Re: [PATCH bpf-next v7 4/8] bpf: lsm: Implement attach, detach and execution
From: James Morris <jmorris@namei.org>
Date: 2020-03-27 00:24:48
Also in:
bpf, lkml
On Thu, 26 Mar 2020, KP Singh wrote:
+int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
+ const struct bpf_prog *prog)
+{
+ /* Only CAP_MAC_ADMIN users are allowed to make changes to LSM hooks
+ */
+ if (!capable(CAP_MAC_ADMIN))
+ return -EPERM;
+Stephen, can you confirm that your concerns around this are resolved (IIRC, by SELinux implementing a bpf_prog callback) ? -- James Morris [off-list ref]