3 ms·
> Unprivileged processes can load bpf filters though No they can't. Calling bpf(2) requires you to be running as root or have CAP_SYS_ADMIN.
by threentaway 7y ago
> Unprivileged processes can load bpf filters though
No they can't. Calling bpf(2) requires you to be running as root or have CAP_SYS_ADMIN.
- taviso 7y agoYou're forgetting CONFIG_USER_NS, like it or not, it's ubiquitous now.
- cyphar 7y agoUsing eBPF requires CAP_SYS_ADMIN in the host user namespace. Unprivileged user namespaces don't help.
- nneonneo 7y agoBut bpf(2) isn't the only entry point for bpf filters in the kernel. Unprivileged user programs have access to the SOL_SOCKET SO_ATTACH_FILTER sockopt, as well as the PR_SET_SECCOMP SECCOMP_MODE_FILTER prctl. Now, these take cBPF programs, not eBPF - so they don't have all the fancy programming features that bpf(2) has - but they're still "code running in the kernel".