Ondrej Mosnacek 881a9c9cb7 bpf: Do not audit capability check in do_jit() ... The failure of this check only results in a security mitigation being applied, slightly affecting performance of the compiled BPF program. It doesn't result in a failed syscall, an thus auditing a failed LSM permission check for it is unwanted. For example with SELinux, it causes a denial to be reported for confined processes running as root, which tends to be flagged as a problem to be fixed in the policy. Yet dontauditing or allowing CAP_SYS_ADMIN to the domain may not be desirable, as it would allow/silence also other checks - either going against the principle of least privilege or making debugging potentially harder. Fix it by changing it from capable() to ns_capable_noaudit(), which instructs the LSMs to not audit the resulting denials. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2369326 Fixes: d4e89d212d ("x86/bpf: Call branch history clearing sequence on exit") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Reviewed-by: Paul Moore <paul@paul-moore.com> Link: https://lore.kernel.org/r/20251021122758.2659513-1-omosnace@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>		2025-10-21 18:22:47 -07:00
..
Makefile	bpf, x86: Add x86 JIT support for timed may_goto	2025-03-15 11:48:28 -07:00
bpf_jit_comp.c	bpf: Do not audit capability check in do_jit()	2025-10-21 18:22:47 -07:00
bpf_jit_comp32.c	…
bpf_timed_may_goto.S	bpf, x86: Fix objtool warning for timed may_goto	2025-03-15 15:55:14 -07:00