2020-04-29 16:35 UTC+0200 ~ Daniel Borkmann <daniel@xxxxxxxxxxxxx> > On 4/29/20 3:05 PM, Quentin Monnet wrote: >> There is demand for a way to identify what BPF helper functions are >> available to unprivileged users. To do so, allow unprivileged users to >> run "bpftool feature probe" to list BPF-related features. This will only >> show features accessible to those users, and may not reflect the full >> list of features available (to administrators) on the system. >> >> To avoid the case where bpftool is inadvertently run as non-root and >> would list only a subset of the features supported by the system when it >> would be expected to list all of them, running as unprivileged is gated >> behind the "unprivileged" keyword passed to the command line. When used >> by a privileged user, this keyword allows to drop the CAP_SYS_ADMIN and >> to list the features available to unprivileged users. Note that this >> addsd a dependency on libpcap for compiling bpftool. >> >> Note that there is no particular reason why the probes were restricted >> to root, other than the fact I did not need them for unprivileged and >> did not bother with the additional checks at the time probes were added. >> >> Signed-off-by: Quentin Monnet <quentin@xxxxxxxxxxxxx> >> --- >> .../bpftool/Documentation/bpftool-feature.rst | 10 +- >> tools/bpf/bpftool/Makefile | 2 +- >> tools/bpf/bpftool/bash-completion/bpftool | 2 +- >> tools/bpf/bpftool/feature.c | 100 +++++++++++++++--- >> 4 files changed, 99 insertions(+), 15 deletions(-) >> >> diff --git a/tools/bpf/bpftool/Documentation/bpftool-feature.rst >> b/tools/bpf/bpftool/Documentation/bpftool-feature.rst >> index b04156cfd7a3..ca085944e4cf 100644 >> --- a/tools/bpf/bpftool/Documentation/bpftool-feature.rst >> +++ b/tools/bpf/bpftool/Documentation/bpftool-feature.rst >> @@ -19,7 +19,7 @@ SYNOPSIS >> FEATURE COMMANDS >> ================ >> -| **bpftool** **feature probe** [*COMPONENT*] [**full**] >> [**macros** [**prefix** *PREFIX*]] >> +| **bpftool** **feature probe** [*COMPONENT*] [**full**] >> [**unprivileged**] [**macros** [**prefix** *PREFIX*]] >> | **bpftool** **feature help** > > Looks good to me, thanks! There is one small thing missing which is > updating > do_help() to display the same as above from bpftool help, but rest lgtm. Eh, I'm usually the one pointing that -_-. Thank you Daniel, v3 incoming.
