is (SYS_ADMIN || BPF) && NET_ADMIN should this not be SYS_ADMIN || (BPF && NET_ADMIN) ? Won't this cause a just SYS_ADMIN process to fail to load network bpf progs? (I haven't debugged this at all, but John is reporting 5.8-rc1 fails to load bpf progs from Android's bpfloader with EPERM error) Or are we okay with this user space visible behavioural change?
