On Thu, 26 Mar 2020, KP Singh wrote:
> +int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
> + const struct bpf_prog *prog)
> +{
> + /* Only CAP_MAC_ADMIN users are allowed to make changes to LSM hooks
> + */
> + if (!capable(CAP_MAC_ADMIN))
> + return -EPERM;
> +
Stephen, can you confirm that your concerns around this are resolved
(IIRC, by SELinux implementing a bpf_prog callback) ?
--
James Morris
<jmorris@xxxxxxxxx>
