From: Djalal Harouni [mailto:tixxdz@xxxxxxxxx]I'm thinking to implement something like this.
Sent: Monday, April 4, 2022 9:45 AM
On Sun, Apr 3, 2022 at 5:42 PM KP Singh <kpsingh@xxxxxxxxxx> wrote:
On Sat, Apr 2, 2022 at 1:55 AM Alexei Starovoitov...
Also, beside of the inode_unlink... and out of curiosity: making sysfs/bpffs/Can this not be already done by adding a BPF_LSM program to thePinningWe can consider inodes in bpffs that are not unlinkable by root
them to unreachable inodes intuitively looked the
way to go for achieving the stated goal.
in the future, but certainly not for this use case.
inode_unlink LSM hook?
readonly after pinning, then using bpf LSM hooks
family combining bpf() LSM hook... isn't this enough to:
1. Restrict who can pin to bpffs without using a full MAC
2. Restrict who can delete or unmount bpf filesystem
First, I add a new program flag called
BPF_F_STOP_ONCONFIRM, which causes the ref count
of the link to increase twice at creation time. In this way,
user space cannot make the link disappear, unless a
confirmation is explicitly sent via the bpf() system call.
Another advantage is that other LSMs can decide
whether or not they allow a program with this flag
(in the bpf security hook).
This would work regardless of the method used to
load the eBPF program (user space or kernel space).
Second, I extend the bpf() system call with a new
subcommand, BPF_LINK_CONFIRM_STOP, which
decreasres the ref count for the link of the programs
with the BPF_F_STOP_ONCONFIRM flag. I will also
introduce a new security hook (something like
security_link_confirm_stop), so that an LSM has the
opportunity to deny the stop (the bpf security hook
would not be sufficient to determine exactly for
which link the confirmation is given, an LSM should
be able to deny the stop for its own programs).
What do you think?
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Li Peng, Zhong Ronghua