lkml.org 
[lkml]   [2020]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH bpf-next v7 4/8] bpf: lsm: Implement attach, detach and execution
On Thu, 26 Mar 2020, KP Singh wrote:

> +int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
> + const struct bpf_prog *prog)
> +{
> + /* Only CAP_MAC_ADMIN users are allowed to make changes to LSM hooks
> + */
> + if (!capable(CAP_MAC_ADMIN))
> + return -EPERM;
> +

Stephen, can you confirm that your concerns around this are resolved
(IIRC, by SELinux implementing a bpf_prog callback) ?


--
James Morris
<jmorris@namei.org>

\
 
 \ /
  Last update: 2020-03-27 01:25    [W:0.143 / U:5.904 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site