On Thu, Apr 20, 2023 at 05:00:55PM -0700, Andrii Nakryiko wrote: > Alright. I now do have an alternative approach in mind that will only > use restrictive LSMs and will still allow BPF usage within user > namespaces. It seems the problem with in the existing kernel is that bpf_capable() is rather inflexible. In only one place is sysctl_unprivileged_bpf_disabled checked (outside the unprivileged_ebpf_enabled() checks in CPU errata fixes). Should CAP_BPF be per-namespace? -- Kees Cook
