bpf, lsm: Add disabled BPF LSM hook list

Add a disabled hooks list for BPF LSM. progs being attached to the
listed hooks will be rejected by the verifier.

Suggested-by: KP Singh <kpsingh@kernel.org>
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Link: https://lore.kernel.org/r/20240719110059.797546-2-xukuohai@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
index 08a338e1f23114e3fda605b167850467cdef0fa4..1f596ad6257c5034ea7228c37af10fcdac5896a9 100644 (file)
--- a/kernel/bpf/bpf_lsm.c
+++ b/kernel/bpf/bpf_lsm.c
@@ -36,6 +36,24 @@ BTF_SET_START(bpf_lsm_hooks)
 #undef LSM_HOOK
 BTF_SET_END(bpf_lsm_hooks)
 
+BTF_SET_START(bpf_lsm_disabled_hooks)
+BTF_ID(func, bpf_lsm_vm_enough_memory)
+BTF_ID(func, bpf_lsm_inode_need_killpriv)
+BTF_ID(func, bpf_lsm_inode_getsecurity)
+BTF_ID(func, bpf_lsm_inode_listsecurity)
+BTF_ID(func, bpf_lsm_inode_copy_up_xattr)
+BTF_ID(func, bpf_lsm_getselfattr)
+BTF_ID(func, bpf_lsm_getprocattr)
+BTF_ID(func, bpf_lsm_setprocattr)
+#ifdef CONFIG_KEYS
+BTF_ID(func, bpf_lsm_key_getsecurity)
+#endif
+#ifdef CONFIG_AUDIT
+BTF_ID(func, bpf_lsm_audit_rule_match)
+#endif
+BTF_ID(func, bpf_lsm_ismaclabel)
+BTF_SET_END(bpf_lsm_disabled_hooks)
+
 /* List of LSM hooks that should operate on 'current' cgroup regardless
  * of function signature.
  */
@@ -97,15 +115,24 @@ void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog,
 int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
                        const struct bpf_prog *prog)
 {
+       u32 btf_id = prog->aux->attach_btf_id;
+       const char *func_name = prog->aux->attach_func_name;
+
        if (!prog->gpl_compatible) {
                bpf_log(vlog,
                        "LSM programs must have a GPL compatible license\n");
                return -EINVAL;
        }
 
-       if (!btf_id_set_contains(&bpf_lsm_hooks, prog->aux->attach_btf_id)) {
+       if (btf_id_set_contains(&bpf_lsm_disabled_hooks, btf_id)) {
+               bpf_log(vlog, "attach_btf_id %u points to disabled hook %s\n",
+                       btf_id, func_name);
+               return -EINVAL;
+       }
+
+       if (!btf_id_set_contains(&bpf_lsm_hooks, btf_id)) {
                bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n",
-                       prog->aux->attach_btf_id, prog->aux->attach_func_name);
+                       btf_id, func_name);
                return -EINVAL;
        }