From: Daniel Borkmann <daniel@iogearbox.net>
To: Chenbo Feng <chenbofeng.kernel@gmail.com>,
netdev@vger.kernel.org, SELinux <Selinux@tycho.nsa.gov>,
linux-security-module@vger.kernel.org
Cc: Jeffrey Vander Stoep <jeffv@google.com>,
Alexei Starovoitov <alexei.starovoitov@gmail.com>,
lorenzo@google.com, Stephen Smalley <sds@tycho.nsa.gov>,
James Morris <james.l.morris@oracle.com>,
Paul Moore <paul@paul-moore.com>, Chenbo Feng <fengc@google.com>
Subject: Re: [PATCH net-next v7 1/5] bpf: Add file mode configuration into bpf maps
Date: Wed, 18 Oct 2017 23:14:21 +0200 [thread overview]
Message-ID: <59E7C42D.1010402@iogearbox.net> (raw)
In-Reply-To: <20171018200026.146093-2-chenbofeng.kernel@gmail.com>
On 10/18/2017 10:00 PM, Chenbo Feng wrote:
> From: Chenbo Feng <fengc@google.com>
>
> Introduce the map read/write flags to the eBPF syscalls that returns the
> map fd. The flags is used to set up the file mode when construct a new
> file descriptor for bpf maps. To not break the backward capability, the
> f_flags is set to O_RDWR if the flag passed by syscall is 0. Otherwise
> it should be O_RDONLY or O_WRONLY. When the userspace want to modify or
> read the map content, it will check the file mode to see if it is
> allowed to make the change.
>
> Signed-off-by: Chenbo Feng <fengc@google.com>
> Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
next prev parent reply other threads:[~2017-10-18 21:14 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-18 20:00 [PATCH net-next v7 0/5] bpf: security: New file mode and LSM hooks for eBPF object permission control Chenbo Feng
2017-10-18 20:00 ` [PATCH net-next v7 1/5] bpf: Add file mode configuration into bpf maps Chenbo Feng
2017-10-18 21:14 ` Daniel Borkmann [this message]
2017-10-18 20:00 ` [PATCH net-next v7 2/5] bpf: Add tests for eBPF file mode Chenbo Feng
2017-10-18 20:00 ` [PATCH net-next v7 3/5] security: bpf: Add LSM hooks for bpf object related syscall Chenbo Feng
2017-10-20 0:54 ` James Morris
2017-10-18 20:00 ` [PATCH net-next v7 4/5] selinux: bpf: Add selinux check for eBPF syscall operations Chenbo Feng
2017-10-20 0:57 ` James Morris
2017-10-23 23:27 ` Paul Moore
2017-10-18 20:00 ` [PATCH net-next v7 5/5] selinux: bpf: Add addtional check for bpf object file receive Chenbo Feng
2017-10-20 1:28 ` James Morris
2017-10-23 23:28 ` Paul Moore
2017-10-20 12:40 ` [PATCH net-next v7 0/5] bpf: security: New file mode and LSM hooks for eBPF object permission control David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=59E7C42D.1010402@iogearbox.net \
--to=daniel@iogearbox.net \
--cc=Selinux@tycho.nsa.gov \
--cc=alexei.starovoitov@gmail.com \
--cc=chenbofeng.kernel@gmail.com \
--cc=fengc@google.com \
--cc=james.l.morris@oracle.com \
--cc=jeffv@google.com \
--cc=linux-security-module@vger.kernel.org \
--cc=lorenzo@google.com \
--cc=netdev@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=sds@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).