bpf/flow_dissector: add mode to enforce global BPF flow dissector

Browse source

Always use init_net flow dissector BPF program if it's attached and fall
back to the per-net namespace one. Also, deny installing new programs if
there is already one attached to the root namespace.
Users can still detach their BPF programs, but can't attach any
new ones (-EEXIST).

Cc: Petar Penkov <ppenkov@google.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

...

This commit is contained in:

Stanislav Fomichev 2019-10-07 09:21:02 -07:00 • committed by Alexei Starovoitov

parent 4564a8bb57

commit a11c397c43

2 changed files with 37 additions and 4 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

Documentation/bpf/prog_flow_dissector.rst

View file

38

net/core/flow_dissector.c

View file