Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add O_PATH-based BPF_OBJ_PIN and BPF_OBJ_GET support #5099

Closed
wants to merge 5 commits into from
Closed

Add O_PATH-based BPF_OBJ_PIN and BPF_OBJ_GET support #5099

wants to merge 5 commits into from

Commits on May 23, 2023

  1. adding ci files

    Kernel Patches Daemon committed May 23, 2023
    Configuration menu
    Copy the full SHA
    c694647 View commit details
    Browse the repository at this point in the history

  2. bpf: validate BPF object in BPF_OBJ_PIN before calling LSM 

    Do a sanity check whether provided file-to-be-pinned is actually a BPF
object (prog, map, btf) before calling security_path_mknod LSM hook. If
it's not, LSM hook doesn't have to be triggered, as the operation has no
chance of succeeding anyways.

Suggested-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Christian Brauner <brauner@kernel.org>
    @anakryiko
    anakryiko authored and Kernel Patches Daemon committed May 23, 2023
    Configuration menu
    Copy the full SHA
    89a5bdb View commit details
    Browse the repository at this point in the history

  3. bpf: support O_PATH FDs in BPF_OBJ_PIN and BPF_OBJ_GET commands 

    Current UAPI of BPF_OBJ_PIN and BPF_OBJ_GET commands of bpf() syscall
forces users to specify pinning location as a string-based absolute or
relative (to current working directory) path. This has various
implications related to security (e.g., symlink-based attacks), forces
BPF FS to be exposed in the file system, which can cause races with
other applications.

One of the feedbacks we got from folks working with containers heavily
was that inability to use purely FD-based location specification was an
unfortunate limitation and hindrance for BPF_OBJ_PIN and BPF_OBJ_GET
commands. This patch closes this oversight, adding path_fd field to
BPF_OBJ_PIN and BPF_OBJ_GET UAPI, following conventions established by
*at() syscalls for dirfd + pathname combinations.

This now allows interesting possibilities like working with detached BPF
FS mount (e.g., to perform multiple pinnings without running a risk of
someone interfering with them), and generally making pinning/getting
more secure and not prone to any races and/or security attacks.

This is demonstrated by a selftest added in subsequent patch that takes
advantage of new mount APIs (fsopen, fsconfig, fsmount) to demonstrate
creating detached BPF FS mount, pinning, and then getting BPF map out of
it, all while never exposing this private instance of BPF FS to outside
worlds.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Christian Brauner <brauner@kernel.org>
    @anakryiko
    anakryiko authored and Kernel Patches Daemon committed May 23, 2023
    Configuration menu
    Copy the full SHA
    593e5a6 View commit details
    Browse the repository at this point in the history

  4. libbpf: add opts-based bpf_obj_pin() API and add support for path_fd 

    Add path_fd support for bpf_obj_pin() and bpf_obj_get() operations
(through their opts-based variants). This allows to take advantage of
new kernel-side support for O_PATH-based pin/get location specification.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
    @anakryiko
    anakryiko authored and Kernel Patches Daemon committed May 23, 2023
    Configuration menu
    Copy the full SHA
    5949833 View commit details
    Browse the repository at this point in the history

  5. selftests/bpf: add path_fd-based BPF_OBJ_PIN and BPF_OBJ_GET tests 

    Add a selftest demonstrating using detach-mounted BPF FS using new mount
APIs, and pinning and getting BPF map using such mount. This
demonstrates how something like container manager could setup BPF FS,
pin and adjust all the necessary objects in it, all before exposing BPF
FS to a particular mount namespace.

Also add a few subtests validating all meaningful combinations of
path_fd and pathname. We use mounted /sys/fs/bpf location for these.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
    @anakryiko
    anakryiko authored and Kernel Patches Daemon committed May 23, 2023
    Configuration menu
    Copy the full SHA
    3266ad7 View commit details
    Browse the repository at this point in the history