3 ms·
BPF's claim to fame is that it is confidently secured enough that it can be used to run user-provided code in kernel space. Snabb side-steps the kernel by prov
by corysama 6y ago
BPF's claim to fame is that it is confidently secured enough that it can be used to run user-provided code in kernel space.
Snabb side-steps the kernel by providing the performance aspects of kernel-like access while staying securely in user space.
- pas 6y agoCurrently that user is almost always the administrator (root). BFP is more safe than secure, if that distinction makes some sense. So it's great because the eBPF verification makes sure that whatever the user loads doesn't blow up the kernel immediately, it's very restricted (no infinite loops, so not Turing complete, can only call predefined API functions, etc). But it still gets JITed into machine code, and still has access to a vast trove of kernel gadgets and data. So it's like a power tool that was designed to be almost impossible to cut your own limbs off with. But it's still a power tool, it still not something you give to any random passer by.
- wahern 6y agoeBPF has had many exploits, the most recent of which was just a few months ago: https://www.thezdi.com/blog/2020/4/8/cve-2020-8835-linux-kernel-privilege-escalation-via-improper-ebpf-program-verification https://www.thezdi.com/blog/2020/4/8/cve-2020-8835-linux-ker... Original BPF was safe by design (no verifier needed) but slow and far more restrictive, and even then there were exploits over the years. When eBPF and then eBPF JIT became a thing it was entirely predictable what would happen.