From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933424AbcHDK7O (ORCPT ); Thu, 4 Aug 2016 06:59:14 -0400 Received: from www62.your-server.de ([213.133.104.62]:32845 "EHLO www62.your-server.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754470AbcHDK7N (ORCPT ); Thu, 4 Aug 2016 06:59:13 -0400 Message-ID: <57A310E5.7030000@iogearbox.net> Date: Thu, 04 Aug 2016 11:54:45 +0200 From: Daniel Borkmann User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: Sargun Dhillon , linux-kernel@vger.kernel.org CC: alexei.starovoitov@gmail.com, linux-security-module@vger.kernel.org, netdev@vger.kernel.org Subject: Re: [RFC 4/4] bpf: Restrict Checmate bpf programs to current kernel ABI References: <20160804071227.GA19135@ircssh.c.rugged-nimbus-611.internal> <57A31070.8090602@iogearbox.net> In-Reply-To: <57A31070.8090602@iogearbox.net> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: daniel@iogearbox.net Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 08/04/2016 11:52 AM, Daniel Borkmann wrote: > On 08/04/2016 09:12 AM, Sargun Dhillon wrote: >> I think it makes sense to restrict Checmate to loading programs that have been >> compiled with the current kernel ABI. We can further stabilize the ABI, and >> perhaps lift this restriction later. >> >> Signed-off-by: Sargun Dhillon >> --- >> kernel/bpf/syscall.c | 2 +- >> samples/bpf/checmate1_kern.c | 3 ++- >> 2 files changed, 3 insertions(+), 2 deletions(-) >> >> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c >> index 228f962..2a37b4d 100644 >> --- a/kernel/bpf/syscall.c >> +++ b/kernel/bpf/syscall.c >> @@ -741,7 +741,7 @@ static int bpf_prog_load(union bpf_attr *attr) >> if (attr->insn_cnt >= BPF_MAXINSNS) >> return -EINVAL; >> >> - if (type == BPF_PROG_TYPE_KPROBE && >> + if ((type & (BPF_PROG_TYPE_KPROBE | BPF_PROG_TYPE_CHECMATE)) && >> attr->kern_version != LINUX_VERSION_CODE) > > Btw, this check is correct, program types are not masks. Sorry, I meant to write *not* correct, which was hopefully inferable from the rest. > BPF_PROG_TYPE_KPROBE (== 2) and BPF_PROG_TYPE_CHECMATE (== 7) will now > require every type to have a version code ... > >> return -EINVAL; >>