lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 259/862] bpf: Only add BTF IDs for socket security hooks when CONFIG_SECURITY_NETWORK is on
    Date
    From: Hou Tao <houtao1@huawei.com>

    [ Upstream commit ef331a8d4c0061ea4d353cd0db1c9b33fd45f0f2 ]

    When CONFIG_SECURITY_NETWORK is disabled, there will be build warnings
    from resolve_btfids:

    WARN: resolve_btfids: unresolved symbol bpf_lsm_socket_socketpair
    ......
    WARN: resolve_btfids: unresolved symbol bpf_lsm_inet_conn_established

    Fixing it by wrapping these BTF ID definitions by CONFIG_SECURITY_NETWORK.

    Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor")
    Fixes: 9113d7e48e91 ("bpf: expose bpf_{g,s}etsockopt to lsm cgroup")
    Signed-off-by: Hou Tao <houtao1@huawei.com>
    Link: https://lore.kernel.org/r/20220901065126.3856297-1-houtao@huaweicloud.com
    Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    kernel/bpf/bpf_lsm.c | 6 ++++++
    1 file changed, 6 insertions(+)

    diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
    index fa71d58b7ded..832a0e48a2a1 100644
    --- a/kernel/bpf/bpf_lsm.c
    +++ b/kernel/bpf/bpf_lsm.c
    @@ -41,17 +41,21 @@ BTF_SET_END(bpf_lsm_hooks)
    */
    BTF_SET_START(bpf_lsm_current_hooks)
    /* operate on freshly allocated sk without any cgroup association */
    +#ifdef CONFIG_SECURITY_NETWORK
    BTF_ID(func, bpf_lsm_sk_alloc_security)
    BTF_ID(func, bpf_lsm_sk_free_security)
    +#endif
    BTF_SET_END(bpf_lsm_current_hooks)

    /* List of LSM hooks that trigger while the socket is properly locked.
    */
    BTF_SET_START(bpf_lsm_locked_sockopt_hooks)
    +#ifdef CONFIG_SECURITY_NETWORK
    BTF_ID(func, bpf_lsm_socket_sock_rcv_skb)
    BTF_ID(func, bpf_lsm_sock_graft)
    BTF_ID(func, bpf_lsm_inet_csk_clone)
    BTF_ID(func, bpf_lsm_inet_conn_established)
    +#endif
    BTF_SET_END(bpf_lsm_locked_sockopt_hooks)

    /* List of LSM hooks that trigger while the socket is _not_ locked,
    @@ -59,8 +63,10 @@ BTF_SET_END(bpf_lsm_locked_sockopt_hooks)
    * in the early init phase.
    */
    BTF_SET_START(bpf_lsm_unlocked_sockopt_hooks)
    +#ifdef CONFIG_SECURITY_NETWORK
    BTF_ID(func, bpf_lsm_socket_post_create)
    BTF_ID(func, bpf_lsm_socket_socketpair)
    +#endif
    BTF_SET_END(bpf_lsm_unlocked_sockopt_hooks)

    #ifdef CONFIG_CGROUP_BPF
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-19 10:56    [W:4.028 / U:0.196 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site