Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 61f3c964 authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by Daniel Borkmann
Browse files

bpf: allow socket_filter programs to use bpf_prog_test_run 



in order to improve test coverage allow socket_filter program type
to be run via bpf_prog_test_run command.
Since such programs can be loaded by non-root tighten
permissions for bpf_prog_test_run to be root only
to avoid surprises.

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent e7b2823a

kernel/bpf/syscall.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -1504,6 +1504,8 @@ static int bpf_prog_test_run(const union bpf_attr *attr, 
	struct bpf_prog *prog;

	struct bpf_prog *prog;

	int ret = -ENOTSUPP;

	int ret = -ENOTSUPP;





	if (!capable(CAP_SYS_ADMIN))

		return -EPERM;

	if (CHECK_ATTR(BPF_PROG_TEST_RUN))

	if (CHECK_ATTR(BPF_PROG_TEST_RUN))

		return -EINVAL;

		return -EINVAL;

net/core/filter.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -4526,6 +4526,7 @@ const struct bpf_verifier_ops sk_filter_verifier_ops = { 
};

};





const struct bpf_prog_ops sk_filter_prog_ops = {

const struct bpf_prog_ops sk_filter_prog_ops = {

	.test_run		= bpf_prog_test_run_skb,

};

};





const struct bpf_verifier_ops tc_cls_act_verifier_ops = {

const struct bpf_verifier_ops tc_cls_act_verifier_ops = {