During exec, argument and environment strings are copied into the new
address space held by struct linux_binprm before that address space is
installed on the task_struct. Existing eBPF user memory helpers only
support reading from the old address space (i.e. current process)
and for this reason programs cannot access these strings from the
bprm_check_security LSM hook.
This series adds two sleepable BPF kfuncs for copying bytes or
NUL-terminated strings from the address space identified by a trusted
struct mm_struct pointer. To support the exec use case, it also marks
linux_binprm->mm as trusted-or-null. This allows BPF LSM programs to
read exec arguments before allowing the exec to continue.
The series also adds selftests covering both kfuncs and the
trusted-or-null annotation.
Anastasios Papagiannis (5):
mm: Add copy_remote_mm_str()
bpf: Add user memory access kfuncs for mm_struct
bpf: Mark linux_binprm->mm as trusted-or-null
selftests/bpf: Test trusted-or-null linux_binprm->mm
selftests/bpf: Test mm_struct user memory kfuncs with linux_binprm
include/linux/mm.h | 2 +
kernel/bpf/helpers.c | 2 +
kernel/bpf/verifier.c | 5 ++
kernel/trace/bpf_trace.c | 83 +++++++++++++++++++
mm/memory.c | 25 +++++-
mm/nommu.c | 25 +++++-
.../bpf/prog_tests/copy_from_user_bprm.c | 52 ++++++++++++
.../selftests/bpf/progs/copy_from_user_bprm.c | 77 +++++++++++++++++
tools/testing/selftests/bpf/progs/lsm.c | 5 +-
.../selftests/bpf/progs/verifier_lsm.c | 31 +++++++
10 files changed, 304 insertions(+), 3 deletions(-)
create mode 100644 tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c
create mode 100644 tools/testing/selftests/bpf/progs/copy_from_user_bprm.c
base-commit: d114bb98936770c501c958bf2bc5fb6b7c0bad7b
--
2.55.0