On Fri, 1 Mar 2019 00:18:24 +0100, Daniel Borkmann wrote: > This work adds two new map creation flags BPF_F_RDONLY_PROG > and BPF_F_WRONLY_PROG in order to allow for read-only or > write-only BPF maps from a BPF program side. > > Today we have BPF_F_RDONLY and BPF_F_WRONLY, but this only > applies to system call side, meaning the BPF program has full > read/write access to the map as usual while bpf(2) calls with > map fd can either only read or write into the map depending > on the flags. BPF_F_RDONLY_PROG and BPF_F_WRONLY_PROG allows > for the exact opposite such that verifier is going to reject > program loads if write into a read-only map or a read into a > write-only map is detected. > > We've enabled this generic map extension to various non-special > maps holding normal user data: array, hash, lru, lpm, local > storage, queue and stack. Further map types could be followed > up in future depending on use-case. Main use case here is to > forbid writes into .rodata map values from verifier side. This will also enable optimizing the accesses on system with rich memory architecture :) > Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx> > --- > include/linux/bpf.h | 18 ++++++++++++++++++ > include/uapi/linux/bpf.h | 10 +++++++++- > kernel/bpf/arraymap.c | 2 +- > kernel/bpf/hashtab.c | 2 +- > kernel/bpf/local_storage.c | 2 +- > kernel/bpf/lpm_trie.c | 2 +- > kernel/bpf/queue_stack_maps.c | 3 +-- > kernel/bpf/verifier.c | 30 +++++++++++++++++++++++++++++- > 8 files changed, 61 insertions(+), 8 deletions(-) > > diff --git a/include/linux/bpf.h b/include/linux/bpf.h > index bdcc6e2a9977..3f74194dd4f6 100644 > --- a/include/linux/bpf.h > +++ b/include/linux/bpf.h > @@ -427,6 +427,24 @@ struct bpf_array { > }; > }; > > +#define BPF_MAP_CAN_READ BIT(0) > +#define BPF_MAP_CAN_WRITE BIT(1) > + > +static inline u32 bpf_map_flags_to_cap(struct bpf_map *map) > +{ > + u32 access_flags = map->map_flags & (BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG); > + > + /* Combination of BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG is > + * not possible. > + */ minor nit: we do check that old RDONLY and WRONLY are not set at the same time, but here it's not done? > + if (access_flags & BPF_F_RDONLY_PROG) > + return BPF_MAP_CAN_READ; > + else if (access_flags & BPF_F_WRONLY_PROG) > + return BPF_MAP_CAN_WRITE; > + else > + return BPF_MAP_CAN_READ | BPF_MAP_CAN_WRITE; > +}