bpf,lsm: add BPF token LSM hooks

Browse source

Wire up bpf_token_create and bpf_token_free LSM hooks, which allow to
allocate LSM security blob (we add `void *security` field to struct
bpf_token for that), but also control who can instantiate BPF token.
This follows existing pattern for BPF map and BPF prog.

Also add security_bpf_token_allow_cmd() and security_bpf_token_capable()
LSM hooks that allow LSM implementation to control and negate (if
necessary) BPF token's delegation of a specific bpf_cmd and capability,
respectively.

Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231130185229.2688956-12-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

...

This commit is contained in:

Andrii Nakryiko 2023-11-30 10:52:23 -08:00 • committed by Alexei Starovoitov

parent 66d636d70a

commit d734ca7b33

6 changed files with 109 additions and 6 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

include/linux/bpf.h

View file

5

include/linux/lsm_hook_defs.h

View file

25

include/linux/security.h

View file

4

kernel/bpf/bpf_lsm.c

View file

18

kernel/bpf/token.c

View file

60

security/security.c

View file