From 0d559c9e9f1bbfac52fda4b504b56ef6ab2b2ee3 Mon Sep 17 00:00:00 2001 From: Chenbo Feng Date: Fri, 2 Jun 2017 17:24:31 -0700 Subject: FROMLIST: [net-next,v2,2/2] bpf: Remove the capability check for cgroup skb eBPF program Currently loading a cgroup skb eBPF program require a CAP_SYS_ADMIN capability while attaching the program to a cgroup only requires the user have CAP_NET_ADMIN privilege. We can escape the capability check when load the program just like socket filter program to make the capability requirement consistent. Change since v1: Change the code style in order to be compliant with checkpatch.pl preference (url: http://patchwork.ozlabs.org/patch/769460/) Signed-off-by: Chenbo Feng Bug: 30950746 Change-Id: Ibe51235127d6f9349b8f563ad31effc061b278ed Signed-off-by: Chatur27 --- kernel/bpf/syscall.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'kernel') diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index b5dcd59c97ef..1cf7a34a4858 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -747,7 +747,9 @@ static int bpf_prog_load(union bpf_attr *attr) attr->kern_version != LINUX_VERSION_CODE) return -EINVAL; - if (type != BPF_PROG_TYPE_SOCKET_FILTER && !capable(CAP_SYS_ADMIN)) + if (type != BPF_PROG_TYPE_SOCKET_FILTER && + type != BPF_PROG_TYPE_CGROUP_SKB && + !capable(CAP_SYS_ADMIN)) return -EPERM; /* plain bpf_prog allocation */ -- cgit v1.2.3