Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF
From: Daniel Borkmann <daniel@iogearbox.net>
Date: 2020-05-12 20:27:37
Also in:
bpf, linux-security-module
On 5/8/20 11:53 PM, Alexei Starovoitov wrote: [...]
quoted hunk ↗ jump to hunk
@@ -2880,8 +2933,6 @@ static int bpf_prog_test_run(const union bpf_attr *attr, struct bpf_prog *prog; int ret = -ENOTSUPP; - if (!capable(CAP_SYS_ADMIN)) - return -EPERM;
Should above be under bpf_capable() as well or is the intention to really let (fully) unpriv users run sk_filter test progs here? I would assume only progs that have prior been loaded under bpf_capable() should suffice, so no need to lower the bar for now, no?
quoted hunk ↗ jump to hunk
if (CHECK_ATTR(BPF_PROG_TEST_RUN)) return -EINVAL;@@ -3163,7 +3214,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog, info.run_time_ns = stats.nsecs; info.run_cnt = stats.cnt; - if (!capable(CAP_SYS_ADMIN)) { + if (!bpf_capable()) {
Given the JIT dump this also exposes addresses when bpf_dump_raw_ok() passes. I presume okay, but should probably be documented given CAP_SYS_ADMIN isn't required anymore?
quoted hunk ↗ jump to hunk
info.jited_prog_len = 0; info.xlated_prog_len = 0; info.nr_jited_ksyms = 0;@@ -3522,7 +3573,7 @@ static int bpf_btf_load(const union bpf_attr *attr) if (CHECK_ATTR(BPF_BTF_LOAD)) return -EINVAL; - if (!capable(CAP_SYS_ADMIN)) + if (!bpf_capable()) return -EPERM; return btf_new_fd(attr);@@ -3736,9 +3787,6 @@ static int link_create(union bpf_attr *attr) struct bpf_prog *prog; int ret; - if (!capable(CAP_NET_ADMIN)) - return -EPERM; - if (CHECK_ATTR(BPF_LINK_CREATE)) return -EINVAL;@@ -3784,9 +3832,6 @@ static int link_update(union bpf_attr *attr) u32 flags; int ret; - if (!capable(CAP_NET_ADMIN)) - return -EPERM; - if (CHECK_ATTR(BPF_LINK_UPDATE)) return -EINVAL;