kernel/bpf/token.c

17 bool bpf_token_capable(const struct bpf_token *token, int cap)
21 	/* BPF token allows ns_capable() level of capabilities */
22 	userns = token ? token->userns : &init_user_ns;
25 	if (token && security_bpf_token_capable(token, cap) < 0)
30 void bpf_token_inc(struct bpf_token *token)
32 	atomic64_inc(&token->refcnt);
35 static void bpf_token_free(struct bpf_token *token)
37 	security_bpf_token_free(token);
38 	put_user_ns(token->userns);
39 	kfree(token);
44 	struct bpf_token *token = container_of(work, struct bpf_token, work);
46 	bpf_token_free(token);
49 void bpf_token_put(struct bpf_token *token)
51 	if (!token)
54 	if (!atomic64_dec_and_test(&token->refcnt))
57 	INIT_WORK(&token->work, bpf_token_put_deferred);
58 	schedule_work(&token->work);
63 	struct bpf_token *token = filp->private_data;
65 	bpf_token_put(token);
71 	struct bpf_token *token = filp->private_data;
76 	if ((token->allowed_cmds & mask) == mask)
79 		seq_printf(m, "allowed_cmds:\t0x%llx\n", token->allowed_cmds);
83 	if ((token->allowed_maps & mask) == mask)
86 		seq_printf(m, "allowed_maps:\t0x%llx\n", token->allowed_maps);
90 	if ((token->allowed_progs & mask) == mask)
93 		seq_printf(m, "allowed_progs:\t0x%llx\n", token->allowed_progs);
97 	if ((token->allowed_attachs & mask) == mask)
100 		seq_printf(m, "allowed_attachs:\t0x%llx\n", token->allowed_attachs);
103 #define BPF_TOKEN_INODE_NAME "bpf-token"
115 	struct bpf_token *token = NULL;
159 	/* Creating BPF token in init_user_ns doesn't make much sense. */
170 		err = -ENOENT; /* no BPF token delegation is set up */
192 	token = kzalloc(sizeof(*token), GFP_USER);
193 	if (!token) {
198 	atomic64_set(&token->refcnt, 1);
201 	token->userns = get_user_ns(userns);
203 	token->allowed_cmds = mnt_opts->delegate_cmds;
204 	token->allowed_maps = mnt_opts->delegate_maps;
205 	token->allowed_progs = mnt_opts->delegate_progs;
206 	token->allowed_attachs = mnt_opts->delegate_attachs;
208 	err = security_bpf_token_create(token, attr, &path);
218 	file->private_data = token;
225 	bpf_token_free(token);
236 	struct bpf_token *token;
245 	token = f.file->private_data;
246 	bpf_token_inc(token);
249 	return token;
252 bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
254 	if (!token)
256 	if (!(token->allowed_cmds & BIT_ULL(cmd)))
258 	return security_bpf_token_cmd(token, cmd) == 0;
261 bool bpf_token_allow_map_type(const struct bpf_token *token, enum bpf_map_type type)
263 	if (!token || type >= __MAX_BPF_MAP_TYPE)
266 	return token->allowed_maps & BIT_ULL(type);
269 bool bpf_token_allow_prog_type(const struct bpf_token *token,
273 	if (!token || prog_type >= __MAX_BPF_PROG_TYPE || attach_type >= __MAX_BPF_ATTACH_TYPE)
276 	return (token->allowed_progs & BIT_ULL(prog_type)) &&
277 	       (token->allowed_attachs & BIT_ULL(attach_type));