Re: [PATCH net-next v2 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff

2017-06-06 Thread David Miller
From: Daniel Borkmann Date: Tue, 06 Jun 2017 22:27:15 +0200 > On 06/06/2017 10:26 PM, David Miller wrote: >> From: Chenbo Feng >> Date: Tue, 6 Jun 2017 13:24:11 -0700 >> >>> On Tue, Jun 6, 2017 at 9:40 AM, Daniel Borkmann >>> wrote: >>> On 06/06/2017 02:04 PM, Daniel Borkmann wrote: >

Re: [PATCH net-next v2 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff

2017-06-06 Thread Daniel Borkmann
On 06/06/2017 10:26 PM, David Miller wrote: From: Chenbo Feng Date: Tue, 6 Jun 2017 13:24:11 -0700 On Tue, Jun 6, 2017 at 9:40 AM, Daniel Borkmann wrote: On 06/06/2017 02:04 PM, Daniel Borkmann wrote: On 06/01/2017 03:15 AM, Chenbo Feng wrote: From: Chenbo Feng This allows cgroup eBPF

Re: [PATCH net-next v2 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff

2017-06-06 Thread David Miller
From: Chenbo Feng Date: Tue, 6 Jun 2017 13:24:11 -0700 > On Tue, Jun 6, 2017 at 9:40 AM, Daniel Borkmann > wrote: > >> On 06/06/2017 02:04 PM, Daniel Borkmann wrote: >> >>> On 06/01/2017 03:15 AM, Chenbo Feng wrote: >>> From: Chenbo Feng This allows cgroup eBPF program to classi

Re: [PATCH net-next v2 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff

2017-06-06 Thread Daniel Borkmann
On 06/06/2017 02:04 PM, Daniel Borkmann wrote: On 06/01/2017 03:15 AM, Chenbo Feng wrote: From: Chenbo Feng This allows cgroup eBPF program to classify packet based on their protocol or other detail information. Currently program need CAP_NET_ADMIN privilege to attach a cgroup eBPF program, an

Re: [PATCH net-next v2 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff

2017-06-06 Thread Daniel Borkmann
On 06/01/2017 03:15 AM, Chenbo Feng wrote: From: Chenbo Feng This allows cgroup eBPF program to classify packet based on their protocol or other detail information. Currently program need CAP_NET_ADMIN privilege to attach a cgroup eBPF program, and A process with CAP_NET_ADMIN can already see a

Re: [PATCH net-next v2 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff

2017-06-02 Thread David Miller
From: Chenbo Feng Date: Wed, 31 May 2017 18:15:59 -0700 > From: Chenbo Feng > > This allows cgroup eBPF program to classify packet based on their > protocol or other detail information. Currently program need > CAP_NET_ADMIN privilege to attach a cgroup eBPF program, and A > process with CAP_NE

Re: [PATCH net-next v2 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff

2017-06-01 Thread Alexei Starovoitov
On Wed, May 31, 2017 at 06:15:59PM -0700, Chenbo Feng wrote: > From: Chenbo Feng > > This allows cgroup eBPF program to classify packet based on their > protocol or other detail information. Currently program need > CAP_NET_ADMIN privilege to attach a cgroup eBPF program, and A > process with CAP

[PATCH net-next v2 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff

2017-05-31 Thread Chenbo Feng
From: Chenbo Feng This allows cgroup eBPF program to classify packet based on their protocol or other detail information. Currently program need CAP_NET_ADMIN privilege to attach a cgroup eBPF program, and A process with CAP_NET_ADMIN can already see all packets on the system, for example, by cre