Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF
From: <hidden>
Date: 2020-05-12 00:12:17
Also in:
bpf, linux-security-module
On 05/08, Alexei Starovoitov wrote:
From: Alexei Starovoitov <ast@kernel.org>
[..]
quoted hunk ↗ jump to hunk
@@ -3932,7 +3977,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr__user *, uattr, unsigned int, siz union bpf_attr attr; int err;
- if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN)) + if (sysctl_unprivileged_bpf_disabled && !bpf_capable()) return -EPERM;
This is awesome, thanks for reviving the effort!
One question I have about this particular snippet:
Does it make sense to drop bpf_capable checks for the operations
that work on a provided fd?
The use-case I have in mind is as follows:
* privileged (CAP_BPF) process loads the programs/maps and pins
them at some known location
* unprivileged process opens up those pins and does the following:
* prepares the maps (and will later on read them)
* does SO_ATTACH_BPF/SO_ATTACH_REUSEPORT_EBPF which afaik don't
require any capabilities
This essentially pushes some of the permission checks into a fs layer. So
whoever has a file descriptor (via unix sock or open) can do BPF operations
on the object that represents it.
Thoughts? Am I missing something important?