On Wed, Dec 2, 2020 at 2:39 AM <mariusz.dudek@xxxxxxxxx> wrote:
> int main(int argc, char **argv)
> {
> + struct __user_cap_header_struct hdr = { _LINUX_CAPABILITY_VERSION_3, 0 };
> + struct __user_cap_data_struct data[2] = { { 0 } };
> struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY};
> bool rx = false, tx = false;
> struct xsk_umem_info *umem;
> struct bpf_object *obj;
> + int xsks_map_fd = 0;
> pthread_t pt;
> int i, ret;
> void *bufs;
>
> parse_command_line(argc, argv);
>
> - if (setrlimit(RLIMIT_MEMLOCK, &r)) {
> - fprintf(stderr, "ERROR: setrlimit(RLIMIT_MEMLOCK) \"%s\"\n",
> - strerror(errno));
> - exit(EXIT_FAILURE);
> + if (opt_reduced_cap) {
> + if (capget(&hdr, data) < 0)
> + fprintf(stderr, "Error getting capabilities\n");
> +
> + data->effective &= CAP_TO_MASK(CAP_NET_RAW);
> + data->permitted &= CAP_TO_MASK(CAP_NET_RAW);
> +
> + if (capset(&hdr, data) < 0)
> + fprintf(stderr, "Setting capabilities failed\n");
> +
> + if (capget(&hdr, data) < 0) {
> + fprintf(stderr, "Error getting capabilities\n");
> + } else {
> + fprintf(stderr, "Capabilities EFF %x Caps INH %x Caps Per %x\n",
> + data[0].effective, data[0].inheritable, data[0].permitted);
> + fprintf(stderr, "Capabilities EFF %x Caps INH %x Caps Per %x\n",
> + data[1].effective, data[1].inheritable, data[1].permitted);
> + }
> + } else {
> + if (setrlimit(RLIMIT_MEMLOCK, &r)) {
> + fprintf(stderr, "ERROR: setrlimit(RLIMIT_MEMLOCK) \"%s\"\n",
> + strerror(errno));
> + exit(EXIT_FAILURE);
> + }
Due to this hunk the patch had an unpleasant conflict with Roman's set
and I had to drop this set from bpf-next.
Please rebase and resend.
But it made me look into this change...why did you make rlimit conditional here?
That doesn't look right.
