Skip to content

Commit 859051d

Browse files
daandemeyerMartin KaFai Lau
daandemeyer
authored and
Martin KaFai Lau
committed
bpf: Implement cgroup sockaddr hooks for unix sockets
These hooks allows intercepting connect(), getsockname(), getpeername(), sendmsg() and recvmsg() for unix sockets. The unix socket hooks get write access to the address length because the address length is not fixed when dealing with unix sockets and needs to be modified when a unix socket address is modified by the hook. Because abstract socket unix addresses start with a NUL byte, we cannot recalculate the socket address in kernelspace after running the hook by calculating the length of the unix socket path using strlen(). These hooks can be used when users want to multiplex syscall to a single unix socket to multiple different processes behind the scenes by redirecting the connect() and other syscalls to process specific sockets. We do not implement support for intercepting bind() because when using bind() with unix sockets with a pathname address, this creates an inode in the filesystem which must be cleaned up. If we rewrite the address, the user might try to clean up the wrong file, leaking the socket in the filesystem where it is never cleaned up. Until we figure out a solution for this (and a use case for intercepting bind()), we opt to not allow rewriting the sockaddr in bind() calls. We also implement recvmsg() support for connected streams so that after a connect() that is modified by a sockaddr hook, any corresponding recmvsg() on the connected socket can also be modified to make the connected program think it is connected to the "intended" remote. Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: Daan De Meyer <daan.j.demeyer@gmail.com> Link: https://lore.kernel.org/r/20231011185113.140426-5-daan.j.demeyer@gmail.com Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
1 parent 53e380d commit 859051d

9 files changed

Lines changed: 114 additions & 14 deletions

File tree

‎include/linux/bpf-cgroup-defs.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,19 +28,24 @@ enum cgroup_bpf_attach_type {
2828
CGROUP_INET6_BIND,
2929
CGROUP_INET4_CONNECT,
3030
CGROUP_INET6_CONNECT,
31+
CGROUP_UNIX_CONNECT,
3132
CGROUP_INET4_POST_BIND,
3233
CGROUP_INET6_POST_BIND,
3334
CGROUP_UDP4_SENDMSG,
3435
CGROUP_UDP6_SENDMSG,
36+
CGROUP_UNIX_SENDMSG,
3537
CGROUP_SYSCTL,
3638
CGROUP_UDP4_RECVMSG,
3739
CGROUP_UDP6_RECVMSG,
40+
CGROUP_UNIX_RECVMSG,
3841
CGROUP_GETSOCKOPT,
3942
CGROUP_SETSOCKOPT,
4043
CGROUP_INET4_GETPEERNAME,
4144
CGROUP_INET6_GETPEERNAME,
45+
CGROUP_UNIX_GETPEERNAME,
4246
CGROUP_INET4_GETSOCKNAME,
4347
CGROUP_INET6_GETSOCKNAME,
48+
CGROUP_UNIX_GETSOCKNAME,
4449
CGROUP_INET_SOCK_RELEASE,
4550
CGROUP_LSM_START,
4651
CGROUP_LSM_END = CGROUP_LSM_START + CGROUP_LSM_NUM - 1,

‎include/linux/bpf-cgroup.h‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,19 +48,24 @@ to_cgroup_bpf_attach_type(enum bpf_attach_type attach_type)
4848
CGROUP_ATYPE(CGROUP_INET6_BIND);
4949
CGROUP_ATYPE(CGROUP_INET4_CONNECT);
5050
CGROUP_ATYPE(CGROUP_INET6_CONNECT);
51+
CGROUP_ATYPE(CGROUP_UNIX_CONNECT);
5152
CGROUP_ATYPE(CGROUP_INET4_POST_BIND);
5253
CGROUP_ATYPE(CGROUP_INET6_POST_BIND);
5354
CGROUP_ATYPE(CGROUP_UDP4_SENDMSG);
5455
CGROUP_ATYPE(CGROUP_UDP6_SENDMSG);
56+
CGROUP_ATYPE(CGROUP_UNIX_SENDMSG);
5557
CGROUP_ATYPE(CGROUP_SYSCTL);
5658
CGROUP_ATYPE(CGROUP_UDP4_RECVMSG);
5759
CGROUP_ATYPE(CGROUP_UDP6_RECVMSG);
60+
CGROUP_ATYPE(CGROUP_UNIX_RECVMSG);
5861
CGROUP_ATYPE(CGROUP_GETSOCKOPT);
5962
CGROUP_ATYPE(CGROUP_SETSOCKOPT);
6063
CGROUP_ATYPE(CGROUP_INET4_GETPEERNAME);
6164
CGROUP_ATYPE(CGROUP_INET6_GETPEERNAME);
65+
CGROUP_ATYPE(CGROUP_UNIX_GETPEERNAME);
6266
CGROUP_ATYPE(CGROUP_INET4_GETSOCKNAME);
6367
CGROUP_ATYPE(CGROUP_INET6_GETSOCKNAME);
68+
CGROUP_ATYPE(CGROUP_UNIX_GETSOCKNAME);
6469
CGROUP_ATYPE(CGROUP_INET_SOCK_RELEASE);
6570
default:
6671
return CGROUP_BPF_ATTACH_TYPE_INVALID;
@@ -289,18 +294,27 @@ static inline bool cgroup_bpf_sock_enabled(struct sock *sk,
289294
#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, uaddrlen) \
290295
BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_INET6_CONNECT, NULL)
291296

297+
#define BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, uaddr, uaddrlen) \
298+
BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UNIX_CONNECT, NULL)
299+
292300
#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) \
293301
BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP4_SENDMSG, t_ctx)
294302

295303
#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) \
296304
BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP6_SENDMSG, t_ctx)
297305

306+
#define BPF_CGROUP_RUN_PROG_UNIX_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) \
307+
BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UNIX_SENDMSG, t_ctx)
308+
298309
#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr, uaddrlen) \
299310
BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP4_RECVMSG, NULL)
300311

301312
#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr, uaddrlen) \
302313
BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP6_RECVMSG, NULL)
303314

315+
#define BPF_CGROUP_RUN_PROG_UNIX_RECVMSG_LOCK(sk, uaddr, uaddrlen) \
316+
BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UNIX_RECVMSG, NULL)
317+
304318
/* The SOCK_OPS"_SK" macro should be used when sock_ops->sk is not a
305319
* fullsock and its parent fullsock cannot be traced by
306320
* sk_to_full_sk().
@@ -492,10 +506,13 @@ static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map,
492506
#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, uaddrlen) ({ 0; })
493507
#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr, uaddrlen) ({ 0; })
494508
#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, uaddrlen) ({ 0; })
509+
#define BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, uaddr, uaddrlen) ({ 0; })
495510
#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) ({ 0; })
496511
#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) ({ 0; })
512+
#define BPF_CGROUP_RUN_PROG_UNIX_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) ({ 0; })
497513
#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr, uaddrlen) ({ 0; })
498514
#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr, uaddrlen) ({ 0; })
515+
#define BPF_CGROUP_RUN_PROG_UNIX_RECVMSG_LOCK(sk, uaddr, uaddrlen) ({ 0; })
499516
#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
500517
#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access) ({ 0; })
501518
#define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos) ({ 0; })

‎include/uapi/linux/bpf.h‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1047,6 +1047,11 @@ enum bpf_attach_type {
10471047
BPF_TCX_INGRESS,
10481048
BPF_TCX_EGRESS,
10491049
BPF_TRACE_UPROBE_MULTI,
1050+
BPF_CGROUP_UNIX_CONNECT,
1051+
BPF_CGROUP_UNIX_SENDMSG,
1052+
BPF_CGROUP_UNIX_RECVMSG,
1053+
BPF_CGROUP_UNIX_GETPEERNAME,
1054+
BPF_CGROUP_UNIX_GETSOCKNAME,
10501055
__MAX_BPF_ATTACH_TYPE
10511056
};
10521057

@@ -2704,8 +2709,8 @@ union bpf_attr {
27042709
* *bpf_socket* should be one of the following:
27052710
*
27062711
* * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**.
2707-
* * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT**
2708-
* and **BPF_CGROUP_INET6_CONNECT**.
2712+
* * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT**,
2713+
* **BPF_CGROUP_INET6_CONNECT** and **BPF_CGROUP_UNIX_CONNECT**.
27092714
*
27102715
* This helper actually implements a subset of **setsockopt()**.
27112716
* It supports the following *level*\ s:
@@ -2943,8 +2948,8 @@ union bpf_attr {
29432948
* *bpf_socket* should be one of the following:
29442949
*
29452950
* * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**.
2946-
* * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT**
2947-
* and **BPF_CGROUP_INET6_CONNECT**.
2951+
* * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT**,
2952+
* **BPF_CGROUP_INET6_CONNECT** and **BPF_CGROUP_UNIX_CONNECT**.
29482953
*
29492954
* This helper actually implements a subset of **getsockopt()**.
29502955
* It supports the same set of *optname*\ s that is supported by

‎kernel/bpf/cgroup.c‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1458,7 +1458,7 @@ EXPORT_SYMBOL(__cgroup_bpf_run_filter_sk);
14581458
* @flags: Pointer to u32 which contains higher bits of BPF program
14591459
* return value (OR'ed together).
14601460
*
1461-
* socket is expected to be of type INET or INET6.
1461+
* socket is expected to be of type INET, INET6 or UNIX.
14621462
*
14631463
* This function will return %-EPERM if an attached program is found and
14641464
* returned value != 1 during execution. In all other cases, 0 is returned.
@@ -1482,7 +1482,8 @@ int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,
14821482
/* Check socket family since not all sockets represent network
14831483
* endpoint (e.g. AF_UNIX).
14841484
*/
1485-
if (sk->sk_family != AF_INET && sk->sk_family != AF_INET6)
1485+
if (sk->sk_family != AF_INET && sk->sk_family != AF_INET6 &&
1486+
sk->sk_family != AF_UNIX)
14861487
return 0;
14871488

14881489
if (!ctx.uaddr) {
@@ -2533,10 +2534,13 @@ cgroup_common_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
25332534
case BPF_CGROUP_SOCK_OPS:
25342535
case BPF_CGROUP_UDP4_RECVMSG:
25352536
case BPF_CGROUP_UDP6_RECVMSG:
2537+
case BPF_CGROUP_UNIX_RECVMSG:
25362538
case BPF_CGROUP_INET4_GETPEERNAME:
25372539
case BPF_CGROUP_INET6_GETPEERNAME:
2540+
case BPF_CGROUP_UNIX_GETPEERNAME:
25382541
case BPF_CGROUP_INET4_GETSOCKNAME:
25392542
case BPF_CGROUP_INET6_GETSOCKNAME:
2543+
case BPF_CGROUP_UNIX_GETSOCKNAME:
25402544
return NULL;
25412545
default:
25422546
return &bpf_get_retval_proto;
@@ -2548,10 +2552,13 @@ cgroup_common_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
25482552
case BPF_CGROUP_SOCK_OPS:
25492553
case BPF_CGROUP_UDP4_RECVMSG:
25502554
case BPF_CGROUP_UDP6_RECVMSG:
2555+
case BPF_CGROUP_UNIX_RECVMSG:
25512556
case BPF_CGROUP_INET4_GETPEERNAME:
25522557
case BPF_CGROUP_INET6_GETPEERNAME:
2558+
case BPF_CGROUP_UNIX_GETPEERNAME:
25532559
case BPF_CGROUP_INET4_GETSOCKNAME:
25542560
case BPF_CGROUP_INET6_GETSOCKNAME:
2561+
case BPF_CGROUP_UNIX_GETSOCKNAME:
25552562
return NULL;
25562563
default:
25572564
return &bpf_set_retval_proto;

‎kernel/bpf/syscall.c‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2446,14 +2446,19 @@ bpf_prog_load_check_attach(enum bpf_prog_type prog_type,
24462446
case BPF_CGROUP_INET6_BIND:
24472447
case BPF_CGROUP_INET4_CONNECT:
24482448
case BPF_CGROUP_INET6_CONNECT:
2449+
case BPF_CGROUP_UNIX_CONNECT:
24492450
case BPF_CGROUP_INET4_GETPEERNAME:
24502451
case BPF_CGROUP_INET6_GETPEERNAME:
2452+
case BPF_CGROUP_UNIX_GETPEERNAME:
24512453
case BPF_CGROUP_INET4_GETSOCKNAME:
24522454
case BPF_CGROUP_INET6_GETSOCKNAME:
2455+
case BPF_CGROUP_UNIX_GETSOCKNAME:
24532456
case BPF_CGROUP_UDP4_SENDMSG:
24542457
case BPF_CGROUP_UDP6_SENDMSG:
2458+
case BPF_CGROUP_UNIX_SENDMSG:
24552459
case BPF_CGROUP_UDP4_RECVMSG:
24562460
case BPF_CGROUP_UDP6_RECVMSG:
2461+
case BPF_CGROUP_UNIX_RECVMSG:
24572462
return 0;
24582463
default:
24592464
return -EINVAL;
@@ -3678,14 +3683,19 @@ attach_type_to_prog_type(enum bpf_attach_type attach_type)
36783683
case BPF_CGROUP_INET6_BIND:
36793684
case BPF_CGROUP_INET4_CONNECT:
36803685
case BPF_CGROUP_INET6_CONNECT:
3686+
case BPF_CGROUP_UNIX_CONNECT:
36813687
case BPF_CGROUP_INET4_GETPEERNAME:
36823688
case BPF_CGROUP_INET6_GETPEERNAME:
3689+
case BPF_CGROUP_UNIX_GETPEERNAME:
36833690
case BPF_CGROUP_INET4_GETSOCKNAME:
36843691
case BPF_CGROUP_INET6_GETSOCKNAME:
3692+
case BPF_CGROUP_UNIX_GETSOCKNAME:
36853693
case BPF_CGROUP_UDP4_SENDMSG:
36863694
case BPF_CGROUP_UDP6_SENDMSG:
3695+
case BPF_CGROUP_UNIX_SENDMSG:
36873696
case BPF_CGROUP_UDP4_RECVMSG:
36883697
case BPF_CGROUP_UDP6_RECVMSG:
3698+
case BPF_CGROUP_UNIX_RECVMSG:
36893699
return BPF_PROG_TYPE_CGROUP_SOCK_ADDR;
36903700
case BPF_CGROUP_SOCK_OPS:
36913701
return BPF_PROG_TYPE_SOCK_OPS;
@@ -3942,14 +3952,19 @@ static int bpf_prog_query(const union bpf_attr *attr,
39423952
case BPF_CGROUP_INET6_POST_BIND:
39433953
case BPF_CGROUP_INET4_CONNECT:
39443954
case BPF_CGROUP_INET6_CONNECT:
3955+
case BPF_CGROUP_UNIX_CONNECT:
39453956
case BPF_CGROUP_INET4_GETPEERNAME:
39463957
case BPF_CGROUP_INET6_GETPEERNAME:
3958+
case BPF_CGROUP_UNIX_GETPEERNAME:
39473959
case BPF_CGROUP_INET4_GETSOCKNAME:
39483960
case BPF_CGROUP_INET6_GETSOCKNAME:
3961+
case BPF_CGROUP_UNIX_GETSOCKNAME:
39493962
case BPF_CGROUP_UDP4_SENDMSG:
39503963
case BPF_CGROUP_UDP6_SENDMSG:
3964+
case BPF_CGROUP_UNIX_SENDMSG:
39513965
case BPF_CGROUP_UDP4_RECVMSG:
39523966
case BPF_CGROUP_UDP6_RECVMSG:
3967+
case BPF_CGROUP_UNIX_RECVMSG:
39533968
case BPF_CGROUP_SOCK_OPS:
39543969
case BPF_CGROUP_DEVICE:
39553970
case BPF_CGROUP_SYSCTL:

‎kernel/bpf/verifier.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14797,10 +14797,13 @@ static int check_return_code(struct bpf_verifier_env *env, int regno)
1479714797
case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
1479814798
if (env->prog->expected_attach_type == BPF_CGROUP_UDP4_RECVMSG ||
1479914799
env->prog->expected_attach_type == BPF_CGROUP_UDP6_RECVMSG ||
14800+
env->prog->expected_attach_type == BPF_CGROUP_UNIX_RECVMSG ||
1480014801
env->prog->expected_attach_type == BPF_CGROUP_INET4_GETPEERNAME ||
1480114802
env->prog->expected_attach_type == BPF_CGROUP_INET6_GETPEERNAME ||
14803+
env->prog->expected_attach_type == BPF_CGROUP_UNIX_GETPEERNAME ||
1480214804
env->prog->expected_attach_type == BPF_CGROUP_INET4_GETSOCKNAME ||
14803-
env->prog->expected_attach_type == BPF_CGROUP_INET6_GETSOCKNAME)
14805+
env->prog->expected_attach_type == BPF_CGROUP_INET6_GETSOCKNAME ||
14806+
env->prog->expected_attach_type == BPF_CGROUP_UNIX_GETSOCKNAME)
1480414807
range = tnum_range(1, 1);
1480514808
if (env->prog->expected_attach_type == BPF_CGROUP_INET4_BIND ||
1480614809
env->prog->expected_attach_type == BPF_CGROUP_INET6_BIND)

‎net/core/filter.c‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7875,14 +7875,19 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
78757875
case BPF_CGROUP_INET6_BIND:
78767876
case BPF_CGROUP_INET4_CONNECT:
78777877
case BPF_CGROUP_INET6_CONNECT:
7878+
case BPF_CGROUP_UNIX_CONNECT:
78787879
case BPF_CGROUP_UDP4_RECVMSG:
78797880
case BPF_CGROUP_UDP6_RECVMSG:
7881+
case BPF_CGROUP_UNIX_RECVMSG:
78807882
case BPF_CGROUP_UDP4_SENDMSG:
78817883
case BPF_CGROUP_UDP6_SENDMSG:
7884+
case BPF_CGROUP_UNIX_SENDMSG:
78827885
case BPF_CGROUP_INET4_GETPEERNAME:
78837886
case BPF_CGROUP_INET6_GETPEERNAME:
7887+
case BPF_CGROUP_UNIX_GETPEERNAME:
78847888
case BPF_CGROUP_INET4_GETSOCKNAME:
78857889
case BPF_CGROUP_INET6_GETSOCKNAME:
7890+
case BPF_CGROUP_UNIX_GETSOCKNAME:
78867891
return &bpf_sock_addr_setsockopt_proto;
78877892
default:
78887893
return NULL;
@@ -7893,14 +7898,19 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
78937898
case BPF_CGROUP_INET6_BIND:
78947899
case BPF_CGROUP_INET4_CONNECT:
78957900
case BPF_CGROUP_INET6_CONNECT:
7901+
case BPF_CGROUP_UNIX_CONNECT:
78967902
case BPF_CGROUP_UDP4_RECVMSG:
78977903
case BPF_CGROUP_UDP6_RECVMSG:
7904+
case BPF_CGROUP_UNIX_RECVMSG:
78987905
case BPF_CGROUP_UDP4_SENDMSG:
78997906
case BPF_CGROUP_UDP6_SENDMSG:
7907+
case BPF_CGROUP_UNIX_SENDMSG:
79007908
case BPF_CGROUP_INET4_GETPEERNAME:
79017909
case BPF_CGROUP_INET6_GETPEERNAME:
7910+
case BPF_CGROUP_UNIX_GETPEERNAME:
79027911
case BPF_CGROUP_INET4_GETSOCKNAME:
79037912
case BPF_CGROUP_INET6_GETSOCKNAME:
7913+
case BPF_CGROUP_UNIX_GETSOCKNAME:
79047914
return &bpf_sock_addr_getsockopt_proto;
79057915
default:
79067916
return NULL;
@@ -8948,8 +8958,8 @@ static bool sock_addr_is_valid_access(int off, int size,
89488958
if (off % size != 0)
89498959
return false;
89508960

8951-
/* Disallow access to IPv6 fields from IPv4 contex and vise
8952-
* versa.
8961+
/* Disallow access to fields not belonging to the attach type's address
8962+
* family.
89538963
*/
89548964
switch (off) {
89558965
case bpf_ctx_range(struct bpf_sock_addr, user_ip4):

‎net/unix/af_unix.c‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,7 @@
116116
#include <linux/freezer.h>
117117
#include <linux/file.h>
118118
#include <linux/btf_ids.h>
119+
#include <linux/bpf-cgroup.h>
119120

120121
#include "scm.h"
121122

@@ -1381,6 +1382,10 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
13811382
if (err)
13821383
goto out;
13831384

1385+
err = BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, addr, &alen);
1386+
if (err)
1387+
goto out;
1388+
13841389
if ((test_bit(SOCK_PASSCRED, &sock->flags) ||
13851390
test_bit(SOCK_PASSPIDFD, &sock->flags)) &&
13861391
!unix_sk(sk)->addr) {
@@ -1490,6 +1495,10 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
14901495
if (err)
14911496
goto out;
14921497

1498+
err = BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, uaddr, &addr_len);
1499+
if (err)
1500+
goto out;
1501+
14931502
if ((test_bit(SOCK_PASSCRED, &sock->flags) ||
14941503
test_bit(SOCK_PASSPIDFD, &sock->flags)) && !u->addr) {
14951504
err = unix_autobind(sk);
@@ -1770,6 +1779,13 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer)
17701779
} else {
17711780
err = addr->len;
17721781
memcpy(sunaddr, addr->name, addr->len);
1782+
1783+
if (peer)
1784+
BPF_CGROUP_RUN_SA_PROG(sk, uaddr, &err,
1785+
CGROUP_UNIX_GETPEERNAME);
1786+
else
1787+
BPF_CGROUP_RUN_SA_PROG(sk, uaddr, &err,
1788+
CGROUP_UNIX_GETSOCKNAME);
17731789
}
17741790
sock_put(sk);
17751791
out:
@@ -1922,6 +1938,13 @@ static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg,
19221938
err = unix_validate_addr(sunaddr, msg->msg_namelen);
19231939
if (err)
19241940
goto out;
1941+
1942+
err = BPF_CGROUP_RUN_PROG_UNIX_SENDMSG_LOCK(sk,
1943+
msg->msg_name,
1944+
&msg->msg_namelen,
1945+
NULL);
1946+
if (err)
1947+
goto out;
19251948
} else {
19261949
sunaddr = NULL;
19271950
err = -ENOTCONN;
@@ -2390,9 +2413,14 @@ int __unix_dgram_recvmsg(struct sock *sk, struct msghdr *msg, size_t size,
23902413
EPOLLOUT | EPOLLWRNORM |
23912414
EPOLLWRBAND);
23922415

2393-
if (msg->msg_name)
2416+
if (msg->msg_name) {
23942417
unix_copy_addr(msg, skb->sk);
23952418

2419+
BPF_CGROUP_RUN_PROG_UNIX_RECVMSG_LOCK(sk,
2420+
msg->msg_name,
2421+
&msg->msg_namelen);
2422+
}
2423+
23962424
if (size > skb->len - skip)
23972425
size = skb->len - skip;
23982426
else if (size < skb->len - skip)
@@ -2744,6 +2772,11 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,
27442772
DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr,
27452773
state->msg->msg_name);
27462774
unix_copy_addr(state->msg, skb->sk);
2775+
2776+
BPF_CGROUP_RUN_PROG_UNIX_RECVMSG_LOCK(sk,
2777+
state->msg->msg_name,
2778+
&state->msg->msg_namelen);
2779+
27472780
sunaddr = NULL;
27482781
}
27492782

0 commit comments

Comments
 (0)