Messages in this thread | | | From | Alexei Starovoitov <> | Date | Fri, 6 Nov 2020 13:16:52 -0800 | Subject | Re: [PATCH bpf-next v2] bpf: Update verification logic for LSM programs |
| |
On Thu, Nov 5, 2020 at 3:06 PM KP Singh <kpsingh@chromium.org> wrote: > > From: KP Singh <kpsingh@google.com> > > The current logic checks if the name of the BTF type passed in > attach_btf_id starts with "bpf_lsm_", this is not sufficient as it also > allows attachment to non-LSM hooks like the very function that performs > this check, i.e. bpf_lsm_verify_prog. > > In order to ensure that this verification logic allows attachment to > only LSM hooks, the LSM_HOOK definitions in lsm_hook_defs.h are used to > generate a BTF_ID set. Upon verification, the attach_btf_id of the > program being attached is checked for presence in this set. > > Signed-off-by: KP Singh <kpsingh@google.com>
I've added Fixes tag and applied to bpf tree.
| |