SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #31090 from poettering/bpf-lsm-rename

Browse Source 
rename a bunch of bpf related .c/.h files, and functions there in to make naming of systematic
This commit is contained in:
Luca Boccassi
2024-01-25 18:20:25 +00:00
committed by GitHub
parent b68f4cade4 9af6ab4499
commit c84e8125c0
24 changed files with 130 additions and 127 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO
+5
View File
@@ -132,6 +132,11 @@ Deprecations and removals:
Features:
* rewrite bpf-devices in libbpf/C code, rather than home-grown BPF assembly, to
match bpf-restrict-fs, bpf-restrict-ifaces, bpf-socket-bind
* ditto: rewrite bpf-firewall in libbpf/C code
* extend the smbios11 logic for passing credentials so that instead of passing
the credential data literally it can also just reference an AF_VSOCK CID/port
to read them from. This way the data doesn't remain in the SMBIOS blob during
src/core/bpf-lsm.h
-28
View File
@@ -1,28 +0,0 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#pragma once
#include "hashmap.h"
typedef enum FilesystemParseFlags {
FILESYSTEM_PARSE_INVERT = 1 << 0,
FILESYSTEM_PARSE_ALLOW_LIST = 1 << 1,
FILESYSTEM_PARSE_LOG = 1 << 2,
} FilesystemParseFlags;
typedef struct Unit Unit;
typedef struct Manager Manager;
typedef struct restrict_fs_bpf restrict_fs_bpf;
bool lsm_bpf_supported(bool initialize);
int lsm_bpf_setup(Manager *m);
int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list);
int lsm_bpf_cleanup(const Unit *u);
int lsm_bpf_map_restrict_fs_fd(Unit *u);
void lsm_bpf_destroy(struct restrict_fs_bpf *prog);
int lsm_bpf_parse_filesystem(const char *name,
Set **filesystems,
FilesystemParseFlags flags,
const char *unit,
const char *filename,
unsigned line);
src/core/bpf-lsm.c → src/core/bpf-restrict-fs.c
+38 -38
View File
@@ -10,7 +10,7 @@
#include <unistd.h>
#include "alloc-util.h"
#include "bpf-lsm.h"
#include "bpf-restrict-fs.h"
#include "cgroup-util.h"
#include "fd-util.h"
#include "fileio.h"
@@ -63,36 +63,36 @@ static int prepare_restrict_fs_bpf(struct restrict_fs_bpf **ret_obj) {
obj = restrict_fs_bpf__open();
if (!obj)
return log_error_errno(errno, "bpf-lsm: Failed to open BPF object: %m");
return log_error_errno(errno, "bpf-restrict-fs: Failed to open BPF object: %m");
/* TODO Maybe choose a number based on runtime information? */
r = sym_bpf_map__set_max_entries(obj->maps.cgroup_hash, CGROUP_HASH_SIZE_MAX);
assert(r <= 0);
if (r < 0)
return log_error_errno(r, "bpf-lsm: Failed to resize BPF map '%s': %m",
return log_error_errno(r, "bpf-restrict-fs: Failed to resize BPF map '%s': %m",
sym_bpf_map__name(obj->maps.cgroup_hash));
/* Dummy map to satisfy the verifier */
inner_map_fd = compat_bpf_map_create(BPF_MAP_TYPE_HASH, NULL, sizeof(uint32_t), sizeof(uint32_t), 128U, NULL);
if (inner_map_fd < 0)
return log_error_errno(errno, "bpf-lsm: Failed to create BPF map: %m");
return log_error_errno(errno, "bpf-restrict-fs: Failed to create BPF map: %m");
r = sym_bpf_map__set_inner_map_fd(obj->maps.cgroup_hash, inner_map_fd);
assert(r <= 0);
if (r < 0)
return log_error_errno(r, "bpf-lsm: Failed to set inner map fd: %m");
return log_error_errno(r, "bpf-restrict-fs: Failed to set inner map fd: %m");
r = restrict_fs_bpf__load(obj);
assert(r <= 0);
if (r < 0)
return log_error_errno(r, "bpf-lsm: Failed to load BPF object: %m");
return log_error_errno(r, "bpf-restrict-fs: Failed to load BPF object: %m");
*ret_obj = TAKE_PTR(obj);
return 0;
}
bool lsm_bpf_supported(bool initialize) {
bool bpf_restrict_fs_supported(bool initialize) {
_cleanup_(restrict_fs_bpf_freep) struct restrict_fs_bpf *obj = NULL;
static int supported = -1;
int r;
@@ -107,12 +107,12 @@ bool lsm_bpf_supported(bool initialize) {
r = lsm_supported("bpf");
if (r < 0) {
log_warning_errno(r, "bpf-lsm: Can't determine whether the BPF LSM module is used: %m");
log_warning_errno(r, "bpf-restrict-fs: Can't determine whether the BPF LSM module is used: %m");
return (supported = false);
}
if (r == 0) {
log_info_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"bpf-lsm: BPF LSM hook not enabled in the kernel, BPF LSM not supported");
"bpf-restrict-fs: BPF LSM hook not enabled in the kernel, BPF LSM not supported");
return (supported = false);
}
@@ -122,14 +122,14 @@ bool lsm_bpf_supported(bool initialize) {
if (!bpf_can_link_lsm_program(obj->progs.restrict_filesystems)) {
log_warning_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"bpf-lsm: Failed to link program; assuming BPF LSM is not available");
"bpf-restrict-fs: Failed to link program; assuming BPF LSM is not available");
return (supported = false);
}
return (supported = true);
}
int lsm_bpf_setup(Manager *m) {
int bpf_restrict_fs_setup(Manager *m) {
_cleanup_(restrict_fs_bpf_freep) struct restrict_fs_bpf *obj = NULL;
_cleanup_(bpf_link_freep) struct bpf_link *link = NULL;
int r;
@@ -143,10 +143,10 @@ int lsm_bpf_setup(Manager *m) {
link = sym_bpf_program__attach_lsm(obj->progs.restrict_filesystems);
r = sym_libbpf_get_error(link);
if (r != 0)
return log_error_errno(r, "bpf-lsm: Failed to link '%s' LSM BPF program: %m",
return log_error_errno(r, "bpf-restrict-fs: Failed to link '%s' LSM BPF program: %m",
sym_bpf_program__name(obj->progs.restrict_filesystems));
log_info("bpf-lsm: LSM BPF program attached");
log_info("bpf-restrict-fs: LSM BPF program attached");
obj->links.restrict_filesystems = TAKE_PTR(link);
m->restrict_fs = TAKE_PTR(obj);
@@ -154,7 +154,7 @@ int lsm_bpf_setup(Manager *m) {
return 0;
}
int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list) {
int bpf_restrict_fs_update(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list) {
uint32_t dummy_value = 1, zero = 0;
const char *fs;
const statfs_f_type_t *magic;
@@ -171,35 +171,35 @@ int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int
128U, /* Should be enough for all filesystem types */
NULL);
if (inner_map_fd < 0)
return log_error_errno(errno, "bpf-lsm: Failed to create inner BPF map: %m");
return log_error_errno(errno, "bpf-restrict-fs: Failed to create inner BPF map: %m");
if (sym_bpf_map_update_elem(outer_map_fd, &cgroup_id, &inner_map_fd, BPF_ANY) != 0)
return log_error_errno(errno, "bpf-lsm: Error populating BPF map: %m");
return log_error_errno(errno, "bpf-restrict-fs: Error populating BPF map: %m");
uint32_t allow = allow_list;
/* Use key 0 to store whether this is an allow list or a deny list */
if (sym_bpf_map_update_elem(inner_map_fd, &zero, &allow, BPF_ANY) != 0)
return log_error_errno(errno, "bpf-lsm: Error initializing map: %m");
return log_error_errno(errno, "bpf-restrict-fs: Error initializing map: %m");
SET_FOREACH(fs, filesystems) {
r = fs_type_from_string(fs, &magic);
if (r < 0) {
log_warning("bpf-lsm: Invalid filesystem name '%s', ignoring.", fs);
log_warning("bpf-restrict-fs: Invalid filesystem name '%s', ignoring.", fs);
continue;
}
log_debug("bpf-lsm: Restricting filesystem access to '%s'", fs);
log_debug("bpf-restrict-fs: Restricting filesystem access to '%s'", fs);
for (int i = 0; i < FILESYSTEM_MAGIC_MAX; i++) {
if (magic[i] == 0)
break;
if (sym_bpf_map_update_elem(inner_map_fd, &magic[i], &dummy_value, BPF_ANY) != 0) {
r = log_error_errno(errno, "bpf-lsm: Failed to update BPF map: %m");
r = log_error_errno(errno, "bpf-restrict-fs: Failed to update BPF map: %m");
if (sym_bpf_map_delete_elem(outer_map_fd, &cgroup_id) != 0)
log_debug_errno(errno, "bpf-lsm: Failed to delete cgroup entry from BPF map: %m");
log_debug_errno(errno, "bpf-restrict-fs: Failed to delete cgroup entry from BPF map: %m");
return r;
}
@@ -209,12 +209,12 @@ int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int
return 0;
}
int lsm_bpf_cleanup(const Unit *u) {
int bpf_restrict_fs_cleanup(const Unit *u) {
assert(u);
assert(u->manager);
/* If we never successfully detected support, there is nothing to clean up. */
if (!lsm_bpf_supported(/* initialize = */ false))
if (!bpf_restrict_fs_supported(/* initialize = */ false))
return 0;
if (!u->manager->restrict_fs)
@@ -225,15 +225,15 @@ int lsm_bpf_cleanup(const Unit *u) {
int fd = sym_bpf_map__fd(u->manager->restrict_fs->maps.cgroup_hash);
if (fd < 0)
return log_unit_error_errno(u, errno, "bpf-lsm: Failed to get BPF map fd: %m");
return log_unit_error_errno(u, errno, "bpf-restrict-fs: Failed to get BPF map fd: %m");
if (sym_bpf_map_delete_elem(fd, &u->cgroup_id) != 0 && errno != ENOENT)
return log_unit_debug_errno(u, errno, "bpf-lsm: Failed to delete cgroup entry from LSM BPF map: %m");
return log_unit_debug_errno(u, errno, "bpf-restrict-fs: Failed to delete cgroup entry from LSM BPF map: %m");
return 0;
}
int lsm_bpf_map_restrict_fs_fd(Unit *unit) {
int bpf_restrict_fs_map_fd(Unit *unit) {
assert(unit);
assert(unit->manager);
@@ -243,36 +243,36 @@ int lsm_bpf_map_restrict_fs_fd(Unit *unit) {
return sym_bpf_map__fd(unit->manager->restrict_fs->maps.cgroup_hash);
}
void lsm_bpf_destroy(struct restrict_fs_bpf *prog) {
void bpf_restrict_fs_destroy(struct restrict_fs_bpf *prog) {
restrict_fs_bpf__destroy(prog);
}
#else /* ! BPF_FRAMEWORK */
bool lsm_bpf_supported(bool initialize) {
bool bpf_restrict_fs_supported(bool initialize) {
return false;
}
int lsm_bpf_setup(Manager *m) {
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-lsm: Failed to set up LSM BPF: %m");
int bpf_restrict_fs_setup(Manager *m) {
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-restrict-fs: Failed to set up LSM BPF: %m");
}
int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, const bool allow_list) {
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-lsm: Failed to restrict filesystems using LSM BPF: %m");
int bpf_restrict_fs_update(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, const bool allow_list) {
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-restrict-fs: Failed to restrict filesystems using LSM BPF: %m");
}
int lsm_bpf_cleanup(const Unit *u) {
int bpf_restrict_fs_cleanup(const Unit *u) {
return 0;
}
int lsm_bpf_map_restrict_fs_fd(Unit *unit) {
int bpf_restrict_fs_map_fd(Unit *unit) {
return -ENOMEDIUM;
}
void lsm_bpf_destroy(struct restrict_fs_bpf *prog) {
void bpf_restrict_fs_destroy(struct restrict_fs_bpf *prog) {
return;
}
#endif
int lsm_bpf_parse_filesystem(
int bpf_restrict_fs_parse_filesystem(
const char *name,
Set **filesystems,
FilesystemParseFlags flags,
@@ -290,7 +290,7 @@ int lsm_bpf_parse_filesystem(
set = filesystem_set_find(name);
if (!set) {
log_syntax(unit, flags & FILESYSTEM_PARSE_LOG ? LOG_WARNING : LOG_DEBUG, filename, line, 0,
"bpf-lsm: Unknown filesystem group, ignoring: %s", name);
"bpf-restrict-fs: Unknown filesystem group, ignoring: %s", name);
return 0;
}
@@ -299,7 +299,7 @@ int lsm_bpf_parse_filesystem(
* (i.e. take away the FILESYSTEM_PARSE_LOG flag) since any issues in the group table
* are our own problem, not a problem in user configuration data and we shouldn't
* pretend otherwise by complaining about them. */
r = lsm_bpf_parse_filesystem(i, filesystems, flags &~ FILESYSTEM_PARSE_LOG, unit, filename, line);
r = bpf_restrict_fs_parse_filesystem(i, filesystems, flags &~ FILESYSTEM_PARSE_LOG, unit, filename, line);
if (r < 0)
return r;
}
src/core/bpf-restrict-fs.h
+23
View File
@@ -0,0 +1,23 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#pragma once
#include "hashmap.h"
typedef enum FilesystemParseFlags {
FILESYSTEM_PARSE_INVERT = 1 << 0,
FILESYSTEM_PARSE_ALLOW_LIST = 1 << 1,
FILESYSTEM_PARSE_LOG = 1 << 2,
} FilesystemParseFlags;
typedef struct Unit Unit;
typedef struct Manager Manager;
typedef struct restrict_fs_bpf restrict_fs_bpf;
bool bpf_restrict_fs_supported(bool initialize);
int bpf_restrict_fs_setup(Manager *m);
int bpf_restrict_fs_update(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list);
int bpf_restrict_fs_cleanup(const Unit *u);
int bpf_restrict_fs_map_fd(Unit *u);
void bpf_restrict_fs_destroy(struct restrict_fs_bpf *prog);
int bpf_restrict_fs_parse_filesystem(const char *name, Set **filesystems, FilesystemParseFlags flags, const char *unit, const char *filename, unsigned line);
src/core/restrict-ifaces.c → src/core/bpf-restrict-ifaces.c
+13 -11
View File
@@ -1,7 +1,7 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include "fd-util.h"
#include "restrict-ifaces.h"
#include "bpf-restrict-ifaces.h"
#include "netlink-util.h"
#if BPF_FRAMEWORK
@@ -72,7 +72,7 @@ static int prepare_restrict_ifaces_bpf(
return 0;
}
int restrict_network_interfaces_supported(void) {
int bpf_restrict_ifaces_supported(void) {
_cleanup_(restrict_ifaces_bpf_freep) struct restrict_ifaces_bpf *obj = NULL;
static int supported = -1;
int r;
@@ -97,7 +97,7 @@ int restrict_network_interfaces_supported(void) {
return (supported = bpf_can_link_program(obj->progs.sd_restrictif_i));
}
static int restrict_network_interfaces_install_impl(Unit *u) {
static int restrict_ifaces_install_impl(Unit *u) {
_cleanup_(bpf_link_freep) struct bpf_link *egress_link = NULL, *ingress_link = NULL;
_cleanup_(restrict_ifaces_bpf_freep) struct restrict_ifaces_bpf *obj = NULL;
_cleanup_free_ char *cgroup_path = NULL;
@@ -143,13 +143,15 @@ static int restrict_network_interfaces_install_impl(Unit *u) {
return 0;
}
int restrict_network_interfaces_install(Unit *u) {
int r = restrict_network_interfaces_install_impl(u);
int bpf_restrict_ifaces_install(Unit *u) {
int r;
r = restrict_ifaces_install_impl(u);
fdset_close(u->initial_restric_ifaces_link_fds);
return r;
}
int serialize_restrict_network_interfaces(Unit *u, FILE *f, FDSet *fds) {
int bpf_restrict_ifaces_serialize(Unit *u, FILE *f, FDSet *fds) {
int r;
assert(u);
@@ -161,7 +163,7 @@ int serialize_restrict_network_interfaces(Unit *u, FILE *f, FDSet *fds) {
return bpf_serialize_link(f, fds, "restrict-ifaces-bpf-fd", u->restrict_ifaces_egress_bpf_link);
}
int restrict_network_interfaces_add_initial_link_fd(Unit *u, int fd) {
int bpf_restrict_ifaces_add_initial_link_fd(Unit *u, int fd) {
int r;
assert(u);
@@ -181,20 +183,20 @@ int restrict_network_interfaces_add_initial_link_fd(Unit *u, int fd) {
}
#else /* ! BPF_FRAMEWORK */
int restrict_network_interfaces_supported(void) {
int bpf_restrict_ifaces_supported(void) {
return 0;
}
int restrict_network_interfaces_install(Unit *u) {
int bpf_restrict_ifaces_install(Unit *u) {
return log_unit_debug_errno(u, SYNTHETIC_ERRNO(EOPNOTSUPP),
"restrict-interfaces: Failed to install; BPF programs built from source code are not supported: %m");
}
int serialize_restrict_network_interfaces(Unit *u, FILE *f, FDSet *fds) {
int bpf_restrict_ifaces_serialize(Unit *u, FILE *f, FDSet *fds) {
return 0;
}
int restrict_network_interfaces_add_initial_link_fd(Unit *u, int fd) {
int bpf_restrict_ifaces_add_initial_link_fd(Unit *u, int fd) {
return 0;
}
#endif
src/core/restrict-ifaces.h → src/core/bpf-restrict-ifaces.h
+4 -4
View File
@@ -6,11 +6,11 @@
typedef struct Unit Unit;
int restrict_network_interfaces_supported(void);
int restrict_network_interfaces_install(Unit *u);
int bpf_restrict_ifaces_supported(void);
int bpf_restrict_ifaces_install(Unit *u);
int serialize_restrict_network_interfaces(Unit *u, FILE *f, FDSet *fds);
int bpf_restrict_ifaces_serialize(Unit *u, FILE *f, FDSet *fds);
/* Add BPF link fd created before daemon-reload or daemon-reexec.
* FDs will be closed at the end of restrict_network_interfaces_install. */
int restrict_network_interfaces_add_initial_link_fd(Unit *u, int fd);
int bpf_restrict_ifaces_add_initial_link_fd(Unit *u, int fd);
src/core/bpf-socket-bind.c
+2 -2
View File
@@ -212,7 +212,7 @@ int bpf_socket_bind_install(Unit *u) {
return r;
}
int bpf_serialize_socket_bind(Unit *u, FILE *f, FDSet *fds) {
int bpf_socket_bind_serialize(Unit *u, FILE *f, FDSet *fds) {
int r;
assert(u);
@@ -238,7 +238,7 @@ int bpf_socket_bind_install(Unit *u) {
"bpf-socket-bind: Failed to install; BPF framework is not supported");
}
int bpf_serialize_socket_bind(Unit *u, FILE *f, FDSet *fds) {
int bpf_socket_bind_serialize(Unit *u, FILE *f, FDSet *fds) {
return 0;
}
#endif
src/core/bpf-socket-bind.h
+1 -1
View File
@@ -12,4 +12,4 @@ int bpf_socket_bind_add_initial_link_fd(Unit *u, int fd);
int bpf_socket_bind_install(Unit *u);
int bpf_serialize_socket_bind(Unit *u, FILE *f, FDSet *fds);
int bpf_socket_bind_serialize(Unit *u, FILE *f, FDSet *fds);
src/core/cgroup.c
+4 -4
View File
@@ -10,6 +10,7 @@
#include "bpf-devices.h"
#include "bpf-firewall.h"
#include "bpf-foreign.h"
#include "bpf-restrict-ifaces.h"
#include "bpf-socket-bind.h"
#include "btrfs-util.h"
#include "bus-error.h"
@@ -32,7 +33,6 @@
#include "percent-util.h"
#include "process-util.h"
#include "procfs-util.h"
#include "restrict-ifaces.h"
#include "set.h"
#include "special.h"
#include "stdio-util.h"
@@ -1849,7 +1849,7 @@ static void cgroup_apply_socket_bind(Unit *u) {
static void cgroup_apply_restrict_network_interfaces(Unit *u) {
assert(u);
(void) restrict_network_interfaces_install(u);
(void) bpf_restrict_ifaces_install(u);
}
static int cgroup_apply_devices(Unit *u) {
@@ -3451,7 +3451,7 @@ void unit_prune_cgroup(Unit *u) {
(void) unit_get_memory_accounting(u, metric, /* ret = */ NULL);
#if BPF_FRAMEWORK
(void) lsm_bpf_cleanup(u); /* Remove cgroup from the global LSM BPF map */
(void) bpf_restrict_fs_cleanup(u); /* Remove cgroup from the global LSM BPF map */
#endif
unit_modify_nft_set(u, /* add = */ false);
@@ -3987,7 +3987,7 @@ static int cg_bpf_mask_supported(CGroupMask *ret) {
mask |= CGROUP_MASK_BPF_SOCKET_BIND;
/* BPF-based cgroup_skb/{egress|ingress} hooks */
r = restrict_network_interfaces_supported();
r = bpf_restrict_ifaces_supported();
if (r < 0)
return r;
if (r > 0)
src/core/cgroup.h
+1 -1
View File
@@ -3,7 +3,7 @@
#include <stdbool.h>
#include "bpf-lsm.h"
#include "bpf-restrict-fs.h"
#include "cgroup-util.h"
#include "cpu-set-util.h"
#include "firewall-util.h"
src/core/dbus-execute.c
+1 -1
View File
@@ -1898,7 +1898,7 @@ int bus_exec_context_set_transient_property(
c->restrict_filesystems_allow_list = allow_list;
STRV_FOREACH(s, l) {
r = lsm_bpf_parse_filesystem(
r = bpf_restrict_fs_parse_filesystem(
*s,
&c->restrict_filesystems,
FILESYSTEM_PARSE_LOG|
src/core/exec-invoke.c
+4 -4
View File
@@ -22,7 +22,7 @@
#include "argv-util.h"
#include "barrier.h"
#include "bpf-dlopen.h"
#include "bpf-lsm.h"
#include "bpf-restrict-fs.h"
#include "btrfs-util.h"
#include "capability-util.h"
#include "cgroup-setup.h"
@@ -1704,7 +1704,7 @@ static int apply_restrict_filesystems(const ExecContext *c, const ExecParameters
if (!exec_context_restrict_filesystems_set(c))
return 0;
if (p->bpf_outer_map_fd < 0) {
if (p->bpf_restrict_fs_map_fd < 0) {
/* LSM BPF is unsupported or lsm_bpf_setup failed */
log_exec_debug(c, p, "LSM BPF not supported, skipping RestrictFileSystems=");
return 0;
@@ -1715,7 +1715,7 @@ static int apply_restrict_filesystems(const ExecContext *c, const ExecParameters
if (r < 0)
return r;
return lsm_bpf_restrict_filesystems(c->restrict_filesystems, p->cgroup_id, p->bpf_outer_map_fd, c->restrict_filesystems_allow_list);
return bpf_restrict_fs_update(c->restrict_filesystems, p->cgroup_id, p->bpf_restrict_fs_map_fd, c->restrict_filesystems_allow_list);
}
#endif
@@ -4139,7 +4139,7 @@ int exec_invoke(
}
#if HAVE_LIBBPF
r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, &params->bpf_outer_map_fd);
r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, &params->bpf_restrict_fs_map_fd);
if (r < 0) {
*exit_status = EXIT_FDS;
return log_exec_error_errno(context, params, r, "Failed to collect shifted fd: %m");
src/core/execute-serialize.c
+2 -2
View File
@@ -1365,7 +1365,7 @@ static int exec_parameters_serialize(const ExecParameters *p, const ExecContext
return r;
if (c && exec_context_restrict_filesystems_set(c)) {
r = serialize_fd(f, fds, "exec-parameters-bpf-outer-map-fd", p->bpf_outer_map_fd);
r = serialize_fd(f, fds, "exec-parameters-bpf-outer-map-fd", p->bpf_restrict_fs_map_fd);
if (r < 0)
return r;
}
@@ -1618,7 +1618,7 @@ static int exec_parameters_deserialize(ExecParameters *p, FILE *f, FDSet *fds) {
if (fd < 0)
continue;
p->bpf_outer_map_fd = fd;
p->bpf_restrict_fs_map_fd = fd;
} else if ((val = startswith(l, "exec-parameters-notify-socket="))) {
r = free_and_strdup(&p->notify_socket, val);
if (r < 0)
src/core/execute.c
+1 -1
View File
@@ -2499,7 +2499,7 @@ void exec_params_shallow_clear(ExecParameters *p) {
p->fds = mfree(p->fds);
p->exec_fd = safe_close(p->exec_fd);
p->user_lookup_fd = -EBADF;
p->bpf_outer_map_fd = -EBADF;
p->bpf_restrict_fs_map_fd = -EBADF;
p->unit_id = mfree(p->unit_id);
p->invocation_id = SD_ID128_NULL;
p->invocation_id_string[0] = '\0';
src/core/execute.h
+12 -11
View File
@@ -453,7 +453,8 @@ struct ExecParameters {
char **files_env;
int user_lookup_fd;
int bpf_outer_map_fd;
int bpf_restrict_fs_map_fd;
/* Used for logging in the executor functions */
char *unit_id;
@@ -461,16 +462,16 @@ struct ExecParameters {
char invocation_id_string[SD_ID128_STRING_MAX];
};
#define EXEC_PARAMETERS_INIT(_flags) \
(ExecParameters) { \
.flags = (_flags), \
.stdin_fd = -EBADF, \
.stdout_fd = -EBADF, \
.stderr_fd = -EBADF, \
.exec_fd = -EBADF, \
.bpf_outer_map_fd = -EBADF, \
.user_lookup_fd = -EBADF, \
};
#define EXEC_PARAMETERS_INIT(_flags) \
(ExecParameters) { \
.flags = (_flags), \
.stdin_fd = -EBADF, \
.stdout_fd = -EBADF, \
.stderr_fd = -EBADF, \
.exec_fd = -EBADF, \
.bpf_restrict_fs_map_fd = -EBADF, \
.user_lookup_fd = -EBADF, \
}
#include "unit.h"
#include "dynamic-user.h"
src/core/fuzz-execute-serialize.c
+1 -1
View File
@@ -56,7 +56,7 @@ static void exec_fuzz_one(FILE *f, FDSet *fdset) {
params.stderr_fd = -EBADF;
params.exec_fd = -EBADF;
params.user_lookup_fd = -EBADF;
params.bpf_outer_map_fd = -EBADF;
params.bpf_restrict_fs_map_fd = -EBADF;
if (!params.fds)
params.n_socket_fds = params.n_storage_fds = 0;
for (size_t i = 0; params.fds && i < params.n_socket_fds + params.n_storage_fds; i++)
src/core/load-fragment.c
+2 -2
View File
@@ -16,8 +16,8 @@
#include "all-units.h"
#include "alloc-util.h"
#include "bpf-firewall.h"
#include "bpf-lsm.h"
#include "bpf-program.h"
#include "bpf-restrict-fs.h"
#include "bpf-socket-bind.h"
#include "bus-error.h"
#include "bus-internal.h"
@@ -3697,7 +3697,7 @@ int config_parse_restrict_filesystems(
break;
}
r = lsm_bpf_parse_filesystem(
r = bpf_restrict_fs_parse_filesystem(
word,
&c->restrict_filesystems,
FILESYSTEM_PARSE_LOG|
src/core/main.c
+1 -1
View File
@@ -21,7 +21,7 @@
#include "architecture.h"
#include "argv-util.h"
#if HAVE_LIBBPF
#include "bpf-lsm.h"
#include "bpf-restrict-fs.h"
#endif
#include "build.h"
#include "bus-error.h"
src/core/manager.c
+3 -3
View File
@@ -992,8 +992,8 @@ int manager_new(RuntimeScope runtime_scope, ManagerTestRunFlags test_run_flags,
return r;
#if HAVE_LIBBPF
if (MANAGER_IS_SYSTEM(m) && lsm_bpf_supported(/* initialize = */ true)) {
r = lsm_bpf_setup(m);
if (MANAGER_IS_SYSTEM(m) && bpf_restrict_fs_supported(/* initialize = */ true)) {
r = bpf_restrict_fs_setup(m);
if (r < 0)
log_warning_errno(r, "Failed to setup LSM BPF, ignoring: %m");
}
@@ -1710,7 +1710,7 @@ Manager* manager_free(Manager *m) {
m->fw_ctx = fw_ctx_free(m->fw_ctx);
#if BPF_FRAMEWORK
lsm_bpf_destroy(m->restrict_fs);
bpf_restrict_fs_destroy(m->restrict_fs);
#endif
safe_close(m->executor_fd);
src/core/meson.build
+2 -2
View File
@@ -7,7 +7,8 @@ libcore_sources = files(
'bpf-devices.c',
'bpf-firewall.c',
'bpf-foreign.c',
'bpf-lsm.c',
'bpf-restrict-fs.c',
'bpf-restrict-ifaces.c',
'bpf-socket-bind.c',
'cgroup.c',
'core-varlink.c',
@@ -51,7 +52,6 @@ libcore_sources = files(
'mount.c',
'namespace.c',
'path.c',
'restrict-ifaces.c',
'scope.c',
'selinux-access.c',
'selinux-setup.c',
src/core/unit-serialize.c
+4 -4
View File
@@ -1,5 +1,6 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include "bpf-restrict-ifaces.h"
#include "bpf-socket-bind.h"
#include "bus-util.h"
#include "dbus.h"
@@ -7,7 +8,6 @@
#include "fileio.h"
#include "format-util.h"
#include "parse-util.h"
#include "restrict-ifaces.h"
#include "serialize.h"
#include "string-table.h"
#include "unit-serialize.h"
@@ -191,7 +191,7 @@ int unit_serialize_state(Unit *u, FILE *f, FDSet *fds, bool switching_root) {
(void) serialize_cgroup_mask(f, "cgroup-enabled-mask", u->cgroup_enabled_mask);
(void) serialize_cgroup_mask(f, "cgroup-invalidated-mask", u->cgroup_invalidated_mask);
(void) bpf_serialize_socket_bind(u, f, fds);
(void) bpf_socket_bind_serialize(u, f, fds);
(void) bpf_program_serialize_attachment(f, fds, "ip-bpf-ingress-installed", u->ip_bpf_ingress_installed);
(void) bpf_program_serialize_attachment(f, fds, "ip-bpf-egress-installed", u->ip_bpf_egress_installed);
@@ -199,7 +199,7 @@ int unit_serialize_state(Unit *u, FILE *f, FDSet *fds, bool switching_root) {
(void) bpf_program_serialize_attachment_set(f, fds, "ip-bpf-custom-ingress-installed", u->ip_bpf_custom_ingress_installed);
(void) bpf_program_serialize_attachment_set(f, fds, "ip-bpf-custom-egress-installed", u->ip_bpf_custom_egress_installed);
(void) serialize_restrict_network_interfaces(u, f, fds);
(void) bpf_restrict_ifaces_serialize(u, f, fds);
if (uid_is_valid(u->ref_uid))
(void) serialize_item_format(f, "ref-uid", UID_FMT, u->ref_uid);
@@ -445,7 +445,7 @@ int unit_deserialize_state(Unit *u, FILE *f, FDSet *fds) {
fd = deserialize_fd(fds, v);
if (fd >= 0)
(void) restrict_network_interfaces_add_initial_link_fd(u, fd);
(void) bpf_restrict_ifaces_add_initial_link_fd(u, fd);
continue;
src/core/unit.c
+3 -3
View File
@@ -5355,12 +5355,12 @@ int unit_set_exec_params(Unit *u, ExecParameters *p) {
p->fallback_smack_process_label = u->manager->defaults.smack_process_label;
if (u->manager->restrict_fs && p->bpf_outer_map_fd < 0) {
int fd = lsm_bpf_map_restrict_fs_fd(u);
if (u->manager->restrict_fs && p->bpf_restrict_fs_map_fd < 0) {
int fd = bpf_restrict_fs_map_fd(u);
if (fd < 0)
return fd;
p->bpf_outer_map_fd = fd;
p->bpf_restrict_fs_map_fd = fd;
}
p->user_lookup_fd = u->manager->user_lookup_fds[1];
src/test/meson.build
+1 -1
View File
@@ -478,7 +478,7 @@ executables += [
'sources' : files('test-bpf-foreign-programs.c'),
},
core_test_template + {
'sources' : files('test-bpf-lsm.c'),
'sources' : files('test-bpf-restrict-fs.c'),
'dependencies' : common_test_dependencies,
},
core_test_template + {
src/test/test-bpf-lsm.c → src/test/test-bpf-restrict-fs.c
+2 -2
View File
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include "bpf-lsm.h"
#include "bpf-restrict-fs.h"
#include "load-fragment.h"
#include "manager.h"
#include "process-util.h"
@@ -75,7 +75,7 @@ int main(int argc, char *argv[]) {
if (!can_memlock())
return log_tests_skipped("Can't use mlock()");
if (!lsm_bpf_supported(/* initialize = */ true))
if (!bpf_restrict_fs_supported(/* initialize = */ true))
return log_tests_skipped("LSM BPF hooks are not supported");
r = enter_cgroup_subroot(NULL);