lkml.org 
[lkml]   [2017]   [Apr]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[RFC net-next] bpf: taint loading !is_gpl programs
Date
The eBPF framework is used for more than just socket level filtering.  It
can also provide tracing, and even change the way packets coming into the
system look. Most of the eBPF callable symbols are available to non-gpl
programs, and this includes helper functions which modify packets. This
allows proprietary eBPF code to link to the kernel and make decisions
which can negatively impact network performance.

Since the sources for these programs are only available under a proprietary
license, it seems better to treat them the same as other proprietary
modules: set the system taint flag. An exemption is made for socket-level
filters, since they do not really impact networking for the whole kernel.

Signed-off-by: Aaron Conole <aconole@bytheb.org>
---
kernel/bpf/syscall.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index ab0cf4c4..1255b51 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -860,6 +860,11 @@ static int bpf_prog_load(union bpf_attr *attr)

bpf_prog_kallsyms_add(prog);
trace_bpf_prog_load(prog, err);
+ if (type != BPF_PROG_TYPE_SOCKET_FILTER && !is_gpl && !(err < 0)) {
+ if (!test_taint(TAINT_PROPRIETARY_MODULE))
+ pr_warn("bpf license '%s' taints kernel.\n", license);
+ add_taint(TAINT_PROPRIETARY_MODULE, LOCKDEP_STILL_OK);
+ }
return err;

free_used_maps:
--
2.9.3
\
 
 \ /
  Last update: 2017-04-04 20:34    [W:0.055 / U:0.032 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site