From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jakub Kicinski Subject: [PATCH net 02/10] bpf: offload: limit offload to cls_bpf and xdp programs only Date: Sun, 19 Nov 2017 20:55:14 -0800 Message-ID: <20171120045522.2188-3-jakub.kicinski@netronome.com> References: <20171120045522.2188-1-jakub.kicinski@netronome.com> Cc: alexei.starovoitov@gmail.com, daniel@iogearbox.net, Jakub Kicinski To: netdev@vger.kernel.org Return-path: Received: from mail-pg0-f67.google.com ([74.125.83.67]:39288 "EHLO mail-pg0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751147AbdKTE4J (ORCPT ); Sun, 19 Nov 2017 23:56:09 -0500 Received: by mail-pg0-f67.google.com with SMTP id 70so6413942pgf.6 for ; Sun, 19 Nov 2017 20:56:09 -0800 (PST) In-Reply-To: <20171120045522.2188-1-jakub.kicinski@netronome.com> Sender: netdev-owner@vger.kernel.org List-ID: We are currently only allowing attachment of device-bound cls_bpf and XDP programs. Make this restriction explicit in the BPF offload code. This way we can potentially reuse the ifindex field in the future. Since XDP and cls_bpf programs can only be loaded by admin, we can drop the explicit capability check from offload code. Signed-off-by: Jakub Kicinski Reviewed-by: Quentin Monnet Acked-by: Alexei Starovoitov Acked-by: Daniel Borkmann --- kernel/bpf/offload.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c index fd696d3dd429..ac187f9ee182 100644 --- a/kernel/bpf/offload.c +++ b/kernel/bpf/offload.c @@ -14,8 +14,9 @@ int bpf_prog_offload_init(struct bpf_prog *prog, union bpf_attr *attr) struct net *net = current->nsproxy->net_ns; struct bpf_dev_offload *offload; - if (!capable(CAP_SYS_ADMIN)) - return -EPERM; + if (attr->prog_type != BPF_PROG_TYPE_SCHED_CLS && + attr->prog_type != BPF_PROG_TYPE_XDP) + return -EINVAL; if (attr->prog_flags) return -EINVAL; -- 2.14.1