Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fb50df8d authored by John Fastabend's avatar John Fastabend Committed by David S. Miller
Browse files

bpf: require CAP_NET_ADMIN when using sockmap maps 



Restrict sockmap to CAP_NET_ADMIN.

Signed-off-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f7e9cb1e

kernel/bpf/sockmap.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -486,6 +486,9 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr) 
	int err = -EINVAL;

	int err = -EINVAL;

	u64 cost;

	u64 cost;





	if (!capable(CAP_NET_ADMIN))

		return ERR_PTR(-EPERM);



	/* check sanity of attributes */

	/* check sanity of attributes */

	if (attr->max_entries == 0 || attr->key_size != 4 ||

	if (attr->max_entries == 0 || attr->key_size != 4 ||

	    attr->value_size != 4 || attr->map_flags & ~BPF_F_NUMA_NODE)

	    attr->value_size != 4 || attr->map_flags & ~BPF_F_NUMA_NODE)