1fc975906SRoberto Sassu // SPDX-License-Identifier: GPL-2.0
2fc975906SRoberto Sassu
3fc975906SRoberto Sassu /*
4fc975906SRoberto Sassu * Copyright (C) 2022 Huawei Technologies Duesseldorf GmbH
5fc975906SRoberto Sassu *
6fc975906SRoberto Sassu * Author: Roberto Sassu <roberto.sassu@huawei.com>
7fc975906SRoberto Sassu */
8fc975906SRoberto Sassu
9fc975906SRoberto Sassu #include "vmlinux.h"
10fc975906SRoberto Sassu #include <errno.h>
11fc975906SRoberto Sassu #include <bpf/bpf_helpers.h>
12fc975906SRoberto Sassu #include <bpf/bpf_tracing.h>
13fc975906SRoberto Sassu
14fc975906SRoberto Sassu #define MAX_DATA_SIZE (1024 * 1024)
15fc975906SRoberto Sassu #define MAX_SIG_SIZE 1024
16fc975906SRoberto Sassu
17fc975906SRoberto Sassu extern struct bpf_key *bpf_lookup_user_key(__u32 serial, __u64 flags) __ksym;
18fc975906SRoberto Sassu extern struct bpf_key *bpf_lookup_system_key(__u64 id) __ksym;
19fc975906SRoberto Sassu extern void bpf_key_put(struct bpf_key *key) __ksym;
20fc975906SRoberto Sassu extern int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_ptr,
21fc975906SRoberto Sassu struct bpf_dynptr *sig_ptr,
22fc975906SRoberto Sassu struct bpf_key *trusted_keyring) __ksym;
23fc975906SRoberto Sassu
24fc975906SRoberto Sassu __u32 monitored_pid;
25fc975906SRoberto Sassu __u32 user_keyring_serial;
26fc975906SRoberto Sassu __u64 system_keyring_id;
27fc975906SRoberto Sassu
28fc975906SRoberto Sassu struct data {
29fc975906SRoberto Sassu __u8 data[MAX_DATA_SIZE];
30fc975906SRoberto Sassu __u32 data_len;
31fc975906SRoberto Sassu __u8 sig[MAX_SIG_SIZE];
32fc975906SRoberto Sassu __u32 sig_len;
33fc975906SRoberto Sassu };
34fc975906SRoberto Sassu
35fc975906SRoberto Sassu struct {
36fc975906SRoberto Sassu __uint(type, BPF_MAP_TYPE_ARRAY);
37fc975906SRoberto Sassu __uint(max_entries, 1);
38fc975906SRoberto Sassu __type(key, __u32);
39fc975906SRoberto Sassu __type(value, struct data);
40fc975906SRoberto Sassu } data_input SEC(".maps");
41fc975906SRoberto Sassu
42fc975906SRoberto Sassu char _license[] SEC("license") = "GPL";
43fc975906SRoberto Sassu
44fc975906SRoberto Sassu SEC("lsm.s/bpf")
BPF_PROG(bpf,int cmd,union bpf_attr * attr,unsigned int size)45fc975906SRoberto Sassu int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size)
46fc975906SRoberto Sassu {
47fc975906SRoberto Sassu struct bpf_dynptr data_ptr, sig_ptr;
48fc975906SRoberto Sassu struct data *data_val;
49fc975906SRoberto Sassu struct bpf_key *trusted_keyring;
50fc975906SRoberto Sassu __u32 pid;
51fc975906SRoberto Sassu __u64 value;
52fc975906SRoberto Sassu int ret, zero = 0;
53fc975906SRoberto Sassu
54fc975906SRoberto Sassu pid = bpf_get_current_pid_tgid() >> 32;
55fc975906SRoberto Sassu if (pid != monitored_pid)
56fc975906SRoberto Sassu return 0;
57fc975906SRoberto Sassu
58fc975906SRoberto Sassu data_val = bpf_map_lookup_elem(&data_input, &zero);
59fc975906SRoberto Sassu if (!data_val)
60fc975906SRoberto Sassu return 0;
61fc975906SRoberto Sassu
62*56e1a504SIlya Leoshkevich ret = bpf_probe_read_kernel(&value, sizeof(value), &attr->value);
63*56e1a504SIlya Leoshkevich if (ret)
64*56e1a504SIlya Leoshkevich return ret;
65fc975906SRoberto Sassu
66*56e1a504SIlya Leoshkevich ret = bpf_copy_from_user(data_val, sizeof(struct data),
67fc975906SRoberto Sassu (void *)(unsigned long)value);
68*56e1a504SIlya Leoshkevich if (ret)
69*56e1a504SIlya Leoshkevich return ret;
70fc975906SRoberto Sassu
71fc975906SRoberto Sassu if (data_val->data_len > sizeof(data_val->data))
72fc975906SRoberto Sassu return -EINVAL;
73fc975906SRoberto Sassu
74fc975906SRoberto Sassu bpf_dynptr_from_mem(data_val->data, data_val->data_len, 0, &data_ptr);
75fc975906SRoberto Sassu
76fc975906SRoberto Sassu if (data_val->sig_len > sizeof(data_val->sig))
77fc975906SRoberto Sassu return -EINVAL;
78fc975906SRoberto Sassu
79fc975906SRoberto Sassu bpf_dynptr_from_mem(data_val->sig, data_val->sig_len, 0, &sig_ptr);
80fc975906SRoberto Sassu
81fc975906SRoberto Sassu if (user_keyring_serial)
82fc975906SRoberto Sassu trusted_keyring = bpf_lookup_user_key(user_keyring_serial, 0);
83fc975906SRoberto Sassu else
84fc975906SRoberto Sassu trusted_keyring = bpf_lookup_system_key(system_keyring_id);
85fc975906SRoberto Sassu
86fc975906SRoberto Sassu if (!trusted_keyring)
87fc975906SRoberto Sassu return -ENOENT;
88fc975906SRoberto Sassu
89fc975906SRoberto Sassu ret = bpf_verify_pkcs7_signature(&data_ptr, &sig_ptr, trusted_keyring);
90fc975906SRoberto Sassu
91fc975906SRoberto Sassu bpf_key_put(trusted_keyring);
92fc975906SRoberto Sassu
93fc975906SRoberto Sassu return ret;
94fc975906SRoberto Sassu }
95