diff options
| author | Chenbo Feng <fengc@google.com> | 2017-06-02 17:04:59 -0700 |
|---|---|---|
| committer | Michael Bestas <mkbestas@lineageos.org> | 2022-04-19 00:51:12 +0300 |
| commit | b5be810c12a12818d5b7e65103f208b5fa7f2130 (patch) | |
| tree | 7771236b00b9afef09aebbb1dee33534846cfee3 /kernel | |
| parent | c90c9a2ac769f401df7e28605b5e51cae098ab42 (diff) | |
FROMLIST: [net-next,v2,1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff
This allows cgroup eBPF program to classify packet based on their
protocol or other detail information. Currently program need
CAP_NET_ADMIN privilege to attach a cgroup eBPF program, and A
process with CAP_NET_ADMIN can already see all packets on the system,
for example, by creating an iptables rules that causes the packet to
be passed to userspace via NFLOG.
(url: http://patchwork.ozlabs.org/patch/769459/)
Signed-off-by: Chenbo Feng <fengc@google.com>
Bug: 30950746
Change-Id: I11bef84ce26cf8b8f1b89483c32a7fcdd61ae926
Signed-off-by: Chatur27 <jasonbright2709@gmail.com>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/verifier.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 44c17f47d94c..fe158bd01dc6 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -2164,6 +2164,7 @@ static bool may_access_skb(enum bpf_prog_type type) case BPF_PROG_TYPE_SOCKET_FILTER: case BPF_PROG_TYPE_SCHED_CLS: case BPF_PROG_TYPE_SCHED_ACT: + case BPF_PROG_TYPE_CGROUP_SKB: return true; default: return false; |