4 ms·
Too bad bpf isn't allowed for non root yet. A bpf futex program like xok's wake programs would be more general, and way nicer.
by monocasa 6y ago
Too bad bpf isn't allowed for non root yet. A bpf futex program like xok's wake programs would be more general, and way nicer.
- fefe23 6y agoWhat are you talking about? I have been using bpf in seccomp for non-root for years. Maybe your distro patched that out. The stock kernel allows bpf for non-root.
- monocasa 6y agoSort of... there's been push back in the post spectre days of expanding non root usage of BPF. Right now, a subset of trace programs and seccomp are allowed for non-root, but that hasn't expanded since 2016. Everything else requires CAP_SYS_ADMIN. They would probably remove those too if the balance of Linux didn't put "don't break user space" higher than "defense in depth security".
- broodbucket 6y agoJust in recent months we've had CVE-2020-2717{0,1} (memory exposure) followed by CVE-2021-29154 (arbitrary code execution on x86). None of which have even had fixes applied by certain distros[0]. I don't really know what the use cases for unprivileged BPF are though. [0] https://access.redhat.com/security/cve/cve-2021-29154 https://access.redhat.com/security/cve/cve-2021-29154