diff options
| author |   Yauheni Kaliuta <ykaliuta@redhat.com> | 2022-09-05 12:01:49 +0300 |
|---|---|---|
| committer |   Daniel Borkmann <daniel@iogearbox.net> | 2022-09-16 22:11:57 +0200 |
| commit | bfeb7e399bacae4ee46ad978f5fce3e47f0978d6 (patch) | |
| tree | 0ee3057e1cda838babe5b1fcbe198c3fa377f3b1 /Documentation/admin-guide | |
| parent | bpf: use kvmemdup_bpfptr helper (diff) | |
| download | linux-dev-bfeb7e399bacae4ee46ad978f5fce3e47f0978d6.tar.xz linux-dev-bfeb7e399bacae4ee46ad978f5fce3e47f0978d6.zip | |
bpf: Use bpf_capable() instead of CAP_SYS_ADMIN for blinding decision
The full CAP_SYS_ADMIN requirement for blinding looks too strict nowadays.
These days given unprivileged BPF is disabled by default, the main users
for constant blinding coming from unprivileged in particular via cBPF -> eBPF
migration (e.g. old-style socket filters).
Signed-off-by: Yauheni Kaliuta <ykaliuta@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20220831090655.156434-1-ykaliuta@redhat.com
Link: https://lore.kernel.org/bpf/20220905090149.61221-1-ykaliuta@redhat.com
Diffstat (limited to 'Documentation/admin-guide')
| -rw-r--r-- | Documentation/admin-guide/sysctl/net.rst | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/Documentation/admin-guide/sysctl/net.rst b/Documentation/admin-guide/sysctl/net.rst index 555681ef6195..6394f5dc2303 100644 --- a/Documentation/admin-guide/sysctl/net.rst +++ b/Documentation/admin-guide/sysctl/net.rst @@ -102,6 +102,9 @@ Values: - 1 - enable JIT hardening for unprivileged users only - 2 - enable JIT hardening for all users +where "privileged user" in this context means a process having +CAP_BPF or CAP_SYS_ADMIN in the root user name space. + bpf_jit_kallsyms ---------------- |