4 ms·
Root adding eBPF code is not worse than root being able to `insmod` a kernel module.
by tenebrisalietum 4y ago
Root adding eBPF code is not worse than root being able to `insmod` a kernel module.
- egberts1 4y agoWrong, eBPF is way, way worse. At the very least, Linux kernel has signed driver modules.
- mdaverde 4y agoCan you explain why you consider it to be worse? eBPF is also working on signed programs [0] [0] https://lwn.net/Articles/853489/ https://lwn.net/Articles/853489/
- egberts1 4y agoeBPF has a way to go before it is secured enough. One should not use eBPF in production machines (along with many other things that uses the mixed write-execute memory regions such as web browsers with JavaScript enabled).
- akira2501 4y agoIt adds a layer where complex attacks can hide. I'm not so much worried about the 'insmod' as I am about long term data exfiltration being used against me. This certainly does seem to make that a little easier.
- ecnahc515 4y agoA kernel module could exfiltrate data just as easily though.