On Thu, Jun 27, 2019 at 1:20 PM Song Liu <songliubraving@xxxxxx> wrote: > > This patch introduce unprivileged BPF access. The access control is > achieved via device /dev/bpf. Users with write access to /dev/bpf are able > to call sys_bpf(). > > Two ioctl command are added to /dev/bpf: > > The two commands enable/disable permission to call sys_bpf() for current > task. This permission is noted by bpf_permitted in task_struct. This > permission is inherited during clone(CLONE_THREAD). > > Helper function bpf_capable() is added to check whether the task has got > permission via /dev/bpf. > > Signed-off-by: Song Liu <songliubraving@xxxxxx> > --- > Documentation/ioctl/ioctl-number.txt | 1 + > include/linux/bpf.h | 11 +++++ > include/linux/sched.h | 3 ++ > include/uapi/linux/bpf.h | 6 +++ > kernel/bpf/arraymap.c | 2 +- > kernel/bpf/cgroup.c | 2 +- > kernel/bpf/core.c | 4 +- > kernel/bpf/cpumap.c | 2 +- > kernel/bpf/devmap.c | 2 +- > kernel/bpf/hashtab.c | 4 +- > kernel/bpf/lpm_trie.c | 2 +- > kernel/bpf/offload.c | 2 +- > kernel/bpf/queue_stack_maps.c | 2 +- > kernel/bpf/reuseport_array.c | 2 +- > kernel/bpf/stackmap.c | 2 +- > kernel/bpf/syscall.c | 71 +++++++++++++++++++++------- > kernel/bpf/verifier.c | 2 +- > kernel/bpf/xskmap.c | 2 +- > kernel/fork.c | 5 ++ > net/core/filter.c | 6 +-- > 20 files changed, 99 insertions(+), 34 deletions(-) > > diff --git a/Documentation/ioctl/ioctl-number.txt b/Documentation/ioctl/ioctl-number.txt > index c9558146ac58..19998b99d603 100644 > --- a/Documentation/ioctl/ioctl-number.txt > +++ b/Documentation/ioctl/ioctl-number.txt > @@ -327,6 +327,7 @@ Code Seq#(hex) Include File Comments > 0xB4 00-0F linux/gpio.h <mailto:linux-gpio@xxxxxxxxxxxxxxx> > 0xB5 00-0F uapi/linux/rpmsg.h <mailto:linux-remoteproc@xxxxxxxxxxxxxxx> > 0xB6 all linux/fpga-dfl.h > +0xBP 01-02 uapi/linux/bpf.h <mailto:bpf@xxxxxxxxxxxxxxx> should this be 0xBF? > 0xC0 00-0F linux/usb/iowarrior.h > 0xCA 00-0F uapi/misc/cxl.h > 0xCA 10-2F uapi/misc/ocxl.h <snip>
