321423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_getsockname) 322423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_getsockopt) 323423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_listen) 324423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_post_create) 325423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_recvmsg) 326423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_sendmsg) 327423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_shutdown) 328423f1610SKP Singh BTF_ID(func, bpf_lsm_socket_socketpair) 32978031381SMikko Ylinen #endif /* CONFIG_SECURITY_NETWORK */ 33078031381SMikko Ylinen 331423f1610SKP Singh BTF_ID(func, bpf_lsm_syslog) 332423f1610SKP Singh BTF_ID(func, bpf_lsm_task_alloc) 33363ee956fSAlexei Starovoitov BTF_ID(func, bpf_lsm_current_getsecid_subj) 3344ebd7651SPaul Moore BTF_ID(func, bpf_lsm_task_getsecid_obj) 335423f1610SKP Singh BTF_ID(func, bpf_lsm_task_prctl) 336423f1610SKP Singh BTF_ID(func, bpf_lsm_task_setscheduler) 337423f1610SKP Singh BTF_ID(func, bpf_lsm_task_to_inode) 338*401e64b3SFrederick Lawler BTF_ID(func, bpf_lsm_userns_create) 339423f1610SKP Singh BTF_SET_END(sleepable_lsm_hooks) 340423f1610SKP Singh 341423f1610SKP Singh bool bpf_lsm_is_sleepable_hook(u32 btf_id) 342423f1610SKP Singh { 343423f1610SKP Singh return btf_id_set_contains(&sleepable_lsm_hooks, btf_id); 344423f1610SKP Singh } 345423f1610SKP Singh 346fc611f47SKP Singh const struct bpf_prog_ops lsm_prog_ops = { 347fc611f47SKP Singh }; 348fc611f47SKP Singh 349fc611f47SKP Singh const struct bpf_verifier_ops lsm_verifier_ops = { 35030897832SKP Singh .get_func_proto = bpf_lsm_func_proto, 351fc611f47SKP Singh .is_valid_access = btf_ctx_access, 352fc611f47SKP Singh }; 353