mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 12:57:53 +00:00
bpf: Support uid and gid when mounting bpffs
Parse uid and gid in bpf_parse_param() so that they can be passed in as the `data` parameter when mount() bpffs. This will be useful when we want to control which user/group has the control to the mounted bpffs, otherwise a separate chown() call will be needed. Signed-off-by: Jie Jiang <jiejiang@chromium.org> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Acked-by: Mike Frysinger <vapier@chromium.org> Acked-by: Christian Brauner <brauner@kernel.org> Acked-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20231212093923.497838-1-jiejiang@chromium.org
This commit is contained in:
parent
62d9a969f4
commit
750e785796
2 changed files with 51 additions and 1 deletions
|
@ -1595,6 +1595,8 @@ struct bpf_link_primer {
|
|||
};
|
||||
|
||||
struct bpf_mount_opts {
|
||||
kuid_t uid;
|
||||
kgid_t gid;
|
||||
umode_t mode;
|
||||
|
||||
/* BPF token-related delegation options */
|
||||
|
|
|
@ -601,9 +601,16 @@ EXPORT_SYMBOL(bpf_prog_get_type_path);
|
|||
static int bpf_show_options(struct seq_file *m, struct dentry *root)
|
||||
{
|
||||
struct bpf_mount_opts *opts = root->d_sb->s_fs_info;
|
||||
umode_t mode = d_inode(root)->i_mode & S_IALLUGO & ~S_ISVTX;
|
||||
struct inode *inode = d_inode(root);
|
||||
umode_t mode = inode->i_mode & S_IALLUGO & ~S_ISVTX;
|
||||
u64 mask;
|
||||
|
||||
if (!uid_eq(inode->i_uid, GLOBAL_ROOT_UID))
|
||||
seq_printf(m, ",uid=%u",
|
||||
from_kuid_munged(&init_user_ns, inode->i_uid));
|
||||
if (!gid_eq(inode->i_gid, GLOBAL_ROOT_GID))
|
||||
seq_printf(m, ",gid=%u",
|
||||
from_kgid_munged(&init_user_ns, inode->i_gid));
|
||||
if (mode != S_IRWXUGO)
|
||||
seq_printf(m, ",mode=%o", mode);
|
||||
|
||||
|
@ -652,6 +659,8 @@ const struct super_operations bpf_super_ops = {
|
|||
};
|
||||
|
||||
enum {
|
||||
OPT_UID,
|
||||
OPT_GID,
|
||||
OPT_MODE,
|
||||
OPT_DELEGATE_CMDS,
|
||||
OPT_DELEGATE_MAPS,
|
||||
|
@ -660,6 +669,8 @@ enum {
|
|||
};
|
||||
|
||||
static const struct fs_parameter_spec bpf_fs_parameters[] = {
|
||||
fsparam_u32 ("uid", OPT_UID),
|
||||
fsparam_u32 ("gid", OPT_GID),
|
||||
fsparam_u32oct ("mode", OPT_MODE),
|
||||
fsparam_string ("delegate_cmds", OPT_DELEGATE_CMDS),
|
||||
fsparam_string ("delegate_maps", OPT_DELEGATE_MAPS),
|
||||
|
@ -672,6 +683,8 @@ static int bpf_parse_param(struct fs_context *fc, struct fs_parameter *param)
|
|||
{
|
||||
struct bpf_mount_opts *opts = fc->s_fs_info;
|
||||
struct fs_parse_result result;
|
||||
kuid_t uid;
|
||||
kgid_t gid;
|
||||
int opt, err;
|
||||
u64 msk;
|
||||
|
||||
|
@ -694,6 +707,34 @@ static int bpf_parse_param(struct fs_context *fc, struct fs_parameter *param)
|
|||
}
|
||||
|
||||
switch (opt) {
|
||||
case OPT_UID:
|
||||
uid = make_kuid(current_user_ns(), result.uint_32);
|
||||
if (!uid_valid(uid))
|
||||
goto bad_value;
|
||||
|
||||
/*
|
||||
* The requested uid must be representable in the
|
||||
* filesystem's idmapping.
|
||||
*/
|
||||
if (!kuid_has_mapping(fc->user_ns, uid))
|
||||
goto bad_value;
|
||||
|
||||
opts->uid = uid;
|
||||
break;
|
||||
case OPT_GID:
|
||||
gid = make_kgid(current_user_ns(), result.uint_32);
|
||||
if (!gid_valid(gid))
|
||||
goto bad_value;
|
||||
|
||||
/*
|
||||
* The requested gid must be representable in the
|
||||
* filesystem's idmapping.
|
||||
*/
|
||||
if (!kgid_has_mapping(fc->user_ns, gid))
|
||||
goto bad_value;
|
||||
|
||||
opts->gid = gid;
|
||||
break;
|
||||
case OPT_MODE:
|
||||
opts->mode = result.uint_32 & S_IALLUGO;
|
||||
break;
|
||||
|
@ -722,6 +763,9 @@ static int bpf_parse_param(struct fs_context *fc, struct fs_parameter *param)
|
|||
}
|
||||
|
||||
return 0;
|
||||
|
||||
bad_value:
|
||||
return invalfc(fc, "Bad value for '%s'", param->key);
|
||||
}
|
||||
|
||||
struct bpf_preload_ops *bpf_preload_ops;
|
||||
|
@ -808,6 +852,8 @@ static int bpf_fill_super(struct super_block *sb, struct fs_context *fc)
|
|||
sb->s_op = &bpf_super_ops;
|
||||
|
||||
inode = sb->s_root->d_inode;
|
||||
inode->i_uid = opts->uid;
|
||||
inode->i_gid = opts->gid;
|
||||
inode->i_op = &bpf_dir_iops;
|
||||
inode->i_mode &= ~S_IALLUGO;
|
||||
populate_bpffs(sb->s_root);
|
||||
|
@ -843,6 +889,8 @@ static int bpf_init_fs_context(struct fs_context *fc)
|
|||
return -ENOMEM;
|
||||
|
||||
opts->mode = S_IRWXUGO;
|
||||
opts->uid = current_fsuid();
|
||||
opts->gid = current_fsgid();
|
||||
|
||||
/* start out with no BPF token delegation enabled */
|
||||
opts->delegate_cmds = 0;
|
||||
|
|
Loading…
Reference in a new issue