[RFC PATCH bpf-next 0/2] unprivileged BPF_PROG_TEST_RUN

[Edwin Peer <epeer@juniper.net>]

Being able to load, verify and test BPF programs in unprivileged
build environments is desirable. The two phase load and then
test API makes this goal difficult to achieve, since relaxing
permissions for BPF_PROG_TEST_RUN alone would be insufficient.

The approach taken in this proposal defers CAP_SYS_ADMIN checks
until program attach time in order to unencumber BPF_PROG_LOAD.

Edwin Peer (2):
  bpf: defer capability checks until program attach
  bpf: relax CAP_SYS_ADMIN requirement for BPF_PROG_TEST_RUN

 include/linux/filter.h |  3 ++-
 kernel/bpf/syscall.c   | 27 +++++++++++++++++----------
 2 files changed, 19 insertions(+), 11 deletions(-)

-- 
2.24.1