From: Jakub Kicinski Date: Mon, 20 Nov 2017 23:21:52 +0000 (-0800) Subject: bpf: offload: limit offload to cls_bpf and xdp programs only X-Git-Tag: v4.15-rc1~15^2~5^2~3^2~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=649f11dcd19a5f0d00fdbc760fbdccdd98e56a43;p=thirdparty%2Fkernel%2Flinux.git bpf: offload: limit offload to cls_bpf and xdp programs only We are currently only allowing attachment of device-bound cls_bpf and XDP programs. Make this restriction explicit in the BPF offload code. This way we can potentially reuse the ifindex field in the future. Since XDP and cls_bpf programs can only be loaded by admin, we can drop the explicit capability check from offload code. Signed-off-by: Jakub Kicinski Reviewed-by: Quentin Monnet Acked-by: Alexei Starovoitov Acked-by: Daniel Borkmann Signed-off-by: Daniel Borkmann --- diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c index fd696d3dd429e..ac187f9ee182e 100644 --- a/kernel/bpf/offload.c +++ b/kernel/bpf/offload.c @@ -14,8 +14,9 @@ int bpf_prog_offload_init(struct bpf_prog *prog, union bpf_attr *attr) struct net *net = current->nsproxy->net_ns; struct bpf_dev_offload *offload; - if (!capable(CAP_SYS_ADMIN)) - return -EPERM; + if (attr->prog_type != BPF_PROG_TYPE_SCHED_CLS && + attr->prog_type != BPF_PROG_TYPE_XDP) + return -EINVAL; if (attr->prog_flags) return -EINVAL;