bpf: Use bpf_capable() instead of CAP_SYS_ADMIN for blinding decision

The full CAP_SYS_ADMIN requirement for blinding looks too strict nowadays.
These days given unprivileged BPF is disabled by default, the main users
for constant blinding coming from unprivileged in particular via cBPF -> eBPF
migration (e.g. old-style socket filters).

Signed-off-by: Yauheni Kaliuta <ykaliuta@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20220831090655.156434-1-ykaliuta@redhat.com
Link: https://lore.kernel.org/bpf/20220905090149.61221-1-ykaliuta@redhat.com

diff --git a/Documentation/admin-guide/sysctl/net.rst b/Documentation/admin-guide/sysctl/net.rst
index 555681ef6195c406f698d9539305168dcc8e7174..6394f5dc2303d4dc0fdb42acafdfce50fc01cef1 100644 (file)
--- a/Documentation/admin-guide/sysctl/net.rst
+++ b/Documentation/admin-guide/sysctl/net.rst
@@ -102,6 +102,9 @@ Values:
        - 1 - enable JIT hardening for unprivileged users only
        - 2 - enable JIT hardening for all users
 
+where "privileged user" in this context means a process having
+CAP_BPF or CAP_SYS_ADMIN in the root user name space.
+
 bpf_jit_kallsyms
 ----------------
 

diff --git a/include/linux/filter.h b/include/linux/filter.h
index 527ae1d64e27e566fef779cde62f4d06475f7ec0..75335432fcbcae5614c7bff59baa33be0e357b80 100644 (file)
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1099,7 +1099,7 @@ static inline bool bpf_jit_blinding_enabled(struct bpf_prog *prog)
                return false;
        if (!bpf_jit_harden)
                return false;
-       if (bpf_jit_harden == 1 && capable(CAP_SYS_ADMIN))
+       if (bpf_jit_harden == 1 && bpf_capable())
                return false;
 
        return true;