bpf: Remove the capability check for cgroup skb eBPF program
authorChenbo Feng <fengc@google.com>
Thu, 1 Jun 2017 01:16:00 +0000 (18:16 -0700)
committerDavid S. Miller <davem@davemloft.net>
Fri, 2 Jun 2017 18:24:40 +0000 (14:24 -0400)
commit80b7d81912d807f161d55e9c2c9cc81061666f83
treea37d8f96dc9e71aedb6528138208bde42fbabf61
parentfb9a307d11d62749d75b404f15517d73f5d6e148
bpf: Remove the capability check for cgroup skb eBPF program

Currently loading a cgroup skb eBPF program require a CAP_SYS_ADMIN
capability while attaching the program to a cgroup only requires the
user have CAP_NET_ADMIN privilege. We can escape the capability
check when load the program just like socket filter program to make
the capability requirement consistent.

Change since v1:
Change the code style in order to be compliant with checkpatch.pl
preference

Signed-off-by: Chenbo Feng <fengc@google.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
kernel/bpf/syscall.c