Add KF_DESTRUCTIVE flag for destructive functions. Functions with this
flag set will require CAP_SYS_BOOT capabilities.
Signed-off-by: Artem Savkov <[email protected]>
---
Documentation/bpf/kfuncs.rst | 9 +++++++++
include/linux/btf.h | 1 +
kernel/bpf/verifier.c | 5 +++++
3 files changed, 15 insertions(+)
diff --git a/Documentation/bpf/kfuncs.rst b/Documentation/bpf/kfuncs.rst
index c0b7dae6dbf5..2e97e08be7de 100644
--- a/Documentation/bpf/kfuncs.rst
+++ b/Documentation/bpf/kfuncs.rst
@@ -146,6 +146,15 @@ that operate (change some property, perform some operation) on an object that
was obtained using an acquire kfunc. Such kfuncs need an unchanged pointer to
ensure the integrity of the operation being performed on the expected object.
+2.4.5 KF_DESTRUCTIVE flag
+--------------------------
+
+The KF_DESTRUCTIVE flag is used to indicate functions calling which is
+destructive to the system. For example such a call can result in system
+rebooting or panicking. Due to this additional restrictions apply to these
+calls. At the moment they only require CAP_SYS_BOOT capability, but more can be
+added later.
+
2.5 Registering the kfuncs
--------------------------
diff --git a/include/linux/btf.h b/include/linux/btf.h
index cdb376d53238..51a0961c84e3 100644
--- a/include/linux/btf.h
+++ b/include/linux/btf.h
@@ -49,6 +49,7 @@
* for this case.
*/
#define KF_TRUSTED_ARGS (1 << 4) /* kfunc only takes trusted pointer arguments */
+#define KF_DESTRUCTIVE (1 << 5) /* kfunc performs destructive actions */
struct btf;
struct btf_member;
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 843a966cd02b..163cc0a2dc5a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7598,6 +7598,11 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
func_name);
return -EACCES;
}
+ if (*kfunc_flags & KF_DESTRUCTIVE && !capable(CAP_SYS_BOOT)) {
+ verbose(env, "destructive kfunc calls require CAP_SYS_BOOT capabilities\n");
+ return -EACCES;
+ }
+
acq = *kfunc_flags & KF_ACQUIRE;
/* Check the arguments */
--
2.37.1
On Tue, 9 Aug 2022 at 12:53, Artem Savkov <[email protected]> wrote:
>
> Add KF_DESTRUCTIVE flag for destructive functions. Functions with this
> flag set will require CAP_SYS_BOOT capabilities.
>
> Signed-off-by: Artem Savkov <[email protected]>
> ---
> Documentation/bpf/kfuncs.rst | 9 +++++++++
> include/linux/btf.h | 1 +
> kernel/bpf/verifier.c | 5 +++++
> 3 files changed, 15 insertions(+)
>
> diff --git a/Documentation/bpf/kfuncs.rst b/Documentation/bpf/kfuncs.rst
> index c0b7dae6dbf5..2e97e08be7de 100644
> --- a/Documentation/bpf/kfuncs.rst
> +++ b/Documentation/bpf/kfuncs.rst
> @@ -146,6 +146,15 @@ that operate (change some property, perform some operation) on an object that
> was obtained using an acquire kfunc. Such kfuncs need an unchanged pointer to
> ensure the integrity of the operation being performed on the expected object.
>
> +2.4.5 KF_DESTRUCTIVE flag
This should be 2.4.6.
> +--------------------------
> +
> +The KF_DESTRUCTIVE flag is used to indicate functions calling which is
> +destructive to the system. For example such a call can result in system
> +rebooting or panicking. Due to this additional restrictions apply to these
> +calls. At the moment they only require CAP_SYS_BOOT capability, but more can be
> +added later.
> +
> 2.5 Registering the kfuncs
> --------------------------
>
> diff --git a/include/linux/btf.h b/include/linux/btf.h
> index cdb376d53238..51a0961c84e3 100644
> --- a/include/linux/btf.h
> +++ b/include/linux/btf.h
> @@ -49,6 +49,7 @@
> * for this case.
> */
> #define KF_TRUSTED_ARGS (1 << 4) /* kfunc only takes trusted pointer arguments */
> +#define KF_DESTRUCTIVE (1 << 5) /* kfunc performs destructive actions */
>
> struct btf;
> struct btf_member;
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 843a966cd02b..163cc0a2dc5a 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -7598,6 +7598,11 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
> func_name);
> return -EACCES;
> }
> + if (*kfunc_flags & KF_DESTRUCTIVE && !capable(CAP_SYS_BOOT)) {
> + verbose(env, "destructive kfunc calls require CAP_SYS_BOOT capabilities\n");
> + return -EACCES;
> + }
> +
> acq = *kfunc_flags & KF_ACQUIRE;
>
> /* Check the arguments */
> --
> 2.37.1
>