From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758600AbcHDKu2 (ORCPT ); Thu, 4 Aug 2016 06:50:28 -0400 Received: from www62.your-server.de ([213.133.104.62]:59752 "EHLO www62.your-server.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751188AbcHDKu1 (ORCPT ); Thu, 4 Aug 2016 06:50:27 -0400 Message-ID: <57A31070.8090602@iogearbox.net> Date: Thu, 04 Aug 2016 11:52:48 +0200 From: Daniel Borkmann User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: Sargun Dhillon , linux-kernel@vger.kernel.org CC: alexei.starovoitov@gmail.com, linux-security-module@vger.kernel.org, netdev@vger.kernel.org Subject: Re: [RFC 4/4] bpf: Restrict Checmate bpf programs to current kernel ABI References: <20160804071227.GA19135@ircssh.c.rugged-nimbus-611.internal> In-Reply-To: <20160804071227.GA19135@ircssh.c.rugged-nimbus-611.internal> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: daniel@iogearbox.net Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 08/04/2016 09:12 AM, Sargun Dhillon wrote: > I think it makes sense to restrict Checmate to loading programs that have been > compiled with the current kernel ABI. We can further stabilize the ABI, and > perhaps lift this restriction later. > > Signed-off-by: Sargun Dhillon > --- > kernel/bpf/syscall.c | 2 +- > samples/bpf/checmate1_kern.c | 3 ++- > 2 files changed, 3 insertions(+), 2 deletions(-) > > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c > index 228f962..2a37b4d 100644 > --- a/kernel/bpf/syscall.c > +++ b/kernel/bpf/syscall.c > @@ -741,7 +741,7 @@ static int bpf_prog_load(union bpf_attr *attr) > if (attr->insn_cnt >= BPF_MAXINSNS) > return -EINVAL; > > - if (type == BPF_PROG_TYPE_KPROBE && > + if ((type & (BPF_PROG_TYPE_KPROBE | BPF_PROG_TYPE_CHECMATE)) && > attr->kern_version != LINUX_VERSION_CODE) Btw, this check is correct, program types are not masks. BPF_PROG_TYPE_KPROBE (== 2) and BPF_PROG_TYPE_CHECMATE (== 7) will now require every type to have a version code ... > return -EINVAL; > > diff --git a/samples/bpf/checmate1_kern.c b/samples/bpf/checmate1_kern.c > index f78b66b..d4ec1fa 100644 > --- a/samples/bpf/checmate1_kern.c > +++ b/samples/bpf/checmate1_kern.c > @@ -3,6 +3,7 @@ > #include > #include > #include "bpf_helpers.h" > +#include > > SEC("checmate") > int prog(struct checmate_ctx *ctx) > @@ -24,4 +25,4 @@ int prog(struct checmate_ctx *ctx) > } > > char _license[] SEC("license") = "GPL"; > - > +u32 _version SEC("version") = LINUX_VERSION_CODE; >