Commit 649f11dc authored Nov 20, 2017 by Jakub Kicinski Committed by Daniel Borkmann Nov 21, 2017

bpf: offload: limit offload to cls_bpf and xdp programs only



We are currently only allowing attachment of device-bound
cls_bpf and XDP programs.  Make this restriction explicit in
the BPF offload code.  This way we can potentially reuse the
ifindex field in the future.

Since XDP and cls_bpf programs can only be loaded by admin,
we can drop the explicit capability check from offload code.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

parent 13a9c48a

kernel/bpf/offload.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -14,8 +14,9 @@ int bpf_prog_offload_init(struct bpf_prog prog, union bpf_attr attr)
		struct net *net = current->nsproxy->net_ns;
		struct bpf_dev_offload *offload;

		if (!capable(CAP_SYS_ADMIN))
		return -EPERM;
		if (attr->prog_type != BPF_PROG_TYPE_SCHED_CLS &&
		attr->prog_type != BPF_PROG_TYPE_XDP)
		return -EINVAL;

		if (attr->prog_flags)
		return -EINVAL;