lkml.org 
[lkml]   [2023]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [RFC PATCH bpf-next 00/13] bpf: Introduce BPF namespace
From
On 03/26, Yafang Shao wrote:
> Currently only CAP_SYS_ADMIN can iterate BPF object IDs and convert IDs
> to FDs, that's intended for BPF's security model[1]. Not only does it
> prevent non-privilidged users from getting other users' bpf program, but
> also it prevents the user from iterating his own bpf objects.

> In container environment, some users want to run bpf programs in their
> containers. These users can run their bpf programs under CAP_BPF and
> some other specific CAPs, but they can't inspect their bpf programs in a
> generic way. For example, the bpftool can't be used as it requires
> CAP_SYS_ADMIN. That is very inconvenient.

> Without CAP_SYS_ADMIN, the only way to get the information of a bpf object
> which is not created by the process itself is with SCM_RIGHTS, that
> requires each processes which created bpf object has to implement a unix
> domain socket to share the fd of a bpf object between different
> processes, that is really trivial and troublesome.

> Hence we need a better mechanism to get bpf object info without
> CAP_SYS_ADMIN.

[..]

> BPF namespace is introduced in this patchset with an attempt to remove
> the CAP_SYS_ADMIN requirement. The user can create bpf map, prog and
> link in a specific bpf namespace, then these bpf objects will not be
> visible to the users in a different bpf namespace. But these bpf
> objects are visible to its parent bpf namespace, so the sys admin can
> still iterate and inspect them.

Does it essentially mean unpriv bpf? Can I, as a non-root, create
a new bpf namespace and start loading/attaching progs?
Maybe add a paragraph about now vs whatever you're proposing.
Otherwise it's not very clear what's the security story.
(haven't looked at the whole series, so maybe it's answered somewhere else?)

> BPF namespace is similar to PID namespace, and the bpf objects are
> similar to tasks, so BPF namespace is very easy to understand. These
> patchset only implements BPF namespace for bpf map, prog and link. In the
> future we may extend it to other bpf objects like btf, bpffs and etc.
> For example, we can allow some of the BTF objects to be used in
> non-init bpf namespace, then the container user can only trace the
> processes running in his container, but can't get the information of
> tasks running in other containers.

> A simple example is introduced into selftests/bpf on how to use the bpf
> namespace.

> Putting bpf map, prog and link into bpf namespace is the first step.
> Let's start with it.

> [1].
> https://lore.kernel.org/bpf/20200513230355.7858-1-alexei.starovoitov@gmail.com/

> Yafang Shao (13):
> fork: New clone3 flag for BPF namespace
> proc_ns: Extend the field type in struct proc_ns_operations to long
> bpf: Implement bpf namespace
> bpf: No need to check if id is 0
> bpf: Make bpf objects id have the same alloc and free pattern
> bpf: Helpers to alloc and free object id in bpf namespace
> bpf: Add bpf helper to get bpf object id
> bpf: Alloc and free bpf_map id in bpf namespace
> bpf: Alloc and free bpf_prog id in bpf namespace
> bpf: Alloc and free bpf_link id in bpf namespace
> bpf: Allow iterating bpf objects with CAP_BPF in bpf namespace
> bpf: Use bpf_idr_lock array instead
> selftests/bpf: Add selftest for bpf namespace

> fs/proc/namespaces.c | 4 +
> include/linux/bpf.h | 9 +-
> include/linux/bpf_namespace.h | 88 ++++++++++
> include/linux/nsproxy.h | 4 +
> include/linux/proc_ns.h | 3 +-
> include/linux/user_namespace.h | 1 +
> include/uapi/linux/bpf.h | 7 +
> include/uapi/linux/sched.h | 1 +
> kernel/bpf/Makefile | 1 +
> kernel/bpf/bpf_namespace.c | 283
> ++++++++++++++++++++++++++++++
> kernel/bpf/offload.c | 16 +-
> kernel/bpf/syscall.c | 262
> ++++++++++-----------------
> kernel/bpf/task_iter.c | 12 ++
> kernel/fork.c | 5 +-
> kernel/nsproxy.c | 19 +-
> kernel/trace/bpf_trace.c | 2 +
> kernel/ucount.c | 1 +
> tools/bpf/bpftool/skeleton/pid_iter.bpf.c | 13 +-
> tools/include/uapi/linux/bpf.h | 7 +
> tools/testing/selftests/bpf/Makefile | 3 +-
> tools/testing/selftests/bpf/test_bpfns.c | 76 ++++++++
> 21 files changed, 637 insertions(+), 180 deletions(-)
> create mode 100644 include/linux/bpf_namespace.h
> create mode 100644 kernel/bpf/bpf_namespace.c
> create mode 100644 tools/testing/selftests/bpf/test_bpfns.c

> --
> 1.8.3.1

\
 
 \ /
  Last update: 2023-03-27 19:29    [W:0.214 / U:0.712 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site