projects / systemd / .git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: cb92f56) | patch
bpf-firewall: attach with BPF_F_ALLOW_MULTI if kernel supports
authorJulia Kartseva <hex@fb.com>
Thu, 4 Feb 2021 06:15:27 +0000 (22:15 -0800)
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Thu, 6 May 2021 12:04:41 +0000 (14:04 +0200)
commit0af3810d4b1c8bb4f0683758f47e042e8cb76972
treeb4619466d7d45fb5250b50b70294a6cc4676bc58tree | snapshot
parentcb92f5601ad169e8f86a61319b73a8fd9e19950bcommit | diff
bpf-firewall: attach with BPF_F_ALLOW_MULTI if kernel supports

Reduced version of [0].
Use BPF_F_ALLOW_MULTI attach flag for bpf-firewall if kernel supports
it.

Aside from addressing security issue in [0] attaching with 'multi'
allows further attaching of cgroup egress, ingress hooks specified by
BPFProgram=.

[0] https://github.com/systemd/systemd/pull/17495/commits/4e42210d40f96e185a55d43041dd6b962ea830dd

(cherry picked from commit a442ccb4ebdbc3a9ff9d4504eb9724092149fd42)
src/core/bpf-firewall.c diff | blob | history
https://github.com/systemd/systemd.git