Re: [RFC 4/4] bpf: Restrict Checmate bpf programs to current kernel ABI

[Daniel Borkmann]

On 08/04/2016 11:52 AM, Daniel Borkmann wrote:
> On 08/04/2016 09:12 AM, Sargun Dhillon wrote:
> > I think it makes sense to restrict Checmate to loading programs that have been
> > compiled with the current kernel ABI. We can further stabilize the ABI, and
> > perhaps lift this restriction later.
> >
> > Signed-off-by: Sargun Dhillon <sargun@xxxxxxxxx>
> > ---
> >   kernel/bpf/syscall.c         | 2 +-
> >   samples/bpf/checmate1_kern.c | 3 ++-
> >   2 files changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> > index 228f962..2a37b4d 100644
> > --- a/kernel/bpf/syscall.c
> > +++ b/kernel/bpf/syscall.c
> > @@ -741,7 +741,7 @@ static int bpf_prog_load(union bpf_attr *attr)
> >       if (attr->insn_cnt >= BPF_MAXINSNS)
> >           return -EINVAL;
> >
> > -    if (type == BPF_PROG_TYPE_KPROBE &&
> > +    if ((type & (BPF_PROG_TYPE_KPROBE | BPF_PROG_TYPE_CHECMATE)) &&
> >           attr->kern_version != LINUX_VERSION_CODE)
>
> Btw, this check is correct, program types are not masks.

Sorry, I meant to write *not* correct, which was hopefully inferable from
the rest.

> BPF_PROG_TYPE_KPROBE (== 2) and BPF_PROG_TYPE_CHECMATE (== 7) will now
> require every type to have a version code ...
>
> >           return -EINVAL;