cf9bf71452
There is demand for a way to identify what BPF helper functions are available to unprivileged users. To do so, allow unprivileged users to run "bpftool feature probe" to list BPF-related features. This will only show features accessible to those users, and may not reflect the full list of features available (to administrators) on the system. To avoid the case where bpftool is inadvertently run as non-root and would list only a subset of the features supported by the system when it would be expected to list all of them, running as unprivileged is gated behind the "unprivileged" keyword passed to the command line. When used by a privileged user, this keyword allows to drop the CAP_SYS_ADMIN and to list the features available to unprivileged users. Note that this addsd a dependency on libpcap for compiling bpftool. Note that there is no particular reason why the probes were restricted to root, other than the fact I did not need them for unprivileged and did not bother with the additional checks at the time probes were added. Signed-off-by: Quentin Monnet <quentin@isovalent.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200429144506.8999-3-quentin@isovalent.com
100 lines
3.3 KiB
ReStructuredText
100 lines
3.3 KiB
ReStructuredText
===============
|
|
bpftool-feature
|
|
===============
|
|
-------------------------------------------------------------------------------
|
|
tool for inspection of eBPF-related parameters for Linux kernel or net device
|
|
-------------------------------------------------------------------------------
|
|
|
|
:Manual section: 8
|
|
|
|
SYNOPSIS
|
|
========
|
|
|
|
**bpftool** [*OPTIONS*] **feature** *COMMAND*
|
|
|
|
*OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] }
|
|
|
|
*COMMANDS* := { **probe** | **help** }
|
|
|
|
FEATURE COMMANDS
|
|
================
|
|
|
|
| **bpftool** **feature probe** [*COMPONENT*] [**full**] [**unprivileged**] [**macros** [**prefix** *PREFIX*]]
|
|
| **bpftool** **feature help**
|
|
|
|
|
| *COMPONENT* := { **kernel** | **dev** *NAME* }
|
|
|
|
DESCRIPTION
|
|
===========
|
|
**bpftool feature probe** [**kernel**] [**full**] [**macros** [**prefix** *PREFIX*]]
|
|
Probe the running kernel and dump a number of eBPF-related
|
|
parameters, such as availability of the **bpf()** system call,
|
|
JIT status, eBPF program types availability, eBPF helper
|
|
functions availability, and more.
|
|
|
|
By default, bpftool **does not run probes** for
|
|
**bpf_probe_write_user**\ () and **bpf_trace_printk**\()
|
|
helpers which print warnings to kernel logs. To enable them
|
|
and run all probes, the **full** keyword should be used.
|
|
|
|
If the **macros** keyword (but not the **-j** option) is
|
|
passed, a subset of the output is dumped as a list of
|
|
**#define** macros that are ready to be included in a C
|
|
header file, for example. If, additionally, **prefix** is
|
|
used to define a *PREFIX*, the provided string will be used
|
|
as a prefix to the names of the macros: this can be used to
|
|
avoid conflicts on macro names when including the output of
|
|
this command as a header file.
|
|
|
|
Keyword **kernel** can be omitted. If no probe target is
|
|
specified, probing the kernel is the default behaviour.
|
|
|
|
When the **unprivileged** keyword is used, bpftool will dump
|
|
only the features available to a user who does not have the
|
|
**CAP_SYS_ADMIN** capability set. The features available in
|
|
that case usually represent a small subset of the parameters
|
|
supported by the system. Unprivileged users MUST use the
|
|
**unprivileged** keyword: This is to avoid misdetection if
|
|
bpftool is inadvertently run as non-root, for example.
|
|
|
|
**bpftool feature probe dev** *NAME* [**full**] [**macros** [**prefix** *PREFIX*]]
|
|
Probe network device for supported eBPF features and dump
|
|
results to the console.
|
|
|
|
The keywords **full**, **macros** and **prefix** have the
|
|
same role as when probing the kernel.
|
|
|
|
**bpftool feature help**
|
|
Print short help message.
|
|
|
|
OPTIONS
|
|
=======
|
|
-h, --help
|
|
Print short generic help message (similar to **bpftool help**).
|
|
|
|
-V, --version
|
|
Print version number (similar to **bpftool version**).
|
|
|
|
-j, --json
|
|
Generate JSON output. For commands that cannot produce JSON, this
|
|
option has no effect.
|
|
|
|
-p, --pretty
|
|
Generate human-readable JSON output. Implies **-j**.
|
|
|
|
-d, --debug
|
|
Print all logs available from libbpf, including debug-level
|
|
information.
|
|
|
|
SEE ALSO
|
|
========
|
|
**bpf**\ (2),
|
|
**bpf-helpers**\ (7),
|
|
**bpftool**\ (8),
|
|
**bpftool-prog**\ (8),
|
|
**bpftool-map**\ (8),
|
|
**bpftool-cgroup**\ (8),
|
|
**bpftool-net**\ (8),
|
|
**bpftool-perf**\ (8),
|
|
**bpftool-btf**\ (8)
|