| Message ID | 20220905090149.61221-1-ykaliuta@redhat.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | bfeb7e399bacae4ee46ad978f5fce3e47f0978d6 |
| Delegated to: | BPF |
| Headers | show |
| Series | [bpf-next] bpf: use bpf_capable() instead of CAP_SYS_ADMIN for blinding decision | expand |
Hello: This patch was applied to bpf/bpf-next.git (master) by Daniel Borkmann <daniel@iogearbox.net>: On Mon, 5 Sep 2022 12:01:49 +0300 you wrote: > The full CAP_SYS_ADMIN requirement for blining looks too strict > nowadays. These days given unpriv eBPF is disabled by default, the > main users for constant blinding coming from unpriv in particular > via cBPF -> eBPF migration (e.g. old-style socket filters). > > Discussion: https://lore.kernel.org/bpf/20220831090655.156434-1-ykaliuta@redhat.com/ > > [...] Here is the summary with links: - [bpf-next] bpf: use bpf_capable() instead of CAP_SYS_ADMIN for blinding decision https://git.kernel.org/bpf/bpf-next/c/bfeb7e399bac You are awesome, thank you!
diff --git a/Documentation/admin-guide/sysctl/net.rst b/Documentation/admin-guide/sysctl/net.rst index 805f2281e000..ff1e5b5acd28 100644 --- a/Documentation/admin-guide/sysctl/net.rst +++ b/Documentation/admin-guide/sysctl/net.rst @@ -101,6 +101,9 @@ Values: - 1 - enable JIT hardening for unprivileged users only - 2 - enable JIT hardening for all users +where "privileged user" in this context means a process having +CAP_BPF or CAP_SYS_ADMIN in the root user name space. + bpf_jit_kallsyms ---------------- diff --git a/include/linux/filter.h b/include/linux/filter.h index 527ae1d64e27..75335432fcbc 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -1099,7 +1099,7 @@ static inline bool bpf_jit_blinding_enabled(struct bpf_prog *prog) return false; if (!bpf_jit_harden) return false; - if (bpf_jit_harden == 1 && capable(CAP_SYS_ADMIN)) + if (bpf_jit_harden == 1 && bpf_capable()) return false; return true;
The full CAP_SYS_ADMIN requirement for blining looks too strict nowadays. These days given unpriv eBPF is disabled by default, the main users for constant blinding coming from unpriv in particular via cBPF -> eBPF migration (e.g. old-style socket filters). Discussion: https://lore.kernel.org/bpf/20220831090655.156434-1-ykaliuta@redhat.com/ Signed-off-by: Yauheni Kaliuta <ykaliuta@redhat.com> --- Documentation/admin-guide/sysctl/net.rst | 3 +++ include/linux/filter.h | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-)