linux/arch/avr32
Vincent Bernat d59577b6ff sk-filter: Add ability to lock a socket filter program
While a privileged program can open a raw socket, attach some
restrictive filter and drop its privileges (or send the socket to an
unprivileged program through some Unix socket), the filter can still
be removed or modified by the unprivileged program. This commit adds a
socket option to lock the filter (SO_LOCK_FILTER) preventing any
modification of a socket filter program.

This is similar to OpenBSD BIOCLOCK ioctl on bpf sockets, except even
root is not allowed change/drop the filter.

The state of the lock can be read with getsockopt(). No error is
triggered if the state is not changed. -EPERM is returned when a user
tries to remove the lock or to change/remove the filter while the lock
is active. The check is done directly in sk_attach_filter() and
sk_detach_filter() and does not affect only setsockopt() syscall.

Signed-off-by: Vincent Bernat <bernat@luffy.cx>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-01-17 03:21:25 -05:00
..
boards avr32: fix build error in ATSTK1002 code 2012-07-30 17:25:13 -07:00
boot Kbuild: centralize MKIMAGE and cmd_uimage definitions 2012-03-26 15:49:20 +02:00
configs arch: Change defconfigs to point to g_mass_storage. 2012-11-08 16:00:52 +02:00
include sk-filter: Add ability to lock a socket filter program 2013-01-17 03:21:25 -05:00
kernel flagday: don't pass regs to copy_thread() 2012-11-28 23:43:42 -05:00
lib ARCH: drivers remove __dev* attributes. 2013-01-03 15:57:13 -08:00
mach-at32ap atmel: move ATMEL_MAX_UART to platform_data/atmel.h 2012-11-19 17:44:54 +01:00
mm readahead: fault retry breaks mmap file read random detection 2012-10-09 16:22:47 +09:00
oprofile Disintegrate asm/system.h for AVR32 2012-03-28 18:30:01 +01:00
Kconfig Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal 2012-12-20 18:05:28 -08:00
Kconfig.debug [AVR32] Include instrumentation menu 2008-01-25 08:31:40 +01:00
Makefile kbuild: allow assignment to {A,C,LD}FLAGS_MODULE on the command line 2010-08-03 14:09:45 +02:00