summaryrefslogtreecommitdiffstats
path: root/kernel
diff options
context:
space:
mode:
authorLorenz Bauer <lmb@cloudflare.com>2020-06-29 10:56:26 +0100
committerAlexei Starovoitov <ast@kernel.org>2020-06-30 10:46:38 -0700
commit4ac2add65974e4efafb8d4ccd8fc5660417ea312 (patch)
tree5d10bfc9e7d53253556506bdbc0d02ca30386354 /kernel
parent1b514239e85965cc4df085180a73dd91733135f7 (diff)
downloadlinux-4ac2add65974e4efafb8d4ccd8fc5660417ea312.tar.gz
linux-4ac2add65974e4efafb8d4ccd8fc5660417ea312.tar.bz2
linux-4ac2add65974e4efafb8d4ccd8fc5660417ea312.zip
bpf: flow_dissector: Check value of unused flags to BPF_PROG_DETACH
Using BPF_PROG_DETACH on a flow dissector program supports neither attach_flags nor attach_bpf_fd. Yet no value is enforced for them. Enforce that attach_flags are zero, and require the current program to be passed via attach_bpf_fd. This allows us to remove the check for CAP_SYS_ADMIN, since userspace can now no longer remove arbitrary flow dissector programs. Fixes: b27f7bb590ba ("flow_dissector: Move out netns_bpf prog callbacks") Signed-off-by: Lorenz Bauer <lmb@cloudflare.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200629095630.7933-3-lmb@cloudflare.com
Diffstat (limited to 'kernel')
-rw-r--r--kernel/bpf/net_namespace.c19
-rw-r--r--kernel/bpf/syscall.c4
2 files changed, 16 insertions, 7 deletions
diff --git a/kernel/bpf/net_namespace.c b/kernel/bpf/net_namespace.c
index 03045f45afec..3dbc29b6f51d 100644
--- a/kernel/bpf/net_namespace.c
+++ b/kernel/bpf/net_namespace.c
@@ -269,7 +269,8 @@ out_unlock:
/* Must be called with netns_bpf_mutex held. */
static int __netns_bpf_prog_detach(struct net *net,
- enum netns_bpf_attach_type type)
+ enum netns_bpf_attach_type type,
+ struct bpf_prog *old)
{
struct bpf_prog *attached;
@@ -278,7 +279,7 @@ static int __netns_bpf_prog_detach(struct net *net,
return -EINVAL;
attached = net->bpf.progs[type];
- if (!attached)
+ if (!attached || attached != old)
return -ENOENT;
netns_bpf_run_array_detach(net, type);
net->bpf.progs[type] = NULL;
@@ -286,19 +287,29 @@ static int __netns_bpf_prog_detach(struct net *net,
return 0;
}
-int netns_bpf_prog_detach(const union bpf_attr *attr)
+int netns_bpf_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype)
{
enum netns_bpf_attach_type type;
+ struct bpf_prog *prog;
int ret;
+ if (attr->target_fd)
+ return -EINVAL;
+
type = to_netns_bpf_attach_type(attr->attach_type);
if (type < 0)
return -EINVAL;
+ prog = bpf_prog_get_type(attr->attach_bpf_fd, ptype);
+ if (IS_ERR(prog))
+ return PTR_ERR(prog);
+
mutex_lock(&netns_bpf_mutex);
- ret = __netns_bpf_prog_detach(current->nsproxy->net_ns, type);
+ ret = __netns_bpf_prog_detach(current->nsproxy->net_ns, type, prog);
mutex_unlock(&netns_bpf_mutex);
+ bpf_prog_put(prog);
+
return ret;
}
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 7d946435587d..28c6ef759037 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2897,9 +2897,7 @@ static int bpf_prog_detach(const union bpf_attr *attr)
case BPF_PROG_TYPE_LIRC_MODE2:
return lirc_prog_detach(attr);
case BPF_PROG_TYPE_FLOW_DISSECTOR:
- if (!capable(CAP_NET_ADMIN))
- return -EPERM;
- return netns_bpf_prog_detach(attr);
+ return netns_bpf_prog_detach(attr, ptype);
case BPF_PROG_TYPE_CGROUP_DEVICE:
case BPF_PROG_TYPE_CGROUP_SKB:
case BPF_PROG_TYPE_CGROUP_SOCK: