This option adds a kernel parameter 'bpf_lsm',
which allows the BPF LSM to be disabled at boot.
The purpose of this option is to allow a single kernel
image to be distributed with the BPF LSM built in,
but not necessarily enabled.
Signed-off-by: Lorenzo Fontana <[email protected]>
---
Documentation/admin-guide/kernel-parameters.txt | 8 ++++++++
init/Kconfig | 12 ++++++++++++
security/bpf/hooks.c | 16 ++++++++++++++++
3 files changed, 36 insertions(+)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index fb95fad81c79..c0d5955279d7 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4575,6 +4575,14 @@
1 -- enable.
Default value is set via kernel config option.
+ bpf_lsm= [BPF_LSM] Disable or enable LSM Instrumentation
+ with BPF at boot time.
+ Format: { "0" | "1" }
+ See init/Kconfig help text.
+ 0 -- disable.
+ 1 -- enable.
+ Default value is 1.
+
serialnumber [BUGS=X86-32]
shapers= [NET]
diff --git a/init/Kconfig b/init/Kconfig
index a46aa8f3174d..410547e4342e 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1659,6 +1659,18 @@ config BPF_LSM
If you are unsure how to answer this question, answer N.
+config BPF_LSM_BOOTPARAM
+ bool "LSM Instrumentation with BPF boot parameter"
+ depends on BPF_LSM
+ help
+ This option adds a kernel parameter 'bpf_lsm', which allows LSM
+ instrumentation with BPF to be disabled at boot.
+ If this option is selected, the BPF LSM
+ functionality can be disabled with bpf_lsm=0 on the kernel
+ command line. The purpose of this option is to allow a single
+ kernel image to be distributed with the BPF LSM built in, but not
+ necessarily enabled.
+
config BPF_SYSCALL
bool "Enable bpf() system call"
select BPF
diff --git a/security/bpf/hooks.c b/security/bpf/hooks.c
index 32d32d485451..6a4b4f63976c 100644
--- a/security/bpf/hooks.c
+++ b/security/bpf/hooks.c
@@ -3,9 +3,24 @@
/*
* Copyright (C) 2020 Google LLC.
*/
+
+#include <linux/init.h>
#include <linux/lsm_hooks.h>
#include <linux/bpf_lsm.h>
+int bpf_lsm_enabled_boot __initdata = 1;
+#ifdef CONFIG_BPF_LSM_BOOTPARAM
+static int __init bpf_lsm_enabled_setup(char *str)
+{
+ unsigned long enabled;
+
+ if (!kstrtoul(str, 0, &enabled))
+ bpf_lsm_enabled_boot = enabled ? 1 : 0;
+ return 1;
+}
+__setup("bpf_lsm=", bpf_lsm_enabled_setup);
+#endif
+
static struct security_hook_list bpf_lsm_hooks[] __lsm_ro_after_init = {
#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
LSM_HOOK_INIT(NAME, bpf_lsm_##NAME),
@@ -23,4 +38,5 @@ static int __init bpf_lsm_init(void)
DEFINE_LSM(bpf) = {
.name = "bpf",
.init = bpf_lsm_init,
+ .enabled = &bpf_lsm_enabled_boot,
};
--
2.27.0
On 7/6/20 6:57 PM, Lorenzo Fontana wrote:
> This option adds a kernel parameter 'bpf_lsm',
> which allows the BPF LSM to be disabled at boot.
> The purpose of this option is to allow a single kernel
> image to be distributed with the BPF LSM built in,
> but not necessarily enabled.
>
> Signed-off-by: Lorenzo Fontana <[email protected]>
Well, this explains what the patch is doing but not *why* you need it exactly.
Please explain your concrete use-case for this patch.
Thanks,
Daniel
On Mon, Jul 6, 2020 at 8:51 PM Daniel Borkmann <[email protected]> wrote:
>
> On 7/6/20 6:57 PM, Lorenzo Fontana wrote:
> > This option adds a kernel parameter 'bpf_lsm',
> > which allows the BPF LSM to be disabled at boot.
> > The purpose of this option is to allow a single kernel
> > image to be distributed with the BPF LSM built in,
> > but not necessarily enabled.
> >
> > Signed-off-by: Lorenzo Fontana <[email protected]>
>
> Well, this explains what the patch is doing but not *why* you need it exactly.
> Please explain your concrete use-case for this patch.
Also, this patch is not really needed as it can already be done with the current
kernel parameters.
LSMs can be enabled on the command line
with the lsm= parameter. So you can just pass lsm="selinux,capabilities" etc
and not pass "bpf" and it will disable the BPF_LSM.
- KP
>
> Thanks,
> Daniel
On Mon, Jul 06, 2020 at 08:59:13PM +0200, KP Singh wrote:
> On Mon, Jul 6, 2020 at 8:51 PM Daniel Borkmann <[email protected]> wrote:
> >
> > On 7/6/20 6:57 PM, Lorenzo Fontana wrote:
> > > This option adds a kernel parameter 'bpf_lsm',
> > > which allows the BPF LSM to be disabled at boot.
> > > The purpose of this option is to allow a single kernel
> > > image to be distributed with the BPF LSM built in,
> > > but not necessarily enabled.
> > >
> > > Signed-off-by: Lorenzo Fontana <[email protected]>
> >
> > Well, this explains what the patch is doing but not *why* you need it exactly.
> > Please explain your concrete use-case for this patch.
>
> Also, this patch is not really needed as it can already be done with the current
> kernel parameters.
>
> LSMs can be enabled on the command line
> with the lsm= parameter. So you can just pass lsm="selinux,capabilities" etc
> and not pass "bpf" and it will disable the BPF_LSM.
>
> - KP
>
> >
> > Thanks,
> > Daniel
Hi,
Thanks Daniel and KP for looking into this, I really appreciate it!
The *why* I need it is because I need to ship the kernel with BPF LSM
disabled at boot time.
The use case is exactly the same as the one described by KP, however
for a personal preference I prefer to pass specifically bpf_lsm=1 or
bpf_lsm=0 - It's easier to change programmatically in my scripts
with a simple sprintf("bpf_lsm=%d", value). I do the same
with "selinux=1" and "selinux=0" in my systems.
From what I can see by reading the code and testing, the two ways
bot act on 'lsm_info.enabled' defined in 'lsm_hooks.h'.
So it's not just a personal preference, I just want the same set
of options available to me as I do with selinux.
Thanks a lot,
Lore
On Mon, Jul 6, 2020 at 10:06 PM Lorenzo Fontana <[email protected]> wrote:
>
> On Mon, Jul 06, 2020 at 08:59:13PM +0200, KP Singh wrote:
> > On Mon, Jul 6, 2020 at 8:51 PM Daniel Borkmann <[email protected]> wrote:
> > >
> > > On 7/6/20 6:57 PM, Lorenzo Fontana wrote:
> > > > This option adds a kernel parameter 'bpf_lsm',
> > > > which allows the BPF LSM to be disabled at boot.
> > > > The purpose of this option is to allow a single kernel
> > > > image to be distributed with the BPF LSM built in,
> > > > but not necessarily enabled.
> > > >
> > > > Signed-off-by: Lorenzo Fontana <[email protected]>
> > >
> > > Well, this explains what the patch is doing but not *why* you need it exactly.
> > > Please explain your concrete use-case for this patch.
> >
> > Also, this patch is not really needed as it can already be done with the current
> > kernel parameters.
> >
> > LSMs can be enabled on the command line
> > with the lsm= parameter. So you can just pass lsm="selinux,capabilities" etc
> > and not pass "bpf" and it will disable the BPF_LSM.
> >
> > - KP
> >
> > >
> > > Thanks,
> > > Daniel
>
> Hi,
> Thanks Daniel and KP for looking into this, I really appreciate it!
>
> The *why* I need it is because I need to ship the kernel with BPF LSM
> disabled at boot time.
>
> The use case is exactly the same as the one described by KP, however
> for a personal preference I prefer to pass specifically bpf_lsm=1 or
> bpf_lsm=0 - It's easier to change programmatically in my scripts
> with a simple sprintf("bpf_lsm=%d", value). I do the same
> with "selinux=1" and "selinux=0" in my systems.
> From what I can see by reading the code and testing, the two ways
> bot act on 'lsm_info.enabled' defined in 'lsm_hooks.h'.
> So it's not just a personal preference, I just want the same set
> of options available to me as I do with selinux.
The "selinux=" option existed before the "lsm=" parameter was added and it
now exists only for backward compatibility. I added Paul and Stephen to Cc
who might have more information about this.
- KP
>
> Thanks a lot,
> Lore