path: root/kernel
diff options
authorJakub Kicinski <jakub.kicinski@netronome.com>2017-11-20 15:21:52 -0800
committerDaniel Borkmann <daniel@iogearbox.net>2017-11-21 00:37:35 +0100
commit649f11dcd19a5f0d00fdbc760fbdccdd98e56a43 (patch)
treebcafe01fe371aa64a477440e4b9a30d1cffe158f /kernel
parent13a9c48a85ccf1417b527975c0a12b47fbfaf625 (diff)
bpf: offload: limit offload to cls_bpf and xdp programs only
We are currently only allowing attachment of device-bound cls_bpf and XDP programs. Make this restriction explicit in the BPF offload code. This way we can potentially reuse the ifindex field in the future. Since XDP and cls_bpf programs can only be loaded by admin, we can drop the explicit capability check from offload code. Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com> Acked-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat (limited to 'kernel')
1 files changed, 3 insertions, 2 deletions
diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
index fd696d3dd429..ac187f9ee182 100644
--- a/kernel/bpf/offload.c
+++ b/kernel/bpf/offload.c
@@ -14,8 +14,9 @@ int bpf_prog_offload_init(struct bpf_prog *prog, union bpf_attr *attr)
struct net *net = current->nsproxy->net_ns;
struct bpf_dev_offload *offload;
- if (!capable(CAP_SYS_ADMIN))
- return -EPERM;
+ if (attr->prog_type != BPF_PROG_TYPE_SCHED_CLS &&
+ attr->prog_type != BPF_PROG_TYPE_XDP)
+ return -EINVAL;
if (attr->prog_flags)
return -EINVAL;

Privacy Policy