I'm wodering about the cap check against CAP_SYS_ADMIN. Is it
intentional to provide more security or oversight in commit
2c78ee898d8f ("bpf: Implement CAP_BPF")?
Signed-off-by: Yauheni Kaliuta <ykaliuta@xxxxxxxxxx>
---
include/linux/filter.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index a5f21dc3c432..3de96b1a736b 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1100,7 +1100,7 @@ static inline bool bpf_jit_blinding_enabled(struct bpf_prog *prog)
return false;
if (!bpf_jit_harden)
return false;
- if (bpf_jit_harden == 1 && capable(CAP_SYS_ADMIN))
+ if (bpf_jit_harden == 1 && bpf_capable())
return false;
return true;
--
2.34.1
