diff options
| author |   John Fastabend <john.fastabend@gmail.com> | 2017-10-18 07:11:22 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2017-10-20 13:01:29 +0100 |
| commit | fb50df8d32283cd95932a182a46a10070c4a8832 (patch) | |
| tree | b04d6da4d4cf84e38de8b3b5ff344661598f8fdc /kernel/bpf/sockmap.c | |
| parent | bpf: remove mark access for SK_SKB program types (diff) | |
| download | wireguard-linux-fb50df8d32283cd95932a182a46a10070c4a8832.tar.xz wireguard-linux-fb50df8d32283cd95932a182a46a10070c4a8832.zip | |
bpf: require CAP_NET_ADMIN when using sockmap maps
Restrict sockmap to CAP_NET_ADMIN.
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to '')
| -rw-r--r-- | kernel/bpf/sockmap.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c index beaabb21c3a3..2b6eb35ae5d3 100644 --- a/kernel/bpf/sockmap.c +++ b/kernel/bpf/sockmap.c @@ -486,6 +486,9 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr) int err = -EINVAL; u64 cost; + if (!capable(CAP_NET_ADMIN)) + return ERR_PTR(-EPERM); + /* check sanity of attributes */ if (attr->max_entries == 0 || attr->key_size != 4 || attr->value_size != 4 || attr->map_flags & ~BPF_F_NUMA_NODE) |