Re: [PATCH v2 bpf-next 2/3] bpf: implement CAP_BPF
From: Alexei Starovoitov <hidden>
Date: 2019-09-05 22:00:45
Also in:
bpf, linux-api
On Thu, Sep 05, 2019 at 10:37:03AM +0200, Daniel Borkmann wrote:
On 9/4/19 5:21 PM, Alexei Starovoitov wrote:quoted
On 9/4/19 8:16 AM, Daniel Borkmann wrote:quoted
opening/creating BPF maps" error="Unable to create map /run/cilium/bpffs/tc/globals/cilium_lxc: operation not permitted" subsys=daemon 2019-09-04T14:11:47.28178666Z level=fatal msg="Error while creating daemon" error="Unable to create map /run/cilium/bpffs/tc/globals/cilium_lxc: operation not permitted" subsys=daemonOk. We have to include caps in both cap_sys_admin and cap_bpf then.quoted
And /same/ deployment with reverted patches, hence no CAP_BPF gets it up and running again: # kubectl get pods --all-namespaces -o wideCan you share what this magic commands do underneath?What do you mean by magic commands? Latter is showing all pods in the cluster: https://kubernetes.io/docs/reference/kubectl/cheatsheet/#viewing-finding-resources
"magic" in a sense that I have no idea how k8s "services" and "pods" map to kernel namespaces.
Checking moby go code, it seems to exec with GetAllCapabilities which returns all of the capabilities it is aware of, and afaics, they seem to be using the below go library to get the hard-coded list from where obviously CAP_BPF is unknown which might also explain the breakage I've been seeing: https://github.com/syndtr/gocapability/blob/33e07d32887e1e06b7c025f27ce52f62c7990bc0/capability/enum_gen.go
thanks for the link. That library is much better written than libcap. capability_linux.go is reading cap_last_cap dynamically and it can understand proposed CAP_BPF, CAP_TRACING without need o be recompiled (unlike libcap). So passing new caps to k8s should be trivial. The library won't know their names, but passing by number looks to be already supported. I'm still not sure which part of k8s setup clears the caps and why this v2 set doesn't work, but that doesn't matter any more. I believe I addressed this compat issue in v3 set. Could you please give a try just repeating your previous commands?