]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/commit
bpf: Implement CAP_BPF
authorAlexei Starovoitov <ast@kernel.org>
Wed, 13 May 2020 23:03:54 +0000 (16:03 -0700)
committerDaniel Borkmann <daniel@iogearbox.net>
Fri, 15 May 2020 15:29:41 +0000 (17:29 +0200)
commit2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366
tree6f2c093168b9b2c532127994bd50ff9f8e82401e
parenta17b53c4a4b55ec322c132b6670743612229ee9c
bpf: Implement CAP_BPF

Implement permissions as stated in uapi/linux/capability.h
In order to do that the verifier allow_ptr_leaks flag is split
into four flags and they are set as:
  env->allow_ptr_leaks = bpf_allow_ptr_leaks();
  env->bypass_spec_v1 = bpf_bypass_spec_v1();
  env->bypass_spec_v4 = bpf_bypass_spec_v4();
  env->bpf_capable = bpf_capable();

The first three currently equivalent to perfmon_capable(), since leaking kernel
pointers and reading kernel memory via side channel attacks is roughly
equivalent to reading kernel memory with cap_perfmon.

'bpf_capable' enables bounded loops, precision tracking, bpf to bpf calls and
other verifier features. 'allow_ptr_leaks' enable ptr leaks, ptr conversions,
subtraction of pointers. 'bypass_spec_v1' disables speculative analysis in the
verifier, run time mitigations in bpf array, and enables indirect variable
access in bpf programs. 'bypass_spec_v4' disables emission of sanitation code
by the verifier.

That means that the networking BPF program loaded with CAP_BPF + CAP_NET_ADMIN
will have speculative checks done by the verifier and other spectre mitigation
applied. Such networking BPF program will not be able to leak kernel pointers
and will not be able to access arbitrary kernel memory.

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20200513230355.7858-3-alexei.starovoitov@gmail.com
19 files changed:
drivers/media/rc/bpf-lirc.c
include/linux/bpf.h
include/linux/bpf_verifier.h
kernel/bpf/arraymap.c
kernel/bpf/bpf_struct_ops.c
kernel/bpf/core.c
kernel/bpf/cpumap.c
kernel/bpf/hashtab.c
kernel/bpf/helpers.c
kernel/bpf/lpm_trie.c
kernel/bpf/map_in_map.c
kernel/bpf/queue_stack_maps.c
kernel/bpf/reuseport_array.c
kernel/bpf/stackmap.c
kernel/bpf/syscall.c
kernel/bpf/verifier.c
kernel/trace/bpf_trace.c
net/core/bpf_sk_storage.c
net/core/filter.c