From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 315CEC433E0 for ; Mon, 22 Jun 2020 20:02:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 06A7D2076A for ; Mon, 22 Jun 2020 20:02:27 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="uDb/6m6q" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728602AbgFVUCZ (ORCPT ); Mon, 22 Jun 2020 16:02:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52484 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728482AbgFVUCP (ORCPT ); Mon, 22 Jun 2020 16:02:15 -0400 Received: from mail-oi1-x241.google.com (mail-oi1-x241.google.com [IPv6:2607:f8b0:4864:20::241]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 28646C061795 for ; Mon, 22 Jun 2020 12:44:55 -0700 (PDT) Received: by mail-oi1-x241.google.com with SMTP id a137so16733780oii.3 for ; Mon, 22 Jun 2020 12:44:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=mg5y3to7GQinVmHOzDaJ7XV7WqxlCDc/TMo6EnpGcTs=; b=uDb/6m6qlj0PFysttennBODak4mm4qQYqd03MDZ1R33VQaWr4CXcIWuW+N7oowKUbF p/oFBS3BbFxCJCG9pp24WhMgvUKl/t9LrlfGnUet39at5E5hYfbcZOnMKzhNiLRgC8Ag NNR69Ib8p3Lw6dkFk+09kWRsu/7gEou0cOaeUPk3Aa5zNv5yEf9gY81qrBpajY2AheMH 5K+RWOWuy+YxqTz+vRkg+PsgBnKgUDGAv/OlMOB0NbI1g7KeB4u4AB51sMu9IxvGHJCX 9980XBEVvVrQMuSsLWfdeyoyHDyXOcY6SZ/YY2OfJ9YzflF7AQ2knlug0YsF8FnLkqm6 4Gsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=mg5y3to7GQinVmHOzDaJ7XV7WqxlCDc/TMo6EnpGcTs=; b=ZTJ/N8tgtdDZxQpuiTCSykSWGIYPmPvt/ow72LNJh+kyux2DMhYW9lpKHad8usNAu7 gJv4rUHueyJP7jxCGbKTwbHcalt2gfORUxSIkDXgeY+YhhwJoCEydTiWGlxRs/NrTDZB aNRGM2XNlKtHT+B72O/Kcr2SOJN9KTywweixD5o0PsFhr8sz2F56E42lhJBXrN64K/eZ AXD/U2yYcrYAbg6gAviHA9kSkQ0U4vjoVe0ex8/1bZSUmAhJOzaWfOa76oX+B1Nq4pGw bsvu28VwRaY3nRBjrh4uUlEAAZ2a5+hrozlWT8qQnZWHipbJgsRPr367dlbFg3AVvpG+ /Y8g== X-Gm-Message-State: AOAM531V4p9/sBozb4nCqpy9eilRXfCI9Y0TmQNQbuaEnhJhIAj9Gf// TniBG0WgDqh6vBaZZEmZafplQPvWbvRde0pXHmwfLg== X-Google-Smtp-Source: ABdhPJy3zt3r18SZTCCHa918AxYLYtT476CxByuaL4koYHT2akdNKZsP1b9JbWI38R6lwVzUcvP4UMhS9YXded0oISI= X-Received: by 2002:aca:5d0b:: with SMTP id r11mr13230543oib.169.1592855094408; Mon, 22 Jun 2020 12:44:54 -0700 (PDT) MIME-Version: 1.0 References: <20200620212616.93894-1-zenczykowski@gmail.com> In-Reply-To: <20200620212616.93894-1-zenczykowski@gmail.com> From: John Stultz Date: Mon, 22 Jun 2020 12:44:44 -0700 Message-ID: Subject: Re: [PATCH bpf v2] restore behaviour of CAP_SYS_ADMIN allowing the loading of networking bpf programs To: =?UTF-8?Q?Maciej_=C5=BBenczykowski?= Cc: =?UTF-8?Q?Maciej_=C5=BBenczykowski?= , Alexei Starovoitov , Daniel Borkmann , Linux Network Development Mailing List , Linux Kernel Mailing List , BPF Mailing List , "David S . Miller" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, Jun 20, 2020 at 2:26 PM Maciej =C5=BBenczykowski wrote: > > From: Maciej =C5=BBenczykowski > > This is a fix for a regression introduced in 5.8-rc1 by: > commit 2c78ee898d8f10ae6fb2fa23a3fbaec96b1b7366 > 'bpf: Implement CAP_BPF' > > Before the above commit it was possible to load network bpf programs > with just the CAP_SYS_ADMIN privilege. > > The Android bpfloader happens to run in such a configuration (it has > SYS_ADMIN but not NET_ADMIN) and creates maps and loads bpf programs > for later use by Android's netd (which has NET_ADMIN but not SYS_ADMIN). > > Cc: Alexei Starovoitov > Cc: Daniel Borkmann > Reported-by: John Stultz > Fixes: 2c78ee898d8f ("bpf: Implement CAP_BPF") > Signed-off-by: Maciej =C5=BBenczykowski Thanks so much for helping narrow this regression down and submitting this = fix! It's much appreciated! Tested-by: John Stultz thanks -john