diff options
| author | Chenbo Feng <fengc@google.com> | 2017-10-18 13:00:26 -0700 |
|---|---|---|
| committer | Michael Bestas <mkbestas@lineageos.org> | 2022-04-19 00:51:16 +0300 |
| commit | aa9eba07a784fce6a9f2f21846c07424a442acb0 (patch) | |
| tree | 49bb8a1c28c69d83147c58a621e26cedf72daa40 /kernel/bpf/syscall.c | |
| parent | 5dd97a8acaf41266d17eb2aa743f9e6dc6f5ffaf (diff) | |
UPSTREAM: selinux: bpf: Add addtional check for bpf object file receive
Introduce a bpf object related check when sending and receiving files
through unix domain socket as well as binder. It checks if the receiving
process have privilege to read/write the bpf map or use the bpf program.
This check is necessary because the bpf maps and programs are using a
anonymous inode as their shared inode so the normal way of checking the
files and sockets when passing between processes cannot work properly on
eBPF object. This check only works when the BPF_SYSCALL is configured.
Signed-off-by: Chenbo Feng <fengc@google.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Reviewed-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry-pick from net-next: f66e448cfda021b0bcd884f26709796fe19c7cc1)
Bug: 30950746
Change-Id: I5b2cf4ccb4eab7eda91ddd7091d6aa3e7ed9f2cd
Signed-off-by: Chatur27 <jasonbright2709@gmail.com>
Diffstat (limited to 'kernel/bpf/syscall.c')
| -rw-r--r-- | kernel/bpf/syscall.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 53dbfb4020f2..eaabb1333670 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -199,7 +199,7 @@ static ssize_t bpf_dummy_write(struct file *filp, const char __user *buf, return -EINVAL; } -static const struct file_operations bpf_map_fops = { +const struct file_operations bpf_map_fops = { #ifdef CONFIG_PROC_FS .show_fdinfo = bpf_map_show_fdinfo, #endif @@ -748,7 +748,7 @@ static int bpf_prog_release(struct inode *inode, struct file *filp) return 0; } -static const struct file_operations bpf_prog_fops = { +const struct file_operations bpf_prog_fops = { .release = bpf_prog_release, .read = bpf_dummy_read, .write = bpf_dummy_write, |