bpf: Centralize permissions checks for all BPF map types

This allows to do more centralized decisions later on, and generally makes it very explicit which maps are privileged and which are not (e.g., LRU_HASH and LRU_PERCPU_HASH, which are privileged HASH variants, as opposed to unprivileged HASH and HASH_PERCPU; now this is explicit and easy to verify).

Andrii Nakryiko committed 3 years ago

Commit 6c3eba11 parent 22db41214 files · +52 −44Browse files

Showing the changes to kernel/bpf/queue_stack_maps.c (1 of 14 files). Show all

Unified · Split

kernel/bpf/queue_stack_maps.c+0−4

@@ -7,7 +7,6 @@ · 6 unmodified lines
7	7	#include <linux/bpf.h>
8	8	#include <linux/list.h>
9	9	#include <linux/slab.h>
10		−#include <linux/capability.h>
11	10	#include <linux/btf_ids.h>
12	11	#include "percpu_freelist.h"
13	12
@@ -46,9 +45,6 @@ static bool queue_stack_map_is_full(struct bpf_queue_stack *qs) · 32 unmodified lines
46	45	/* Called from syscall */
47	46	static int queue_stack_map_alloc_check(union bpf_attr *attr)
48	47	{
49		− if (!bpf_capable())
50		− return -EPERM;
51		−
52	48	/* check sanity of attributes */
53	49	if (attr->max_entries == 0 \|\| attr->key_size != 0 \|\|
54	50	attr->value_size == 0 \|\|