> bpf: check CAP_SYS_ADMIN before looking up bpffs delegation names TL;DR: Commit message only: the "TODO-NEEDS-IHOR:" prefix on Ihor Solodrai's Signed-off-by line looks like a leftover placeholder, so the tag isn't parsed. The code change itself looks fine.
> bpf: check CAP_SYS_ADMIN before looking up bpffs delegation names > > bpf_parse_param() resolves the symbolic values of the delegate_cmds, > delegate_maps, delegate_progs and delegate_attachs mount options with > find_bpffs_btf_enums(), which fetches the vmlinux BTF, and only then > refuses a non-zero mask from a caller without CAP_SYS_ADMIN. bpffs can > be mounted in a user namespace, so any local user can run > "unshare -Urm mount -t bpf -o delegate_cmds=any bpf /mnt" and get > EPERM, after the lookup. > > That is free today because the vmlinux BTF is parsed at boot. Once it > is parsed on first use (CONFIG_DEBUG_INFO_BTF_LAZY, later in this > series), it would let any user make the kernel parse it and keep it > parsed until reboot, which is what the option is meant to avoid on > systems that do not use BTF. > > Check the capability first. An unprivileged caller could only ever set > an empty mask; such a no-op delegate option, and a malformed value, > now fail with EPERM as well instead of being accepted or failing with > EINVAL. Privileged callers are not affected. > > TODO-NEEDS-IHOR: Signed-off-by: Ihor Solodrai <[email protected]> > Signed-off-by: Jay Wang <[email protected]> Is the "TODO-NEEDS-IHOR:" prefix on the first sign-off line a leftover placeholder? With that prefix the line is not parsed as a Signed-off-by tag by git, b4 or checkpatch, so the only valid sign-off on the commit is the one from Jay Wang, and the commit has no Signed-off-by matching its From: identity. The same prefix appears to be present on the other commits in this series. Should the line be resolved before this is applied, either to a plain: Signed-off-by: Ihor Solodrai <[email protected]> or dropped? The code change itself looks fine. The unconditional capable(CAP_SYS_ADMIN) runs strictly before the old "msk && !capable(CAP_SYS_ADMIN)" test, and privileged callers see no difference. --- AI reviewed your patch. Please fix the bug or email reply why it's not a bug. See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md CI run summary: https://github.com/kernel-patches/bpf/actions/runs/41205212136
