Merge pull request #18145 from kinvolk/iaguis/lsm-bpf

Add RestrictFileSystems= property using LSM BPF

src/shared/bpf-dlopen.c

@@ -8,13 +8,17 @@
 static void *bpf_dl = NULL;
 
 struct bpf_link* (*sym_bpf_program__attach_cgroup)(struct bpf_program *, int);
+struct bpf_link* (*sym_bpf_program__attach_lsm)(struct bpf_program *);
 long (*sym_libbpf_get_error)(const void *);
 int (*sym_bpf_link__fd)(const struct bpf_link *);
 int (*sym_bpf_link__destroy)(struct bpf_link *);
 int (*sym_bpf_map__fd)(const struct bpf_map *);
 const char* (*sym_bpf_map__name)(const struct bpf_map *);
+int (*sym_bpf_create_map)(enum bpf_map_type,  int key_size, int value_size, int max_entries, __u32 map_flags);
 int (*sym_bpf_map__resize)(struct bpf_map *, __u32);
 int (*sym_bpf_map_update_elem)(int, const void *, const void *, __u64);
+int (*sym_bpf_map_delete_elem)(int, const void *);
+int (*sym_bpf_map__set_inner_map_fd)(struct bpf_map *, int);
 int (*sym_bpf_object__open_skeleton)(struct bpf_object_skeleton *, const struct bpf_object_open_opts *);
 int (*sym_bpf_object__load_skeleton)(struct bpf_object_skeleton *);
 int (*sym_bpf_object__attach_skeleton)(struct bpf_object_skeleton *);
@@ -30,8 +34,11 @@ int dlopen_bpf(void) {
                         DLSYM_ARG(bpf_link__fd),
                         DLSYM_ARG(bpf_map__fd),
                         DLSYM_ARG(bpf_map__name),
+                        DLSYM_ARG(bpf_create_map),
                         DLSYM_ARG(bpf_map__resize),
                         DLSYM_ARG(bpf_map_update_elem),
+                        DLSYM_ARG(bpf_map_delete_elem),
+                        DLSYM_ARG(bpf_map__set_inner_map_fd),
                         DLSYM_ARG(bpf_object__open_skeleton),
                         DLSYM_ARG(bpf_object__load_skeleton),
                         DLSYM_ARG(bpf_object__attach_skeleton),
@@ -39,6 +46,7 @@ int dlopen_bpf(void) {
                         DLSYM_ARG(bpf_object__destroy_skeleton),
                         DLSYM_ARG(bpf_probe_prog_type),
                         DLSYM_ARG(bpf_program__attach_cgroup),
+                        DLSYM_ARG(bpf_program__attach_lsm),
                         DLSYM_ARG(bpf_program__name),
                         DLSYM_ARG(libbpf_get_error));
 }

src/shared/bpf-dlopen.h

@@ -7,13 +7,17 @@
 #include <bpf/libbpf.h>
 
 extern struct bpf_link* (*sym_bpf_program__attach_cgroup)(struct bpf_program *, int);
+extern struct bpf_link* (*sym_bpf_program__attach_lsm)(struct bpf_program *);
 extern long (*sym_libbpf_get_error)(const void *);
 extern int (*sym_bpf_link__fd)(const struct bpf_link *);
 extern int (*sym_bpf_link__destroy)(struct bpf_link *);
 extern int (*sym_bpf_map__fd)(const struct bpf_map *);
 extern const char* (*sym_bpf_map__name)(const struct bpf_map *);
+extern int (*sym_bpf_create_map)(enum bpf_map_type, int key_size, int value_size, int max_entries, __u32 map_flags);
 extern int (*sym_bpf_map__resize)(struct bpf_map *, __u32);
 extern int (*sym_bpf_map_update_elem)(int, const void *, const void *, __u64);
+extern int (*sym_bpf_map_delete_elem)(int, const void *);
+extern int (*sym_bpf_map__set_inner_map_fd)(struct bpf_map *, int);
 /* The *_skeleton APIs are autogenerated by bpftool, the targets can be found
  * in ./build/src/core/bpf/socket_bind/socket-bind.skel.h */
 extern int (*sym_bpf_object__open_skeleton)(struct bpf_object_skeleton *, const struct bpf_object_open_opts *);

src/shared/bus-unit-util.c

@@ -1386,6 +1386,7 @@ static int bus_append_execute_property(sd_bus_message *m, const char *field, con
         }
 
         if (STR_IN_SET(field, "RestrictAddressFamilies",
+                              "RestrictFileSystems",
                               "SystemCallFilter",
                               "SystemCallLog",
                               "RestrictNetworkInterfaces")) {

src/shared/exit-status.c

@@ -18,8 +18,8 @@ const ExitStatusMapping exit_status_mappings[256] = {
          *   8…63  │ (Currently unmapped)
          *  64…78  │ BSD defined exit codes
          *  79…199 │ (Currently unmapped)
-         * 200…243 │ systemd's private error codes (might be extended to 254 in future development)
-         * 244…254 │ (Currently unmapped, but see above)
+         * 200…244 │ systemd's private error codes (might be extended to 254 in future development)
+         * 245…254 │ (Currently unmapped, but see above)
          *
          *   255   │ EXIT_EXCEPTION (We use this to propagate exit-by-signal events. It's frequently used by others apps (like bash)
          *         │ to indicate exit reason that cannot really be expressed in a single exit status value — such as a propagated
@@ -71,6 +71,7 @@ const ExitStatusMapping exit_status_mappings[256] = {
         [EXIT_CONFIGURATION_DIRECTORY] = { "CONFIGURATION_DIRECTORY", EXIT_STATUS_SYSTEMD },
         [EXIT_NUMA_POLICY] =             { "NUMA_POLICY",             EXIT_STATUS_SYSTEMD },
         [EXIT_CREDENTIALS] =             { "CREDENTIALS",             EXIT_STATUS_SYSTEMD },
+        [EXIT_BPF] =                     { "BPF",                     EXIT_STATUS_SYSTEMD },
 
         [EXIT_EXCEPTION] =               { "EXCEPTION",               EXIT_STATUS_SYSTEMD },
 

src/shared/exit-status.h

@@ -71,6 +71,7 @@ enum {
         EXIT_CONFIGURATION_DIRECTORY,
         EXIT_NUMA_POLICY,
         EXIT_CREDENTIALS,
+        EXIT_BPF,
 
         EXIT_EXCEPTION = 255,  /* Whenever we want to propagate an abnormal/signal exit, in line with bash */
 };