4 ms·
As far as I know, eBPF today is only usable as root - or, if they expanded the permissions for eBPF, can be limited to only be used by root. The same root user
by pclmulqdq 4y ago
As far as I know, eBPF today is only usable as root - or, if they expanded the permissions for eBPF, can be limited to only be used by root. The same root user can install a kernel module to do everything that eBPF lets you do. Getting to root on a machine is the endgame, at least as far as that machine is concerned.
- stefan_ 4y agoAn eBPF enabled kernel makes a great jump off point for any exploit chain.
- mdaverde 4y agoIn 2020, CAP_BPF was added to allow the use of eBPF. For most programs, you'll use a combination of CAP_BPF, CAP_PERFMON and/or CAP_NET_ADMIN. For some edge cases (such as hardware offload), you'll need the entire CAP_SYS_ADMIN (basically root). I wrote more about this here: https://mdaverde.com/posts/cap-bpf/ https://mdaverde.com/posts/cap-bpf/
- pclmulqdq 4y agoInteresting. That's basically read-only root permission, which should probably be handed out sparingly, but it makes sense for isolation purposes to separate out your BPF programs from root.