Messages in this thread | | | Date | Fri, 27 Jun 2014 22:55:15 -0700 | Subject | Re: [PATCH RFC net-next 03/14] bpf: introduce syscall(BPF, ...) and BPF maps | From | Alexei Starovoitov <> |
| |
On Fri, Jun 27, 2014 at 5:16 PM, Andy Lutomirski <luto@amacapital.net> wrote: > On Fri, Jun 27, 2014 at 5:05 PM, Alexei Starovoitov <ast@plumgrid.com> wrote: >> BPF syscall is a demux for different BPF releated commands. >> >> 'maps' is a generic storage of different types for sharing data between kernel >> and userspace. >> >> The maps can be created/deleted from user space via BPF syscall: >> - create a map with given id, type and attributes >> map_id = bpf_map_create(int map_id, map_type, struct nlattr *attr, int len) >> returns positive map id or negative error >> >> - delete map with given map id >> err = bpf_map_delete(int map_id) >> returns zero or negative error > > What's the scope of "id"? How is it secured?
the map and program id space is global and it's cap_sys_admin only. There is no pressing need to do it with per-user limits. So the whole thing is root only for now.
Since I got your attention please review the most interesting verifier bits (patch 08/14) ;)
| |