History

bpf: flow_dissector: Check value of unused flags to BPF_PROG_DETACH

Using BPF_PROG_DETACH on a flow dissector program supports neither attach_flags nor attach_bpf_fd. Yet no value is enforced for them. Enforce that attach_flags are zero, and require the current program to be passed via attach_bpf_fd. This allows us to remove the check for CAP_SYS_ADMIN, since userspace can now no longer remove arbitrary flow dissector programs.

Lorenz Bauer committed 6 years ago

Commit 4ac2add1 parent 1b514233 files · +19 −9Browse files

Showing the changes to include/linux (1 of 3 files). Show all

Unified · Split

include/linux/bpf-netns.h+3−2
@@ -33,7 +33,7 @@ int netns_bpf_prog_query(const union bpf_attr *attr, · 32 unmodified lines
33 union bpf_attr __user *uattr);33 union bpf_attr __user *uattr);
34int netns_bpf_prog_attach(const union bpf_attr *attr,34int netns_bpf_prog_attach(const union bpf_attr *attr,
35 struct bpf_prog *prog);35 struct bpf_prog *prog);
36int netns_bpf_prog_detach(const union bpf_attr *attr);36int netns_bpf_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype);
37int netns_bpf_link_create(const union bpf_attr *attr,37int netns_bpf_link_create(const union bpf_attr *attr,
38 struct bpf_prog *prog);38 struct bpf_prog *prog);
39#else39#else
@@ -49,7 +49,8 @@ static inline int netns_bpf_prog_attach(const union bpf_attr *attr, · 9 unmodified lines
49 return -EOPNOTSUPP;49 return -EOPNOTSUPP;
50}50}
51 51
52static inline int netns_bpf_prog_detach(const union bpf_attr *attr)52static inline int netns_bpf_prog_detach(const union bpf_attr *attr,
53 enum bpf_prog_type ptype)
53{54{
54 return -EOPNOTSUPP;55 return -EOPNOTSUPP;
55}56}