4 ms·
Surely if you are allowing non-root eBPF then security of the programs is one of your least worries? Given all the implicit privilege escalation that comes with
by stefan_ 3y ago
Surely if you are allowing non-root eBPF then security of the programs is one of your least worries? Given all the implicit privilege escalation that comes with allowing non-root to spy on everything the kernel does.
- tptacek 3y agoUnprivileged BPF is used for socket filters, for programs to BPF-extend themselves. It wasn't ever the case that unprivileged eBPF would allow you to, say, load a TC filter and read everybody's traffic.
- saagarjha 3y agoOk but you can like put a tracepoint on read/write and peek at what’s going through those, no?
- tptacek 3y agoI have no idea, because every system I've ever worked on has disabled unprivileged eBPF.
- madog 3y agoNope. Tracepoint eBPF programs require root to load always. For eBPF you select a program type, and that limits what you can do (aka what helper functions are available to you) and what privileges are required.