path: root/security/Makefile
diff options
authorKP Singh <>2020-03-29 01:43:52 +0100
committerDaniel Borkmann <>2020-03-30 01:34:00 +0200
commit9e4e01dfd3254c7f04f24b7c6b29596bc12332f3 (patch)
tree5c98d39252c414dd308b372c07c0bd6bec4944ac /security/Makefile
parent9d3fdea789c8fab51381c2d609932fabe94c0517 (diff)
bpf: lsm: Implement attach, detach and execution
JITed BPF programs are dynamically attached to the LSM hooks using BPF trampolines. The trampoline prologue generates code to handle conversion of the signature of the hook to the appropriate BPF context. The allocated trampoline programs are attached to the nop functions initialized as LSM hooks. BPF_PROG_TYPE_LSM programs must have a GPL compatible license and and need CAP_SYS_ADMIN (required for loading eBPF programs). Upon attachment: * A BPF fexit trampoline is used for LSM hooks with a void return type. * A BPF fmod_ret trampoline is used for LSM hooks which return an int. The attached programs can override the return value of the bpf LSM hook to indicate a MAC Policy decision. Signed-off-by: KP Singh <> Signed-off-by: Daniel Borkmann <> Reviewed-by: Brendan Jackman <> Reviewed-by: Florent Revest <> Acked-by: Andrii Nakryiko <> Acked-by: James Morris <> Link:
Diffstat (limited to 'security/Makefile')
0 files changed, 0 insertions, 0 deletions