Commit 520b7aa0 authored by KP Singh's avatar KP Singh Committed by Daniel Borkmann
Browse files

bpf: lsm: Initialize the BPF LSM hooks 



* The hooks are initialized using the definitions in
  include/linux/lsm_hook_defs.h.
* The LSM can be enabled / disabled with CONFIG_BPF_LSM.

Signed-off-by: default avatarKP Singh <kpsingh@google.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Reviewed-by: default avatarBrendan Jackman <jackmanb@google.com>
Reviewed-by: default avatarFlorent Revest <revest@google.com>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarJames Morris <jamorris@linux.microsoft.com>
Link: https://lore.kernel.org/bpf/20200329004356.27286-6-kpsingh@chromium.org
parent 9e4e01df

security/Kconfig

+5 −5
Original line number Diff line number Diff line
@@ -277,11 +277,11 @@ endchoice 


config LSM

	string "Ordered list of enabled LSMs"

	default "lockdown,yama,loadpin,safesetid,integrity,smack,selinux,tomoyo,apparmor" if DEFAULT_SECURITY_SMACK

	default "lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo" if DEFAULT_SECURITY_APPARMOR

	default "lockdown,yama,loadpin,safesetid,integrity,tomoyo" if DEFAULT_SECURITY_TOMOYO

	default "lockdown,yama,loadpin,safesetid,integrity" if DEFAULT_SECURITY_DAC

	default "lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor"

	default "lockdown,yama,loadpin,safesetid,integrity,smack,selinux,tomoyo,apparmor,bpf" if DEFAULT_SECURITY_SMACK

	default "lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo,bpf" if DEFAULT_SECURITY_APPARMOR

	default "lockdown,yama,loadpin,safesetid,integrity,tomoyo,bpf" if DEFAULT_SECURITY_TOMOYO

	default "lockdown,yama,loadpin,safesetid,integrity,bpf" if DEFAULT_SECURITY_DAC

	default "lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"

	help

	  A comma-separated list of LSMs, in initialization order.

	  Any LSMs left off this list will be ignored. This can be

security/Makefile

+2 −0
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ subdir-$(CONFIG_SECURITY_YAMA) += yama 
subdir-$(CONFIG_SECURITY_LOADPIN)	+= loadpin

subdir-$(CONFIG_SECURITY_SAFESETID)    += safesetid

subdir-$(CONFIG_SECURITY_LOCKDOWN_LSM)	+= lockdown

subdir-$(CONFIG_BPF_LSM)		+= bpf



# always enable default capabilities

obj-y					+= commoncap.o
@@ -30,6 +31,7 @@ obj-$(CONFIG_SECURITY_LOADPIN) += loadpin/ 
obj-$(CONFIG_SECURITY_SAFESETID)       += safesetid/

obj-$(CONFIG_SECURITY_LOCKDOWN_LSM)	+= lockdown/

obj-$(CONFIG_CGROUP_DEVICE)		+= device_cgroup.o

obj-$(CONFIG_BPF_LSM)			+= bpf/



# Object integrity file lists

subdir-$(CONFIG_INTEGRITY)		+= integrity

security/bpf/Makefile

0 → 100644
+5 −0
Original line number Diff line number Diff line 
# SPDX-License-Identifier: GPL-2.0

#

# Copyright (C) 2020 Google LLC.



obj-$(CONFIG_BPF_LSM) := hooks.o

security/bpf/hooks.c

0 → 100644
+26 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0



/*

 * Copyright (C) 2020 Google LLC.

 */

#include <linux/lsm_hooks.h>

#include <linux/bpf_lsm.h>



static struct security_hook_list bpf_lsm_hooks[] __lsm_ro_after_init = {

	#define LSM_HOOK(RET, DEFAULT, NAME, ...) \

	LSM_HOOK_INIT(NAME, bpf_lsm_##NAME),

	#include <linux/lsm_hook_defs.h>

	#undef LSM_HOOK

};



static int __init bpf_lsm_init(void)

{

	security_add_hooks(bpf_lsm_hooks, ARRAY_SIZE(bpf_lsm_hooks), "bpf");

	pr_info("LSM support for eBPF active\n");

	return 0;

}



DEFINE_LSM(bpf) = {

	.name = "bpf",

	.init = bpf_lsm_init,

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE