2 ms·

Is your position that Linux should remove eBPF?

• IncRnd 8y ago
  That's not germane to this discussion. My position is that this project throws away defense in depth. Is your point that because eBPF exists in a different OS that there is no security impact to using Nebulet?
  • pcwalton 8y ago
    I think that having a user-accessible VM in the kernel is a useful thing that a lot of OS's eventually need for other reasons (e.g. packet filtering, syscall sandboxing). We might as well design for it properly up front.
    • IncRnd 8y ago
      Thank you for bringing that up. That's an entirely different discussion, and one that I agree is valid to have. Though, I really don't see the need for user space programs to be able to insert executable code into kernel memory, when hw ring protections would otherwise be in use. Maybe if there were already a verified set of interlocking software controls, then hw protections could be replaced, but I don't see that with running all wasm in the kernel space.