On Tue, Oct 31, 2017 at 7:32 PM, Jason Wang [off-list ref] wrote:

This patch introduces an eBPF based queue selection method based on
the flow steering policy ops. Userspace could load an eBPF program
through TUNSETSTEERINGEBPF. This gives much more flexibility compare
to simple but hard coded policy in kernel.

Signed-off-by: Jason Wang <jasowang@redhat.com>
---
+static int tun_set_steering_ebpf(struct tun_struct *tun, void __user *data)
+{
+       struct bpf_prog *prog;
+       u32 fd;
+
+       if (copy_from_user(&fd, data, sizeof(fd)))
+               return -EFAULT;
+
+       prog = bpf_prog_get_type(fd, BPF_PROG_TYPE_SOCKET_FILTER);

If the idea is to allow guests to pass BPF programs down to the host,
you may want to define a new program type that is more restrictive than
socket filter.

The external functions allowed for socket filters (sk_filter_func_proto)
are relatively few (compared to, say, clsact), but may still leak host
information to a guest. More importantly, guest security considerations
limits how we can extend socket filters later.