7 ms·
In 2020, CAP_BPF was added to allow the use of eBPF. For most programs, you'll use a combination of CAP_BPF, CAP_PERFMON and/or CAP_NET_ADMIN. For some edge ca
by mdaverde 4y ago
In 2020, CAP_BPF was added to allow the use of eBPF.
For most programs, you'll use a combination of CAP_BPF, CAP_PERFMON and/or CAP_NET_ADMIN. For some edge cases (such as hardware offload), you'll need the entire CAP_SYS_ADMIN (basically root).
I wrote more about this here: https://mdaverde.com/posts/cap-bpf/ https://mdaverde.com/posts/cap-bpf/
- pclmulqdq 4y agoInteresting. That's basically read-only root permission, which should probably be handed out sparingly, but it makes sense for isolation purposes to separate out your BPF programs from root.