On 05/09/2022 11:02 PM, Daniel Borkmann wrote:
On 5/9/22 8:57 AM, Tiezhu Yang wrote:
The mode of the following procnames are defined as 0644, 0600, 0600
and 0600 respectively in net_core_table[], normal user can not write
them, so no need to check CAP_SYS_ADMIN in the related proc_handler
function, just remove the checks.
/proc/sys/net/core/bpf_jit_enable
/proc/sys/net/core/bpf_jit_harden
/proc/sys/net/core/bpf_jit_kallsyms
/proc/sys/net/core/bpf_jit_limit
Signed-off-by: Tiezhu Yang <yangtiezhu@xxxxxxxxxxx>
I don't think we can make this assumption - there are various other
(non-BPF)
sysctl handlers in the tree doing similar check to prevent from userns'
based
CAP_SYS_ADMIN.
OK, thank you for your reply, let me drop this patch now,
I will send v2 (patch #1 and #3) later.
Thanks,
Tiezhu
