2 ms·
eBPF feature request for the eBFP foundation. The ability to completely disable eBPF without having to recompile the kernel, ideally in a kernel boot option.
by LinuxBender 4y ago
eBPF feature request for the eBFP foundation. The ability to completely disable eBPF without having to recompile the kernel, ideally in a kernel boot option. e.g. ebpf=0
Why? eBPF can bypass most facets of security controls and exposes potential and future file-less/disk-less vulnerabilities from trusted actors. [1][2][3]
[1] - https://github.com/h3xduck/TripleCross https://github.com/h3xduck/TripleCross
[2] - https://github.com/pathtofile/bad-bpf https://github.com/pathtofile/bad-bpf
[3] - https://github.com/Gui774ume/ebpfkit https://github.com/Gui774ume/ebpfkit