> On Aug 28, 2019, at 10:12 PM, Alexei Starovoitov <ast@xxxxxxxxxx> wrote:
>
[...]
> diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
> index 44e2d640b088..91a7f25512ca 100644
> --- a/tools/testing/selftests/bpf/test_verifier.c
> +++ b/tools/testing/selftests/bpf/test_verifier.c
> @@ -805,10 +805,20 @@ static void do_test_fixup(struct bpf_test *test, enum bpf_prog_type prog_type,
> }
> }
>
> +struct libcap {
> + struct __user_cap_header_struct hdr;
> + struct __user_cap_data_struct data[2];
> +};
> +
I am confused by struct libcap. Why do we need it?
> static int set_admin(bool admin)
> {
> cap_t caps;
> - const cap_value_t cap_val = CAP_SYS_ADMIN;
> + /* need CAP_BPF to load progs and CAP_NET_ADMIN to run networking progs,
> + * and CAP_TRACING to create stackmap
> + */
> + const cap_value_t cap_net_admin = CAP_NET_ADMIN;
> + const cap_value_t cap_sys_admin = CAP_SYS_ADMIN;
> + struct libcap *cap;
> int ret = -1;
>
> caps = cap_get_proc();
> @@ -816,11 +826,26 @@ static int set_admin(bool admin)
> perror("cap_get_proc");
> return -1;
> }
> - if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
> + cap = (struct libcap *)caps;
> + if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_sys_admin, CAP_CLEAR)) {
> + perror("cap_set_flag clear admin");
> + goto out;
> + }
> + if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_net_admin,
> admin ? CAP_SET : CAP_CLEAR)) {
> - perror("cap_set_flag");
> + perror("cap_set_flag set_or_clear net");
> goto out;
> }
> + /* libcap is likely old and simply ignores CAP_BPF and CAP_TRACING,
> + * so update effective bits manually
> + */
> + if (admin) {
> + cap->data[1].effective |= 1 << (38 /* CAP_BPF */ - 32);
> + cap->data[1].effective |= 1 << (39 /* CAP_TRACING */ - 32);
> + } else {
> + cap->data[1].effective &= ~(1 << (38 - 32));
> + cap->data[1].effective &= ~(1 << (39 - 32));
> + }
And why we do not need cap->data[0]?
Thanks,
Song
