Merge branch 'enforce-global-flow-dissector'

Browse source

Stanislav Fomichev says:

====================
While having a per-net-ns flow dissector programs is convenient for
testing, security-wise it's better to have only one vetted global
flow dissector implementation.

Let's have a convention that when BPF flow dissector is installed
in the root namespace, child namespaces can't override it.

The intended use-case is to attach global BPF flow dissector
early from the init scripts/systemd. Attaching global dissector
is prohibited if some non-root namespace already has flow dissector
attached. Also, attaching to non-root namespace is prohibited
when there is flow dissector attached to the root namespace.

v3:
* drop extra check and empty line (Andrii Nakryiko)

v2:
* EPERM -> EEXIST (Song Liu)
* Make sure we don't have dissector attached to non-root namespaces
  when attaching the global one (Andrii Nakryiko)
====================

Signed-off-by: Alexei Starovoitov <ast@kernel.org>

...

This commit is contained in:

Alexei Starovoitov 2019-10-07 20:16:34 -07:00

parent 4564a8bb57 1d9626dc08

commit 72ccd9200f

3 changed files with 79 additions and 10 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

Documentation/bpf/prog_flow_dissector.rst

View file

38

net/core/flow_dissector.c

View file

50

tools/testing/selftests/bpf/test_flow_dissector.sh

View file