Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Jul 02, 2019 at 12:22:56PM -0700, Andrii Nakryiko wrote:
> On Thu, Jun 27, 2019 at 1:20 PM Song Liu <songliubraving@fb.com> wrote:
> >
> > This patch introduce unprivileged BPF access. The access control is
> > achieved via device /dev/bpf. Users with write access to /dev/bpf are able
> > to call sys_bpf().
> >
> > Two ioctl command are added to /dev/bpf:
> >
> > The two commands enable/disable permission to call sys_bpf() for current
> > task. This permission is noted by bpf_permitted in task_struct. This
> > permission is inherited during clone(CLONE_THREAD).
> >
> > Helper function bpf_capable() is added to check whether the task has got
> > permission via /dev/bpf.
> >
> > Signed-off-by: Song Liu <songliubraving@fb.com>
> > ---
> >  Documentation/ioctl/ioctl-number.txt |  1 +
> >  include/linux/bpf.h                  | 11 +++++
> >  include/linux/sched.h                |  3 ++
> >  include/uapi/linux/bpf.h             |  6 +++
> >  kernel/bpf/arraymap.c                |  2 +-
> >  kernel/bpf/cgroup.c                  |  2 +-
> >  kernel/bpf/core.c                    |  4 +-
> >  kernel/bpf/cpumap.c                  |  2 +-
> >  kernel/bpf/devmap.c                  |  2 +-
> >  kernel/bpf/hashtab.c                 |  4 +-
> >  kernel/bpf/lpm_trie.c                |  2 +-
> >  kernel/bpf/offload.c                 |  2 +-
> >  kernel/bpf/queue_stack_maps.c        |  2 +-
> >  kernel/bpf/reuseport_array.c         |  2 +-
> >  kernel/bpf/stackmap.c                |  2 +-
> >  kernel/bpf/syscall.c                 | 71 +++++++++++++++++++++-------
> >  kernel/bpf/verifier.c                |  2 +-
> >  kernel/bpf/xskmap.c                  |  2 +-
> >  kernel/fork.c                        |  5 ++
> >  net/core/filter.c                    |  6 +--
> >  20 files changed, 99 insertions(+), 34 deletions(-)
> >
> > diff --git a/Documentation/ioctl/ioctl-number.txt b/Documentation/ioctl/ioctl-number.txt
> > index c9558146ac58..19998b99d603 100644
> > --- a/Documentation/ioctl/ioctl-number.txt
> > +++ b/Documentation/ioctl/ioctl-number.txt
> > @@ -327,6 +327,7 @@ Code  Seq#(hex)     Include File            Comments
> >  0xB4   00-0F   linux/gpio.h            <mailto:linux-gpio@vger.kernel.org>
> >  0xB5   00-0F   uapi/linux/rpmsg.h      <mailto:linux-remoteproc@vger.kernel.org>
> >  0xB6   all     linux/fpga-dfl.h
> > +0xBP   01-02   uapi/linux/bpf.h        <mailto:bpf@vger.kernel.org>
> 
> should this be 0xBF?

Why?  It can be whatever the developer wants :)

thanks,

greg k-h