Add basic support of BPF token to BPF_PROG_LOAD. Wire through a set of allowed BPF program types and attach types, derived from BPF FS at BPF token creation time. Then make sure we perform bpf_token_capable() checks everywhere where it's relevant.
Showing the changes to include/uapi (1 of 9 files). Show all
Unified · Split
| @@ -1028,6 +1028,7 @@ enum bpf_prog_type { · 1027 unmodified lines | ||
| 1028 | 1028 | BPF_PROG_TYPE_SK_LOOKUP, |
| 1029 | 1029 | BPF_PROG_TYPE_SYSCALL, /* a program that can execute syscalls */ |
| 1030 | 1030 | BPF_PROG_TYPE_NETFILTER, |
| 1031 | + __MAX_BPF_PROG_TYPE | |
| 1031 | 1032 | }; |
| 1032 | 1033 | |
| 1033 | 1034 | enum bpf_attach_type { |
| @@ -1504,6 +1505,7 @@ union bpf_attr { · 470 unmodified lines | ||
| 1504 | 1505 | * truncated), or smaller (if log buffer wasn't filled completely). |
| 1505 | 1506 | */ |
| 1506 | 1507 | __u32 log_true_size; |
| 1508 | + __u32 prog_token_fd; | |
| 1507 | 1509 | }; |
| 1508 | 1510 | |
| 1509 | 1511 | struct { /* anonymous struct used by BPF_OBJ_* commands */ |