Re: [PATCH bpf-next 03/13] bpf: check CAP_SYS_ADMIN before looking up bpffs delegation names

[bot+bpf-ci]

> bpf: check CAP_SYS_ADMIN before looking up bpffs delegation names

TL;DR: Commit message only: the "TODO-NEEDS-IHOR:" prefix on Ihor Solodrai's
Signed-off-by line looks like a leftover placeholder, so the tag isn't parsed.
The code change itself looks fine.

>     bpf: check CAP_SYS_ADMIN before looking up bpffs delegation names
>
>     bpf_parse_param() resolves the symbolic values of the delegate_cmds,
>     delegate_maps, delegate_progs and delegate_attachs mount options with
>     find_bpffs_btf_enums(), which fetches the vmlinux BTF, and only then
>     refuses a non-zero mask from a caller without CAP_SYS_ADMIN.  bpffs can
>     be mounted in a user namespace, so any local user can run
>     "unshare -Urm mount -t bpf -o delegate_cmds=any bpf /mnt" and get
>     EPERM, after the lookup.
>
>     That is free today because the vmlinux BTF is parsed at boot.  Once it
>     is parsed on first use (CONFIG_DEBUG_INFO_BTF_LAZY, later in this
>     series), it would let any user make the kernel parse it and keep it
>     parsed until reboot, which is what the option is meant to avoid on
>     systems that do not use BTF.
>
>     Check the capability first.  An unprivileged caller could only ever set
>     an empty mask; such a no-op delegate option, and a malformed value,
>     now fail with EPERM as well instead of being accepted or failing with
>     EINVAL.  Privileged callers are not affected.
>
>     TODO-NEEDS-IHOR: Signed-off-by: Ihor Solodrai <ihor.solodrai@xxxxxxxxx>
>     Signed-off-by: Jay Wang <wanjay@xxxxxxxxxx>

Is the "TODO-NEEDS-IHOR:" prefix on the first sign-off line a leftover
placeholder?

With that prefix the line is not parsed as a Signed-off-by tag by git, b4 or
checkpatch, so the only valid sign-off on the commit is the one from Jay Wang,
and the commit has no Signed-off-by matching its From: identity.

The same prefix appears to be present on the other commits in this series.

Should the line be resolved before this is applied, either to a plain:

  Signed-off-by: Ihor Solodrai <ihor.solodrai@xxxxxxxxx>

or dropped?

The code change itself looks fine.  The unconditional capable(CAP_SYS_ADMIN)
runs strictly before the old "msk && !capable(CAP_SYS_ADMIN)" test, and
privileged callers see no difference.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/41205212136