1 // SPDX-License-Identifier: GPL-2.0 2 3 /* 4 * Copyright (C) 2020 Google LLC. 5 */ 6 7 #include <linux/filter.h> 8 #include <linux/bpf.h> 9 #include <linux/btf.h> 10 #include <linux/lsm_hooks.h> 11 #include <linux/bpf_lsm.h> 12 #include <linux/kallsyms.h> 13 #include <linux/bpf_verifier.h> 14 #include <net/bpf_sk_storage.h> 15 #include <linux/bpf_local_storage.h> 16 #include <linux/btf_ids.h> 17 18 /* For every LSM hook that allows attachment of BPF programs, declare a nop 19 * function where a BPF program can be attached. 20 */ 21 #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ 22 noinline RET bpf_lsm_##NAME(__VA_ARGS__) \ 23 { \ 24 return DEFAULT; \ 25 } 26 27 #include <linux/lsm_hook_defs.h> 28 #undef LSM_HOOK 29 30 #define LSM_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME) 31 BTF_SET_START(bpf_lsm_hooks) 32 #include <linux/lsm_hook_defs.h> 33 #undef LSM_HOOK 34 BTF_SET_END(bpf_lsm_hooks) 35 36 int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, 37 const struct bpf_prog *prog) 38 { 39 if (!prog->gpl_compatible) { 40 bpf_log(vlog, 41 "LSM programs must have a GPL compatible license\n"); 42 return -EINVAL; 43 } 44 45 if (!btf_id_set_contains(&bpf_lsm_hooks, prog->aux->attach_btf_id)) { 46 bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n", 47 prog->aux->attach_btf_id, prog->aux->attach_func_name); 48 return -EINVAL; 49 } 50 51 return 0; 52 } 53 54 static const struct bpf_func_proto * 55 bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) 56 { 57 switch (func_id) { 58 case BPF_FUNC_inode_storage_get: 59 return &bpf_inode_storage_get_proto; 60 case BPF_FUNC_inode_storage_delete: 61 return &bpf_inode_storage_delete_proto; 62 case BPF_FUNC_sk_storage_get: 63 return &bpf_sk_storage_get_proto; 64 case BPF_FUNC_sk_storage_delete: 65 return &bpf_sk_storage_delete_proto; 66 default: 67 return tracing_prog_func_proto(func_id, prog); 68 } 69 } 70 71 const struct bpf_prog_ops lsm_prog_ops = { 72 }; 73 74 const struct bpf_verifier_ops lsm_verifier_ops = { 75 .get_func_proto = bpf_lsm_func_proto, 76 .is_valid_access = btf_ctx_access, 77 }; 78