1 // SPDX-License-Identifier: GPL-2.0
4 * Copyright (C) 2020 Google LLC.
7 #include <linux/filter.h>
10 #include <linux/lsm_hooks.h>
11 #include <linux/bpf_lsm.h>
12 #include <linux/kallsyms.h>
13 #include <linux/bpf_verifier.h>
14 #include <net/bpf_sk_storage.h>
15 #include <linux/bpf_local_storage.h>
16 #include <linux/btf_ids.h>
18 /* For every LSM hook that allows attachment of BPF programs, declare a nop
19 * function where a BPF program can be attached.
21 #define LSM_HOOK(RET, DEFAULT, NAME, ...) \
22 noinline RET bpf_lsm_##NAME(__VA_ARGS__) \
27 #include <linux/lsm_hook_defs.h>
30 #define LSM_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME)
31 BTF_SET_START(bpf_lsm_hooks)
32 #include <linux/lsm_hook_defs.h>
34 BTF_SET_END(bpf_lsm_hooks)
36 int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
37 const struct bpf_prog *prog)
39 if (!prog->gpl_compatible) {
41 "LSM programs must have a GPL compatible license\n");
45 if (!btf_id_set_contains(&bpf_lsm_hooks, prog->aux->attach_btf_id)) {
46 bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n",
47 prog->aux->attach_btf_id, prog->aux->attach_func_name);
54 static const struct bpf_func_proto *
55 bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
58 case BPF_FUNC_inode_storage_get:
59 return &bpf_inode_storage_get_proto;
60 case BPF_FUNC_inode_storage_delete:
61 return &bpf_inode_storage_delete_proto;
62 case BPF_FUNC_sk_storage_get:
63 return &bpf_sk_storage_get_proto;
64 case BPF_FUNC_sk_storage_delete:
65 return &bpf_sk_storage_delete_proto;
67 return tracing_prog_func_proto(func_id, prog);
71 const struct bpf_prog_ops lsm_prog_ops = {
74 const struct bpf_verifier_ops lsm_verifier_ops = {
75 .get_func_proto = bpf_lsm_func_proto,
76 .is_valid_access = btf_ctx_access,