Vincent Bernat d59577b6ff sk-filter: Add ability to lock a socket filter program ... While a privileged program can open a raw socket, attach some restrictive filter and drop its privileges (or send the socket to an unprivileged program through some Unix socket), the filter can still be removed or modified by the unprivileged program. This commit adds a socket option to lock the filter (SO_LOCK_FILTER) preventing any modification of a socket filter program. This is similar to OpenBSD BIOCLOCK ioctl on bpf sockets, except even root is not allowed change/drop the filter. The state of the lock can be read with getsockopt(). No error is triggered if the state is not changed. -EPERM is returned when a user tries to remove the lock or to change/remove the filter while the lock is active. The check is done directly in sk_attach_filter() and sk_detach_filter() and does not affect only setsockopt() syscall. Signed-off-by: Vincent Bernat <bernat@luffy.cx> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-01-17 03:21:25 -05:00
..
ABI	Merge branch 'akpm' (Andrew's patch-bomb)	2012-12-20 20:00:43 -08:00
DocBook	Documentation: remove __dev* attributes.	2013-01-03 15:57:16 -08:00
EDID	…
PCI	Documentation: remove __dev* attributes.	2013-01-03 15:57:16 -08:00
RCU	…
accounting	doc: Remove unnecessary declarations from Documentation/accounting/getdelays.c	2012-11-26 14:22:21 +01:00
acpi	Documentation: remove __dev* attributes.	2013-01-03 15:57:16 -08:00
aoe	aoe: allow user to disable target failure timeout	2012-12-17 17:15:25 -08:00
arm	fbdev changes for 3.8:	2012-12-15 13:03:48 -08:00
arm64	Documentation: Fixes a word in Documentation/arm64/memory.txt	2012-11-29 16:33:18 +00:00
auxdisplay	…
backlight	drivers/video/backlight/lp855x_bl.c: use generic PWM functions	2012-12-17 17:15:16 -08:00
blackfin	…
block	…
blockdev	…
bus-devices	…
cdrom	…
cgroups	kmem: add slab-specific documentation about the kmem controller	2012-12-18 15:02:15 -08:00
connector	…
console	…
cpu-freq	…
cpuidle	…
cris	…
crypto	…
development-process	…
device-mapper	…
devicetree	ARM: arm-soc fixes for 3.8-rc	2013-01-08 18:53:56 -08:00
driver-model	…
dvb	…
early-userspace	…
extcon	…
fault-injection	…
fb	…
filesystems	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2012-12-20 18:14:31 -08:00
firmware_class	…
frv	…
hid	…
hwmon	hwmon: (it87) Report thermal sensor type as Intel PECI if appropriate	2012-12-19 22:17:02 +01:00
i2c	Documentation: remove __dev* attributes.	2013-01-03 15:57:16 -08:00
i2o	…
ia64	…
ide	…
infiniband	…
input	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid	2012-12-13 12:00:48 -08:00
ioctl	…
isdn	…
ja_JP	…
kbuild	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2012-12-13 12:00:02 -08:00
kdump	…
ko_KR	…
laptops	…
leds	…
m68k	…
make	…
memory-devices	…
mips	…
misc-devices	…
mmc	mmc: core: Extend sysfs to ext_csd parameters for RPMB support	2012-12-06 13:54:48 -05:00
mn10300	…
mtd	…
namespaces	…
netlabel	…
networking	sk-filter: Add ability to lock a socket filter program	2013-01-17 03:21:25 -05:00
nfc	…
parisc	…
pcmcia	…
power	PM: Move disabling/enabling runtime PM to late suspend/early resume	2013-01-06 00:35:55 +01:00
powerpc	…
pps	…
prctl	…
pti	…
ptp	…
rapidio	…
s390	…
scheduler	…
scsi	[SCSI] hptiop: Support HighPoint RR4520/RR4522 HBA	2012-11-27 08:59:43 +04:00
security	Documentation: fix Documentation/security/00-INDEX	2012-12-17 17:15:22 -08:00
serial	…
sh	…
sound	…
spi	Documentation: remove __dev* attributes.	2013-01-03 15:57:16 -08:00
sysctl	Documentation/sysctl/kernel.txt: document /proc/sys/shmall	2013-01-04 16:11:46 -08:00
target	…
thermal	…
timers	…
trace	…
usb	…
vDSO	…
video4linux	Documentation: remove __dev* attributes.	2013-01-03 15:57:16 -08:00
virtual	KVM: PPC: booke: Get/set guest EPCR register using ONE_REG interface	2012-12-06 01:34:20 +01:00
vm	Merge branch 'akpm' (Andrew's patch-bomb)	2012-12-13 13:11:15 -08:00
w1	…
watchdog	…
wimax	…
x86	Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2012-12-19 12:56:42 -08:00
xtensa	xtensa: initialize atomctl SR	2012-12-18 21:10:22 -08:00
zh_CN	Documentation: remove __dev* attributes.	2013-01-03 15:57:16 -08:00
.gitignore	…
00-INDEX	Documentation: remove reference to feature-removal-schedule.txt	2012-12-17 17:15:12 -08:00
BUG-HUNTING	…
Changes	…
CodingStyle	…
DMA-API-HOWTO.txt	…
DMA-API.txt	…
DMA-ISA-LPC.txt	…
DMA-attributes.txt	common: DMA-mapping: add DMA_ATTR_FORCE_CONTIGUOUS attribute	2012-11-29 03:30:34 -08:00
HOWTO	HOWTO: fix double words typo	2012-12-10 15:54:27 +01:00
IPMI.txt	…
IRQ-affinity.txt	…
IRQ-domain.txt	irqdomain: update documentation	2012-12-05 23:52:10 +00:00
IRQ.txt	…
Intel-IOMMU.txt	…
Makefile	…
ManagementStyle	…
SAK.txt	…
SM501.txt	…
SecurityBugs	…
SubmitChecklist	…
SubmittingDrivers	…
SubmittingPatches	…
VGA-softcursor.txt	…
applying-patches.txt	…
atomic_ops.txt	…
bad_memory.txt	…
basic_profiling.txt	…
binfmt_misc.txt	…
braille-console.txt	…
bt8xxgpio.txt	…
btmrvl.txt	…
bus-virt-phys-mapping.txt	…
cachetlb.txt	…
circular-buffers.txt	…
clk.txt	…
coccinelle.txt	…
cpu-hotplug.txt	…
cpu-load.txt	…
cputopology.txt	…
crc32.txt	…
dcdbas.txt	…
debugging-modules.txt	…
debugging-via-ohci1394.txt	…
dell_rbu.txt	…
devices.txt	firmware: remove last vestiges of dabusb	2012-11-21 13:03:01 -08:00
digsig.txt	…
dma-buf-sharing.txt	…
dmaengine.txt	…
dontdiff	…
dynamic-debug-howto.txt	…
edac.txt	…
eisa.txt	…
email-clients.txt	…
flexible-arrays.txt	…
futex-requeue-pi.txt	…
gcov.txt	…
gpio.txt	…
highuid.txt	…
hw_random.txt	…
hwspinlock.txt	…
init.txt	…
initrd.txt	…
intel_txt.txt	…
io-mapping.txt	…
io_ordering.txt	…
iostats.txt	…
irqflags-tracing.txt	…
isapnp.txt	…
java.txt	…
kernel-doc-nano-HOWTO.txt	Kernel-doc: Convention: Use a "Return" section to describe return values	2012-11-27 21:08:57 +01:00
kernel-docs.txt	…
kernel-parameters.txt	Documentation: kernel-parameters.txt remove capability.disable	2012-12-20 17:40:19 -08:00
kmemcheck.txt	…
kmemleak.txt	…
kobject.txt	…
kprobes.txt	…
kref.txt	kref: Add kref_get_unless_zero documentation	2012-11-28 18:36:06 +10:00
ldm.txt	…
local_ops.txt	…
lockdep-design.txt	…
lockstat.txt	…
lockup-watchdogs.txt	…
logo.gif	…
logo.txt	…
magic-number.txt	…
md.txt	…
media-framework.txt	…
memory-barriers.txt	…
memory-hotplug.txt	hotplug: update nodemasks management	2012-12-12 17:38:33 -08:00
mono.txt	…
mutex-design.txt	…
nommu-mmap.txt	…
numastat.txt	…
oops-tracing.txt	…
padata.txt	…
parport-lowlevel.txt	…
parport.txt	…
percpu-rw-semaphore.txt	…
pi-futex.txt	…
pinctrl.txt	…
pnp.txt	…
preempt-locking.txt	…
printk-formats.txt	…
pwm.txt	…
ramoops.txt	…
rbtree.txt	…
remoteproc.txt	…
rfkill.txt	…
robust-futex-ABI.txt	…
robust-futexes.txt	…
rpmsg.txt	Documentation: remove __dev* attributes.	2013-01-03 15:57:16 -08:00
rt-mutex-design.txt	…
rt-mutex.txt	…
rtc.txt	…
serial-console.txt	…
sgi-ioc4.txt	…
sgi-visws.txt	…
smsc_ece1099.txt	…
sparse.txt	Documentation/sparse.txt: document context annotations for lock checking	2012-12-17 17:15:23 -08:00
spinlocks.txt	…
stable_api_nonsense.txt	…
stable_kernel_rules.txt	…
static-keys.txt	…
svga.txt	…
sysfs-rules.txt	…
sysrq.txt	…
unaligned-memory-access.txt	…
unicode.txt	…
unshare.txt	…
vfio.txt	…
vgaarbiter.txt	…
video-output.txt	…
vme_api.txt	…
volatile-considered-harmful.txt	…
workqueue.txt	…
xz.txt	…
zorro.txt	…