bpf_jit_blinding_enabled capabilities

bpf_jit_blinding_enabled capabilities

[Yauheni Kaliuta]

Hi!

I'm wodering about the cap check against CAP_SYS_ADMIN:

static inline bool bpf_jit_blinding_enabled(struct bpf_prog *prog)
{
        /* These are the prerequisites, should someone ever have the
         * idea to call blinding outside of them, we make sure to
         * bail out.
         */
        if (!bpf_jit_is_ebpf())
                return false;
        if (!prog->jit_requested)
                return false;
        if (!bpf_jit_harden)
                return false;
        if (bpf_jit_harden == 1 && capable(CAP_SYS_ADMIN))
                return false;

        return true;
}

Is it intentional to provide more security or oversight in commit
2c78ee898d8f ("bpf: Implement CAP_BPF")
(and should be bpf_capable())?


-- 
WBR,
Yauheni Kaliuta