4 ms·
(e)BPF has the following guarantees: * Strictly typed -- registers, and memory are type checked at compilation time. If you use something like Rust, you'd have
by sargun 9y ago
(e)BPF has the following guarantees:
* Strictly typed -- registers, and memory are type checked at compilation time. If you use something like Rust, you'd have to bring rustc into the kernel
* Guaranteed to terminate -- you cannot jump backwards, and there is an upper bound on the instruction count
* Bounded memory -- The registers, and accessible memory via maps are a fixed size. We don't have a stack per se.
Compiling Rust to this is possible, but it'd require quite a bit of infrastructure in the kernel to verify that the code is safe, versus the simplicity of eBPF. Early attempts at a general purpose in-kernel VM included passing an AST in, and then doing safety checking on the AST, but they proved too complicated to do safely.
- dangisafascist 9y agoI'm not arguing against eBPF the language. It's safety guarantees make sense to me. I'm arguing against the in-kernel eBPF infrastructure: bpf system call, the JIT and the VM. I think it makes more sense to just compile eBPF (or rust or whatever safe language you want) to a kernel module.
- codyps 9y agoThe idea with having eBPF in the kernel is that we can limit the amount of trust given to a particular user-space task. Accepting compiled stuff in the form of a kernel module requires root privileges and requires that the kernel essentially have complete trust in the code being loaded. Loading eBPF eliminates the need to trust the process/user doing the loading to that level.
- dangisafascist 9y agoThe bpf() system call and SOCK_RAW both require root. Is there an example of using bpf that doesn't require root?
- sargun 9y agoThe BPF syscalls don't require cap sys admin. Only specific invocations. You can setup a socket filter without sys admin, and a device or XDP filter with net admin.
- dangisafascist 9y agoSure but how common is that case? How common are multi-tenant Linux systems with untrusted users that give those specific permissions? Do you want untrusted users sniffing the packets of others?