]> git.baikalelectronics.ru Git - kernel.git/commit
bpf: restrict access to core bpf sysctls
authorDaniel Borkmann <daniel@iogearbox.net>
Sat, 20 Jan 2018 00:24:34 +0000 (01:24 +0100)
committerAlexei Starovoitov <ast@kernel.org>
Sat, 20 Jan 2018 02:37:00 +0000 (18:37 -0800)
commit8da8ffb368f22b77d31168181df7e7f8d2ffaa29
tree7a284360e27df66f12da60329433fd7fd787183e
parentcd40ba83543b147429c7a02303a9122204dacd17
bpf: restrict access to core bpf sysctls

Given BPF reaches far beyond just networking these days, it was
never intended to allow setting and in some cases reading those
knobs out of a user namespace root running without CAP_SYS_ADMIN,
thus tighten such access.

Also the bpf_jit_enable = 2 debugging mode should only be allowed
if kptr_restrict is not set since it otherwise can leak addresses
to the kernel log. Dump a note to the kernel log that this is for
debugging JITs only when enabled.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
net/core/sysctl_net_core.c