When security_bprm_check runs, the arg and env strings for the exec have been copied into bprm->mm. The new address space has not been associated yet with a task_struct until exec_mmap(), so existing BPF user memory helpers can only read from the calling task's old address space. This patch adds bpf_copy_from_user_bprm() and bpf_copy_from_user_bprm_str() kfuncs. Both use the mm_struct provided by struct linux_binprm. Register these kfuncs only when CONFIG_MMU is enabled. On NOMMU systems, exec arguments are staged in bprm->page[] rather than mapped in bprm->mm, so these accessors cannot read them. bpf_copy_from_user_bprm() has similar semantics as bpf_copy_from_user_task(). bpf_copy_from_user_bprm_str() copies one NUL-terminated string and returns its size including the NUL terminator. It accepts BPF_F_PAD_ZEROS to clear unused destination bytes on success. This patch registers both kfuncs with KF_SLEEPABLE because accessing the remote address space can fault. This allows BPF LSM programs attached to security_bprm_check to read arguments beginning at bprm->p and reject an exec based on its command-line arguments. Signed-off-by: Anastasios Papagiannis --- fs/bpf_fs_kfuncs.c | 112 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 112 insertions(+) diff --git a/fs/bpf_fs_kfuncs.c b/fs/bpf_fs_kfuncs.c index f1863a891db6..74befdadad68 100644 --- a/fs/bpf_fs_kfuncs.c +++ b/fs/bpf_fs_kfuncs.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 /* Copyright (c) 2024 Google LLC. */ +#include #include #include #include @@ -379,6 +380,112 @@ __bpf_kfunc struct inode *bpf_real_data_inode(struct file *file) return d_real_inode(file_dentry(file)); } +/** + * bpf_copy_from_user_bprm - Copy data from a binary parameter address space + * @dst: Destination address, in kernel space + * @dst__sz: Number of bytes to copy + * @unsafe_ptr__ign: Source address in the binary parameter address space + * @bprm: Binary parameters whose address space will be used + * @flags: Reserved for future use; must be zero + * + * Copies data from the nascent address space associated with @bprm. This is + * useful for reading the argument and environment strings before the new + * address space is installed by exec_mmap(). For example, at the + * bprm_check_security LSM hook, @bprm->p points at the first argument string. + * + * The destination is zeroed if the requested number of bytes cannot be copied + * in full. + * + * Return: 0 on success, -EINVAL if @flags is non-zero, or -EFAULT if the copy + * fails or is partial. + */ +__bpf_kfunc int bpf_copy_from_user_bprm(void *dst, u32 dst__sz, + const void __user *unsafe_ptr__ign, + const struct linux_binprm *bprm, u64 flags) +{ + struct mm_struct *mm; + int ret; + + if (unlikely(flags)) + return -EINVAL; + + if (unlikely(!dst__sz)) + return 0; + + mm = bprm->mm; + if (!mm) { + memset(dst, 0, dst__sz); + return -EFAULT; + } + + ret = access_remote_vm(mm, (unsigned long)unsafe_ptr__ign, + dst, dst__sz, 0); + if (ret != dst__sz) { + memset(dst, 0, dst__sz); + return -EFAULT; + } + + return 0; +} + +/** + * bpf_copy_from_user_bprm_str - Copy a string from binary parameter memory + * @dst: Destination address, in kernel space. This buffer must be + * at least @dst__sz bytes long + * @dst__sz: Maximum number of bytes to copy, including the trailing NUL + * @unsafe_ptr__ign: Source address in the binary parameter address space + * @bprm: Binary parameters whose address space will be used + * @flags: The only supported flag is BPF_F_PAD_ZEROS + * + * Copies a NUL-terminated string from the nascent address space associated + * with @bprm. If the string is too long, @dst is still NUL-terminated unless + * @dst__sz is zero. + * + * If BPF_F_PAD_ZEROS is set, the unused portion of @dst is cleared on success + * and all of @dst is cleared on failure. + * + * Return: The number of copied bytes including the NUL terminator on success, + * or a negative error code on failure. + */ +__bpf_kfunc int bpf_copy_from_user_bprm_str(void *dst, u32 dst__sz, + const void __user *unsafe_ptr__ign, + const struct linux_binprm *bprm, + u64 flags) +{ + struct mm_struct *mm; + int ret; + + if (unlikely(flags & ~BPF_F_PAD_ZEROS)) + return -EINVAL; + + if (unlikely(!dst__sz)) + return 0; + + mm = bprm->mm; + if (!mm) { + if (flags & BPF_F_PAD_ZEROS) + memset(dst, 0, dst__sz); + else + *(char *)dst = '\0'; + + return -EFAULT; + } + + ret = copy_remote_mm_str(mm, (unsigned long)unsafe_ptr__ign, + dst, dst__sz, 0); + if (ret < 0) { + if (flags & BPF_F_PAD_ZEROS) + memset(dst, 0, dst__sz); + + return ret; + } + + if (flags & BPF_F_PAD_ZEROS) + memset(dst + ret, 0, dst__sz - ret); + + return ret + 1; +} + __bpf_kfunc_end_defs(); BTF_KFUNCS_START(bpf_fs_kfunc_set_ids) @@ -390,6 +497,11 @@ BTF_ID_FLAGS(func, bpf_get_file_xattr, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_set_dentry_xattr, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_remove_dentry_xattr, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_real_data_inode, KF_SLEEPABLE | KF_RET_NULL) +#ifdef CONFIG_MMU +/* NOMMU keeps the staged arguments in bprm->page[], not bprm->mm. */ +BTF_ID_FLAGS(func, bpf_copy_from_user_bprm, KF_SLEEPABLE) +BTF_ID_FLAGS(func, bpf_copy_from_user_bprm_str, KF_SLEEPABLE) +#endif BTF_KFUNCS_END(bpf_fs_kfunc_set_ids) static int bpf_fs_kfuncs_filter(const struct bpf_prog *prog, u32 kfunc_id) -- 2.55.0