lkml.org 
[lkml]   [2020]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH bpf-next v7 4/8] bpf: lsm: Implement attach, detach and execution
    On Thu, 26 Mar 2020, KP Singh wrote:

    > +int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
    > + const struct bpf_prog *prog)
    > +{
    > + /* Only CAP_MAC_ADMIN users are allowed to make changes to LSM hooks
    > + */
    > + if (!capable(CAP_MAC_ADMIN))
    > + return -EPERM;
    > +

    Stephen, can you confirm that your concerns around this are resolved
    (IIRC, by SELinux implementing a bpf_prog callback) ?


    --
    James Morris
    <jmorris@namei.org>

    \
     
     \ /
      Last update: 2020-03-27 01:25    [W:4.161 / U:0.264 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site