Re: [PATCH v5 bpf-next 0/3] Introduce CAP_BPF

2020-05-08 Thread Alexei Starovoitov
On Fri, May 08, 2020 at 03:45:36PM -0700, Casey Schaufler wrote: > On 5/8/2020 2:53 PM, Alexei Starovoitov wrote: > > From: Alexei Starovoitov > > > > v4->v5: > > > > Split BPF operations that are allowed under CAP_SYS_ADMIN into combination > > of > > CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN and keep

Re: [PATCH v5 bpf-next 0/3] Introduce CAP_BPF

2020-05-08 Thread Casey Schaufler
On 5/8/2020 2:53 PM, Alexei Starovoitov wrote: > From: Alexei Starovoitov > > v4->v5: > > Split BPF operations that are allowed under CAP_SYS_ADMIN into combination of > CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN and keep some of them under CAP_SYS_ADMIN. > > The user process has to have > - CAP_BPF and

[PATCH v5 bpf-next 0/3] Introduce CAP_BPF

2020-05-08 Thread Alexei Starovoitov
From: Alexei Starovoitov v4->v5: Split BPF operations that are allowed under CAP_SYS_ADMIN into combination of CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN and keep some of them under CAP_SYS_ADMIN. The user process has to have - CAP_BPF and CAP_PERFMON to load tracing programs. - CAP_BPF and CAP_NET_AD