4 ms·
Note to Linus: We have to be able to compile out this eBPF kernel config option, like completely.
by egberts1 2y ago
Note to Linus: We have to be able to compile out this eBPF kernel config option, like completely.
- fragmede 2y agoI believe that's CONFIG_BPF
- egberts1 2y agoIt gets flipped on under most settings if you try to disable it, notably by nftables.
- wmf 2y agoIf eBPF is disabled you can use other debugging facilities.
- A1kmm 2y agoNote that despite the headline, the feature actually used here is kprobe and uprobe (which use eBPF to collect data using eBPF every time an event, such as passing a certain point in code, is executed - allowing for hooking of functions and extraction of data). You can turn them off with CONFIG_KPROBE_EVENTS=n and CONFIG_UPROBE_EVENTS=n. That said, there are other ways to do similar probing: - Loading kernel modules. - Using ptrace. - Using LD_PRELOAD against a dynamic binary.
- brendangregg 2y agoRight; disabling eBPF doesn't solve this. And the bigger point is that this kind of eBPF is still super-user only. Apart from the more exotic facilities, the critical facilities that would be hard to disable include LD_PRELOAD for interposers/shims (as you mentioned), and gdb for just setting breakpoints on crypto functions. And if neither of those existed, then I may have to edit openssl code and recompile my own edited version. And if that wasn't allowed (signed libraries) then maybe I'd edit the application code or binaries.
- egberts1 2y agoLibmusl will drop your LD_PRELOAD nicely. And modules can be compiled directly into a module-less kernel.