Skip to contentSkip to conversation

bpf: skip unnecessary capability check

PATCH In review Chenbo Feng 3 participants 3 messages Mar 20, 2018

Subsystems (4)
Networking Network drivers BPF BPF core
lore
Share & tools
lore

Chenbo Feng

author
#0 lore raw

PATCH 1/1 bpf: skip unnecessary capability check

From: Chenbo Feng <[email protected]>

The current check statement in BPF syscall will do a capability check for CAP_SYS_ADMIN before checking sysctl_unprivileged_bpf_disabled. This code path will trigger unnecessary security hooks on capability checking and cause false alarms on unprivileged process trying to get CAP_SYS_ADMIN access. This can be resolved by simply switch the order of the statement and CAP_SYS_ADMIN is not required anyway if unprivileged bpf syscall is allowed.

Signed-off-by Chenbo Feng <[email protected]>
---
 kernel/bpf/syscall.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/syscall.c +1 -1
index e24aa3241387..43f95d190eea 100644
@@ -1845,7 +1845,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, siz
 	union bpf_attr attr = {};
 	int err;
 
-	if (!capable(CAP_SYS_ADMIN) && sysctl_unprivileged_bpf_disabled)
+	if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
 	err = check_uarg_tail_zero(uattr, sizeof(attr), size);
Signature · 1 line
2.16.2.804.g6dcf76e118-goog
Acked-by on v1 1/1
#1 lore raw

kernel/bpf/syscall.c SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, siz · line 1849

Quoted 4 lines · Chenbo Feng
kernel/bpf/syscall.c +1 -1
-       if (!capable(CAP_SYS_ADMIN) && sysctl_unprivileged_bpf_disabled)
+       if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN))
                return -EPERM;
Acked-by Lorenzo Colitti <[email protected]>

Should this be targeted to bpf (or even -stable) instead of bpf-next?

maintainer
#2 lore raw
Quoted 10 lines · Lorenzo Colitti

kernel/bpf/syscall.c SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, siz · line 1849

Quoted 4 lines · Chenbo Feng
kernel/bpf/syscall.c +1 -1
-       if (!capable(CAP_SYS_ADMIN) && sysctl_unprivileged_bpf_disabled)
+       if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN))
                return -EPERM;
Acked-by Lorenzo Colitti <[email protected]>

Should this be targeted to bpf (or even -stable) instead of bpf-next?

Ok, I've applied to bpf tree, thanks guys!