diff options
| author |   Martin KaFai Lau <kafai@fb.com> | 2022-08-16 23:17:23 -0700 |
|---|---|---|
| committer |   Alexei Starovoitov <ast@kernel.org> | 2022-08-18 17:06:12 -0700 |
| commit | e42c7beee71d0d84a6193357e3525d0cf2a3e168 (patch) | |
| tree | 07465d67db08849512a87e907cfbc160881dcbdc /include/net/sock.h | |
| parent | bpf: net: Avoid sk_setsockopt() taking sk lock when called from bpf (diff) | |
| download | linux-dev-e42c7beee71d0d84a6193357e3525d0cf2a3e168.tar.xz linux-dev-e42c7beee71d0d84a6193357e3525d0cf2a3e168.zip | |
bpf: net: Consider has_current_bpf_ctx() when testing capable() in sk_setsockopt()
When bpf program calling bpf_setsockopt(SOL_SOCKET),
it could be run in softirq and doesn't make sense to do the capable
check. There was a similar situation in bpf_setsockopt(TCP_CONGESTION).
In commit 8d650cdedaab ("tcp: fix tcp_set_congestion_control() use from bpf hook"),
tcp_set_congestion_control(..., cap_net_admin) was added to skip
the cap check for bpf prog.
This patch adds sockopt_ns_capable() and sockopt_capable() for
the sk_setsockopt() to use. They will consider the
has_current_bpf_ctx() before doing the ns_capable() and capable() test.
They are in EXPORT_SYMBOL for the ipv6 module to use in a latter patch.
Suggested-by: Stanislav Fomichev <sdf@google.com>
Reviewed-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/r/20220817061723.4175820-1-kafai@fb.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'include/net/sock.h')
| -rw-r--r-- | include/net/sock.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/net/sock.h b/include/net/sock.h index 352b9458fdc6..13089d88a2e2 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -1751,6 +1751,8 @@ static inline void unlock_sock_fast(struct sock *sk, bool slow) void sockopt_lock_sock(struct sock *sk); void sockopt_release_sock(struct sock *sk); +bool sockopt_ns_capable(struct user_namespace *ns, int cap); +bool sockopt_capable(int cap); /* Used by processes to "lock" a socket state, so that * interrupts and bottom half handlers won't change it |