From 169b56758b9cad5136eeaf7a790eef0f94e86f19 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 25 Jan 2024 13:41:46 +0100 Subject: [PATCH 1/5] =?UTF-8?q?core:=20rename=20"bpf-lsm.[ch]"=20=E2=86=92?= =?UTF-8?q?=20"bpf-restrict-fs.[ch]"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This file is a bit misnamed. What it actually implements is one specific BPF LSM module, that restricts file systems. As such it really should be named after that, and not primarily by the mechanism it uses for that. With this our glue code is now named the same way as the actual bpf code files in src/core/bpf/, thus things become a bit more symmetric. This is particular relevant as we'll soon have another BPF LSM in our tree, see #26826, and we should be able to distinguish them by name. This commit just renames the files and does some dumb search/replace of the string. A follow-up commit will name some functions more expressively inside the files. --- src/core/{bpf-lsm.c => bpf-restrict-fs.c} | 46 +++++++++---------- src/core/{bpf-lsm.h => bpf-restrict-fs.h} | 0 src/core/cgroup.h | 2 +- src/core/exec-invoke.c | 2 +- src/core/load-fragment.c | 2 +- src/core/main.c | 2 +- src/core/meson.build | 2 +- src/test/meson.build | 2 +- ...{test-bpf-lsm.c => test-bpf-restrict-fs.c} | 2 +- 9 files changed, 30 insertions(+), 30 deletions(-) rename src/core/{bpf-lsm.c => bpf-restrict-fs.c} (82%) rename src/core/{bpf-lsm.h => bpf-restrict-fs.h} (100%) rename src/test/{test-bpf-lsm.c => test-bpf-restrict-fs.c} (99%) diff --git a/src/core/bpf-lsm.c b/src/core/bpf-restrict-fs.c similarity index 82% rename from src/core/bpf-lsm.c rename to src/core/bpf-restrict-fs.c index 216fc341c1..14ef52faf1 100644 --- a/src/core/bpf-lsm.c +++ b/src/core/bpf-restrict-fs.c @@ -10,7 +10,7 @@ #include #include "alloc-util.h" -#include "bpf-lsm.h" +#include "bpf-restrict-fs.h" #include "cgroup-util.h" #include "fd-util.h" #include "fileio.h" @@ -63,29 +63,29 @@ static int prepare_restrict_fs_bpf(struct restrict_fs_bpf **ret_obj) { obj = restrict_fs_bpf__open(); if (!obj) - return log_error_errno(errno, "bpf-lsm: Failed to open BPF object: %m"); + return log_error_errno(errno, "bpf-restrict-fs: Failed to open BPF object: %m"); /* TODO Maybe choose a number based on runtime information? */ r = sym_bpf_map__set_max_entries(obj->maps.cgroup_hash, CGROUP_HASH_SIZE_MAX); assert(r <= 0); if (r < 0) - return log_error_errno(r, "bpf-lsm: Failed to resize BPF map '%s': %m", + return log_error_errno(r, "bpf-restrict-fs: Failed to resize BPF map '%s': %m", sym_bpf_map__name(obj->maps.cgroup_hash)); /* Dummy map to satisfy the verifier */ inner_map_fd = compat_bpf_map_create(BPF_MAP_TYPE_HASH, NULL, sizeof(uint32_t), sizeof(uint32_t), 128U, NULL); if (inner_map_fd < 0) - return log_error_errno(errno, "bpf-lsm: Failed to create BPF map: %m"); + return log_error_errno(errno, "bpf-restrict-fs: Failed to create BPF map: %m"); r = sym_bpf_map__set_inner_map_fd(obj->maps.cgroup_hash, inner_map_fd); assert(r <= 0); if (r < 0) - return log_error_errno(r, "bpf-lsm: Failed to set inner map fd: %m"); + return log_error_errno(r, "bpf-restrict-fs: Failed to set inner map fd: %m"); r = restrict_fs_bpf__load(obj); assert(r <= 0); if (r < 0) - return log_error_errno(r, "bpf-lsm: Failed to load BPF object: %m"); + return log_error_errno(r, "bpf-restrict-fs: Failed to load BPF object: %m"); *ret_obj = TAKE_PTR(obj); @@ -107,12 +107,12 @@ bool lsm_bpf_supported(bool initialize) { r = lsm_supported("bpf"); if (r < 0) { - log_warning_errno(r, "bpf-lsm: Can't determine whether the BPF LSM module is used: %m"); + log_warning_errno(r, "bpf-restrict-fs: Can't determine whether the BPF LSM module is used: %m"); return (supported = false); } if (r == 0) { log_info_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), - "bpf-lsm: BPF LSM hook not enabled in the kernel, BPF LSM not supported"); + "bpf-restrict-fs: BPF LSM hook not enabled in the kernel, BPF LSM not supported"); return (supported = false); } @@ -122,7 +122,7 @@ bool lsm_bpf_supported(bool initialize) { if (!bpf_can_link_lsm_program(obj->progs.restrict_filesystems)) { log_warning_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), - "bpf-lsm: Failed to link program; assuming BPF LSM is not available"); + "bpf-restrict-fs: Failed to link program; assuming BPF LSM is not available"); return (supported = false); } @@ -143,10 +143,10 @@ int lsm_bpf_setup(Manager *m) { link = sym_bpf_program__attach_lsm(obj->progs.restrict_filesystems); r = sym_libbpf_get_error(link); if (r != 0) - return log_error_errno(r, "bpf-lsm: Failed to link '%s' LSM BPF program: %m", + return log_error_errno(r, "bpf-restrict-fs: Failed to link '%s' LSM BPF program: %m", sym_bpf_program__name(obj->progs.restrict_filesystems)); - log_info("bpf-lsm: LSM BPF program attached"); + log_info("bpf-restrict-fs: LSM BPF program attached"); obj->links.restrict_filesystems = TAKE_PTR(link); m->restrict_fs = TAKE_PTR(obj); @@ -171,35 +171,35 @@ int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int 128U, /* Should be enough for all filesystem types */ NULL); if (inner_map_fd < 0) - return log_error_errno(errno, "bpf-lsm: Failed to create inner BPF map: %m"); + return log_error_errno(errno, "bpf-restrict-fs: Failed to create inner BPF map: %m"); if (sym_bpf_map_update_elem(outer_map_fd, &cgroup_id, &inner_map_fd, BPF_ANY) != 0) - return log_error_errno(errno, "bpf-lsm: Error populating BPF map: %m"); + return log_error_errno(errno, "bpf-restrict-fs: Error populating BPF map: %m"); uint32_t allow = allow_list; /* Use key 0 to store whether this is an allow list or a deny list */ if (sym_bpf_map_update_elem(inner_map_fd, &zero, &allow, BPF_ANY) != 0) - return log_error_errno(errno, "bpf-lsm: Error initializing map: %m"); + return log_error_errno(errno, "bpf-restrict-fs: Error initializing map: %m"); SET_FOREACH(fs, filesystems) { r = fs_type_from_string(fs, &magic); if (r < 0) { - log_warning("bpf-lsm: Invalid filesystem name '%s', ignoring.", fs); + log_warning("bpf-restrict-fs: Invalid filesystem name '%s', ignoring.", fs); continue; } - log_debug("bpf-lsm: Restricting filesystem access to '%s'", fs); + log_debug("bpf-restrict-fs: Restricting filesystem access to '%s'", fs); for (int i = 0; i < FILESYSTEM_MAGIC_MAX; i++) { if (magic[i] == 0) break; if (sym_bpf_map_update_elem(inner_map_fd, &magic[i], &dummy_value, BPF_ANY) != 0) { - r = log_error_errno(errno, "bpf-lsm: Failed to update BPF map: %m"); + r = log_error_errno(errno, "bpf-restrict-fs: Failed to update BPF map: %m"); if (sym_bpf_map_delete_elem(outer_map_fd, &cgroup_id) != 0) - log_debug_errno(errno, "bpf-lsm: Failed to delete cgroup entry from BPF map: %m"); + log_debug_errno(errno, "bpf-restrict-fs: Failed to delete cgroup entry from BPF map: %m"); return r; } @@ -225,10 +225,10 @@ int lsm_bpf_cleanup(const Unit *u) { int fd = sym_bpf_map__fd(u->manager->restrict_fs->maps.cgroup_hash); if (fd < 0) - return log_unit_error_errno(u, errno, "bpf-lsm: Failed to get BPF map fd: %m"); + return log_unit_error_errno(u, errno, "bpf-restrict-fs: Failed to get BPF map fd: %m"); if (sym_bpf_map_delete_elem(fd, &u->cgroup_id) != 0 && errno != ENOENT) - return log_unit_debug_errno(u, errno, "bpf-lsm: Failed to delete cgroup entry from LSM BPF map: %m"); + return log_unit_debug_errno(u, errno, "bpf-restrict-fs: Failed to delete cgroup entry from LSM BPF map: %m"); return 0; } @@ -252,11 +252,11 @@ bool lsm_bpf_supported(bool initialize) { } int lsm_bpf_setup(Manager *m) { - return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-lsm: Failed to set up LSM BPF: %m"); + return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-restrict-fs: Failed to set up LSM BPF: %m"); } int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, const bool allow_list) { - return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-lsm: Failed to restrict filesystems using LSM BPF: %m"); + return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-restrict-fs: Failed to restrict filesystems using LSM BPF: %m"); } int lsm_bpf_cleanup(const Unit *u) { @@ -290,7 +290,7 @@ int lsm_bpf_parse_filesystem( set = filesystem_set_find(name); if (!set) { log_syntax(unit, flags & FILESYSTEM_PARSE_LOG ? LOG_WARNING : LOG_DEBUG, filename, line, 0, - "bpf-lsm: Unknown filesystem group, ignoring: %s", name); + "bpf-restrict-fs: Unknown filesystem group, ignoring: %s", name); return 0; } diff --git a/src/core/bpf-lsm.h b/src/core/bpf-restrict-fs.h similarity index 100% rename from src/core/bpf-lsm.h rename to src/core/bpf-restrict-fs.h diff --git a/src/core/cgroup.h b/src/core/cgroup.h index 6cb04f4eb2..d834cb8bbd 100644 --- a/src/core/cgroup.h +++ b/src/core/cgroup.h @@ -3,7 +3,7 @@ #include -#include "bpf-lsm.h" +#include "bpf-restrict-fs.h" #include "cgroup-util.h" #include "cpu-set-util.h" #include "firewall-util.h" diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c index 829e094f51..b98e9e6a4b 100644 --- a/src/core/exec-invoke.c +++ b/src/core/exec-invoke.c @@ -22,7 +22,7 @@ #include "argv-util.h" #include "barrier.h" #include "bpf-dlopen.h" -#include "bpf-lsm.h" +#include "bpf-restrict-fs.h" #include "btrfs-util.h" #include "capability-util.h" #include "cgroup-setup.h" diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c index 5f4e642e54..cecd01fdcf 100644 --- a/src/core/load-fragment.c +++ b/src/core/load-fragment.c @@ -16,8 +16,8 @@ #include "all-units.h" #include "alloc-util.h" #include "bpf-firewall.h" -#include "bpf-lsm.h" #include "bpf-program.h" +#include "bpf-restrict-fs.h" #include "bpf-socket-bind.h" #include "bus-error.h" #include "bus-internal.h" diff --git a/src/core/main.c b/src/core/main.c index 10f60c2425..1e66770df0 100644 --- a/src/core/main.c +++ b/src/core/main.c @@ -21,7 +21,7 @@ #include "architecture.h" #include "argv-util.h" #if HAVE_LIBBPF -#include "bpf-lsm.h" +#include "bpf-restrict-fs.h" #endif #include "build.h" #include "bus-error.h" diff --git a/src/core/meson.build b/src/core/meson.build index 7701d3de0a..a32f0739ce 100644 --- a/src/core/meson.build +++ b/src/core/meson.build @@ -7,7 +7,7 @@ libcore_sources = files( 'bpf-devices.c', 'bpf-firewall.c', 'bpf-foreign.c', - 'bpf-lsm.c', + 'bpf-restrict-fs.c', 'bpf-socket-bind.c', 'cgroup.c', 'core-varlink.c', diff --git a/src/test/meson.build b/src/test/meson.build index 5acf5b4a61..ef741388d5 100644 --- a/src/test/meson.build +++ b/src/test/meson.build @@ -478,7 +478,7 @@ executables += [ 'sources' : files('test-bpf-foreign-programs.c'), }, core_test_template + { - 'sources' : files('test-bpf-lsm.c'), + 'sources' : files('test-bpf-restrict-fs.c'), 'dependencies' : common_test_dependencies, }, core_test_template + { diff --git a/src/test/test-bpf-lsm.c b/src/test/test-bpf-restrict-fs.c similarity index 99% rename from src/test/test-bpf-lsm.c rename to src/test/test-bpf-restrict-fs.c index 42ea64cd0a..b629393217 100644 --- a/src/test/test-bpf-lsm.c +++ b/src/test/test-bpf-restrict-fs.c @@ -1,6 +1,6 @@ /* SPDX-License-Identifier: LGPL-2.1-or-later */ -#include "bpf-lsm.h" +#include "bpf-restrict-fs.h" #include "load-fragment.h" #include "manager.h" #include "process-util.h" From 352ec23c7f7d487c483137f93a64ea17e7d1ede9 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 25 Jan 2024 13:56:32 +0100 Subject: [PATCH 2/5] bpf-restrict-fs: also rename functions to bpf_restrict_fs_xyz() Rename the functions too, to make clear this is really just about the restrict-fs, and not generic LSM_BPF code. --- src/core/bpf-restrict-fs.c | 30 +++++++++++++++--------------- src/core/bpf-restrict-fs.h | 19 +++++++------------ src/core/cgroup.c | 2 +- src/core/dbus-execute.c | 2 +- src/core/exec-invoke.c | 6 +++--- src/core/execute-serialize.c | 4 ++-- src/core/execute.c | 2 +- src/core/execute.h | 23 ++++++++++++----------- src/core/fuzz-execute-serialize.c | 2 +- src/core/load-fragment.c | 2 +- src/core/manager.c | 6 +++--- src/core/unit.c | 6 +++--- src/test/test-bpf-restrict-fs.c | 2 +- 13 files changed, 51 insertions(+), 55 deletions(-) diff --git a/src/core/bpf-restrict-fs.c b/src/core/bpf-restrict-fs.c index 14ef52faf1..15ef86d50f 100644 --- a/src/core/bpf-restrict-fs.c +++ b/src/core/bpf-restrict-fs.c @@ -92,7 +92,7 @@ static int prepare_restrict_fs_bpf(struct restrict_fs_bpf **ret_obj) { return 0; } -bool lsm_bpf_supported(bool initialize) { +bool bpf_restrict_fs_supported(bool initialize) { _cleanup_(restrict_fs_bpf_freep) struct restrict_fs_bpf *obj = NULL; static int supported = -1; int r; @@ -129,7 +129,7 @@ bool lsm_bpf_supported(bool initialize) { return (supported = true); } -int lsm_bpf_setup(Manager *m) { +int bpf_restrict_fs_setup(Manager *m) { _cleanup_(restrict_fs_bpf_freep) struct restrict_fs_bpf *obj = NULL; _cleanup_(bpf_link_freep) struct bpf_link *link = NULL; int r; @@ -154,7 +154,7 @@ int lsm_bpf_setup(Manager *m) { return 0; } -int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list) { +int bpf_restrict_fs_update(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list) { uint32_t dummy_value = 1, zero = 0; const char *fs; const statfs_f_type_t *magic; @@ -209,12 +209,12 @@ int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int return 0; } -int lsm_bpf_cleanup(const Unit *u) { +int bpf_restrict_fs_cleanup(const Unit *u) { assert(u); assert(u->manager); /* If we never successfully detected support, there is nothing to clean up. */ - if (!lsm_bpf_supported(/* initialize = */ false)) + if (!bpf_restrict_fs_supported(/* initialize = */ false)) return 0; if (!u->manager->restrict_fs) @@ -233,7 +233,7 @@ int lsm_bpf_cleanup(const Unit *u) { return 0; } -int lsm_bpf_map_restrict_fs_fd(Unit *unit) { +int bpf_restrict_fs_map_fd(Unit *unit) { assert(unit); assert(unit->manager); @@ -243,36 +243,36 @@ int lsm_bpf_map_restrict_fs_fd(Unit *unit) { return sym_bpf_map__fd(unit->manager->restrict_fs->maps.cgroup_hash); } -void lsm_bpf_destroy(struct restrict_fs_bpf *prog) { +void bpf_restrict_fs_destroy(struct restrict_fs_bpf *prog) { restrict_fs_bpf__destroy(prog); } #else /* ! BPF_FRAMEWORK */ -bool lsm_bpf_supported(bool initialize) { +bool bpf_restrict_fs_supported(bool initialize) { return false; } -int lsm_bpf_setup(Manager *m) { +int bpf_restrict_fs_setup(Manager *m) { return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-restrict-fs: Failed to set up LSM BPF: %m"); } -int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, const bool allow_list) { +int bpf_restrict_fs_update(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, const bool allow_list) { return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-restrict-fs: Failed to restrict filesystems using LSM BPF: %m"); } -int lsm_bpf_cleanup(const Unit *u) { +int bpf_restrict_fs_cleanup(const Unit *u) { return 0; } -int lsm_bpf_map_restrict_fs_fd(Unit *unit) { +int bpf_restrict_fs_map_fd(Unit *unit) { return -ENOMEDIUM; } -void lsm_bpf_destroy(struct restrict_fs_bpf *prog) { +void bpf_restrict_fs_destroy(struct restrict_fs_bpf *prog) { return; } #endif -int lsm_bpf_parse_filesystem( +int bpf_restrict_fs_parse_filesystem( const char *name, Set **filesystems, FilesystemParseFlags flags, @@ -299,7 +299,7 @@ int lsm_bpf_parse_filesystem( * (i.e. take away the FILESYSTEM_PARSE_LOG flag) since any issues in the group table * are our own problem, not a problem in user configuration data and we shouldn't * pretend otherwise by complaining about them. */ - r = lsm_bpf_parse_filesystem(i, filesystems, flags &~ FILESYSTEM_PARSE_LOG, unit, filename, line); + r = bpf_restrict_fs_parse_filesystem(i, filesystems, flags &~ FILESYSTEM_PARSE_LOG, unit, filename, line); if (r < 0) return r; } diff --git a/src/core/bpf-restrict-fs.h b/src/core/bpf-restrict-fs.h index a6eda193fe..ffb360b117 100644 --- a/src/core/bpf-restrict-fs.h +++ b/src/core/bpf-restrict-fs.h @@ -14,15 +14,10 @@ typedef struct Manager Manager; typedef struct restrict_fs_bpf restrict_fs_bpf; -bool lsm_bpf_supported(bool initialize); -int lsm_bpf_setup(Manager *m); -int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list); -int lsm_bpf_cleanup(const Unit *u); -int lsm_bpf_map_restrict_fs_fd(Unit *u); -void lsm_bpf_destroy(struct restrict_fs_bpf *prog); -int lsm_bpf_parse_filesystem(const char *name, - Set **filesystems, - FilesystemParseFlags flags, - const char *unit, - const char *filename, - unsigned line); +bool bpf_restrict_fs_supported(bool initialize); +int bpf_restrict_fs_setup(Manager *m); +int bpf_restrict_fs_update(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list); +int bpf_restrict_fs_cleanup(const Unit *u); +int bpf_restrict_fs_map_fd(Unit *u); +void bpf_restrict_fs_destroy(struct restrict_fs_bpf *prog); +int bpf_restrict_fs_parse_filesystem(const char *name, Set **filesystems, FilesystemParseFlags flags, const char *unit, const char *filename, unsigned line); diff --git a/src/core/cgroup.c b/src/core/cgroup.c index 6c37856faf..7f360de496 100644 --- a/src/core/cgroup.c +++ b/src/core/cgroup.c @@ -3451,7 +3451,7 @@ void unit_prune_cgroup(Unit *u) { (void) unit_get_memory_accounting(u, metric, /* ret = */ NULL); #if BPF_FRAMEWORK - (void) lsm_bpf_cleanup(u); /* Remove cgroup from the global LSM BPF map */ + (void) bpf_restrict_fs_cleanup(u); /* Remove cgroup from the global LSM BPF map */ #endif unit_modify_nft_set(u, /* add = */ false); diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c index 602fec1314..cad6a200b5 100644 --- a/src/core/dbus-execute.c +++ b/src/core/dbus-execute.c @@ -1898,7 +1898,7 @@ int bus_exec_context_set_transient_property( c->restrict_filesystems_allow_list = allow_list; STRV_FOREACH(s, l) { - r = lsm_bpf_parse_filesystem( + r = bpf_restrict_fs_parse_filesystem( *s, &c->restrict_filesystems, FILESYSTEM_PARSE_LOG| diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c index b98e9e6a4b..ab13f0342a 100644 --- a/src/core/exec-invoke.c +++ b/src/core/exec-invoke.c @@ -1704,7 +1704,7 @@ static int apply_restrict_filesystems(const ExecContext *c, const ExecParameters if (!exec_context_restrict_filesystems_set(c)) return 0; - if (p->bpf_outer_map_fd < 0) { + if (p->bpf_restrict_fs_map_fd < 0) { /* LSM BPF is unsupported or lsm_bpf_setup failed */ log_exec_debug(c, p, "LSM BPF not supported, skipping RestrictFileSystems="); return 0; @@ -1715,7 +1715,7 @@ static int apply_restrict_filesystems(const ExecContext *c, const ExecParameters if (r < 0) return r; - return lsm_bpf_restrict_filesystems(c->restrict_filesystems, p->cgroup_id, p->bpf_outer_map_fd, c->restrict_filesystems_allow_list); + return bpf_restrict_fs_update(c->restrict_filesystems, p->cgroup_id, p->bpf_restrict_fs_map_fd, c->restrict_filesystems_allow_list); } #endif @@ -4139,7 +4139,7 @@ int exec_invoke( } #if HAVE_LIBBPF - r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, ¶ms->bpf_outer_map_fd); + r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, ¶ms->bpf_restrict_fs_map_fd); if (r < 0) { *exit_status = EXIT_FDS; return log_exec_error_errno(context, params, r, "Failed to collect shifted fd: %m"); diff --git a/src/core/execute-serialize.c b/src/core/execute-serialize.c index ccfc00c6e9..c7cda98ff0 100644 --- a/src/core/execute-serialize.c +++ b/src/core/execute-serialize.c @@ -1365,7 +1365,7 @@ static int exec_parameters_serialize(const ExecParameters *p, const ExecContext return r; if (c && exec_context_restrict_filesystems_set(c)) { - r = serialize_fd(f, fds, "exec-parameters-bpf-outer-map-fd", p->bpf_outer_map_fd); + r = serialize_fd(f, fds, "exec-parameters-bpf-outer-map-fd", p->bpf_restrict_fs_map_fd); if (r < 0) return r; } @@ -1618,7 +1618,7 @@ static int exec_parameters_deserialize(ExecParameters *p, FILE *f, FDSet *fds) { if (fd < 0) continue; - p->bpf_outer_map_fd = fd; + p->bpf_restrict_fs_map_fd = fd; } else if ((val = startswith(l, "exec-parameters-notify-socket="))) { r = free_and_strdup(&p->notify_socket, val); if (r < 0) diff --git a/src/core/execute.c b/src/core/execute.c index 5c10aabc7e..d4095ae01a 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -2499,7 +2499,7 @@ void exec_params_shallow_clear(ExecParameters *p) { p->fds = mfree(p->fds); p->exec_fd = safe_close(p->exec_fd); p->user_lookup_fd = -EBADF; - p->bpf_outer_map_fd = -EBADF; + p->bpf_restrict_fs_map_fd = -EBADF; p->unit_id = mfree(p->unit_id); p->invocation_id = SD_ID128_NULL; p->invocation_id_string[0] = '\0'; diff --git a/src/core/execute.h b/src/core/execute.h index e3708e1b01..6f91309b16 100644 --- a/src/core/execute.h +++ b/src/core/execute.h @@ -453,7 +453,8 @@ struct ExecParameters { char **files_env; int user_lookup_fd; - int bpf_outer_map_fd; + + int bpf_restrict_fs_map_fd; /* Used for logging in the executor functions */ char *unit_id; @@ -461,16 +462,16 @@ struct ExecParameters { char invocation_id_string[SD_ID128_STRING_MAX]; }; -#define EXEC_PARAMETERS_INIT(_flags) \ - (ExecParameters) { \ - .flags = (_flags), \ - .stdin_fd = -EBADF, \ - .stdout_fd = -EBADF, \ - .stderr_fd = -EBADF, \ - .exec_fd = -EBADF, \ - .bpf_outer_map_fd = -EBADF, \ - .user_lookup_fd = -EBADF, \ - }; +#define EXEC_PARAMETERS_INIT(_flags) \ + (ExecParameters) { \ + .flags = (_flags), \ + .stdin_fd = -EBADF, \ + .stdout_fd = -EBADF, \ + .stderr_fd = -EBADF, \ + .exec_fd = -EBADF, \ + .bpf_restrict_fs_map_fd = -EBADF, \ + .user_lookup_fd = -EBADF, \ + } #include "unit.h" #include "dynamic-user.h" diff --git a/src/core/fuzz-execute-serialize.c b/src/core/fuzz-execute-serialize.c index 6069efd519..5b2dc952ad 100644 --- a/src/core/fuzz-execute-serialize.c +++ b/src/core/fuzz-execute-serialize.c @@ -56,7 +56,7 @@ static void exec_fuzz_one(FILE *f, FDSet *fdset) { params.stderr_fd = -EBADF; params.exec_fd = -EBADF; params.user_lookup_fd = -EBADF; - params.bpf_outer_map_fd = -EBADF; + params.bpf_restrict_fs_map_fd = -EBADF; if (!params.fds) params.n_socket_fds = params.n_storage_fds = 0; for (size_t i = 0; params.fds && i < params.n_socket_fds + params.n_storage_fds; i++) diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c index cecd01fdcf..819cbb2772 100644 --- a/src/core/load-fragment.c +++ b/src/core/load-fragment.c @@ -3697,7 +3697,7 @@ int config_parse_restrict_filesystems( break; } - r = lsm_bpf_parse_filesystem( + r = bpf_restrict_fs_parse_filesystem( word, &c->restrict_filesystems, FILESYSTEM_PARSE_LOG| diff --git a/src/core/manager.c b/src/core/manager.c index 47244a4a26..5014c3e1c8 100644 --- a/src/core/manager.c +++ b/src/core/manager.c @@ -992,8 +992,8 @@ int manager_new(RuntimeScope runtime_scope, ManagerTestRunFlags test_run_flags, return r; #if HAVE_LIBBPF - if (MANAGER_IS_SYSTEM(m) && lsm_bpf_supported(/* initialize = */ true)) { - r = lsm_bpf_setup(m); + if (MANAGER_IS_SYSTEM(m) && bpf_restrict_fs_supported(/* initialize = */ true)) { + r = bpf_restrict_fs_setup(m); if (r < 0) log_warning_errno(r, "Failed to setup LSM BPF, ignoring: %m"); } @@ -1710,7 +1710,7 @@ Manager* manager_free(Manager *m) { m->fw_ctx = fw_ctx_free(m->fw_ctx); #if BPF_FRAMEWORK - lsm_bpf_destroy(m->restrict_fs); + bpf_restrict_fs_destroy(m->restrict_fs); #endif safe_close(m->executor_fd); diff --git a/src/core/unit.c b/src/core/unit.c index 6496fc96d4..fd652df35b 100644 --- a/src/core/unit.c +++ b/src/core/unit.c @@ -5355,12 +5355,12 @@ int unit_set_exec_params(Unit *u, ExecParameters *p) { p->fallback_smack_process_label = u->manager->defaults.smack_process_label; - if (u->manager->restrict_fs && p->bpf_outer_map_fd < 0) { - int fd = lsm_bpf_map_restrict_fs_fd(u); + if (u->manager->restrict_fs && p->bpf_restrict_fs_map_fd < 0) { + int fd = bpf_restrict_fs_map_fd(u); if (fd < 0) return fd; - p->bpf_outer_map_fd = fd; + p->bpf_restrict_fs_map_fd = fd; } p->user_lookup_fd = u->manager->user_lookup_fds[1]; diff --git a/src/test/test-bpf-restrict-fs.c b/src/test/test-bpf-restrict-fs.c index b629393217..e1d56163ef 100644 --- a/src/test/test-bpf-restrict-fs.c +++ b/src/test/test-bpf-restrict-fs.c @@ -75,7 +75,7 @@ int main(int argc, char *argv[]) { if (!can_memlock()) return log_tests_skipped("Can't use mlock()"); - if (!lsm_bpf_supported(/* initialize = */ true)) + if (!bpf_restrict_fs_supported(/* initialize = */ true)) return log_tests_skipped("LSM BPF hooks are not supported"); r = enter_cgroup_subroot(NULL); From 62e22490205428fa557230bf72dc46516a07ee03 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 25 Jan 2024 14:02:24 +0100 Subject: [PATCH 3/5] =?UTF-8?q?core:=20rename=20restrict-ifaces.[ch]=20?= =?UTF-8?q?=E2=86=92=20bpf-restrict-ifaces.[ch]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's also clean-up naming of the "restrict-ifaces" BPF code. Let's name the userspace glue analogous to the actual bpf code in src/core/bpf. --- ...estrict-ifaces.c => bpf-restrict-ifaces.c} | 24 ++++++++++--------- ...estrict-ifaces.h => bpf-restrict-ifaces.h} | 8 +++---- src/core/cgroup.c | 6 ++--- src/core/meson.build | 2 +- src/core/unit-serialize.c | 6 ++--- 5 files changed, 24 insertions(+), 22 deletions(-) rename src/core/{restrict-ifaces.c => bpf-restrict-ifaces.c} (91%) rename src/core/{restrict-ifaces.h => bpf-restrict-ifaces.h} (52%) diff --git a/src/core/restrict-ifaces.c b/src/core/bpf-restrict-ifaces.c similarity index 91% rename from src/core/restrict-ifaces.c rename to src/core/bpf-restrict-ifaces.c index 4dd8656718..9cfe49a318 100644 --- a/src/core/restrict-ifaces.c +++ b/src/core/bpf-restrict-ifaces.c @@ -1,7 +1,7 @@ /* SPDX-License-Identifier: LGPL-2.1-or-later */ #include "fd-util.h" -#include "restrict-ifaces.h" +#include "bpf-restrict-ifaces.h" #include "netlink-util.h" #if BPF_FRAMEWORK @@ -72,7 +72,7 @@ static int prepare_restrict_ifaces_bpf( return 0; } -int restrict_network_interfaces_supported(void) { +int bpf_restrict_ifaces_supported(void) { _cleanup_(restrict_ifaces_bpf_freep) struct restrict_ifaces_bpf *obj = NULL; static int supported = -1; int r; @@ -97,7 +97,7 @@ int restrict_network_interfaces_supported(void) { return (supported = bpf_can_link_program(obj->progs.sd_restrictif_i)); } -static int restrict_network_interfaces_install_impl(Unit *u) { +static int restrict_ifaces_install_impl(Unit *u) { _cleanup_(bpf_link_freep) struct bpf_link *egress_link = NULL, *ingress_link = NULL; _cleanup_(restrict_ifaces_bpf_freep) struct restrict_ifaces_bpf *obj = NULL; _cleanup_free_ char *cgroup_path = NULL; @@ -143,13 +143,15 @@ static int restrict_network_interfaces_install_impl(Unit *u) { return 0; } -int restrict_network_interfaces_install(Unit *u) { - int r = restrict_network_interfaces_install_impl(u); +int bpf_restrict_ifaces_install(Unit *u) { + int r; + + r = restrict_ifaces_install_impl(u); fdset_close(u->initial_restric_ifaces_link_fds); return r; } -int serialize_restrict_network_interfaces(Unit *u, FILE *f, FDSet *fds) { +int bpf_restrict_ifaces_serialize(Unit *u, FILE *f, FDSet *fds) { int r; assert(u); @@ -161,7 +163,7 @@ int serialize_restrict_network_interfaces(Unit *u, FILE *f, FDSet *fds) { return bpf_serialize_link(f, fds, "restrict-ifaces-bpf-fd", u->restrict_ifaces_egress_bpf_link); } -int restrict_network_interfaces_add_initial_link_fd(Unit *u, int fd) { +int bpf_restrict_ifaces_add_initial_link_fd(Unit *u, int fd) { int r; assert(u); @@ -181,20 +183,20 @@ int restrict_network_interfaces_add_initial_link_fd(Unit *u, int fd) { } #else /* ! BPF_FRAMEWORK */ -int restrict_network_interfaces_supported(void) { +int bpf_restrict_ifaces_supported(void) { return 0; } -int restrict_network_interfaces_install(Unit *u) { +int bpf_restrict_ifaces_install(Unit *u) { return log_unit_debug_errno(u, SYNTHETIC_ERRNO(EOPNOTSUPP), "restrict-interfaces: Failed to install; BPF programs built from source code are not supported: %m"); } -int serialize_restrict_network_interfaces(Unit *u, FILE *f, FDSet *fds) { +int bpf_restrict_ifaces_serialize(Unit *u, FILE *f, FDSet *fds) { return 0; } -int restrict_network_interfaces_add_initial_link_fd(Unit *u, int fd) { +int bpf_restrict_ifaces_add_initial_link_fd(Unit *u, int fd) { return 0; } #endif diff --git a/src/core/restrict-ifaces.h b/src/core/bpf-restrict-ifaces.h similarity index 52% rename from src/core/restrict-ifaces.h rename to src/core/bpf-restrict-ifaces.h index 6e7a824364..28f74279f5 100644 --- a/src/core/restrict-ifaces.h +++ b/src/core/bpf-restrict-ifaces.h @@ -6,11 +6,11 @@ typedef struct Unit Unit; -int restrict_network_interfaces_supported(void); -int restrict_network_interfaces_install(Unit *u); +int bpf_restrict_ifaces_supported(void); +int bpf_restrict_ifaces_install(Unit *u); -int serialize_restrict_network_interfaces(Unit *u, FILE *f, FDSet *fds); +int bpf_restrict_ifaces_serialize(Unit *u, FILE *f, FDSet *fds); /* Add BPF link fd created before daemon-reload or daemon-reexec. * FDs will be closed at the end of restrict_network_interfaces_install. */ -int restrict_network_interfaces_add_initial_link_fd(Unit *u, int fd); +int bpf_restrict_ifaces_add_initial_link_fd(Unit *u, int fd); diff --git a/src/core/cgroup.c b/src/core/cgroup.c index 7f360de496..bc820b7d14 100644 --- a/src/core/cgroup.c +++ b/src/core/cgroup.c @@ -10,6 +10,7 @@ #include "bpf-devices.h" #include "bpf-firewall.h" #include "bpf-foreign.h" +#include "bpf-restrict-ifaces.h" #include "bpf-socket-bind.h" #include "btrfs-util.h" #include "bus-error.h" @@ -32,7 +33,6 @@ #include "percent-util.h" #include "process-util.h" #include "procfs-util.h" -#include "restrict-ifaces.h" #include "set.h" #include "special.h" #include "stdio-util.h" @@ -1849,7 +1849,7 @@ static void cgroup_apply_socket_bind(Unit *u) { static void cgroup_apply_restrict_network_interfaces(Unit *u) { assert(u); - (void) restrict_network_interfaces_install(u); + (void) bpf_restrict_ifaces_install(u); } static int cgroup_apply_devices(Unit *u) { @@ -3987,7 +3987,7 @@ static int cg_bpf_mask_supported(CGroupMask *ret) { mask |= CGROUP_MASK_BPF_SOCKET_BIND; /* BPF-based cgroup_skb/{egress|ingress} hooks */ - r = restrict_network_interfaces_supported(); + r = bpf_restrict_ifaces_supported(); if (r < 0) return r; if (r > 0) diff --git a/src/core/meson.build b/src/core/meson.build index a32f0739ce..bda4a3450e 100644 --- a/src/core/meson.build +++ b/src/core/meson.build @@ -8,6 +8,7 @@ libcore_sources = files( 'bpf-firewall.c', 'bpf-foreign.c', 'bpf-restrict-fs.c', + 'bpf-restrict-ifaces.c', 'bpf-socket-bind.c', 'cgroup.c', 'core-varlink.c', @@ -51,7 +52,6 @@ libcore_sources = files( 'mount.c', 'namespace.c', 'path.c', - 'restrict-ifaces.c', 'scope.c', 'selinux-access.c', 'selinux-setup.c', diff --git a/src/core/unit-serialize.c b/src/core/unit-serialize.c index 40cdb615be..7f07bc8e31 100644 --- a/src/core/unit-serialize.c +++ b/src/core/unit-serialize.c @@ -1,5 +1,6 @@ /* SPDX-License-Identifier: LGPL-2.1-or-later */ +#include "bpf-restrict-ifaces.h" #include "bpf-socket-bind.h" #include "bus-util.h" #include "dbus.h" @@ -7,7 +8,6 @@ #include "fileio.h" #include "format-util.h" #include "parse-util.h" -#include "restrict-ifaces.h" #include "serialize.h" #include "string-table.h" #include "unit-serialize.h" @@ -199,7 +199,7 @@ int unit_serialize_state(Unit *u, FILE *f, FDSet *fds, bool switching_root) { (void) bpf_program_serialize_attachment_set(f, fds, "ip-bpf-custom-ingress-installed", u->ip_bpf_custom_ingress_installed); (void) bpf_program_serialize_attachment_set(f, fds, "ip-bpf-custom-egress-installed", u->ip_bpf_custom_egress_installed); - (void) serialize_restrict_network_interfaces(u, f, fds); + (void) bpf_restrict_ifaces_serialize(u, f, fds); if (uid_is_valid(u->ref_uid)) (void) serialize_item_format(f, "ref-uid", UID_FMT, u->ref_uid); @@ -445,7 +445,7 @@ int unit_deserialize_state(Unit *u, FILE *f, FDSet *fds) { fd = deserialize_fd(fds, v); if (fd >= 0) - (void) restrict_network_interfaces_add_initial_link_fd(u, fd); + (void) bpf_restrict_ifaces_add_initial_link_fd(u, fd); continue; From 0e949cff539d678a901c1f0d6fedef5c40634059 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 25 Jan 2024 14:06:59 +0100 Subject: [PATCH 4/5] =?UTF-8?q?bpf-socket-bind:=20rename=20bpf=5Fserialize?= =?UTF-8?q?=5Fsocket=5Fbind()=20=E2=86=92=20bpf=5Fsocket=5Fbind=5Fserializ?= =?UTF-8?q?e()?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This function is the only outlier, all other BPF glue functions are called bpf__xyz(). Hence swap this over here too. --- src/core/bpf-socket-bind.c | 4 ++-- src/core/bpf-socket-bind.h | 2 +- src/core/unit-serialize.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/core/bpf-socket-bind.c b/src/core/bpf-socket-bind.c index 9f290ab412..b1b1a6770e 100644 --- a/src/core/bpf-socket-bind.c +++ b/src/core/bpf-socket-bind.c @@ -212,7 +212,7 @@ int bpf_socket_bind_install(Unit *u) { return r; } -int bpf_serialize_socket_bind(Unit *u, FILE *f, FDSet *fds) { +int bpf_socket_bind_serialize(Unit *u, FILE *f, FDSet *fds) { int r; assert(u); @@ -238,7 +238,7 @@ int bpf_socket_bind_install(Unit *u) { "bpf-socket-bind: Failed to install; BPF framework is not supported"); } -int bpf_serialize_socket_bind(Unit *u, FILE *f, FDSet *fds) { +int bpf_socket_bind_serialize(Unit *u, FILE *f, FDSet *fds) { return 0; } #endif diff --git a/src/core/bpf-socket-bind.h b/src/core/bpf-socket-bind.h index 7d426df714..28b25f6872 100644 --- a/src/core/bpf-socket-bind.h +++ b/src/core/bpf-socket-bind.h @@ -12,4 +12,4 @@ int bpf_socket_bind_add_initial_link_fd(Unit *u, int fd); int bpf_socket_bind_install(Unit *u); -int bpf_serialize_socket_bind(Unit *u, FILE *f, FDSet *fds); +int bpf_socket_bind_serialize(Unit *u, FILE *f, FDSet *fds); diff --git a/src/core/unit-serialize.c b/src/core/unit-serialize.c index 7f07bc8e31..297bf771b7 100644 --- a/src/core/unit-serialize.c +++ b/src/core/unit-serialize.c @@ -191,7 +191,7 @@ int unit_serialize_state(Unit *u, FILE *f, FDSet *fds, bool switching_root) { (void) serialize_cgroup_mask(f, "cgroup-enabled-mask", u->cgroup_enabled_mask); (void) serialize_cgroup_mask(f, "cgroup-invalidated-mask", u->cgroup_invalidated_mask); - (void) bpf_serialize_socket_bind(u, f, fds); + (void) bpf_socket_bind_serialize(u, f, fds); (void) bpf_program_serialize_attachment(f, fds, "ip-bpf-ingress-installed", u->ip_bpf_ingress_installed); (void) bpf_program_serialize_attachment(f, fds, "ip-bpf-egress-installed", u->ip_bpf_egress_installed); From 9af6ab4499a4a6abc273e9941e568a2ff7074124 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 25 Jan 2024 14:06:37 +0100 Subject: [PATCH 5/5] update TODO --- TODO | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/TODO b/TODO index 90971fbcd0..e69cb70c1c 100644 --- a/TODO +++ b/TODO @@ -132,6 +132,11 @@ Deprecations and removals: Features: +* rewrite bpf-devices in libbpf/C code, rather than home-grown BPF assembly, to + match bpf-restrict-fs, bpf-restrict-ifaces, bpf-socket-bind + +* ditto: rewrite bpf-firewall in libbpf/C code + * extend the smbios11 logic for passing credentials so that instead of passing the credential data literally it can also just reference an AF_VSOCK CID/port to read them from. This way the data doesn't remain in the SMBIOS blob during