From mboxrd@z Thu Jan 1 00:00:00 1970 From: Chenbo Feng Subject: [PATCH net-next 2/2] bpf: Remove the capability check for cgroup skb eBPF program Date: Wed, 31 May 2017 11:06:53 -0700 Message-ID: <1496254013-18719-2-git-send-email-chenbofeng.kernel@gmail.com> References: <1496254013-18719-1-git-send-email-chenbofeng.kernel@gmail.com> Cc: Lorenzo Colitti , Chenbo Feng To: netdev@vger.kernel.org, David Miller Return-path: Received: from mail-pf0-f196.google.com ([209.85.192.196]:36115 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751080AbdEaSHM (ORCPT ); Wed, 31 May 2017 14:07:12 -0400 Received: by mail-pf0-f196.google.com with SMTP id n23so3375998pfb.3 for ; Wed, 31 May 2017 11:07:12 -0700 (PDT) In-Reply-To: <1496254013-18719-1-git-send-email-chenbofeng.kernel@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: From: Chenbo Feng Currently loading a cgroup skb eBPF program require a CAP_SYS_ADMIN capability while attaching the program to a cgroup only requires the user have CAP_NET_ADMIN privilege. We can escape the capability check when load the program just like socket filter program to make the capability requirement consistent. Signed-off-by: Chenbo Feng --- kernel/bpf/syscall.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 265a0d8..021c0b4 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -815,7 +815,9 @@ static int bpf_prog_load(union bpf_attr *attr) attr->kern_version != LINUX_VERSION_CODE) return -EINVAL; - if (type != BPF_PROG_TYPE_SOCKET_FILTER && !capable(CAP_SYS_ADMIN)) + if (type != BPF_PROG_TYPE_SOCKET_FILTER + && type != BPF_PROG_TYPE_CGROUP_SKB + && !capable(CAP_SYS_ADMIN)) return -EPERM; /* plain bpf_prog allocation */ -- 2.7.4