Messages in this thread | | | From | Andy Lutomirski <> | Date | Thu, 4 Oct 2018 12:51:00 -0700 | Subject | Re: [PATCH bpf-next 1/6] bpf: introduce BPF_PROG_TYPE_FILE_FILTER |
| |
On Thu, Oct 4, 2018 at 12:41 PM Roman Gushchin <guro@fb.com> wrote: > > On Wed, Oct 03, 2018 at 07:57:45PM -0700, Alexei Starovoitov wrote: > > Similar to networking sandboxing programs and cgroup-v2 based hooks > > (BPF_CGROUP_INET_[INGRESS|EGRESS,] BPF_CGROUP_INET[4|6]_[BIND|CONNECT], etc) > > introduce basic per-container sandboxing for file access via > > new BPF_PROG_TYPE_FILE_FILTER program type that attaches after > > security_file_open() LSM hook and works as additional file_open filter. > > The new cgroup bpf hook is called BPF_CGROUP_FILE_OPEN. > > > > Just like other cgroup-bpf programs new BPF_PROG_TYPE_FILE_FILTER type > > is only available to root. > > > > This program type has access to single argument 'struct bpf_file_info' > > that contains standard sys_stat fields: > > struct bpf_file_info { > > __u64 inode; > > __u32 dev_major; > > __u32 dev_minor; > > __u32 fs_magic; > > __u32 mnt_id; > > __u32 nlink; > > __u32 mode; /* file mode S_ISDIR, S_ISLNK, 0755, etc */ > > __u32 flags; /* open flags O_RDWR, O_CREAT, etc */ > > }; > > It's probably nice to have file uid/gid as well.
And an indication of which mount namespace we're looking at.
--Andy
| |