1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2024 Google LLC. */
3
4 #include <vmlinux.h>
5 #include <bpf/bpf_helpers.h>
6 #include <bpf/bpf_tracing.h>
7 #include <linux/limits.h>
8
9 #include "bpf_misc.h"
10 #include "bpf_experimental.h"
11
12 static char buf[PATH_MAX];
13
14 SEC("lsm.s/file_open")
15 __failure __msg("Possibly NULL pointer passed to trusted arg0")
16 int BPF_PROG(get_task_exe_file_kfunc_null)
17 {
18 struct file *acquired;
19
20 /* Can't pass a NULL pointer to bpf_get_task_exe_file(). */
21 acquired = bpf_get_task_exe_file(NULL);
22 if (!acquired)
23 return 0;
24
25 bpf_put_file(acquired);
26 return 0;
27 }
28
29 SEC("lsm.s/inode_getxattr")
30 __failure __msg("arg#0 pointer type STRUCT task_struct must point to scalar, or struct with scalar")
31 int BPF_PROG(get_task_exe_file_kfunc_fp)
32 {
33 u64 x;
34 struct file *acquired;
35 struct task_struct *task;
36
37 task = (struct task_struct *)&x;
38 /* Can't pass random frame pointer to bpf_get_task_exe_file(). */
39 acquired = bpf_get_task_exe_file(task);
40 if (!acquired)
41 return 0;
42
43 bpf_put_file(acquired);
44 return 0;
45 }
46
47 SEC("lsm.s/file_open")
48 __failure __msg("R1 must be referenced or trusted")
49 int BPF_PROG(get_task_exe_file_kfunc_untrusted)
50 {
51 struct file *acquired;
52 struct task_struct *parent;
53
54 /* Walking a trusted struct task_struct returned from
55 * bpf_get_current_task_btf() yields an untrusted pointer.
56 */
57 parent = bpf_get_current_task_btf()->parent;
58 /* Can't pass untrusted pointer to bpf_get_task_exe_file(). */
59 acquired = bpf_get_task_exe_file(parent);
60 if (!acquired)
61 return 0;
62
63 bpf_put_file(acquired);
64 return 0;
65 }
66
67 SEC("lsm.s/file_open")
68 __failure __msg("Unreleased reference")
69 int BPF_PROG(get_task_exe_file_kfunc_unreleased)
70 {
71 struct file *acquired;
72
73 acquired = bpf_get_task_exe_file(bpf_get_current_task_btf());
74 if (!acquired)
75 return 0;
76
77 /* Acquired but never released. */
78 return 0;
79 }
80
81 SEC("lsm.s/file_open")
82 __failure __msg("release kernel function bpf_put_file expects")
83 int BPF_PROG(put_file_kfunc_unacquired, struct file *file)
84 {
85 /* Can't release an unacquired pointer. */
86 bpf_put_file(file);
87 return 0;
88 }
89
90 SEC("lsm.s/file_open")
91 __failure __msg("Possibly NULL pointer passed to trusted arg0")
92 int BPF_PROG(path_d_path_kfunc_null)
93 {
94 /* Can't pass NULL value to bpf_path_d_path() kfunc. */
95 bpf_path_d_path(NULL, buf, sizeof(buf));
96 return 0;
97 }
98
99 SEC("lsm.s/task_alloc")
100 __failure __msg("R1 must be referenced or trusted")
101 int BPF_PROG(path_d_path_kfunc_untrusted_from_argument, struct task_struct *task)
102 {
103 struct path *root;
104
105 /* Walking a trusted argument typically yields an untrusted
106 * pointer. This is one example of that.
107 */
108 root = &task->fs->root;
109 bpf_path_d_path(root, buf, sizeof(buf));
110 return 0;
111 }
112
113 SEC("lsm.s/file_open")
114 __failure __msg("R1 must be referenced or trusted")
115 int BPF_PROG(path_d_path_kfunc_untrusted_from_current)
116 {
117 struct path *pwd;
118 struct task_struct *current;
119
120 current = bpf_get_current_task_btf();
121 /* Walking a trusted pointer returned from bpf_get_current_task_btf()
122 * yields an untrusted pointer.
123 */
124 pwd = ¤t->fs->pwd;
125 bpf_path_d_path(pwd, buf, sizeof(buf));
126 return 0;
127 }
128
129 SEC("lsm.s/file_open")
130 __failure __msg("kernel function bpf_path_d_path args#0 expected pointer to STRUCT path but R1 has a pointer to STRUCT file")
131 int BPF_PROG(path_d_path_kfunc_type_mismatch, struct file *file)
132 {
133 bpf_path_d_path((struct path *)&file->f_task_work, buf, sizeof(buf));
134 return 0;
135 }
136
137 SEC("lsm.s/file_open")
138 __failure __msg("invalid access to map value, value_size=4096 off=0 size=8192")
139 int BPF_PROG(path_d_path_kfunc_invalid_buf_sz, struct file *file)
140 {
141 /* bpf_path_d_path() enforces a constraint on the buffer size supplied
142 * by the BPF LSM program via the __sz annotation. buf here is set to
143 * PATH_MAX, so let's ensure that the BPF verifier rejects BPF_PROG_LOAD
144 * attempts if the supplied size and the actual size of the buffer
145 * mismatches.
146 */
147 bpf_path_d_path(&file->f_path, buf, PATH_MAX * 2);
148 return 0;
149 }
150
151 SEC("fentry/vfs_open")
152 __failure __msg("calling kernel function bpf_path_d_path is not allowed")
153 int BPF_PROG(path_d_path_kfunc_non_lsm, struct path *path, struct file *f)
154 {
155 /* Calling bpf_path_d_path() from a non-LSM BPF program isn't permitted.
156 */
157 bpf_path_d_path(path, buf, sizeof(buf));
158 return 0;
159 }
160
161 char _license[] SEC("license") = "GPL";
162
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.