2 ms·
Generally agreed, but Linux BPF is considerably more powerful than traditional Unix BPF, so I wouldn't depend on "it has been around for a long time" for safety
by sanxiyn 7y ago
Generally agreed, but Linux BPF is considerably more powerful than traditional Unix BPF, so I wouldn't depend on "it has been around for a long time" for safety.
I would like to see some academic research on Linux BPF verifier. If you are a graduate student working on formal methods looking for a topic, this is a hint.
- allset_ 7y agoIf someone has root, it's already game over. An attacker could just hook the syscalls directly which would be more stealthy that using BPF programs.