From nobody Mon Jun 22 14:24:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 294D5C433F5 for ; Tue, 22 Mar 2022 14:50:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235293AbiCVOwU (ORCPT ); Tue, 22 Mar 2022 10:52:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52660 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235251AbiCVOwP (ORCPT ); Tue, 22 Mar 2022 10:52:15 -0400 Received: from mail-oa1-x43.google.com (mail-oa1-x43.google.com [IPv6:2001:4860:4864:20::43]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 906098594C for ; Tue, 22 Mar 2022 07:50:47 -0700 (PDT) Received: by mail-oa1-x43.google.com with SMTP id 586e51a60fabf-ddfa38f1c1so1918553fac.11 for ; Tue, 22 Mar 2022 07:50:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mdaverde-com.20210112.gappssmtp.com; s=20210112; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=XYYstwn1s64pcwK5LvShx5Ry1kTzUTbuHMZkOFyWOz8=; b=ZjsT4c7xexfSKGND54aezvA9skGMTBZlXA87WTG7NJQRdzZluD+OHzmiuaoXloyRtp hLl9YFuYKFrp64iAHtzj6qtVcUyqAzCWzhCYS0RNjor9O+5RhIX1Ls4m2z9lcMwQXg6t PqzmhwSWnUKXponrH2tpBf+unNy16PA2JZD/8h6MjI3mnQEd68uqXqCv3LFMmIyTpw7c 09ROx7ObSUyR5UgEnUDu42GN3RGjLuAmlW9xyGx9hyv3vAPNW+Tdv1rwaZKhveF89WCC +SXHw1DJUvAE12r7QEo/tQwnqS0Adq2yK6AKnB/oC5R0HGIE6FTq6uNZL5cAZFnAtTBp 8hEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=XYYstwn1s64pcwK5LvShx5Ry1kTzUTbuHMZkOFyWOz8=; b=0WAZ5CFvPPX3dwFw/RBxh6fcYyhB3gRVpFcOB2pBibAkML5ilpssHvgLglpAnq9eBh d8ZEJCUsryG8uXqc1SASrnNjMC3KUP4Wo+Yy5nLYFnBd/i6JfJXF7pTMymhAW3JZT/hi 3BETRvXD0+YQzbKO/KhES6deB9ovEIplnfqLdDryWlTE4PaG2BLz23XbdkiKpoSUoEx8 ZKw3KfU6L49+tYwEG5IrBo9t7QJDjYG3q/f8xBKIpaMFNDRf+60abzvsmcefvfAaSHpU KuvOyvkBFNX0G8CZSbckhTYfYkun84kF27fFYp9qUFq9NqdBxj+bQuBWUcP000Wi8gSp GnMg== X-Gm-Message-State: AOAM531/7Xh+roJL1TGd4XFbUlsaYWoGGe/i9G43io2fHw0Jpl5uD/hu 3gY7orhiGvBJXdz5WkbyzRvqww== X-Google-Smtp-Source: ABdhPJyRj33zOTBSk65QR+/BBFJji9LHPpSAJ+IGbEKBruNYqJT7qSmMhvc8BVN+Rm/R5EY3mIagiA== X-Received: by 2002:a05:6870:b303:b0:d6:f4d1:990d with SMTP id a3-20020a056870b30300b000d6f4d1990dmr1770423oao.53.1647960646595; Tue, 22 Mar 2022 07:50:46 -0700 (PDT) Received: from pop-os.attlocal.net ([2600:1700:1d10:5830:90b:eeed:e704:d511]) by smtp.gmail.com with ESMTPSA id a15-20020a056870000f00b000de1ab6364dsm2223135oaa.49.2022.03.22.07.50.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 22 Mar 2022 07:50:46 -0700 (PDT) From: Milan Landaverde Cc: milan@mdaverde.com, Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , Quentin Monnet , Paul Chaignon , =?UTF-8?q?Niklas=20S=C3=B6derlund?= , netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH bpf-next] bpf/bpftool: add unprivileged_bpf_disabled check against value of 2 Date: Tue, 22 Mar 2022 10:49:45 -0400 Message-Id: <20220322145012.1315376-1-milan@mdaverde.com> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" In [1], we added a kconfig knob that can set /proc/sys/kernel/unprivileged_bpf_disabled to 2 We now check against this value in bpftool feature probe [1] https://lore.kernel.org/bpf/74ec548079189e4e4dffaeb42b8987bb3c852eee.16= 20765074.git.daniel@iogearbox.net Signed-off-by: Milan Landaverde Acked-by: KP Singh Acked-by: Quentin Monnet --- tools/bpf/bpftool/feature.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/bpf/bpftool/feature.c b/tools/bpf/bpftool/feature.c index c2f43a5d38e0..290998c82de1 100644 --- a/tools/bpf/bpftool/feature.c +++ b/tools/bpf/bpftool/feature.c @@ -207,7 +207,10 @@ static void probe_unprivileged_disabled(void) printf("bpf() syscall for unprivileged users is enabled\n"); break; case 1: - printf("bpf() syscall restricted to privileged users\n"); + printf("bpf() syscall restricted to privileged users (without recovery)= \n"); + break; + case 2: + printf("bpf() syscall restricted to privileged users (admin can change)= \n"); break; case -1: printf("Unable to retrieve required privileges for bpf() syscall\n"); --=20 2.32.0