netdev - [RFC PATCH bpf-next 0/2] unprivileged BPF_PROG_TEST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191219013534.125342-1-epeer@juniper.net>
Date:   Thu, 19 Dec 2019 01:36:26 +0000
From:   Edwin Peer <epeer@...iper.net>
To:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     "ast@...nel.org" <ast@...nel.org>,
        "daniel@...earbox.net" <daniel@...earbox.net>,
        Edwin Peer <epeer@...iper.net>
Subject: [RFC PATCH bpf-next 0/2] unprivileged BPF_PROG_TEST_RUN 

Being able to load, verify and test BPF programs in unprivileged
build environments is desirable. The two phase load and then
test API makes this goal difficult to achieve, since relaxing
permissions for BPF_PROG_TEST_RUN alone would be insufficient.

The approach taken in this proposal defers CAP_SYS_ADMIN checks
until program attach time in order to unencumber BPF_PROG_LOAD.

Edwin Peer (2):
  bpf: defer capability checks until program attach
  bpf: relax CAP_SYS_ADMIN requirement for BPF_PROG_TEST_RUN

 include/linux/filter.h |  3 ++-
 kernel/bpf/syscall.c   | 27 +++++++++++++++++----------
 2 files changed, 19 insertions(+), 11 deletions(-)

-- 
2.24.1