lkml.org 
[lkml]   [2022]   [Aug]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH bpf-next v2 1/3] bpf: add destructive kfunc flag
    Date
    Add KF_DESTRUCTIVE flag for destructive functions. Functions with this
    flag set will require CAP_SYS_BOOT capabilities.

    Signed-off-by: Artem Savkov <asavkov@redhat.com>
    ---
    include/linux/btf.h | 1 +
    kernel/bpf/verifier.c | 5 +++++
    2 files changed, 6 insertions(+)

    diff --git a/include/linux/btf.h b/include/linux/btf.h
    index cdb376d53238..51a0961c84e3 100644
    --- a/include/linux/btf.h
    +++ b/include/linux/btf.h
    @@ -49,6 +49,7 @@
    * for this case.
    */
    #define KF_TRUSTED_ARGS (1 << 4) /* kfunc only takes trusted pointer arguments */
    +#define KF_DESTRUCTIVE (1 << 5) /* kfunc performs destructive actions */

    struct btf;
    struct btf_member;
    diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
    index 096fdac70165..e52ca1631d3f 100644
    --- a/kernel/bpf/verifier.c
    +++ b/kernel/bpf/verifier.c
    @@ -7584,6 +7584,11 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
    func_name);
    return -EACCES;
    }
    + if (*kfunc_flags & KF_DESTRUCTIVE && !capable(CAP_SYS_BOOT)) {
    + verbose(env, "destructive kfunc calls require CAP_SYS_BOOT capabilities\n");
    + return -EACCES;
    + }
    +
    acq = *kfunc_flags & KF_ACQUIRE;

    /* Check the arguments */
    --
    2.35.3
    \
     
     \ /
      Last update: 2022-08-02 11:11    [W:3.004 / U:0.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site