• Odin Ugedal's avatar
    device_cgroup: Cleanup cgroup eBPF device filter code · eec8fd02
    Odin Ugedal authored
    Original cgroup v2 eBPF code for filtering device access made it
    possible to compile with CONFIG_CGROUP_DEVICE=n and still use the eBPF
    filtering. Change
    commit 4b7d4d45
    
     ("device_cgroup: Export devcgroup_check_permission")
    reverted this, making it required to set it to y.
    
    Since the device filtering (and all the docs) for cgroup v2 is no longer
    a "device controller" like it was in v1, someone might compile their
    kernel with CONFIG_CGROUP_DEVICE=n. Then (for linux 5.5+) the eBPF
    filter will not be invoked, and all processes will be allowed access
    to all devices, no matter what the eBPF filter says.
    Signed-off-by: default avatarOdin Ugedal <odin@ugedal.com>
    Acked-by: default avatarRoman Gushchin <guro@fb.com>
    Signed-off-by: default avatarTejun Heo <tj@kernel.org>
    eec8fd02
Makefile 1.26 KB
# SPDX-License-Identifier: GPL-2.0
#
# Makefile for the kernel security code
#

obj-$(CONFIG_KEYS)			+= keys/
subdir-$(CONFIG_SECURITY_SELINUX)	+= selinux
subdir-$(CONFIG_SECURITY_SMACK)		+= smack
subdir-$(CONFIG_SECURITY_TOMOYO)        += tomoyo
subdir-$(CONFIG_SECURITY_APPARMOR)	+= apparmor
subdir-$(CONFIG_SECURITY_YAMA)		+= yama
subdir-$(CONFIG_SECURITY_LOADPIN)	+= loadpin
subdir-$(CONFIG_SECURITY_SAFESETID)    += safesetid
subdir-$(CONFIG_SECURITY_LOCKDOWN_LSM)	+= lockdown
subdir-$(CONFIG_BPF_LSM)		+= bpf

# always enable default capabilities
obj-y					+= commoncap.o
obj-$(CONFIG_MMU)			+= min_addr.o

# Object file lists
obj-$(CONFIG_SECURITY)			+= security.o
obj-$(CONFIG_SECURITYFS)		+= inode.o
obj-$(CONFIG_SECURITY_SELINUX)		+= selinux/
obj-$(CONFIG_SECURITY_SMACK)		+= smack/
obj-$(CONFIG_SECURITY)			+= lsm_audit.o
obj-$(CONFIG_SECURITY_TOMOYO)		+= tomoyo/
obj-$(CONFIG_SECURITY_APPARMOR)		+= apparmor/
obj-$(CONFIG_SECURITY_YAMA)		+= yama/
obj-$(CONFIG_SECURITY_LOADPIN)		+= loadpin/
obj-$(CONFIG_SECURITY_SAFESETID)       += safesetid/
obj-$(CONFIG_SECURITY_LOCKDOWN_LSM)	+= lockdown/
obj-$(CONFIG_CGROUPS)			+= device_cgroup.o
obj-$(CONFIG_BPF_LSM)			+= bpf/

# Object integrity file lists
subdir-$(CONFIG_INTEGRITY)		+= integrity
obj-$(CONFIG_INTEGRITY)			+= integrity/