diff options
| author | Yonghong Song <yhs@fb.com> | 2018-09-27 14:37:30 -0700 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2018-09-28 14:15:19 +0200 |
| commit | 5bf7a60b8e70969f65c961d7e2c4eb40eb2c664d (patch) | |
| tree | 97159aaae6aa1e3502737f33f7f2d0e42b4239b2 /kernel/capability.c | |
| parent | 78e6e5c11acef7dae81d7f0e919ad5563a611a6a (diff) | |
| download | linux-5bf7a60b8e70969f65c961d7e2c4eb40eb2c664d.tar.bz2 | |
bpf: permit CGROUP_DEVICE programs accessing helper bpf_get_current_cgroup_id()
Currently, helper bpf_get_current_cgroup_id() is not permitted
for CGROUP_DEVICE type of programs. If the helper is used
in such cases, the verifier will log the following error:
0: (bf) r6 = r1
1: (69) r7 = *(u16 *)(r6 +0)
2: (85) call bpf_get_current_cgroup_id#80
unknown func bpf_get_current_cgroup_id#80
The bpf_get_current_cgroup_id() is useful for CGROUP_DEVICE
type of programs in order to customize action based on cgroup id.
This patch added such a support.
Cc: Roman Gushchin <guro@fb.com>
Signed-off-by: Yonghong Song <yhs@fb.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Roman Gushchin <guro@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat (limited to 'kernel/capability.c')
0 files changed, 0 insertions, 0 deletions