| Message ID | 20231018105033.13669-13-michael.weiss@aisec.fraunhofer.de (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | BPF |
| Headers | show |
| Series | device_cgroup: guard mknod for non-initial user namespace | expand |
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 0448700890f7..0196b9c72d3e 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -6927,6 +6927,7 @@ enum { BPF_DEVCG_ACC_MKNOD = (1ULL << 0), BPF_DEVCG_ACC_READ = (1ULL << 1), BPF_DEVCG_ACC_WRITE = (1ULL << 2), + BPF_DEVCG_ACC_MKNOD_UNS = (1ULL << 3), }; enum {
With this new flag for bpf cgroup device programs, it should be possible to guard mknod() access in non-initial user namespaces later on. Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de> --- include/uapi/linux/bpf.h | 1 + 1 file changed, 1 insertion(+)