Messages in this thread | | | Date | Fri, 27 Mar 2020 11:24:12 +1100 (AEDT) | From | James Morris <> | Subject | Re: [PATCH bpf-next v7 4/8] bpf: lsm: Implement attach, detach and execution |
| |
On Thu, 26 Mar 2020, KP Singh wrote:
> +int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, > + const struct bpf_prog *prog) > +{ > + /* Only CAP_MAC_ADMIN users are allowed to make changes to LSM hooks > + */ > + if (!capable(CAP_MAC_ADMIN)) > + return -EPERM; > +
Stephen, can you confirm that your concerns around this are resolved (IIRC, by SELinux implementing a bpf_prog callback) ?
-- James Morris <jmorris@namei.org>
| |