Add basic support of BPF token to BPF_PROG_LOAD. Wire through a set of allowed BPF program types and attach types, derived from BPF FS at BPF token creation time. Then make sure we perform bpf_token_capable() checks everywhere where it's relevant.
Showing the changes to include/uapi (1 of 9 files). Show all
Unified · Split
| @@ -1028,6 +1028,7 @@ enum bpf_prog_type { · 1027 unmodified lines | |||
| 1028 | BPF_PROG_TYPE_SK_LOOKUP, | 1028 | BPF_PROG_TYPE_SK_LOOKUP, |
| 1029 | BPF_PROG_TYPE_SYSCALL, /* a program that can execute syscalls */ | 1029 | BPF_PROG_TYPE_SYSCALL, /* a program that can execute syscalls */ |
| 1030 | BPF_PROG_TYPE_NETFILTER, | 1030 | BPF_PROG_TYPE_NETFILTER, |
| 1031 | __MAX_BPF_PROG_TYPE | ||
| 1031 | }; | 1032 | }; |
| 1032 | 1033 | ||
| 1033 | enum bpf_attach_type { | 1034 | enum bpf_attach_type { |
| @@ -1504,6 +1505,7 @@ union bpf_attr { · 470 unmodified lines | |||
| 1504 | * truncated), or smaller (if log buffer wasn't filled completely). | 1505 | * truncated), or smaller (if log buffer wasn't filled completely). |
| 1505 | */ | 1506 | */ |
| 1506 | __u32 log_true_size; | 1507 | __u32 log_true_size; |
| 1508 | __u32 prog_token_fd; | ||
| 1507 | }; | 1509 | }; |
| 1508 | 1510 | ||
| 1509 | struct { /* anonymous struct used by BPF_OBJ_* commands */ | 1511 | struct { /* anonymous struct used by BPF_OBJ_* commands */ |