From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
To: Andreas Steinmetz <ast@domdv.de>,
netdev@vger.kernel.org, bpf@vger.kernel.org
Subject: Re: [RFC][PATCH kernel_bpf] honor CAP_NET_ADMIN for BPF_PROG_LOAD
Date: Mon, 3 Jun 2019 19:12:26 +0200 [thread overview]
Message-ID: <1188fe85-d627-89d1-d56b-91011166f9c7@6wind.com> (raw)
In-Reply-To: <56c1f2f89428b49dad615fc13cc8c120d4ca4abf.camel@domdv.de>
Le 28/05/2019 à 18:53, Andreas Steinmetz a écrit :
> [sorry for crossposting but this affects both lists]
>
> BPF_PROG_TYPE_SCHED_CLS and BPF_PROG_TYPE_XDP should be allowed
> for CAP_NET_ADMIN capability. Nearly everything one can do with
> these program types can be done some other way with CAP_NET_ADMIN
> capability (e.g. NFQUEUE), but only slower.
>
> This change is similar in behaviour to the /proc/sys/net
> CAP_NET_ADMIN exemption.
>
> Overall chances are of increased security as network related
> applications do no longer require to keep CAP_SYS_ADMIN
> admin capability for network related eBPF operations.
>
> It may well be that other program types than BPF_PROG_TYPE_XDP
> and BPF_PROG_TYPE_SCHED_CLS do need the same exemption, though
> I do not have sufficient knowledge of other program types
> to be able to decide this.
>
> Preloading BPF programs is not possible in case of application
> modified or generated BPF programs, so this is no alternative.
> The verifier does prevent the BPF program from doing harmful
> things anyway.
>
> Signed-off-by: Andreas Steinmetz <ast@domdv.de>
It makes sense to me.
Do you plan to submit it formally?
Looking a bit more at this topic, I see that most part of the bpf code uses
capable(CAP_NET_ADMIN). I don't see why we cannot use ns_capable(CAP_NET_ADMIN).
Regards,
Nicolas
>
> --- a/kernel/bpf/syscall.c 2019-05-28 18:00:40.472841432 +0200
> +++ b/kernel/bpf/syscall.c 2019-05-28 18:17:50.162811510 +0200
> @@ -1561,8 +1561,13 @@ static int bpf_prog_load(union bpf_attr
> return -E2BIG;
> if (type != BPF_PROG_TYPE_SOCKET_FILTER &&
> type != BPF_PROG_TYPE_CGROUP_SKB &&
> - !capable(CAP_SYS_ADMIN))
> - return -EPERM;
> + !capable(CAP_SYS_ADMIN)) {
> + if (type != BPF_PROG_TYPE_SCHED_CLS &&
> + type != BPF_PROG_TYPE_XDP)
> + return -EPERM;
> + if(!capable(CAP_NET_ADMIN))
> + return -EPERM;
> + }
>
> bpf_prog_load_fixup_attach_type(attr);
> if (bpf_prog_load_check_attach_type(type, attr->expected_attach_type))
>
next prev parent reply other threads:[~2019-06-03 17:12 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-28 16:53 [RFC][PATCH kernel_bpf] honor CAP_NET_ADMIN for BPF_PROG_LOAD Andreas Steinmetz
2019-05-28 21:04 ` Song Liu
2019-06-05 10:56 ` Andreas Steinmetz
2019-06-03 17:12 ` Nicolas Dichtel [this message]
2019-06-05 10:59 ` Andreas Steinmetz
2019-06-05 11:51 ` Nicolas Dichtel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1188fe85-d627-89d1-d56b-91011166f9c7@6wind.com \
--to=nicolas.dichtel@6wind.com \
--cc=ast@domdv.de \
--cc=bpf@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).