mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-08-27 14:04:47 -04:00
7ae4eb14c5
Add BPF kfuncs that allow BPF LSM programs to create and use sockets for
sending data. This provides a mechanism for BPF programs to emit
telemetry. For this first patch set, it's restricted to SOCK_DGRAM
socket types with IPPROTO_UDP protocol but could be easily extended to
SOCK_STREAM and IPPROTO_TCP in the future.
The API consists of five kfuncs:
bpf_ksock_create() - Create a socket (sleepable)
bpf_ksock_connect() - Connect socket to remote address (sleepable)
bpf_ksock_send() - Send data through the socket (sleepable)
bpf_ksock_acquire() - Acquire a reference to a socket context
bpf_ksock_release() - Release a reference (cleanup via
queue_rcu_work since sock_release sleeps)
The setup kfuncs bpf_ksock_create, bpf_ksock_connect, can be called from
SYSCALL programs only. While bpf_ksock_acquire, bpf_ksock_release and
bpf_ksock_send can be called from SYSCALL and LSM programs.
The implementation follows the established kfunc lifecycle pattern
(create/acquire/release with refcounting, kptr map storage, dtor
registration). The kernel socket is wrapped in a refcounted bpf_ksock
struct. Cleanup is deferred via queue_rcu_work() because sock_release()
may sleep.
The kfuncs are only compiled when CONFIG_INET is enabled, as they
specifically support AF_INET and AF_INET6 sockets.
The socket operations go through the expected LSM hooks instead of
by-passing them like many kernel sockets since those are created by BPF
programs and thus system users. Thus, the bpf_ksock_send() kfunc, which
is exposed to LSM progs has a verifier filter protection to avoid
recursion so that the whole bpf_kfunc_set kfunc set cannot be called in
a program attached to security_socket_sendmsg(). Also, because of the
LSM checks, we prevent the use of the kfuncs from asynchronous workqueue
as the current value would then be invalid.
In bpf_ksock_create(), we copy the arg values to avoid TOCTOU races
since the kfunc can sleep and the arg values could be stored in a map
that could be re-written by BPF progs or even userspace programs if the
map is mmaped.
Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Acked-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/bpf/20260813110540.103550-3-mahe.tardy@gmail.com
55 lines
1.9 KiB
Makefile
55 lines
1.9 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# Makefile for the Linux networking core.
|
|
#
|
|
|
|
obj-y := sock.o skbuff.o datagram.o stream.o scm.o \
|
|
gen_stats.o gen_estimator.o net_namespace.o secure_seq.o \
|
|
flow_dissector.o
|
|
|
|
obj-$(CONFIG_SYSCTL) += sysctl_net_core.o
|
|
|
|
obj-y += dev.o dev_api.o dev_addr_lists.o dst.o netevent.o \
|
|
neighbour.o rtnetlink.o utils.o link_watch.o filter.o \
|
|
sock_diag.o dev_ioctl.o tso.o sock_reuseport.o \
|
|
fib_notifier.o xdp.o flow_offload.o gro.o \
|
|
netdev-genl.o netdev-genl-gen.o netdev_work.o gso.o
|
|
|
|
obj-$(CONFIG_NETDEV_ADDR_LIST_TEST) += dev_addr_lists_test.o
|
|
|
|
obj-y += net-sysfs.o
|
|
obj-y += hotdata.o
|
|
obj-y += netdev_config.o
|
|
obj-y += netdev_rx_queue.o
|
|
obj-y += netdev_queues.o
|
|
obj-$(CONFIG_PAGE_POOL) += page_pool.o page_pool_user.o
|
|
obj-$(CONFIG_PROC_FS) += net-procfs.o
|
|
obj-$(CONFIG_NET_PKTGEN) += pktgen.o
|
|
obj-$(CONFIG_NETPOLL) += netpoll.o
|
|
obj-$(CONFIG_FIB_RULES) += fib_rules.o
|
|
obj-$(CONFIG_TRACEPOINTS) += net-traces.o
|
|
obj-$(CONFIG_NET_DROP_MONITOR) += drop_monitor.o
|
|
obj-$(CONFIG_NET_IEEE8021Q_HELPERS) += ieee8021q_helpers.o
|
|
obj-$(CONFIG_NET_SELFTESTS) += selftests.o
|
|
obj-$(CONFIG_NETWORK_PHY_TIMESTAMPING) += timestamping.o
|
|
obj-$(CONFIG_NET_PTP_CLASSIFY) += ptp_classifier.o
|
|
obj-$(CONFIG_CGROUP_NET_PRIO) += netprio_cgroup.o
|
|
obj-$(CONFIG_CGROUP_NET_CLASSID) += netclassid_cgroup.o
|
|
obj-$(CONFIG_LWTUNNEL) += lwtunnel.o
|
|
obj-$(CONFIG_LWTUNNEL_BPF) += lwt_bpf.o
|
|
obj-$(CONFIG_DST_CACHE) += dst_cache.o
|
|
obj-$(CONFIG_HWBM) += hwbm.o
|
|
obj-$(CONFIG_GRO_CELLS) += gro_cells.o
|
|
obj-$(CONFIG_FAILOVER) += failover.o
|
|
obj-$(CONFIG_NET_SOCK_MSG) += skmsg.o
|
|
obj-$(CONFIG_BPF_SYSCALL) += sock_map.o
|
|
obj-$(CONFIG_BPF_SYSCALL) += bpf_sk_storage.o
|
|
ifdef CONFIG_INET
|
|
obj-$(CONFIG_BPF_SYSCALL) += bpf_ksock.o
|
|
endif
|
|
obj-$(CONFIG_OF) += of_net.o
|
|
obj-$(CONFIG_NET_TEST) += net_test.o
|
|
obj-$(CONFIG_NET_DEVMEM) += devmem.o
|
|
obj-$(CONFIG_DEBUG_NET) += lock_debug.o
|
|
obj-$(CONFIG_FAIL_SKB_REALLOC) += skb_fault_injection.o
|