Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1616307

[RFC net-next] bpf: taint loading !is_gpl programs

Show all headers | View raw

The eBPF framework is used for more than just socket level filtering.  It
can also provide tracing, and even change the way packets coming into the
system look.  Most of the eBPF callable symbols are available to non-gpl
programs, and this includes helper functions which modify packets.  This
allows proprietary eBPF code to link to the kernel and make decisions
which can negatively impact network performance.

Since the sources for these programs are only available under a proprietary
license, it seems better to treat them the same as other proprietary
modules: set the system taint flag.  An exemption is made for socket-level
filters, since they do not really impact networking for the whole kernel.

Signed-off-by: Aaron Conole <aconole@bytheb.org>
---
 kernel/bpf/syscall.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index ab0cf4c4..1255b51 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -860,6 +860,11 @@ static int bpf_prog_load(union bpf_attr *attr)
 
 	bpf_prog_kallsyms_add(prog);
 	trace_bpf_prog_load(prog, err);
+	if (type != BPF_PROG_TYPE_SOCKET_FILTER && !is_gpl && !(err < 0)) {
+		if (!test_taint(TAINT_PROPRIETARY_MODULE))
+			pr_warn("bpf license '%s' taints kernel.\n", license);
+		add_taint(TAINT_PROPRIETARY_MODULE, LOCKDEP_STILL_OK);
+	}
 	return err;
 
 free_used_maps:
-- 
2.9.3

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[RFC net-next] bpf: taint loading !is_gpl programs Aaron Conole <aconole@bytheb.org> - 2017-04-04 20:40 +0200
  Re: [RFC net-next] bpf: taint loading !is_gpl programs Daniel Borkmann <daniel@iogearbox.net> - 2017-04-04 23:20 +0200
    Re: [RFC net-next] bpf: taint loading !is_gpl programs Aaron Conole <aconole@bytheb.org> - 2017-04-06 05:10 +0200
      Re: [RFC net-next] bpf: taint loading !is_gpl programs Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2017-04-06 14:50 +0200
        Re: [RFC net-next] bpf: taint loading !is_gpl programs Aaron Conole <aconole@bytheb.org> - 2017-04-07 19:50 +0200
          Re: [RFC net-next] bpf: taint loading !is_gpl programs Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2017-04-09 01:20 +0200

csiph-web