3 ms·
What are you talking about? I have been using bpf in seccomp for non-root for years. Maybe your distro patched that out. The stock kernel allows bpf for non-r
by fefe23 5y ago
What are you talking about?
I have been using bpf in seccomp for non-root for years.
Maybe your distro patched that out. The stock kernel allows bpf for non-root.
- monocasa 5y agoSort of... there's been push back in the post spectre days of expanding non root usage of BPF. Right now, a subset of trace programs and seccomp are allowed for non-root, but that hasn't expanded since 2016. Everything else requires CAP_SYS_ADMIN. They would probably remove those too if the balance of Linux didn't put "don't break user space" higher than "defense in depth security".
- broodbucket 5y agoJust in recent months we've had CVE-2020-2717{0,1} (memory exposure) followed by CVE-2021-29154 (arbitrary code execution on x86). None of which have even had fixes applied by certain distros[0]. I don't really know what the use cases for unprivileged BPF are though. [0] https://access.redhat.com/security/cve/cve-2021-29154 https://access.redhat.com/security/cve/cve-2021-29154