Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 70ad009577f8..a6893746cd87 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c

@@ -1293,7 +1293,7 @@ static void __mark_reg_unknown(const struct bpf_verifier_env *env,
  	reg->type = SCALAR_VALUE;
  	reg->var_off = tnum_unknown;
  	reg->frameno = 0;
-	reg->precise = env->subprog_cnt > 1 || !env->allow_ptr_leaks;
+	reg->precise = env->subprog_cnt > 1 || !env->bpf_capable;
  	__mark_reg_unbounded(reg);
  }
  

@@ -1425,8 +1425,9 @@ static int check_subprogs(struct bpf_verifier_env *env)
  			continue;
  		if (insn[i].src_reg != BPF_PSEUDO_CALL)
  			continue;
-		if (!env->allow_ptr_leaks) {
-			verbose(env, "function calls to other bpf functions are allowed for root only\n");
+		if (!env->bpf_capable) {
+			verbose(env,
+				"function calls to other bpf functions are allowed for CAP_BPF and CAP_SYS_ADMIN\n");
  			return -EPERM;
  		}
  		ret = add_subprog(env, i + insn[i].imm + 1);

@@ -1960,7 +1961,7 @@ static int __mark_chain_precision(struct bpf_verifier_env *env, int regno,
  	bool new_marks = false;
  	int i, err;
  
-	if (!env->allow_ptr_leaks)
+	if (!env->bpf_capable)
  		/* backtracking is root only for now */
  		return 0;
  

@@ -2208,7 +2209,7 @@ static int check_stack_write(struct bpf_verifier_env *env,
  		reg = &cur->regs[value_regno];
  
  	if (reg && size == BPF_REG_SIZE && register_is_const(reg) &&
-	    !register_is_null(reg) && env->allow_ptr_leaks) {
+	    !register_is_null(reg) && env->bpf_capable) {
  		if (dst_reg != BPF_REG_FP) {
  			/* The backtracking logic can only recognize explicit
  			 * stack slot address like [fp - 8]. Other spill of

@@ -3428,7 +3429,7 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno,
  		 * Spectre masking for stack ALU.
  		 * See also retrieve_ptr_limit().
  		 */
-		if (!env->allow_ptr_leaks) {
+		if (!env->bpf_capable) {
  			char tn_buf[48];
  
  			tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);

@@ -7229,7 +7230,7 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env,
  		insn_stack[env->cfg.cur_stack++] = w;
  		return 1;
  	} else if ((insn_state[w] & 0xF0) == DISCOVERED) {
-		if (loop_ok && env->allow_ptr_leaks)
+		if (loop_ok && env->bpf_capable)
  			return 0;
  		verbose_linfo(env, t, "%d: ", t);
  		verbose_linfo(env, w, "%d: ", w);

@@ -8338,7 +8339,7 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
  	if (env->max_states_per_insn < states_cnt)
  		env->max_states_per_insn = states_cnt;
  
-	if (!env->allow_ptr_leaks && states_cnt > BPF_COMPLEXITY_LIMIT_STATES)
+	if (!env->bpf_capable && states_cnt > BPF_COMPLEXITY_LIMIT_STATES)
  		return push_jmp_history(env, cur);
  
  	if (!add_new_state)

@@ -9998,7 +9999,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
  			insn->code = BPF_JMP | BPF_TAIL_CALL;
  
  			aux = &env->insn_aux_data[i + delta];
-			if (env->allow_ptr_leaks && !expect_blinding &&
+			if (env->bpf_capable && !expect_blinding &&
  			    prog->jit_requested &&
  			    !bpf_map_key_poisoned(aux) &&
  			    !bpf_map_ptr_poisoned(aux) &&

@@ -10725,7 +10726,7 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr,
  		env->insn_aux_data[i].orig_idx = i;
  	env->prog = *prog;
  	env->ops = bpf_verifier_ops[env->prog->type];
-	is_priv = capable(CAP_SYS_ADMIN);
+	is_priv = bpf_capable();
  
  	if (!btf_vmlinux && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) {
  		mutex_lock(&bpf_verifier_lock);

@@ -10766,7 +10767,8 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr,
  	if (attr->prog_flags & BPF_F_ANY_ALIGNMENT)
  		env->strict_alignment = false;
  
-	env->allow_ptr_leaks = is_priv;
+	env->allow_ptr_leaks = perfmon_capable();
+	env->bpf_capable = bpf_capable();