Re: [PATCH bpf-next 0/3] Relax checks for unprivileged bpf() commands

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Wed, 24 May 2023 15:54:18 -0700 you wrote:
> During last relaxation of bpf syscall's capabilities checks ([0]), the model
> of FD-based ownership was established: if process through whatever means got
> FD for some BPF object (map, prog, etc), it should be able to perform
> operations on this object without extra CAP_SYS_ADMIN or CAP_BPF capabilities.
> 
> It seems like we missed a few cases, though, in which we are still enforcing extra caps for no good reason, even though operations are not really unsafe and/or do not require any system-wide capabilities:
>   - BPF_MAP_FREEZE command;
>   - GET_NEXT_ID family of commands;
>   - GET_INFO_BY_FD command has extra bpf_capable()-based sanitization.
> 
> [...]

Here is the summary with links:
  - [bpf-next,1/3] bpf: drop unnecessary bpf_capable() check in BPF_MAP_FREEZE command
    https://git.kernel.org/bpf/bpf-next/c/c4c84f6fb2c4
  - [bpf-next,2/3] bpf: don't require CAP_SYS_ADMIN for getting NEXT_ID
    (no matching commit)
  - [bpf-next,3/3] bpf: don't require bpf_capable() for GET_INFO_BY_FD
    (no matching commit)

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html