Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.31 as permitted sender) client-ip=23.128.96.31;
IronPort-PHdr: A9a23:cSN9DxzDyXu5w63XCzKPy1BlVkEcU8jcIFtMudIu3qhVe+G4/524Y
 RKMrf44llLNVJXW57Vehu7fo63sCgliqZrUvmoLbZpMUBEIk4MRmQkhC9SCEkr1MLjhaClpV
 N8XT1Jh8nqnNlIPXcjkbkDUonq84CRXHRP6NAFvIf/yFJKXhMOyhIXQs52GTR9PgWiRaK9/f
 i6rpwfcvdVEpIZ5Ma8+x17ojiljfOJKyGV0YG6Chxuuw+aV0dtd/j5LuvUnpf4FdJ6/UrQzT
 bVeAzljCG0z6MDxnDXoTQaE5Sh5MC0ckk9oDyH940joAYzK6gLVqOYhxjCTE+3sFqoVYGWv1
 aVKQxLHoT4pPDNkq0CH358V7upR9T6sll96gKuEPtilbdBBc4XMV9QcflgeUetheSJCHsClT
 6kMBfINFP1cn6/Nn1Uls0uCLAO0Ce7lz29UxVHUgYR936MnGwzlhwUKNNwAuliEkOfkNuQMA
 cun4ZfS1G+cQdIN/Re+uYr4fDlx+a2RZrdtaPvI5G0ITRneq0S+qIDmBGLW+98DtUmrrNdbT
 fz310NglS1VhiadxecF2qn21qAswWyc9z1YwdcrKojrAF4+YMSjFoNXrT3fLYZtX8c+Fnlho
 z1polVnkZuyfSxPxZgoyh3WMaDBfZKB/xTjU+icO3F0iSEtdLG+gkOq+FO7gq3nV8ay2UpXt
 CcNjNTWt34M2hCSosiKQ/dw5AGgjB6BzQnO7OFDL00u063dLp8q2LkrkZQP90/EG0fL
IronPort-SDR: 6538e32d_b/52dP1ggGLqKsCp8ZDpm+8+pOPPzqR6dSt1kc8MYf50BLo
 6kwysTKcVMWjf+Fs5yWMeUS4TeWBhcy51vcERfw==
IronPort-PHdr: A9a23:yLG4uBSo74peuRLfCfJvHvuoLtpsovKeAWYlg6HP9ppQJ/3wt523J
 lfWoO5thQWUA9aT4Kdehu7fo63sHnYN5Z+RvXxRFf4EW0oLk8wLmQwnDsOfT0r9Kf/hdSshG
 8peElRi+iLzKh1OFcLzbEHVuCf34yQbBxP/MgR4PKHyHIvThN6wzOe859jYZAAb4Vj1YeZcN
 hKz/ynYqsREupZoKKs61knsr2BTcutbgEJEd3mUmQrx4Nv1wI97/nZ1mtcMsvBNS777eKJqf
 fl9N3ELI2s17cvkuFz4QA2D62E1fk4WnxFLUG2npBv6C7f9mxP17/giwxLCFOLoQewqQD2Mz
 70wUj7R2So9NR8y/U7+k+J7gf8AgUL09Hkdi4SBTIykd/89W/ODJONDb1VMeNd7UCp6MNyzQ
 rshAekdfv94jYr3v1cnth+OIzmUCsjxmgNhjGf70Kc/g/hiPyOa9UssWNQEvVePpf/eOqkYf
 bCJ/rjKjiuTROF75y3kstfmU0sFgbLdX4J+WJqJlVQUEh7cv0y9jau/JSiwx8oMv2ugvqlNb
 uypql5kljppvGDz64ASpq3tmLAW6nmU1Rop4r8+GYW6UG96MMCrRcgYp2SbLYxwWsQ4XyRyt
 T0nzqFToZegZ3tiIPUPwhfeb7mCb4Gkzki+EuiLKCp+hHVrdaj5ixvhuUSjy+ipTsCvyx4Kt
 StKlNDQq2oAnwLe8MmJS/Zxvw+h1D+D2hqV67RsL1o9iKzbLJAs2Pg3kJ8Sul7EBSj4hAP9i
 6r+Sw==
IronPort-Data: A9a23:NtqDva8/6YGJlFV24uwnDrUDBHqTJUtcMsCJ2f8bNWPcYEJGY0x3n
 2NLUGGPbvuLZWD8eIogYIWzoEhS65SGnNJqQQNlritEQiMRo6IpJzg2wmQcn8+2BpeeJK6yx
 5xGMrEsFOhtEjmG4E3F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZg6mJTqYb/W1jlV
 e/a+ZWFYwb9gWMsawr41orawP9RlKSq0N8nlgFmDRx7lAe2v2UYCpsZOZawIxPQKmWDNrfnL
 wpr5OjRElLxp3/BOPv8+lrIWhFirorpAOS7oiE+t55OIvR1jndaPq4TbJLwYKrM4tmDt4gZJ
 N5l7fRcReq1V0HBsLx1bvVWL81xFaps5q//EUWNi5TN8nfNc3ixx8t8M2hjaOX0+s4vaY1P3
 ecdNChLYwCIh6S42rumTOlriMk5asXmVG8dkig9lneIUrB/HsGFGv+VjTNb9G9YasRmGPfVZ
 8MUbXxwYRXbeDVGO0waA9Qwhu61gHn4fTBC7l6YzUYyyzGDnFAgiea0bbI5fPSBGPVP3We7p
 lnM/nu+A0oeN+WQ7GG8pyfEaujn2HmTtJgpPLS8++5jhlGe3EQWCR0fUVqwsP//gUm7M/pVM
 UUJ/Cc0has/7kqmSp/6RRLQiHefojYfVsBWHul87xuCooLM6hudLnANUzoEbdshrsJwTjsvv
 neFltXoCDhHsbqaRHuH/LCE6zW/JUA9JGkOfy4FZQgI+d/upMc0lB2nZtNqCrK0iJvxECzYx
 zGMsTh4i7gN5eYQ0KO01VPKmTShot7OVAFdzhTXRUqr5EVyY4vNT46v6V6d4/9bMI+TQ1+Nl
 HcBksmaqusJCPmllzSWQeMCHJmq6uyDPTmahkRgd7E6+zqF9HmkcoRdpjp5IS9BMs8DfSLuS
 EDUvgxV6dlYO37CRa1wZ5m4I8cn167tEZLiTP+8RsNTb55tdQmv/Tppe0eU0mbx1kMrlMkXJ
 5aBdu6+AHAbF+JjzTyrV6Eay7Bt2yNW7WbSRpT81Dy8w7eEaXKUD7cYWHOHa+Ejs/iFpC3a9
 t9eM42BzBA3ePbzeCba2Y4aKVQbKz4wApWeg8ZPeMadLQd8XmIsEfncxfUmYYMNt6BUkPrYu
 3KwQElVzHLhinDdbwaHcHZubPXoR5kXhXY6OzE8eFiz13U9bIKH8qgSbd00cKMh+eglyuR7J
 8TpYO3ZX68KG2uComtMKMCn88p8cVKgwwyUNjejYD8xcoQmSwGhFsLYQzYDPRImV0KfncUkq
 qCm1gTVTIBFQAJnDc3Mb+mowU/3tn8Y8N+elWOUSjWKUBS9rNpZOGbqg+UpIsoBDxzGy3HIn
 0yVGBoU762F6YM87NCD1+jOopaLAtlOOBNQP1DayrKqagjc3G6omrFbXMiyIDvyaWLT+YeZX
 9tz8c3SCvM8sWxxg9JOKIozlaMazPnzloBe1TVhTSnqbUz0K7ZOIUum/Mhot49Nz49/vTqnB
 0eE//cDM7CJJvHgLk81ITAhT+Wc1MM7nivZwuQ1LX7bug523uujemdDMyacjBdyKONOD7ok5
 uM6qegq6wCboTg7AOas1yx72TyFES0dbv8BqJofPr7OtiMq7VNzObrnFS785cC0WeVma0UFD
 Gedu/vfuu562EHHTnsUEErN18p7gbAlmkhD7H0GFmSztuv1vN0F9zwPzm1vVSVQ9AtN7MxrM
 GsyN0FVG7SHzw01uOd9BVKTCyNzLzzH3Hfuymk5tnzTFGipcW3vEFcTG8iw+GIhzmYNWQQDo
 Z+5zj7+XCfIbfPB+HI4eXRYpszJSf1z8Qz/m/6bIfmVIqliYRTZr/+vQUEqtyrYBdgAgRybh
 Otyo8d1R67JFQ8RhKwZGYOq76s0TS7YFTZNXMNn3qMFIjzbcmuA3TOPdkODQeJWBvnw6UTjI
 ddfFsFOcBWf1Si1sTEQA5AXEYJ0hPIE4NkjeKvhAGw774uksTtitazP+hjEhGMER8tkleA/I
 Njzcw2uP3Oxh3wOvUPwt+hBZ3SFZOcbaD3G3Oya9PsDE7QBurpOdWAwyr6FgGWHAjB4/h67v
 BLxWIGO9rZMkb9TporLFrlPIy6WKtmpDeSBz12VguR0NNjKNZ/DihMRplzZJD9pBLo2Welst
 LGzodXyjVLkvrE3bjjjoKO/NZJ1vOe8YOkGFfjMDih+vTCDU8rS8Rc86ziGCZhWouh8uOijZ
 SWFMfWVS/BEdetZ9nNvbwpmLy08EIXyN6fpmjO8pa+DCz8byg32E+mk/n7IM0BeWDcDYaP8L
 grGqsee2M1Rg9VJNi8lGsNJPp5cC33gUJsAaNfem2S5DG6po1XaoZrkt0Mqxg/qA0m+MvTRw
 Mz6VDmnUzrqo4DO7tVSk7Iqjy0tFHwn3NUBJBMMyeB5mxWRLTAgL91EFb4kF5sNsCj59K+gV
 QH3dGF4VBnMB2VVQy7dvubmcByUXNEVG9HDITcswUOYRgG2CK6EA5pj7i1Q2Gh3SBSy0NCYL
 cwixVOoMiiT2p1JQcMh1s6/i8pjxdLYwSss0mL5mMrQHR0fIOsr0FpMIQlzbhHEQvr9zBjzG
 WsIRG56GRDxDQa7FMt7YHdaFS0IpD6lnX1icS6Lx82ZoImBivFJzPrkIezoz7kfd4IwKaUTQ
 W/sDX64i4xMNqf/ZYNy0z7xvZJJNA==
IronPort-HdrOrdr: A9a23:V2UiFqBJ1v8dKhblHehOsceALOsnbusQ8zAXPh9KJiC9I/b1qy
 nxppkmPH/P6Qr4WBkb6LS90c67MA/hHP9OkPQs1NKZMjUO11HYSr2KgbGSoQEIXheOjdK1tp
 0QApSWdueAdGSS5PySiGLTc6dC/DDEytHTuQ639QYScegAUdAG0+4WMHf/LqUgLzM2eqbRWa
 Dsrvau4FGbCAEqR/X+IkNAc/nIptXNmp6jSRkaByQ/4A3LqT+z8rb1HzWRwx9bClp0sP0f2F
 mAtza8yrSosvm9xBOZ/2jP765OkN+k7tdYHsSDhuUcNz2poAe1Y4ZKXaGEoVkO0aqSwWdvtO
 OJjwYrPsx15X+UVmapoSH10w2l6zoq42+K8y7uvVLT5ejCAB4qActIgoxUNjHD7VA7gd162K
 VXm0qEqpt+F3r77WvAzumNcysvulu/oHIkn+JWpWdYS5EiZLhYqpFa1F9JEa0HADnx5OkcYa
 VT5fnnlbdrmG6hHjDkVjEF+q3uYp1zJGbKfqE6gL3a79AM90oJjXfxx6Qk7wM9HdwGOtx5Dt
 //Q9ZVfYF1P78rhJ1GdZQ8qLOMexTwqDL3QRSvyAfcZeg60jT22trK3Ik=
From:   =?UTF-8?q?Michael=20Wei=C3=9F?= <michael.weiss@aisec.fraunhofer.de>
To:     Alexander Mikhalitsyn <alexander@mihalicyn.com>,
        Christian Brauner <brauner@kernel.org>,
        Alexei Starovoitov <ast@kernel.org>,
        Paul Moore <paul@paul-moore.com>
CC:     Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        Martin KaFai Lau <martin.lau@linux.dev>,
        Song Liu <song@kernel.org>, Yonghong Song <yhs@fb.com>,
        John Fastabend <john.fastabend@gmail.com>,
        KP Singh <kpsingh@kernel.org>,
        Stanislav Fomichev <sdf@google.com>,
        Hao Luo <haoluo@google.com>, Jiri Olsa <jolsa@kernel.org>,
        Quentin Monnet <quentin@isovalent.com>,
        Alexander Viro <viro@zeniv.linux.org.uk>,
        Miklos Szeredi <miklos@szeredi.hu>,
        Amir Goldstein <amir73il@gmail.com>,
        "Serge E. Hallyn" <serge@hallyn.com>, <bpf@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>, <linux-fsdevel@vger.kernel.org>,
        <gyroidos@aisec.fraunhofer.de>,
        =?UTF-8?q?Michael=20Wei=C3=9F?= <michael.weiss@aisec.fraunhofer.de>
Subject: [RESEND RFC PATCH v2 12/14] bpf: Add flag BPF_DEVCG_ACC_MKNOD_UNS for device access
Date:   Wed, 25 Oct 2023 11:42:22 +0200
Message-Id: <20231025094224.72858-13-michael.weiss@aisec.fraunhofer.de>
In-Reply-To: <20231025094224.72858-1-michael.weiss@aisec.fraunhofer.de>
References: <20231025094224.72858-1-michael.weiss@aisec.fraunhofer.de>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?NFNhVW1XaHNjbkdoZzZxRzVWWkZkcFQrTUJ5Snh2UWRmUHFIdDJaR3gzclFx?=
 =?utf-8?B?eVZoRk14QndFL1Q2K3pnTDkwWkRBeXIrcVFVOGFFOGJDaThieTFTNm9sakpR?=
 =?utf-8?B?QitEb28vQm9ZdlBJWVVhQVUycjdQWURVWjhxZEpvV0l5ZXkybmVnQ3RSOExa?=
 =?utf-8?B?cC9rZmhhTjdFcEgxZDhJek1tbWo1aHdQVzZIUU5Fb1ZIQXlUNlRoZWJCZWdu?=
 =?utf-8?B?bko3bEFwa3R3RGZBK0hWdTRWL3Z6dDNGTDhNeitSQit4bDZpWitFd2wzQ1Fm?=
 =?utf-8?B?WXhnamRiNkVyZ29FQnZzanhyMy9NZVVQMk1FUkFpaU81a0VVU2N4bTNMWDZI?=
 =?utf-8?B?TVBJQ0s2Z0tvM3ZLb0FrdDU5MWc0elMwdkhZQllRcEtnWUJ6TkQ3bzQ1Q01N?=
 =?utf-8?B?WkE0L3N3QlNjWVBsbUNKWXhMWW1aUjlvbmZoV2Y0cGl6alB4Snc1bzRaakY2?=
 =?utf-8?B?UFV1VHNOaEJTSU1oWk8yVHo1SGJyWkJHbTRudTU0TGovYlZndWRnNDA5cmZi?=
 =?utf-8?B?ZnB6N2VGNnMyZ0NUSy9JdFlUN0xBMDBJTHc2ai92QUF0NThKQUJSR3JtNVpD?=
 =?utf-8?B?NTRlVjRRTllSbFl0Ym9KVXJ2bHdtRWphT3ZFbHo3VXdneXhDaDl1b1RIb2Rj?=
 =?utf-8?B?NUZRUStkeFJRNVEzZW4xNWFoYS9YMzV3SldiQnY2dmp6TzN3L3d5RnJIcXc4?=
 =?utf-8?B?eHRyUzV6aEdKYi9oRS9FUDhEeDI2V0h5aTczSW13TmRVSFQ0Y0lKbDcxK3Iy?=
 =?utf-8?B?R0UrQUFCcTFrUlU0TDAwY0t2Nm1uUjdLWU9BV2RJL1NXTWgvZDJldzRKMU1t?=
 =?utf-8?B?VmFxdmF0eFF3RmhmUkZXT0N4YUlEdm1BZTZkNC9xWHdYTHVycGtkQWNmODQr?=
 =?utf-8?B?S1d5WWVVZzJDd3d2UkVEamxMS051d2lqTjExYUpoTWU2VGRKQWJkeGNxOHpJ?=
 =?utf-8?B?UUNyVERqRTV6LzNaWEE3WTVTWTA3Wm00L09WVHpuNkh1MXp0bXo0RDJ0MStv?=
 =?utf-8?B?SGVnMlh6ZHFxNGVPWVJOZURlVDBlNERRaWRUSlhjY3JDckpIZXhLb0hSK20w?=
 =?utf-8?B?dGYrVGg0WHpEc1JYbStxblhuU3I0TFJ3dk1SRVpXMi90V0VURGN2RkVrMlpk?=
 =?utf-8?B?eGU1ZGtWT243SG1HYXJKZXF4QXBBK2tLbW5rUW9HTjBwb0FtMEg5QVBDU1Q0?=
 =?utf-8?B?cHZxai9tLzcrbHFZZDRqTzFlR0Z5SmRzdjRlWnRQcGxueWh3WGg5bjlpWmpL?=
 =?utf-8?B?QjZkeVRCSlZuUWYzWDNxQlJXWDN1ZG5DWVNldkVtOGhDUG1ZVWlKMjZGT1dn?=
 =?utf-8?B?d3lsNFpaZFNIR1poSnAzaWYzVzJFSmo0V1Z0RnVFRnd6MWdCQlpSendkWFov?=
 =?utf-8?B?Uzlua3o2T2JRdVFrQnFDNGJNZlNpZnZHK2c0S0NrcU5KblJhWk5wS2VsTWs3?=
 =?utf-8?B?SktBMDRkanlLRVo1dDN5L2twY1B3R0lXcnh6N1FBMlhyanZzTnovUEtIQXEz?=
 =?utf-8?B?QkJjS05vVHROYS9sakZSRVFPNWZvekxrd1JRRjEvN3h1Rm5admVqU3d3bWdS?=
 =?utf-8?B?VWFmL2RIVU03UU5IVUl2SGZ4RmJiejAwWkVicGZ0RDlYS2lKM25iVHNSY2dI?=
 =?utf-8?B?T3crd0taQVBiWUNzcEtzRExVMFdVM3FvTEM4bVVzRHJmcE1YZWpucU5FVHp4?=
 =?utf-8?B?NzlkakZFRUpoM29mRVVUSGtpNFJ3Wm1CUFlpR0U2d1NvSEU1SSttdWt1MnNB?=
 =?utf-8?B?M3F6dGNydzIzUVh5LzdjbmZrK2ZMV1lGeVY1TllXbXZmK3B1d25VZ1hISjJi?=
 =?utf-8?B?MVZkTklLa3J3Mk4yTCtvTnRnRDMvM0JTbUtOZGtlWWNEajBHV2VmcVFHYVhM?=
 =?utf-8?B?VjJoMkc5VzRIQ3EwRllvcU52SEFnY2NaYzhPT1RReFF4QmlRYlNUWDVXZlBt?=
 =?utf-8?B?V3JXNHduNmI2UDFBVittWTlTYmhDZERUZUVKSWNjZ21EUng3cXAwQnBFWVB4?=
 =?utf-8?B?R2oxUW5seHBibks1a3pYdURlTnhqQ2VPQkJrcXBaSi9YQkViMENJMGYxeFF6?=
 =?utf-8?B?dnRJYXdtdHVmZVo5WnZuSGU2M0JEZEV1TzVvVlVoK0lUaEFkNGsveHl3TC9w?=
 =?utf-8?B?cjA1c2wwYzFNQUg5V1ErNnNQeEc1MlVtVGVLNmJmQmI2NFA5TEt2Y0pUOUhP?=
 =?utf-8?B?R0tHNktjUnl2aGgvZjJ2N2pjQS8xaFBxZTBIa2J2N204YloyVy9uTnRIUFBP?=
 =?utf-8?Q?IMLBl0LacPQ2zYb6LCOzND8Djg8svE7gcJ9rd0OCWg=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 82c39ad8-a557-480b-9859-08dbd53eca1b
X-MS-Exchange-CrossTenant-AuthSource: BEZP281MB2791.DEUP281.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Oct 2023 09:43:05.9749
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f930300c-c97d-4019-be03-add650a171c4
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: ARggjbMX13nOsPVFNakzq2jKHDqc6UAyDb+ZxMo4hf7sRjo026m+qhLCkJj34UbpVUbel2h50n153oT1n3lS8pei00gQNbKaYLBMA8hXZ1uIjJ00Va/ONokFnMitOKZa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BE0P281MB0116
X-OriginatorOrg: aisec.fraunhofer.de
X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,
	SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on morse.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (morse.vger.email [0.0.0.0]); Wed, 25 Oct 2023 02:45:27 -0700 (PDT)

With this new flag for bpf cgroup device programs, it should be
possible to guard mknod() access in non-initial user namespaces
later on.

Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
---
 include/uapi/linux/bpf.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 0448700890f7..0196b9c72d3e 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -6927,6 +6927,7 @@ enum {
 	BPF_DEVCG_ACC_MKNOD	= (1ULL << 0),
 	BPF_DEVCG_ACC_READ	= (1ULL << 1),
 	BPF_DEVCG_ACC_WRITE	= (1ULL << 2),
+	BPF_DEVCG_ACC_MKNOD_UNS	= (1ULL << 3),
 };
 
 enum {
-- 
2.30.2