On Thu, Dec 3, 2020 at 3:50 AM Alexei Starovoitov
<alexei.starovoitov@xxxxxxxxx> wrote:
>
> On Wed, Dec 2, 2020 at 2:39 AM <mariusz.dudek@xxxxxxxxx> wrote:
> > int main(int argc, char **argv)
> > {
> > + struct __user_cap_header_struct hdr = { _LINUX_CAPABILITY_VERSION_3, 0 };
> > + struct __user_cap_data_struct data[2] = { { 0 } };
> > struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY};
> > bool rx = false, tx = false;
> > struct xsk_umem_info *umem;
> > struct bpf_object *obj;
> > + int xsks_map_fd = 0;
> > pthread_t pt;
> > int i, ret;
> > void *bufs;
> >
> > parse_command_line(argc, argv);
> >
> > - if (setrlimit(RLIMIT_MEMLOCK, &r)) {
> > - fprintf(stderr, "ERROR: setrlimit(RLIMIT_MEMLOCK) \"%s\"\n",
> > - strerror(errno));
> > - exit(EXIT_FAILURE);
> > + if (opt_reduced_cap) {
> > + if (capget(&hdr, data) < 0)
> > + fprintf(stderr, "Error getting capabilities\n");
> > +
> > + data->effective &= CAP_TO_MASK(CAP_NET_RAW);
> > + data->permitted &= CAP_TO_MASK(CAP_NET_RAW);
> > +
> > + if (capset(&hdr, data) < 0)
> > + fprintf(stderr, "Setting capabilities failed\n");
> > +
> > + if (capget(&hdr, data) < 0) {
> > + fprintf(stderr, "Error getting capabilities\n");
> > + } else {
> > + fprintf(stderr, "Capabilities EFF %x Caps INH %x Caps Per %x\n",
> > + data[0].effective, data[0].inheritable, data[0].permitted);
> > + fprintf(stderr, "Capabilities EFF %x Caps INH %x Caps Per %x\n",
> > + data[1].effective, data[1].inheritable, data[1].permitted);
> > + }
> > + } else {
> > + if (setrlimit(RLIMIT_MEMLOCK, &r)) {
> > + fprintf(stderr, "ERROR: setrlimit(RLIMIT_MEMLOCK) \"%s\"\n",
> > + strerror(errno));
> > + exit(EXIT_FAILURE);
> > + }
>
> Due to this hunk the patch had an unpleasant conflict with Roman's set
> and I had to drop this set from bpf-next.
> Please rebase and resend.
>
> But it made me look into this change...why did you make rlimit conditional here?
> That doesn't look right.
RLIMIT_MEMLOCK was conditioned before, so I didn't change it. It is
not in my branch "if (opt_reduced_cap)" because RLIMIT_MEMLOCK
requires additional CAP_IPC_LOCK and my main task was to made it
possible to use xsk_socket creation and this example with only
CAP_NET_RAW.
As described in the cover letter "In case your umem is larger or equal
process limit for MEMLOCK you need either increase the limit or
CAP_IPC_LOCK capability."
