Re: [PATCH bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

2019-06-27 Thread Greg KH
On Thu, Jun 27, 2019 at 04:51:20PM +, Song Liu wrote: > > > > On Jun 27, 2019, at 9:37 AM, Greg KH wrote: > > > > On Thu, Jun 27, 2019 at 01:00:03AM +, Song Liu wrote: > >> > >> > >>> On Jun 26, 2019, at 5:08 PM, Greg KH wrote: > >>> > >>> On Wed, Jun 26, 2019 at 03:17:47PM +, S

Re: [PATCH bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

2019-06-27 Thread Song Liu
> On Jun 27, 2019, at 9:37 AM, Greg KH wrote: > > On Thu, Jun 27, 2019 at 01:00:03AM +, Song Liu wrote: >> >> >>> On Jun 26, 2019, at 5:08 PM, Greg KH wrote: >>> >>> On Wed, Jun 26, 2019 at 03:17:47PM +, Song Liu wrote: >> +static struct miscdevice bpf_dev = { >> +.

Re: [PATCH bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

2019-06-27 Thread Greg KH
On Thu, Jun 27, 2019 at 01:00:03AM +, Song Liu wrote: > > > > On Jun 26, 2019, at 5:08 PM, Greg KH wrote: > > > > On Wed, Jun 26, 2019 at 03:17:47PM +, Song Liu wrote: > +static struct miscdevice bpf_dev = { > +.minor = MISC_DYNAMIC_MINOR, > +.nam

Re: [PATCH bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

2019-06-26 Thread Song Liu
> On Jun 26, 2019, at 5:08 PM, Greg KH wrote: > > On Wed, Jun 26, 2019 at 03:17:47PM +, Song Liu wrote: +static struct miscdevice bpf_dev = { + .minor = MISC_DYNAMIC_MINOR, + .name = "bpf", + .fops = &bpf_chardev_ops, + .mode

Re: [PATCH bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

2019-06-26 Thread Greg KH
On Wed, Jun 26, 2019 at 03:17:47PM +, Song Liu wrote: > >> +static struct miscdevice bpf_dev = { > >> + .minor = MISC_DYNAMIC_MINOR, > >> + .name = "bpf", > >> + .fops = &bpf_chardev_ops, > >> + .mode = 0440, > >> + .nodename = "bpf", > > > > H

Re: [PATCH bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

2019-06-26 Thread Song Liu
> On Jun 26, 2019, at 8:26 AM, Lorenz Bauer wrote: > > On Wed, 26 Jun 2019 at 16:19, Song Liu wrote: >>> I know nothing about the scheduler, so pardon my ignorance. Does >>> TASK_BPF_FLAG_PERMITTED apply per user-space process, or per thread? >> >> It is per thread. clone() also clears the b

Re: [PATCH bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

2019-06-26 Thread Lorenz Bauer
On Wed, 26 Jun 2019 at 16:19, Song Liu wrote: > > I know nothing about the scheduler, so pardon my ignorance. Does > > TASK_BPF_FLAG_PERMITTED apply per user-space process, or per thread? > > It is per thread. clone() also clears the bit. I will make it more > clear int the commit log. In that ca

Re: [PATCH bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

2019-06-26 Thread Song Liu
> On Jun 26, 2019, at 6:45 AM, Lorenz Bauer wrote: > > On Tue, 25 Jun 2019 at 19:23, Song Liu wrote: >> >> This patch introduce unprivileged BPF access. The access control is >> achieved via device /dev/bpf. Users with access to /dev/bpf are able >> to access BPF syscall. >> >> Two ioctl co

Re: [PATCH bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

2019-06-26 Thread Song Liu
> On Jun 26, 2019, at 6:32 AM, Daniel Borkmann wrote: > > On 06/25/2019 08:23 PM, Song Liu wrote: >> This patch introduce unprivileged BPF access. The access control is >> achieved via device /dev/bpf. Users with access to /dev/bpf are able >> to access BPF syscall. >> >> Two ioctl command ar

Re: [PATCH bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

2019-06-26 Thread Lorenz Bauer
On Tue, 25 Jun 2019 at 19:23, Song Liu wrote: > > This patch introduce unprivileged BPF access. The access control is > achieved via device /dev/bpf. Users with access to /dev/bpf are able > to access BPF syscall. > > Two ioctl command are added to /dev/bpf: > > The first two commands get/put perm

[PATCH bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

2019-06-25 Thread Song Liu
This patch introduce unprivileged BPF access. The access control is achieved via device /dev/bpf. Users with access to /dev/bpf are able to access BPF syscall. Two ioctl command are added to /dev/bpf: The first two commands get/put permission to access sys_bpf. This permission is noted by setting