bpf: BPF token support for BPF_BTF_GET_FD_BY_ID

Currently BPF_BTF_GET_FD_BY_ID requires CAP_SYS_ADMIN, which does not allow running it from user namespace. This creates a problem when freplace program running from user namespace needs to query target program BTF. This patch relaxes capable check from CAP_SYS_ADMIN to CAP_BPF and adds support for BPF token that can be passed in attributes to syscall.

Mykyta Yatsenko committed 1 year ago

Commit 0de445d1 parent 812f7703 files · +23 −2Browse files

Showing the changes to tools/include/uapi/linux (1 of 3 files). Show all

Unified · Split

tools/include/uapi/linux/bpf.h+1−0

@@ -1652,6 +1652,7 @@ union bpf_attr { · 1651 unmodified lines
1652	};	1652	};
1653	__u32 next_id;	1653	__u32 next_id;
1654	__u32 open_flags;	1654	__u32 open_flags;
		1655	__s32 fd_by_id_token_fd;
1655	};	1656	};
1656		1657
1657	struct { /* anonymous struct used by BPF_OBJ_GET_INFO_BY_FD */	1658	struct { /* anonymous struct used by BPF_OBJ_GET_INFO_BY_FD */