Hi Vincent, On Mon, 15 Aug 2022 at 18:46, Vincent Li <vincent.mc.li@xxxxxxxxx> wrote: > > Hi, > > I compile and run kernel 5.18.0 in Centos 8 from bpf-next in my dev > machine, I also compiled bpftool from bpf-next on same machine, when > run bpftool on same machine, I got : > > ./bpftool feature probe > > Error: bug: failed to retrieve CAP_BPF status: Invalid argument > > where bpftool to retrieve CAP_BPF ? from running kernel or from somewhere else? Yes, bpftool calls cap_get_proc() to get the capabilities of the current process. From what I understand of your output, it looks like capget() returns CAP_BPF: I believe the "0x1c0" value at the end is (1<<(CAP_CHECKPOINT_RESTORE-32)) + (1<<(CAP_BPF-32)) + (1<<(CAP_PERFMON-32)). You could probably check this with a more recent version of strace. Then assuming you do retrieve CAP_BPF from capget(), I don't know why cap_get_flag() in bpftool fails to retrieve the capability state. It would be worth running bpftool in GDB to check what happens. The check in libcap is here [0] but I don't see where we would fail to provide valid arguments. Just in case, could you please let me know what version of libcap you're using when compiling bpftool? Thanks, Quentin [0] https://git.kernel.org/pub/scm/libs/libcap/libcap.git/tree/libcap/cap_flag.c?h=libcap-2.65#n12
