bpftool: Use appropriate permissions for map access

Modify several functions in tools/bpf/bpftool/common.c to allow
specification of requested access for file descriptors, such as
read-only access.

Update bpftool to request only read access for maps when write
access is not required. This fixes errors when reading from maps
that are protected from modification via security_bpf_map.

Signed-off-by: Slava Imameev <slava.imameev@crowdstrike.com>
Reviewed-by: Quentin Monnet <qmo@kernel.org>
Link: https://lore.kernel.org/r/20250620151812.13952-1-slava.imameev@crowdstrike.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c
index 6b14cbfa58aa2b2234978fa86f33bfc364c71663..946612029deeee8ef5062d8421ba1e1b92b4fdda 100644 (file)
--- a/tools/bpf/bpftool/btf.c
+++ b/tools/bpf/bpftool/btf.c
@@ -905,7 +905,8 @@ static int do_dump(int argc, char **argv)
                        return -1;
                }
 
-               fd = map_parse_fd_and_info(&argc, &argv, &info, &len);
+               fd = map_parse_fd_and_info(&argc, &argv, &info, &len,
+                                          BPF_F_RDONLY);
                if (fd < 0)
                        return -1;
 
@@ -1118,10 +1119,13 @@ build_btf_type_table(struct hashmap *tab, enum bpf_obj_type type,
                [BPF_OBJ_PROG]          = "prog",
                [BPF_OBJ_MAP]           = "map",
        };
+       LIBBPF_OPTS(bpf_get_fd_by_id_opts, opts_ro);
        __u32 btf_id, id = 0;
        int err;
        int fd;
 
+       opts_ro.open_flags = BPF_F_RDONLY;
+
        while (true) {
                switch (type) {
                case BPF_OBJ_PROG:
@@ -1151,7 +1155,7 @@ build_btf_type_table(struct hashmap *tab, enum bpf_obj_type type,
                        fd = bpf_prog_get_fd_by_id(id);
                        break;
                case BPF_OBJ_MAP:
-                       fd = bpf_map_get_fd_by_id(id);
+                       fd = bpf_map_get_fd_by_id_opts(id, &opts_ro);
                        break;
                default:
                        err = -1;

diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
index ecfa790adc13f22efb73355bbdc037100b4ae1c0..b07317d2842fe81b7690830c417d04b26ad0d84b 100644 (file)
--- a/tools/bpf/bpftool/common.c
+++ b/tools/bpf/bpftool/common.c
@@ -4,6 +4,7 @@
 #ifndef _GNU_SOURCE
 #define _GNU_SOURCE
 #endif
+#include <assert.h>
 #include <ctype.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -193,7 +194,8 @@ int mount_tracefs(const char *target)
        return err;
 }
 
-int open_obj_pinned(const char *path, bool quiet)
+int open_obj_pinned(const char *path, bool quiet,
+                   const struct bpf_obj_get_opts *opts)
 {
        char *pname;
        int fd = -1;
@@ -205,7 +207,7 @@ int open_obj_pinned(const char *path, bool quiet)
                goto out_ret;
        }
 
-       fd = bpf_obj_get(pname);
+       fd = bpf_obj_get_opts(pname, opts);
        if (fd < 0) {
                if (!quiet)
                        p_err("bpf obj get (%s): %s", pname,
@@ -221,12 +223,13 @@ out_ret:
        return fd;
 }
 
-int open_obj_pinned_any(const char *path, enum bpf_obj_type exp_type)
+int open_obj_pinned_any(const char *path, enum bpf_obj_type exp_type,
+                       const struct bpf_obj_get_opts *opts)
 {
        enum bpf_obj_type type;
        int fd;
 
-       fd = open_obj_pinned(path, false);
+       fd = open_obj_pinned(path, false, opts);
        if (fd < 0)
                return -1;
 
@@ -555,7 +558,7 @@ static int do_build_table_cb(const char *fpath, const struct stat *sb,
        if (typeflag != FTW_F)
                goto out_ret;
 
-       fd = open_obj_pinned(fpath, true);
+       fd = open_obj_pinned(fpath, true, NULL);
        if (fd < 0)
                goto out_ret;
 
@@ -928,7 +931,7 @@ int prog_parse_fds(int *argc, char ***argv, int **fds)
                path = **argv;
                NEXT_ARGP();
 
-               (*fds)[0] = open_obj_pinned_any(path, BPF_OBJ_PROG);
+               (*fds)[0] = open_obj_pinned_any(path, BPF_OBJ_PROG, NULL);
                if ((*fds)[0] < 0)
                        return -1;
                return 1;
@@ -965,7 +968,8 @@ exit_free:
        return fd;
 }
 
-static int map_fd_by_name(char *name, int **fds)
+static int map_fd_by_name(char *name, int **fds,
+                         const struct bpf_get_fd_by_id_opts *opts)
 {
        unsigned int id = 0;
        int fd, nb_fds = 0;
@@ -973,6 +977,7 @@ static int map_fd_by_name(char *name, int **fds)
        int err;
 
        while (true) {
+               LIBBPF_OPTS(bpf_get_fd_by_id_opts, opts_ro);
                struct bpf_map_info info = {};
                __u32 len = sizeof(info);
 
@@ -985,7 +990,9 @@ static int map_fd_by_name(char *name, int **fds)
                        return nb_fds;
                }
 
-               fd = bpf_map_get_fd_by_id(id);
+               /* Request a read-only fd to query the map info */
+               opts_ro.open_flags = BPF_F_RDONLY;
+               fd = bpf_map_get_fd_by_id_opts(id, &opts_ro);
                if (fd < 0) {
                        p_err("can't get map by id (%u): %s",
                              id, strerror(errno));
@@ -1004,6 +1011,19 @@ static int map_fd_by_name(char *name, int **fds)
                        continue;
                }
 
+               /* Get an fd with the requested options, if they differ
+                * from the read-only options used to get the fd above.
+                */
+               if (memcmp(opts, &opts_ro, sizeof(opts_ro))) {
+                       close(fd);
+                       fd = bpf_map_get_fd_by_id_opts(id, opts);
+                       if (fd < 0) {
+                               p_err("can't get map by id (%u): %s", id,
+                                       strerror(errno));
+                               goto err_close_fds;
+                       }
+               }
+
                if (nb_fds > 0) {
                        tmp = realloc(*fds, (nb_fds + 1) * sizeof(int));
                        if (!tmp) {
@@ -1023,8 +1043,13 @@ err_close_fds:
        return -1;
 }
 
-int map_parse_fds(int *argc, char ***argv, int **fds)
+int map_parse_fds(int *argc, char ***argv, int **fds, __u32 open_flags)
 {
+       LIBBPF_OPTS(bpf_get_fd_by_id_opts, opts);
+
+       assert((open_flags & ~BPF_F_RDONLY) == 0);
+       opts.open_flags = open_flags;
+
        if (is_prefix(**argv, "id")) {
                unsigned int id;
                char *endptr;
@@ -1038,7 +1063,7 @@ int map_parse_fds(int *argc, char ***argv, int **fds)
                }
                NEXT_ARGP();
 
-               (*fds)[0] = bpf_map_get_fd_by_id(id);
+               (*fds)[0] = bpf_map_get_fd_by_id_opts(id, &opts);
                if ((*fds)[0] < 0) {
                        p_err("get map by id (%u): %s", id, strerror(errno));
                        return -1;
@@ -1056,16 +1081,18 @@ int map_parse_fds(int *argc, char ***argv, int **fds)
                }
                NEXT_ARGP();
 
-               return map_fd_by_name(name, fds);
+               return map_fd_by_name(name, fds, &opts);
        } else if (is_prefix(**argv, "pinned")) {
                char *path;
+               LIBBPF_OPTS(bpf_obj_get_opts, get_opts);
+               get_opts.file_flags = open_flags;
 
                NEXT_ARGP();
 
                path = **argv;
                NEXT_ARGP();
 
-               (*fds)[0] = open_obj_pinned_any(path, BPF_OBJ_MAP);
+               (*fds)[0] = open_obj_pinned_any(path, BPF_OBJ_MAP, &get_opts);
                if ((*fds)[0] < 0)
                        return -1;
                return 1;
@@ -1075,7 +1102,7 @@ int map_parse_fds(int *argc, char ***argv, int **fds)
        return -1;
 }
 
-int map_parse_fd(int *argc, char ***argv)
+int map_parse_fd(int *argc, char ***argv, __u32 open_flags)
 {
        int *fds = NULL;
        int nb_fds, fd;
@@ -1085,7 +1112,7 @@ int map_parse_fd(int *argc, char ***argv)
                p_err("mem alloc failed");
                return -1;
        }
-       nb_fds = map_parse_fds(argc, argv, &fds);
+       nb_fds = map_parse_fds(argc, argv, &fds, open_flags);
        if (nb_fds != 1) {
                if (nb_fds > 1) {
                        p_err("several maps match this handle");
@@ -1103,12 +1130,12 @@ exit_free:
 }
 
 int map_parse_fd_and_info(int *argc, char ***argv, struct bpf_map_info *info,
-                         __u32 *info_len)
+                         __u32 *info_len, __u32 open_flags)
 {
        int err;
        int fd;
 
-       fd = map_parse_fd(argc, argv);
+       fd = map_parse_fd(argc, argv, open_flags);
        if (fd < 0)
                return -1;
 

diff --git a/tools/bpf/bpftool/iter.c b/tools/bpf/bpftool/iter.c
index 5c39c2ed36a2bebd62e17f7663882caa6f7b30d8..df5f0d1e07e8552a9d16641d1ccc057f38d7ef4a 100644 (file)
--- a/tools/bpf/bpftool/iter.c
+++ b/tools/bpf/bpftool/iter.c
@@ -37,7 +37,7 @@ static int do_pin(int argc, char **argv)
                                return -1;
                        }
 
-                       map_fd = map_parse_fd(&argc, &argv);
+                       map_fd = map_parse_fd(&argc, &argv, BPF_F_RDONLY);
                        if (map_fd < 0)
                                return -1;
 

diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
index 03513ffffb79b0232fb4cd5a0b9de8a0845cfa07..a773e05d5ade44dce1f64bc051a0b512e5958dd3 100644 (file)
--- a/tools/bpf/bpftool/link.c
+++ b/tools/bpf/bpftool/link.c
@@ -117,7 +117,7 @@ static int link_parse_fd(int *argc, char ***argv)
                path = **argv;
                NEXT_ARGP();
 
-               return open_obj_pinned_any(path, BPF_OBJ_LINK);
+               return open_obj_pinned_any(path, BPF_OBJ_LINK, NULL);
        }
 
        p_err("expected 'id' or 'pinned', got: '%s'?", **argv);

diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
index 9eb764fe4cc8bda6207c63f90a961141ad24d4cb..6db704fda5c00f524e7664485e8376020af497f6 100644 (file)
--- a/tools/bpf/bpftool/main.h
+++ b/tools/bpf/bpftool/main.h
@@ -15,6 +15,7 @@
 
 #include <bpf/hashmap.h>
 #include <bpf/libbpf.h>
+#include <bpf/bpf.h>
 
 #include "json_writer.h"
 
@@ -140,8 +141,10 @@ void get_prog_full_name(const struct bpf_prog_info *prog_info, int prog_fd,
 int get_fd_type(int fd);
 const char *get_fd_type_name(enum bpf_obj_type type);
 char *get_fdinfo(int fd, const char *key);
-int open_obj_pinned(const char *path, bool quiet);
-int open_obj_pinned_any(const char *path, enum bpf_obj_type exp_type);
+int open_obj_pinned(const char *path, bool quiet,
+                   const struct bpf_obj_get_opts *opts);
+int open_obj_pinned_any(const char *path, enum bpf_obj_type exp_type,
+                       const struct bpf_obj_get_opts *opts);
 int mount_bpffs_for_file(const char *file_name);
 int create_and_mount_bpffs_dir(const char *dir_name);
 int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(int *, char ***));
@@ -167,10 +170,10 @@ int do_iter(int argc, char **argv) __weak;
 int parse_u32_arg(int *argc, char ***argv, __u32 *val, const char *what);
 int prog_parse_fd(int *argc, char ***argv);
 int prog_parse_fds(int *argc, char ***argv, int **fds);
-int map_parse_fd(int *argc, char ***argv);
-int map_parse_fds(int *argc, char ***argv, int **fds);
+int map_parse_fd(int *argc, char ***argv, __u32 open_flags);
+int map_parse_fds(int *argc, char ***argv, int **fds, __u32 open_flags);
 int map_parse_fd_and_info(int *argc, char ***argv, struct bpf_map_info *info,
-                         __u32 *info_len);
+                         __u32 *info_len, __u32 open_flags);
 
 struct bpf_prog_linfo;
 #if defined(HAVE_LLVM_SUPPORT) || defined(HAVE_LIBBFD_SUPPORT)

diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 81cc668b4b05c55188ce534ba648ed1c7806cf4a..c9de44a45778b2fc9c215feb8c41cf4e6132c55e 100644 (file)
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -337,9 +337,9 @@ static void fill_per_cpu_value(struct bpf_map_info *info, void *value)
                memcpy(value + i * step, value, info->value_size);
 }
 
-static int parse_elem(char **argv, struct bpf_map_info *info,
-                     void *key, void *value, __u32 key_size, __u32 value_size,
-                     __u32 *flags, __u32 **value_fd)
+static int parse_elem(char **argv, struct bpf_map_info *info, void *key,
+                     void *value, __u32 key_size, __u32 value_size,
+                     __u32 *flags, __u32 **value_fd, __u32 open_flags)
 {
        if (!*argv) {
                if (!key && !value)
@@ -362,7 +362,7 @@ static int parse_elem(char **argv, struct bpf_map_info *info,
                        return -1;
 
                return parse_elem(argv, info, NULL, value, key_size, value_size,
-                                 flags, value_fd);
+                                 flags, value_fd, open_flags);
        } else if (is_prefix(*argv, "value")) {
                int fd;
 
@@ -388,7 +388,7 @@ static int parse_elem(char **argv, struct bpf_map_info *info,
                                return -1;
                        }
 
-                       fd = map_parse_fd(&argc, &argv);
+                       fd = map_parse_fd(&argc, &argv, open_flags);
                        if (fd < 0)
                                return -1;
 
@@ -424,7 +424,7 @@ static int parse_elem(char **argv, struct bpf_map_info *info,
                }
 
                return parse_elem(argv, info, key, NULL, key_size, value_size,
-                                 flags, NULL);
+                                 flags, NULL, open_flags);
        } else if (is_prefix(*argv, "any") || is_prefix(*argv, "noexist") ||
                   is_prefix(*argv, "exist")) {
                if (!flags) {
@@ -440,7 +440,7 @@ static int parse_elem(char **argv, struct bpf_map_info *info,
                        *flags = BPF_EXIST;
 
                return parse_elem(argv + 1, info, key, value, key_size,
-                                 value_size, NULL, value_fd);
+                                 value_size, NULL, value_fd, open_flags);
        }
 
        p_err("expected key or value, got: %s", *argv);
@@ -639,7 +639,7 @@ static int do_show_subset(int argc, char **argv)
                p_err("mem alloc failed");
                return -1;
        }
-       nb_fds = map_parse_fds(&argc, &argv, &fds);
+       nb_fds = map_parse_fds(&argc, &argv, &fds, BPF_F_RDONLY);
        if (nb_fds < 1)
                goto exit_free;
 
@@ -672,12 +672,15 @@ exit_free:
 
 static int do_show(int argc, char **argv)
 {
+       LIBBPF_OPTS(bpf_get_fd_by_id_opts, opts);
        struct bpf_map_info info = {};
        __u32 len = sizeof(info);
        __u32 id = 0;
        int err;
        int fd;
 
+       opts.open_flags = BPF_F_RDONLY;
+
        if (show_pinned) {
                map_table = hashmap__new(hash_fn_for_key_as_id,
                                         equal_fn_for_key_as_id, NULL);
@@ -707,7 +710,7 @@ static int do_show(int argc, char **argv)
                        break;
                }
 
-               fd = bpf_map_get_fd_by_id(id);
+               fd = bpf_map_get_fd_by_id_opts(id, &opts);
                if (fd < 0) {
                        if (errno == ENOENT)
                                continue;
@@ -909,7 +912,7 @@ static int do_dump(int argc, char **argv)
                p_err("mem alloc failed");
                return -1;
        }
-       nb_fds = map_parse_fds(&argc, &argv, &fds);
+       nb_fds = map_parse_fds(&argc, &argv, &fds, BPF_F_RDONLY);
        if (nb_fds < 1)
                goto exit_free;
 
@@ -997,7 +1000,7 @@ static int do_update(int argc, char **argv)
        if (argc < 2)
                usage();
 
-       fd = map_parse_fd_and_info(&argc, &argv, &info, &len);
+       fd = map_parse_fd_and_info(&argc, &argv, &info, &len, 0);
        if (fd < 0)
                return -1;
 
@@ -1006,7 +1009,7 @@ static int do_update(int argc, char **argv)
                goto exit_free;
 
        err = parse_elem(argv, &info, key, value, info.key_size,
-                        info.value_size, &flags, &value_fd);
+                        info.value_size, &flags, &value_fd, 0);
        if (err)
                goto exit_free;
 
@@ -1076,7 +1079,7 @@ static int do_lookup(int argc, char **argv)
        if (argc < 2)
                usage();
 
-       fd = map_parse_fd_and_info(&argc, &argv, &info, &len);
+       fd = map_parse_fd_and_info(&argc, &argv, &info, &len, BPF_F_RDONLY);
        if (fd < 0)
                return -1;
 
@@ -1084,7 +1087,8 @@ static int do_lookup(int argc, char **argv)
        if (err)
                goto exit_free;
 
-       err = parse_elem(argv, &info, key, NULL, info.key_size, 0, NULL, NULL);
+       err = parse_elem(argv, &info, key, NULL, info.key_size, 0, NULL, NULL,
+                        BPF_F_RDONLY);
        if (err)
                goto exit_free;
 
@@ -1127,7 +1131,7 @@ static int do_getnext(int argc, char **argv)
        if (argc < 2)
                usage();
 
-       fd = map_parse_fd_and_info(&argc, &argv, &info, &len);
+       fd = map_parse_fd_and_info(&argc, &argv, &info, &len, BPF_F_RDONLY);
        if (fd < 0)
                return -1;
 
@@ -1140,8 +1144,8 @@ static int do_getnext(int argc, char **argv)
        }
 
        if (argc) {
-               err = parse_elem(argv, &info, key, NULL, info.key_size, 0,
-                                NULL, NULL);
+               err = parse_elem(argv, &info, key, NULL, info.key_size, 0, NULL,
+                                NULL, BPF_F_RDONLY);
                if (err)
                        goto exit_free;
        } else {
@@ -1198,7 +1202,7 @@ static int do_delete(int argc, char **argv)
        if (argc < 2)
                usage();
 
-       fd = map_parse_fd_and_info(&argc, &argv, &info, &len);
+       fd = map_parse_fd_and_info(&argc, &argv, &info, &len, 0);
        if (fd < 0)
                return -1;
 
@@ -1209,7 +1213,8 @@ static int do_delete(int argc, char **argv)
                goto exit_free;
        }
 
-       err = parse_elem(argv, &info, key, NULL, info.key_size, 0, NULL, NULL);
+       err = parse_elem(argv, &info, key, NULL, info.key_size, 0, NULL, NULL,
+                        0);
        if (err)
                goto exit_free;
 
@@ -1226,11 +1231,16 @@ exit_free:
        return err;
 }
 
+static int map_parse_read_only_fd(int *argc, char ***argv)
+{
+       return map_parse_fd(argc, argv, BPF_F_RDONLY);
+}
+
 static int do_pin(int argc, char **argv)
 {
        int err;
 
-       err = do_pin_any(argc, argv, map_parse_fd);
+       err = do_pin_any(argc, argv, map_parse_read_only_fd);
        if (!err && json_output)
                jsonw_null(json_wtr);
        return err;
@@ -1319,7 +1329,7 @@ offload_dev:
                        if (!REQ_ARGS(2))
                                usage();
                        inner_map_fd = map_parse_fd_and_info(&argc, &argv,
-                                                            &info, &len);
+                                                            &info, &len, BPF_F_RDONLY);
                        if (inner_map_fd < 0)
                                return -1;
                        attr.inner_map_fd = inner_map_fd;
@@ -1368,7 +1378,7 @@ static int do_pop_dequeue(int argc, char **argv)
        if (argc < 2)
                usage();
 
-       fd = map_parse_fd_and_info(&argc, &argv, &info, &len);
+       fd = map_parse_fd_and_info(&argc, &argv, &info, &len, 0);
        if (fd < 0)
                return -1;
 
@@ -1407,7 +1417,7 @@ static int do_freeze(int argc, char **argv)
        if (!REQ_ARGS(2))
                return -1;
 
-       fd = map_parse_fd(&argc, &argv);
+       fd = map_parse_fd(&argc, &argv, 0);
        if (fd < 0)
                return -1;
 

diff --git a/tools/bpf/bpftool/map_perf_ring.c b/tools/bpf/bpftool/map_perf_ring.c
index 552b4ca40c27c09adb7a4560590c641f18f8b033..bcb767e2d67339936073ffb0b71e7f1743720ef6 100644 (file)
--- a/tools/bpf/bpftool/map_perf_ring.c
+++ b/tools/bpf/bpftool/map_perf_ring.c
@@ -128,7 +128,8 @@ int do_event_pipe(int argc, char **argv)
        int err, map_fd;
 
        map_info_len = sizeof(map_info);
-       map_fd = map_parse_fd_and_info(&argc, &argv, &map_info, &map_info_len);
+       map_fd = map_parse_fd_and_info(&argc, &argv, &map_info, &map_info_len,
+                                      0);
        if (map_fd < 0)
                return -1;
 

diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 96eea8a672258b3dcf6aecde0b841c99ac90e5b4..deeaa5c1ed7db0fbd2d1a86687ac7f4ac0467143 100644 (file)
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -1062,7 +1062,7 @@ static int parse_attach_detach_args(int argc, char **argv, int *progfd,
        if (!REQ_ARGS(2))
                return -EINVAL;
 
-       *mapfd = map_parse_fd(&argc, &argv);
+       *mapfd = map_parse_fd(&argc, &argv, 0);
        if (*mapfd < 0)
                return *mapfd;
 
@@ -1608,7 +1608,7 @@ static int load_with_options(int argc, char **argv, bool first_prog_only)
                        }
                        NEXT_ARG();
 
-                       fd = map_parse_fd(&argc, &argv);
+                       fd = map_parse_fd(&argc, &argv, 0);
                        if (fd < 0)
                                goto err_free_reuse_maps;