Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF

2020-05-12 Thread Alexei Starovoitov
On Tue, May 12, 2020 at 10:07:08PM +0200, Daniel Borkmann wrote: > On 5/12/20 8:25 PM, Alexei Starovoitov wrote: > > On Tue, May 12, 2020 at 04:35:41PM +0200, Daniel Borkmann wrote: > > > On 5/8/20 11:53 PM, Alexei Starovoitov wrote: > > > > From: Alexei Starovoitov > > > > > > > > Implement perm

Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF

2020-05-12 Thread Daniel Borkmann
On 5/12/20 8:29 PM, Alexei Starovoitov wrote: On Tue, May 12, 2020 at 05:05:12PM +0200, Daniel Borkmann wrote: - env->allow_ptr_leaks = is_priv; + env->allow_ptr_leaks = perfmon_capable(); + env->bpf_capable = bpf_capable(); Probably more of a detail, but it feels weird to ti

Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF

2020-05-12 Thread Daniel Borkmann
On 5/12/20 8:25 PM, Alexei Starovoitov wrote: On Tue, May 12, 2020 at 04:35:41PM +0200, Daniel Borkmann wrote: On 5/8/20 11:53 PM, Alexei Starovoitov wrote: From: Alexei Starovoitov Implement permissions as stated in uapi/linux/capability.h In order to do that the verifier allow_ptr_leaks fla

Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF

2020-05-12 Thread Alexei Starovoitov
On Tue, May 12, 2020 at 08:54:11AM -0700, s...@google.com wrote: > On 05/11, Alexei Starovoitov wrote: > > On Mon, May 11, 2020 at 05:12:10PM -0700, s...@google.com wrote: > > > On 05/08, Alexei Starovoitov wrote: > > > > From: Alexei Starovoitov > > > [..] > > > > @@ -3932,7 +3977,7 @@ SYSCALL_DE

Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF

2020-05-12 Thread Alexei Starovoitov
On Tue, May 12, 2020 at 05:05:12PM +0200, Daniel Borkmann wrote: > > - env->allow_ptr_leaks = is_priv; > > + env->allow_ptr_leaks = perfmon_capable(); > > + env->bpf_capable = bpf_capable(); > > Probably more of a detail, but it feels weird to tie perfmon_capable() into > the BPF > core and

Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF

2020-05-12 Thread Alexei Starovoitov
On Tue, May 12, 2020 at 04:35:41PM +0200, Daniel Borkmann wrote: > On 5/8/20 11:53 PM, Alexei Starovoitov wrote: > > From: Alexei Starovoitov > > > > Implement permissions as stated in uapi/linux/capability.h > > In order to do that the verifier allow_ptr_leaks flag is split > > into allow_ptr_le

Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF

2020-05-12 Thread Alexei Starovoitov
On Tue, May 12, 2020 at 12:50:05PM +, Jordan Glover wrote: > On Tuesday, May 12, 2020 2:36 AM, Alexei Starovoitov > wrote: > > > On Mon, May 11, 2020 at 05:12:10PM -0700, s...@google.com wrote: > > > > > On 05/08, Alexei Starovoitov wrote: > > > > > > > From: Alexei Starovoitov a...@kernel.o

Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF

2020-05-12 Thread Daniel Borkmann
On 5/8/20 11:53 PM, Alexei Starovoitov wrote: From: Alexei Starovoitov Implement permissions as stated in uapi/linux/capability.h In order to do that the verifier allow_ptr_leaks flag is split into allow_ptr_leaks and bpf_capable flags and they are set as: env->allow_ptr_leaks = perfmon_capa

Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF

2020-05-12 Thread Daniel Borkmann
On 5/8/20 11:53 PM, Alexei Starovoitov wrote: From: Alexei Starovoitov Implement permissions as stated in uapi/linux/capability.h In order to do that the verifier allow_ptr_leaks flag is split into allow_ptr_leaks and bpf_capable flags and they are set as: env->allow_ptr_leaks = perfmon_capa

Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF

2020-05-12 Thread Jordan Glover
On Tuesday, May 12, 2020 2:36 AM, Alexei Starovoitov wrote: > On Mon, May 11, 2020 at 05:12:10PM -0700, s...@google.com wrote: > > > On 05/08, Alexei Starovoitov wrote: > > > > > From: Alexei Starovoitov a...@kernel.org > > > [..] > > > @@ -3932,7 +3977,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union

Re: [PATCH v5 bpf-next 2/3] bpf: implement CAP_BPF

2020-05-11 Thread Alexei Starovoitov
On Mon, May 11, 2020 at 05:12:10PM -0700, s...@google.com wrote: > On 05/08, Alexei Starovoitov wrote: > > From: Alexei Starovoitov > [..] > > @@ -3932,7 +3977,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr > > __user *, uattr, unsigned int, siz > > union bpf_attr attr; > > int err; >