v2: Fixed trailing whitespace (reported by checkpatch.pl)
Docs currently suggest that all attached BPF LSM programs always run
and that ret simply carries the previous return code. In reality,
execution stops as soon as one program returns non-zero. This is
because call_int_hook() breaks out of the loop when RC != 0, so later
programs are not executed.
Signed-off-by: arielsilver77@xxxxxxxxx <arielsilver77@xxxxxxxxx>
---
Documentation/bpf/prog_lsm.rst | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/Documentation/bpf/prog_lsm.rst b/Documentation/bpf/prog_lsm.rst
index ad2be02f3..92bfb64c2 100644
--- a/Documentation/bpf/prog_lsm.rst
+++ b/Documentation/bpf/prog_lsm.rst
@@ -66,21 +66,17 @@ example:
SEC("lsm/file_mprotect")
int BPF_PROG(mprotect_audit, struct vm_area_struct *vma,
- unsigned long reqprot, unsigned long prot, int ret)
+ unsigned long reqprot, unsigned long prot)
{
- /* ret is the return value from the previous BPF program
- * or 0 if it's the first hook.
- */
- if (ret != 0)
- return ret;
-
int is_heap;
is_heap = (vma->vm_start >= vma->vm_mm->start_brk &&
vma->vm_end <= vma->vm_mm->brk);
/* Return an -EPERM or write information to the perf events buffer
- * for auditing
+ * for auditing.
+ * Returning a non-zero value will stop the chain of
+ * LSM BPF programs attached to the same hook.
*/
if (is_heap)
return -EPERM;
--
2.50.1
