Docs currently suggest that all attached BPF LSM programs always run and that ret simply carries the previous return code. In reality, execution stops as soon as one program returns non-zero. This is because call_int_hook() breaks out of the loop when RC != 0, so later programs are not executed. Signed-off-by: arielsilver77@gmail.com --- Documentation/bpf/prog_lsm.rst | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/Documentation/bpf/prog_lsm.rst b/Documentation/bpf/prog_lsm.rst index ad2be02f3..92bfb64c2 100644 --- a/Documentation/bpf/prog_lsm.rst +++ b/Documentation/bpf/prog_lsm.rst @@ -66,21 +66,17 @@ example: SEC("lsm/file_mprotect") int BPF_PROG(mprotect_audit, struct vm_area_struct *vma, - unsigned long reqprot, unsigned long prot, int ret) + unsigned long reqprot, unsigned long prot) { - /* ret is the return value from the previous BPF program - * or 0 if it's the first hook. - */ - if (ret != 0) - return ret; - int is_heap; is_heap = (vma->vm_start >= vma->vm_mm->start_brk && vma->vm_end <= vma->vm_mm->brk); /* Return an -EPERM or write information to the perf events buffer - * for auditing + * for auditing. + * Returning a non-zero value will stop the chain of + * LSM BPF programs attached to the same hook. */ if (is_heap) return -EPERM; -- 2.50.1