4 ms·

Sort of... there's been push back in the post spectre days of expanding non root usage of BPF. Right now, a subset of trace programs and seccomp are allowed fo

Sort of... there's been push back in the post spectre days of expanding non root usage of BPF. Right now, a subset of trace programs and seccomp are allowed for non-root, but that hasn't expanded since 2016. Everything else requires CAP_SYS_ADMIN. They would probably remove those too if the balance of Linux didn't put "don't break user space" higher than "defense in depth security".

broodbucket 6y ago
Just in recent months we've had CVE-2020-2717{0,1} (memory exposure) followed by CVE-2021-29154 (arbitrary code execution on x86). None of which have even had fixes applied by certain distros[0]. I don't really know what the use cases for unprivileged BPF are though. [0] https://access.redhat.com/security/cve/cve-2021-29154 https://access.redhat.com/security/cve/cve-2021-29154