On Fri, Jun 23, 2023 at 1:54 PM Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx> wrote: > > If we use CAP_SYS_ADMIN all seems to work fine. The issue seems > > related to the fact that during the relocation libbpf is not able > > to find `audit_task_info` in the running kernel BTF, since we are not > > running on COS system, and for this reason, it searches for it in > > modules BTF, but in order to do that we need CAP_SYS_ADMIN[1]. > > Is this the intended behavior? > > Not really, though it is unfortunate that we need CAP_SYS_ADMIN just > to find kernel module's BTF. cc Alexei, maybe we can relax some rules > at least for BTFs? Good point. Since BTF_LOAD is guarded by CAP_BPF there is no need to restrict iteration and get_fd_by_id of BTFs with CAP_SYS_ADMIN. Both can be CAP_BPF. We can consider relaxing btf load, iter, get_fd_by_id to unpriv, but let's start with cap_bpf if it addresses the problem.
