* [PATCH net-next 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff
@ 2017-05-31 18:06 Chenbo Feng
2017-05-31 18:06 ` [PATCH net-next 2/2] bpf: Remove the capability check for cgroup skb eBPF program Chenbo Feng
0 siblings, 1 reply; 3+ messages in thread
From: Chenbo Feng @ 2017-05-31 18:06 UTC (permalink / raw)
To: netdev, David Miller; +Cc: Lorenzo Colitti, Chenbo Feng
From: Chenbo Feng <fengc@google.com>
This allows cgroup eBPF program to classify packet based on their
protocol or other detail information. Currently program need
CAP_NET_ADMIN privilege to attach a cgroup eBPF program, and A
process with CAP_NET_ADMIN can already see all packets on the system,
for example, by creating an iptables rules that causes the packet to
be passed to userspace via NFLOG.
Signed-off-by: Chenbo Feng <fengc@google.com>
---
kernel/bpf/verifier.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 339c8a1..94a9bc9 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2419,6 +2419,7 @@ static bool may_access_skb(enum bpf_prog_type type)
case BPF_PROG_TYPE_SOCKET_FILTER:
case BPF_PROG_TYPE_SCHED_CLS:
case BPF_PROG_TYPE_SCHED_ACT:
+ case BPF_PROG_TYPE_CGROUP_SKB:
return true;
default:
return false;
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH net-next 2/2] bpf: Remove the capability check for cgroup skb eBPF program
2017-05-31 18:06 [PATCH net-next 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff Chenbo Feng
@ 2017-05-31 18:06 ` Chenbo Feng
2017-06-01 0:17 ` YUAN Linyu
0 siblings, 1 reply; 3+ messages in thread
From: Chenbo Feng @ 2017-05-31 18:06 UTC (permalink / raw)
To: netdev, David Miller; +Cc: Lorenzo Colitti, Chenbo Feng
From: Chenbo Feng <fengc@google.com>
Currently loading a cgroup skb eBPF program require a CAP_SYS_ADMIN
capability while attaching the program to a cgroup only requires the
user have CAP_NET_ADMIN privilege. We can escape the capability
check when load the program just like socket filter program to make
the capability requirement consistent.
Signed-off-by: Chenbo Feng <fengc@google.com>
---
kernel/bpf/syscall.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 265a0d8..021c0b4 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -815,7 +815,9 @@ static int bpf_prog_load(union bpf_attr *attr)
attr->kern_version != LINUX_VERSION_CODE)
return -EINVAL;
- if (type != BPF_PROG_TYPE_SOCKET_FILTER && !capable(CAP_SYS_ADMIN))
+ if (type != BPF_PROG_TYPE_SOCKET_FILTER
+ && type != BPF_PROG_TYPE_CGROUP_SKB
+ && !capable(CAP_SYS_ADMIN))
return -EPERM;
/* plain bpf_prog allocation */
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* RE: [PATCH net-next 2/2] bpf: Remove the capability check for cgroup skb eBPF program
2017-05-31 18:06 ` [PATCH net-next 2/2] bpf: Remove the capability check for cgroup skb eBPF program Chenbo Feng
@ 2017-06-01 0:17 ` YUAN Linyu
0 siblings, 0 replies; 3+ messages in thread
From: YUAN Linyu @ 2017-06-01 0:17 UTC (permalink / raw)
To: Chenbo Feng, netdev, David Miller; +Cc: Lorenzo Colitti, Chenbo Feng
hi
> -----Original Message-----
> From: netdev-owner@vger.kernel.org [mailto:netdev-owner@vger.kernel.org]
> On Behalf Of Chenbo Feng
> Sent: Thursday, June 01, 2017 2:07 AM
> To: netdev@vger.kernel.org; David Miller
> Cc: Lorenzo Colitti; Chenbo Feng
> Subject: [PATCH net-next 2/2] bpf: Remove the capability check for cgroup skb
> eBPF program
> - if (type != BPF_PROG_TYPE_SOCKET_FILTER
> && !capable(CAP_SYS_ADMIN))
> + if (type != BPF_PROG_TYPE_SOCKET_FILTER
> + && type != BPF_PROG_TYPE_CGROUP_SKB
> + && !capable(CAP_SYS_ADMIN))
checkpatch.pl prefer put && at end of line
> return -EPERM;
>
> /* plain bpf_prog allocation */
> --
> 2.7.4
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-06-01 0:17 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-31 18:06 [PATCH net-next 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff Chenbo Feng
2017-05-31 18:06 ` [PATCH net-next 2/2] bpf: Remove the capability check for cgroup skb eBPF program Chenbo Feng
2017-06-01 0:17 ` YUAN Linyu
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.