Commit 4dd48c6f authored by Artem Savkov's avatar Artem Savkov Committed by Alexei Starovoitov
Browse files

bpf: add destructive kfunc flag 



Add KF_DESTRUCTIVE flag for destructive functions. Functions with this
flag set will require CAP_SYS_BOOT capabilities.

Signed-off-by: default avatarArtem Savkov <asavkov@redhat.com>
Link: https://lore.kernel.org/r/20220810065905.475418-2-asavkov@redhat.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 3143d10b

Documentation/bpf/kfuncs.rst

+9 −0
Original line number Diff line number Diff line
@@ -152,6 +152,15 @@ ensure the integrity of the operation being performed on the expected object. 
The KF_SLEEPABLE flag is used for kfuncs that may sleep. Such kfuncs can only

be called by sleepable BPF programs (BPF_F_SLEEPABLE).



2.4.7 KF_DESTRUCTIVE flag

--------------------------



The KF_DESTRUCTIVE flag is used to indicate functions calling which is

destructive to the system. For example such a call can result in system

rebooting or panicking. Due to this additional restrictions apply to these

calls. At the moment they only require CAP_SYS_BOOT capability, but more can be

added later.



2.5 Registering the kfuncs

--------------------------

include/linux/btf.h

+2 −1
Original line number Diff line number Diff line
@@ -50,6 +50,7 @@ 
 */

#define KF_TRUSTED_ARGS (1 << 4) /* kfunc only takes trusted pointer arguments */

#define KF_SLEEPABLE    (1 << 5) /* kfunc may sleep */

#define KF_DESTRUCTIVE  (1 << 6) /* kfunc performs destructive actions */



struct btf;

struct btf_member;

kernel/bpf/verifier.c

+5 −0
Original line number Diff line number Diff line
@@ -7584,6 +7584,11 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, 
			func_name);

		return -EACCES;

	}

	if (*kfunc_flags & KF_DESTRUCTIVE && !capable(CAP_SYS_BOOT)) {

		verbose(env, "destructive kfunc calls require CAP_SYS_BOOT capabilities\n");

		return -EACCES;

	}



	acq = *kfunc_flags & KF_ACQUIRE;



	/* Check the arguments */