libbpf: Skip modules BTF loading when CAP_SYS_ADMIN is missing
authorAndrea Terzolo <andreaterzolo3@gmail.com>
Mon, 26 Jun 2023 09:36:14 +0000 (11:36 +0200)
committerAndrii Nakryiko <andrii@kernel.org>
Fri, 30 Jun 2023 19:27:16 +0000 (12:27 -0700)
commit2d2c95162de8fc6875c9c3d39f83527ae28e2e8a
tree3854001902f1bdeb613e907c098bfbb30179af3b
parent539c7e67aa4a170eea9a401464ec72a18a795a30
libbpf: Skip modules BTF loading when CAP_SYS_ADMIN is missing

If during CO-RE relocations libbpf is not able to find the target type
in the running kernel BTF, it searches for it in modules' BTF.
The downside of this approach is that loading modules' BTF requires
CAP_SYS_ADMIN and this prevents BPF applications from running with more
granular capabilities (e.g. CAP_BPF) when they don't need to search
types into modules' BTF.

This patch skips by default modules' BTF loading phase when
CAP_SYS_ADMIN is missing.

Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Co-developed-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/CAGQdkDvYU_e=_NX+6DRkL_-TeH3p+QtsdZwHkmH0w3Fuzw0C4w@mail.gmail.com
Link: https://lore.kernel.org/bpf/20230626093614.21270-1-andreaterzolo3@gmail.com
tools/lib/bpf/libbpf.c